Exchange/Outlook Connections

Administration of Exchange with AuthLite users

• Find the Exchange Admins or Organization Management group used to declare what users are exchange admins.  
• Remove it from the Builtin\Administrators group if it is a member.  Otherwise, that membership will break the 2-factor protection.
• If you want all Domain Admins under AuthLite to be Exchange Admins, then add the AuthLite-Protected Domain Admins group to the Exchange admin group you located above.

Mailbox Access

Note: If your AuthLite users do not have on-premises Exchange mailboxes, you can skip the rest of this page.

ActiveSync can't be 2-Factor with AuthLite

You will (ideally) be using client certificates on each ActiveSync device for strong authentication, because it would be impractical to supply an OTP each time ActiveSync runs on the user's phone.

Group Policy Exception

Normally, we expect there to be a group policy enforcing 2FA for AuthLite users at all OU levels for all logon types.  But because of the above issue with ActiveSync, group policy is not granular enough; it would block ActiveSync.

So make a Net Deny Group Policy Exception so the servers should now permit 1-factor access by AuthLite users to network protocols including all Exchange access.

Note: If you do not need to enforce 2-factor logon for mailbox access, then you can skip the rest of this page.

Fixing Kerberos

Starting with Exchange 2013/Outlook 2013, it is configured to always use RPC/HTTP instead of the local direct RPC, even when connected to the LAN.  Even when logged on to the desktop with Kerberos.

The problem is that by default it's configured to use NTLM even in this case, and Microsoft does not make it easy to change.  Since AuthLite uses an OTP, the NTLM authentication will fail if your Exchange server demands 2-factor logon.  So your user will get a credential popup when opening Outlook.

To correctly use the desktop's 2-factor Kerberos ticket, you need to get your Exchange environment to use Kerberos when available.  This is 100% about configuring first-party Microsoft software, so is technically out of scope for AuthLite.  But Microsoft does not make it easy to change.  Here is some (possibly outdated) guidance:

    • The services must be told to accept Negotiate auth instead of just NTLM. Something like:

Get-OutlookAnywhere -Server $computername -ADPropertiesOnly | Set-OutlookAnywhere -InternalClientAuthenticationMethod Negotiate -IISAuthenticationMethods Negotiate

    • This does not take effect immediately. You need to wait for the application event log to record a new event ID 3036, which means the configuration has updated the correct items in IIS

    • And, the client outlook may need to have its mode set to Negotiate too. Reg key for that in Outlook 2013:

HKCU\software\microsoft\office\15.0\outlook\rpc

Value name:

proxyauthenticationservice

Value string:

Negotiate

Possibly useful MS link: Configure Kerberos authentication for load-balanced Client Access services

Outlook Anywhere (RPC/HTTP) from the Extranet

When a workstation is connecting from outside the LAN, Kerberos won't work and authentication will always be NTLM.  So you will always have an authentication popup when opening Outlook in this scenario.  But several authentications in a row may be needed as it establishes connections. So we recommend making a short Replay Window containing only the Exchange server, such that these NTLM authentications can all use the same OTP entered by the user.

Enforce Application Pools

Consider an Exchange server which must support OWA and ActiveSync.

Enter the following strings into the Forced 2-Factor Processes list on each Exchange server.

Note: This feature is configured on each member server independently.

At the time of writing, the following process list causes all non-ActiveSync Exchage processes to require 2-factor for AuthLite users:

• MSExchangeECPAppPool

• MSExchangeOWAAppPool

• RPCClientAccess

• MSExchangeRPCProxy

• MSExchangeOABAppPool

• MSExchangeServicesAppPool

Note: IIS/Exchange caches logons for a period of time. Also, AuthLite only updates its knowledge of groups and settings every 20 minutes. So after you enable two-factor enforcement on OWA, you may still be able to log on with one-factor until these caches expire.