[bakerfall]

I have to admit, I find it a bit funny and slightly hypocritical that you have an open OWA page, but don't want users accessing it on their blackberry. From a security standpoint, you should most definitely require a SSL Cert or put a RSA or some other security protocol on that. Without it, users can access it using any web based device, Blackberry's included.

Certainly there are ways to prevent it or make it difficult as mentioned in this thread, but it seems to me that you are still leaving it open to Windows Mobile, iPhone or any other internet capable device. If you are really worried about it, lock down OWA. If you don't, you aren't solving the problem.

[knottyrope]

bakerfall, yeah that was said already kinda

Originally Posted by knottyrope

We use SSL certs for OMA with ISA. No cert = no email. the cert is not installed on the domain controller so each user has to have it manually entered.

If you have no cert then anyone can access it with a password with most mobile devices.

[lawson23]

I have found out why my request are not being blocked by my IIS restriction. I'm posting so someone may be helped by this information in the future.

In my ISA box my 443 rule says that all request to the server act as if it is coming from the ISA box. So if I look at my logging in IIS I see the c-ip across the board for every request is the ip of my ISA box (internal IP).

[knottyrope]

Lawson I did mention block it at the firewall after your 7-31-08 post.

ISA can do this with ease and might do a better job of it.