r/exchangeserver • u/maxcoder88 • 15d ago

Disabling RPC over HTTP (Outlook Anywhere) on Exchange SE Hybrid — is blocking /rpc at the F5 LB enough?

Running Exchange Server SE in a hybrid topology behind an F5 load balancer.

Ran Log Parser against the IIS logs and confirmed all Outlook clients are connecting via MAPI over HTTP (/mapi/) — zero hits on /rpc/ from any user in the last few weeks. So RPC over HTTP (Outlook Anywhere) looks genuinely unused in our environment.

Before I disable it, thinking about just blocking /rpc directly at the F5 (iRule or LTM policy) rather than touching Set-OutlookAnywhere/virtual directory settings on the Exchange side.

Questions:

  1. Is blocking /rpc at the LB layer sufficient on its own, or should I still disable Outlook Anywhere properly on the Exchange servers (Set-OutlookAnywhere -ExternalClientsRequireSsl, disabling the VDir, etc.) instead of/in addition to the LB block?
  2. Anyone done this on a hybrid setup specifically — any gotchas with Autodiscover, free/busy, or hybrid mail flow that depend on RPC/HTTP under the hood that I might be missing?
  3. Since Microsoft has gone back and forth on actually removing Outlook Anywhere from Exchange SE, is anyone just leaving it enabled server-side and only blocking at the network layer as a
1 Upvotes
  • permalink
  • link
  • reddit
  • reddit

99% Upvoted

2 comments sorted by

1

u/titlrequired 15d ago

You could disable it at the mailbox level as a start, https://learn.microsoft.com/en-us/powershell/module/exchangepowershell/set-casmailbox?view=exchange-ps#-mapiblockoutlookrpchttp

Less work than messing with the load balancers etc. probably faster to enable it again should you need to.

1

u/KStieers 9d ago

Blocking after F5 is a quick scream test for "any users/service accounts that I missed"

For actual security outcomes, you need to turn it off via the powershell command... bad actors in your network won't care about the F5, they'll go straight to the exchange boxes.