Exchange 2010 - EWS access

[TMcCaffery]

Hello!

 

Long time lurker, first time posting!

 

We have an exchange 2010 server, which I'm sure many others do as well but since i have only been working with it for a year or so i haven't had much experience with EWS. As far as i can tell through research its for third party apps and programs to access exchange and provide services? Correct me if I'm wrong!

 

My issue is I have a student who (despite being told otherwise) has somehow found out our EWS url and using it for class projects. I am trying to talk to his teacher to stop this but it has raised a few questions. Is there any security risks to him having this url? can i disable it or restrict access? Surely the url isnt all you need?

 

Any information anyone has would be most useful. Thanks

 

Thomas

Network Manager

[rpwillis]

The normal Exchange security is still in force, so the student should only be able to do what he could do through other tools such as OWA. However some issue spring to mind:

1. How are they storing their credentials in the application. If in plain text then they could easily be read by other.

2. Are the students sharing credentials in order to access other mailboxes, in which case they will have access to everything that username has access to, including other systems.

https://msdn.microsoft.com/en-us/library/office/dd633646%28v=exchg.80%29.aspx

 

You can limit access to EWS to applications and users using PowerShell.

https://msdn.microsoft.com/en-us/library/office/ff597941%28v=exchg.80%29.aspx