Error 403: Forbidden Access in Exchange - Fix Guide 2025

HTTP Error 403.0 - Forbidden
You do not have permission to view this directory or page
using the credentials that you supplied.

Most likely causes:
- The account used does not have permission to access this resource
- SSL is required to view this resource
- The IP address of the client has been restricted

# Enable Forms Authentication for OWA (standard for external access)
Set-OwaVirtualDirectory -Identity "EXCH01\owa (Default Web Site)" -FormsAuthentication $true -WindowsAuthentication $false

# For internal-only access, use Windows Authentication
# Set-OwaVirtualDirectory -Identity "EXCH01\owa (Default Web Site)" -FormsAuthentication $false -WindowsAuthentication $true-Identity "EXCH01\owa (Default Web Site)" -FormsAuthentication $false -WindowsAuthentication $true

# Enable authentication for ECP
Set-EcpVirtualDirectory -Identity "EXCH01\ecp (Default Web Site)" -FormsAuthentication $true -WindowsAuthentication $false

# Restart IIS to apply changes
iisreset /restart

# Verify settings
Get-OwaVirtualDirectory | Format-List Identity,FormsAuthentication,WindowsAuthentication

# Check current SSL setting
Import-Module WebAdministration
Get-WebConfigurationProperty -pspath 'MACHINE/WEBROOT/APPHOST/Default Web Site/owa' -filter "system.webServer/security/access" -name "sslFlags"

# Options: None, Ssl, SslNegotiateCert, SslRequireCert, Ssl128

# If SSL should NOT be required (internal HTTP allowed):
Set-WebConfigurationProperty -pspath 'MACHINE/WEBROOT/APPHOST/Default Web Site/owa' -filter "system.webServer/security/access" -name "sslFlags" -value "None"

# If SSL SHOULD be required, ensure HTTPS binding exists:
New-WebBinding -Name "Default Web Site" -Protocol https -Port 443 -IPAddress "*" -SslFlags 0

# Assign certificate to binding
$cert = Get-ChildItem Cert:\LocalMachine\My | Where-Object {$_.Subject -like "*mail.company.com*"}
$binding = Get-WebBinding -Name "Default Web Site" -Protocol https
$binding.AddSslCertificate($cert.Thumbprint, "My")

iisreset /restart

# Check current IP restrictions
Import-Module WebAdministration
Get-WebConfigurationProperty -pspath 'MACHINE/WEBROOT/APPHOST/Default Web Site/owa' -filter "system.webServer/security/ipSecurity" -name "."

# Remove all IP restrictions (allow all)
Clear-WebConfiguration -pspath 'MACHINE/WEBROOT/APPHOST/Default Web Site/owa' -filter "system.webServer/security/ipSecurity"

# Or add specific allowed IPs
Add-WebConfigurationProperty -pspath 'MACHINE/WEBROOT/APPHOST/Default Web Site/owa' -filter "system.webServer/security/ipSecurity" -name "." -value @{ipAddress='192.168.1.0'168.1.0';subnetMask='255.255.255.0'255.255.0';allowed='true'}

iisreset /restart

# Check user OWA status
$user = "user@company.com"
Get-CASMailbox -Identity $user | Format-List DisplayName,OWAEnabled,OwaMailboxPolicy

# Enable OWA for user
Set-CASMailbox -Identity $user -OWAEnabled $true

# If user has restrictive OWA policy, change it
Set-CASMailbox -Identity $user -OwaMailboxPolicy "Default"

# Verify change
Get-CASMailbox -Identity $user | Format-List OWAEnabled,OwaMailboxPolicy

# Reset OWA virtual directory permissions
$exchangePath = "C:\Program Files\Microsoft\Exchange Server\V15\FrontEnd\HttpProxy\owa"

# Grant IIS_IUSRS read/execute
icacls $exchangePath /grant "IIS_IUSRS:(OI)(CI)RX" /T

# Grant NETWORK SERVICE access
icacls $exchangePath /grant "NETWORK SERVICE:(OI)(CI)RX" /T

# For more comprehensive fix, use Exchange setup
# Run from Exchange installation media:
# Setup.exe /IAcceptExchangeServerLicenseTerms /Mode:Upgrade

iisreset /restart

# 1. Check virtual directory settings
Get-OwaVirtualDirectory | Format-List Identity,*Auth*,InternalUrl,ExternalUrl

# 2. Test OWA access from server
$url = "https://mail.company.com/owa"
try {
    $response = Invoke-WebRequest -Uri $url -UseDefaultCredentials -MaximumRedirection 0 -ErrorAction SilentlyContinue
    "Status: $($response.StatusCode)"
} catch {
    "Error: $($_.Exception.Message)"
}

# 3. Check IIS logs for new 403 errors403 errors
$logPath = "C:\inetpub\logs\LogFiles\W3SVC1"
Get-ChildItem $logPath -Filter "*.log" | Sort-Object LastWriteTime -Descending | Select-Object -First 1 |
    Get-Content | Select-String " 403 " | Select-Object -Last 5

# 4. Test user access
Test-OwaConnectivity -URL "https://mail.company.com/owa" -MailboxCredential (Get-Credential)

# Run after every Exchange Cumulative Update
Write-Host "Checking virtual directory settings..." -ForegroundColor Cyan

# OWA
$owa = Get-OwaVirtualDirectory
if (-not ($owa.FormsAuthentication -or $owa.WindowsAuthentication)) {
    Write-Warning "OWA has no authentication enabled!"
}

# ECP
$ecp = Get-EcpVirtualDirectory
if (-not ($ecp.FormsAuthentication -or $ecp.WindowsAuthentication)) {
    Write-Warning "ECP has no authentication enabled!"
}

# Test access
Test-OwaConnectivity -URL (Get-OwaVirtualDirectory).ExternalUrl -MonitoringContext