Exchange Protection Integration IV: Exchange 2013

Create Service Account

• Open your Active Directory
• Open Active Directory Users and Computers
• Navigate to a Organization Unit
• Right Click in the right pane 
• Select New
• Click User
• Add user object information according to your company guidelines
  • e.g. First name: Silverback
  • e.g. Last name: Exchange
  • e.g. User logon name: silverback_exchange@imagoverum.com
  • e.g. SamAccountName: IMAGOVERUM\silverback_exchange 
• Click Next
  • Enter and confirm a Password
    • e.g. Pa$$w0rd
  • Disable User must change password at next login
  • Enable Password never expires
• Click Next
• Click Finish

Add a description

• Right Click your created service account
• Select Properties
• Add as description e.g. Service Account for Silverback Exchange Protection

Create new Role and grant access

• Select permissions
• Click +
• Enter a Name: e.g. Exchange Protection
• Enter a description (optional)
• Under Roles, click + and add the following roles 
  • Mail Recipients
  • Organization Client Access
• Click ok
• Under Members, click + 
  • Select your previously created service account
  • Click add
  • Click ok
• Press save

Create Device Mailbox Policy  

• Navigate to mobile
• Navigate to mobile device mailbox policies
• Click +
• Enter a name for the profile
  • e.g.  Silverback Exchange Protection Policy
• Enable This is the default policy
• Press Save

Set Execution Policy

• Run PowerShell with administrative privileges
• Run the following command line to check your Status
  • get-executionpolicy
• If the answer is RemoteSigned you are ready
• If the answer is something else, please run the following command line
  • set-executionpolicy RemoteSigned
  • Confirm with Yes

Configure IIS

• Open Internet Information Services (IIS) Manager
• Expand your Server
• Expand Sites
• Expand Default Web Site
• Select PowerShell
• Double Click Authentication
• Ensure that Windows Authentication is enabled

Set Execution Policy

• Run PowerShell with administrative privileges
• Run the following command line to check your Status
  • get-executionpolicy
• If the answer is RemoteSigned you are ready
• If the answer is something else, please run the following command line
  • set-executionpolicy RemoteSigned
  • Confirm with Yes

Set Authentication

• Run the following command to get authentication info
  • winrm get winrm/config/client/auth
• If the value Kerberos=true is not set run the following command
  • winrm set winrm/config/client/auth @{Kerberos="true"}

Service Account Validation

$UserCredentials = Get-Credential

$session = New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri http://eas.imagoverum.com/powershell/ -Authentication Kerberos -Credential $UserCredentials

Import-PSSession $Session

get-casmailbox -Identity "tim.tober@imagoverum.com"

Set-User silverback_exchange -RemotePowerShellEnabled $true

Additional commands 

• Check the following commands to get familiar with the handling

Get-ActiveSyncOrganizationSettings | ft DefaultAccessLevel

Get-MailboxStatistics -Identity username | fl

Get-MobileDeviceStatistics -Mailbox username

Get-CASMailbox -Identity username | fl *ActiveSync*

Get-CASMailbox -Identity username | select {$_.ActiveSyncAllowedDeviceIDs}

Get-CASMailbox -Identity username | select {$_.ActiveSyncBlockedDeviceIDs}

Get-MobileDevice | select UserDisplayName,DeviceID,DeviceType,DeviceUserAgent,DeviceModel,Name

Set-CASMailbox -Identity username –ActiveSyncAllowedDeviceIDs DeviceID

| Export-CSV C:\file.csv

• To close the session execute the following command

 Remove-PSSession $Session 

Configure Exchange Protection 

• Login as an Administrator
• Navigate to Admin
• Navigate to Exchange Protection
• Enable Exchange Protection
• Select as Server Version Exchange Server 2013
• Enter your Exchange Server Address with Powershell at the end as following
  • e.g. https://eas.imagoverum.com/powershell/
• Enter as Username your Service Account
  • e.g. IMAGOVERUM\silverback_exchange 
• Enter the corresponding Service Account Password
  • e.g. Pa$$w0rd
• Enter your previously created Device Mailbox Policy
  • e.g. Silverback Exchange Protection Policy
• Set Auth. Mechanism to Default or Kerberos
• Click Save
• Confirm with Yes
• If you are running Silverback with a Cloud Connector
  • please proceed with Cloud Connector Setup
  • otherwise proceed with Exchange Admin Center

Cloud Connector

• Logout as Administrator 
• Login as Settings Administrator
• Navigate to Cloud Connector
• Enable Exchange Protection Service
• Decrease the Exchange Task Interval (mins) to e.g. 1 Minute
• Press Save
• Confirm with OK
• Restart all Silverback and Cloud Connector services

Enable Quarantine Mode 

• Navigate to mobile
• Navigate to mobile device access
• Press above and right to Quarantined Devices edit 
• Select Quarantine - Let me decide to block or allow later
• Click +
• Select the receiver of Notification Email Messages
• Click add
• Click OK
• Enter a text to include in-emails
  • e.g. This device is unknown and will be blocked until it will be enrolled in the Mobile Device Management Solution
• Click Save
• A list of Quarantined Devices will now get visible to you
• Administrators will receive a Notification Email Message
• All quarantined devices users  will receive the previously configured Notification Email Message

Check for managed devices 

• Enroll a device and assign an Exchange Active Profile 
• Follow the configuration on your device as usual
• Check if you have access to emails, calendar and contacts
• Your newly enrolled device should now be whitelisted automatically
  • Navigate back to your Exchange Admin Center
  • Check that the device is not in quarantined state

Check for restricted devices 

• Use a different unenrolled device
• On the device, add your Exchange ActiveSync account manually 
  • For iOS and iPadOS devices,
    • Open Settings 
    • Navigate to Passwords & Accounts
    • Tab Add Account
    • Select Microsoft Exchange
    • Finish your configuration
  • For Android and Samsung devices
    • Open Gmail 
    • Tab on your current account
    • Choose Add another account
    • Select Exchange and Office 365
    • Finish your configuration
• Your unenrolled device should now be quarantined automatically
  • Navigate back to your Exchange Admin Center
  • Check that the device is in quarantined state