Exchange 2016:- Restrict Access to the EAC in IIS

  • Article

In Exchange 2016, you can harden access to the Exchange Admin Center (EAC) by creating a rule/s in IIS.

To do this you will need to add an additional feature to IIS called "IP and Domain Restrictions". This can be done from Server Manager and selecting "Add Roles and Features" as shown below:

https://collaborationpro.com/wp-content/uploads/2018/10/Restrict1.png

Once installed, you can launch IIS Manager and then expand your Sites -> Default Web Site and then click on the ECP directory.

Double click "IP address and Domain Restrictions" and then click on "Add Allow Entry" on the right hand side as shown below:

https://collaborationpro.com/wp-content/uploads/2018/10/Restrict2-1024x540.png

Once you click that action item, a new window will show as below, you can restrict a single IP or a range. Range can be as follows:

  • IP: 192.168.0.1
  • Mask: 255.255.255.0

https://collaborationpro.com/wp-content/uploads/2018/10/Restrict3.png

Click OK when done, you will be taken back to the "IP Address and Domain Restrictions" page where the information provided above will show. Now click on Edit Feature Settings on the right hand side as shown below:

https://collaborationpro.com/wp-content/uploads/2018/10/Restrict4-1024x539.png

On the Edit Page, Select Deny as shown below as well as "Not Found" under the Action Type section:

https://collaborationpro.com/wp-content/uploads/2018/10/Restrict5.png

Click OK when done.

Restart IIS by doing an IISRESET from an elevated prompt or restart the server.

**Warning**, if you decide to decide to remove the IP, it can potentially break the EAC.