Remote use of Outlook in SBS 2003

Hi there – I am HArry Brelsford, the author of the Windows Small Business Server 2003 Best Practices book and each day a I post up a few pages for your reading pleasure. I will do this until SBS 2008 ships!

Today is the REMOTE USE of MICROSOFT OUTLOOK in an SBS 2003 world. Guess I am shouting for empahsis, eh?

Anyways – until tomorrow – harrybbbbb

Harry Brelsford |CEO at SMB NATION | www.smbnation.com

Microsoft Small Business Specialist (SBSC) and other non-sense like an MBA!

ps – I hold an annual conference each year in Seattle for SBSers…this year is early October to discuss SB S 2008 and EBS 2008.

###

 

 

Real Outlook 2003 Used Remotely

This section speaks to the ability to utilize your real Outlook 2003 client application across the Internet and connect to your SBS 2003 server machine. This might be used in lieu of OWA. There are two ways to make real Outlook speak to SBS 2003’s Exchange Server 2003 messaging application: VPN and RPC over HTTP. The VPN method is fairly straightforward. You simply establish a VPN connection (discussed in the next section below) and launch your Outlook 2003 client application. Your mailbox is then presented to you.

But a more hip, cool, and exciting way to remotely connect your Outlook 2003 client application to SBS 2003 is to use RPC over HTTP. RPC, which stands for “remote procedure call,” is how Outlook 2003 communicates over with Exchange Server 2003 on a local area network (LAN). The difference is that you are going to do it remotely over the Internet without having to first establish a VPN connection or present other authentication stuff like smart cards or security

tokens. This allows a remote worker to use real Outlook 2003 and get through the firewall.

BEST PRACTICE: Be advised there are some minimum requirements to using this cool messaging retrieval method. The client computer must be running Windows XP Professional with XP Service Pack 1 (SP1) and have the Microsoft Knowledge Base article 331320 updates installed. You must be running SBS 2003 (which includes Windows Server 2003 and Exchange Server 2003). The Exchange Server 2003 must be configured to allow connections via HTTP (fortunately, this is enabled by default in SBS 2003). You can see HTTP connection support in Exchange Server 2003 in SBS 2003 from Start, Server Management, Advanced Management, SPRINGERSLTD (Exchange), Servers, Springers1, Protocols, HTTP, Exchange Virtual Server. Notice the virtual server is configured and running (compare this to the POP3 virtual server that is not).

Given the baseline prerequisites have been met, complete the following procedure.

1                    On the remote client computer (NormLap), have NormH log on locally with the password Purple3300.

2                    Launch Outlook 2003 from Start, E-mail. If this is the first time you’ve launched Outlook 2003, complete the configuration screens to configure Exchange e-mail to point to SPRINGERS1 for the user Norm Hasborn.

3                    Click Tools, E-mail accounts. The E-mail accounts wizard commences.

4                    Select View or Change existing e-mail accounts and click Next.

5                    Select the Exchange e-mail account on the E-mail Accounts page and click Change.

6                    Click More Settings and select the Connections tab on the Microsoft Exchange properties dialog box.

7                    Under Exchange over the Internet, select Connect to my Exchange mailbox using HTTP. This is shown in Figure 8-27.

 

Notes:

 Visit http://www.microsoft.com/technet for the latest updates for any Microsoft product.

Figure 8-27

Selecting the option to connect over the Internet to your Exchange-based mailbox.

BEST PRACTICE: So let me guess. You don’t see the menu option in Step 7 above. If that is the case, you didn’t download and apply the patch specified above (331320). This can be found as http://www.microsoft.com/technet by entering 331320 in the Search field. The Microsoft search result should look similar to article page in Figure 8-28. Apply it now and restart the above procedure. See you back at Step 7, mate!

Notes:

Figure 8-28

Download and install this to complete the Outlook 2003 RPC over HTTP example.

 

8.         Click on the Exchange Proxy Setting button.

 

9.         Complete the Exchange Proxy Settings screen with https://spring­ers1.springersltd.com and verify the Connect using SSL only checkbox is selected. This is shown in Figure 8-29. Accept the default settings and click OK.

 

10.       Click OK to close the Microsoft Exchange properties dialog box.

 

11.       Click OK when notified you will need to restart Outlook.

 

12.       Click Next on the E-mail Accounts wizard, followed by Finish.

 

13.       Close and start Outlook again. Outlook 2003 will appear and ready for your use.

 

Notes:

 Visit http://www.microsoft.com/technet for the latest updates for any Microsoft product.

Figure 8-29

Completing the final RPC over HTTP steps for Outlook 2003.

BEST PRACTICE: How ‘bout a little bit more discussion on RPC over HTTP. Try on this advanced stuff for size. As you might have guessed, Outlook 2003 is capable of wrapping an HTTP/HTTPS header around each MAPI RPC request. This gives Outlook 2003 the capability of communication to the Exchange Server using direct HTTP or HTTPS. With the correct configuration (such as you did above), this feature allows a rich client experience to a corporate mailbox server over the Internet (as you know by now) where no RPC ports or VPN are required. Where Exchange front-end servers have been deployed in the DMZ, these act as RPC/HTTP proxy servers to the back-ends on the corporate network (oops – I just went beyond the scope of SBS there).

The Windows RPC over HTTP feature provides an RPC client (in this case, Outlook 2003) with the ability to establish connections across the Internet by tunneling the RPC traffic over HTTP. Because standard RPC communication is not designed for use on the Internet and doesn’t work well with perimeter firewalls, RPC over HTTP makes it possible to use RPC clients in conjunction with perimeter firewalls (again, this is kinda beyond the scope of SBS). If the RPC client can make an HTTP connection to a remote computer running Internet Information Services (IIS), the client can connect to any available server on the remote network and execute remote procedure calls. Furthermore, the RPC client and server programs can connect across the Internet – even if both are behind firewalls on different networks.

So now for a real advanced issue! You and I have likely read popular trade journal media stories that the RPC stack on Windows (NT/ 2000/XP/2003) having been exploited by hackers (Blaster). Hell ­you might have seen it! So is RPC over HTTP vulnerable to this type of attack? Nope would be the official reply. Nope because only authenticated users are allowed access to RPC over HTTP. That’s why you’re prompted to log on in again when you try to get Outlook to connect to the Exchange server using RPC over HTTP. The cited exploit could only use anonymous access to RPC.

And that’s that!

Advertisements

3 Comments

Filed under Book

3 responses to “Remote use of Outlook in SBS 2003

  1. Anthony Dingman

    Hello,
    It there a means by which to force domain authentication for Outlook via a smart card for a remote computer system? We currently log in to outlook RPC over HTTP using user ID and password. Soon our domain passwords will be over 128 characters and user ID and password authentication will no longer be feasible. I do not believe that exchange as this functionality. Do you know if middleware exists to make authentication via a smart card using Outlook possible on a remote system? Would that remote system need to be a member of the domain? Do other vendors such as Lotus Notes or Groupwise have this functionality?
    Thanks,
    Tony

  2. Hi Anthony,
    I beleive this would be a perfect place to use a solution like AuthAnvil. No more annoyingly long passwords or pass phrases. You see can this first hand at the SMB Nation Conference next month(www.smbnation.com). Or if you are in a hurry hop on over to Scorpion Software’s web ite at http://www.scorpionsoft.com/
    Once you have installed their software, it will require the code on the Key Fob to enable logon.

  3. Pingback: b2 consulting blog » Blog Archive » Getting an Off-Site Outlook Install to Connect to SBS 2003

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s