Extended Protection on Exchange Server: enabling it safely and fixing broken clients

Extended Protection is one of the most effective hardening settings for on-premises Exchange, and current Exchange setup turns it on for you. When it breaks something, the cause is almost always a missed prerequisite: inconsistent TLS, SSL offloading, something intercepting TLS, or NTLMv1. In this post I'll explain what it does, how to check the prerequisites, how to enable it (or confirm setup did), and how to fix clients that stop connecting.

How it works#

Windows Extended Protection binds Windows authentication (NTLM or Kerberos) to the TLS session it arrived on, using a Channel Binding Token. If an attacker relays a user's authentication through a different TLS session, IIS rejects it. That mitigates the authentication relay and man-in-the-middle attacks used against Exchange.

It's configured per IIS virtual directory as token checking (None, Allow or Require) with the SSL flags Ssl and Ssl128. Microsoft's recommended values for every Exchange server except Edge Transport:

Since Exchange Server 2019 CU14, setup enables Extended Protection on the server it runs on, for new installs and upgrades, and turns off SSL offloading for Outlook Anywhere. Exchange Server Subscription Edition (SE) is later than CU14, so an SE server should already have it unless someone installed with /DoNotEnableEP or changed it afterwards.

Prerequisites#

• Current builds. Every server on Exchange Server SE with the latest security update. Exchange 2016 and 2019 reached end of support on 14 October 2025.
• Identical TLS settings on all servers, with the .NET values SchUseStrongCrypto and SystemDefaultTlsVersions explicitly set to 1. A mismatch between servers is the classic cause of failures.
• No SSL offloading. Load balancers must not terminate TLS. SSL bridging is supported only if the load balancer presents the same certificate as Exchange.
• No NTLMv1. LmCompatibilityLevel under HKLM\System\CurrentControlSet\Control\Lsa must be at least 3 on clients and servers; Microsoft recommends 5 (Group Policy: Network security: LAN Manager authentication level).
• Nothing in the middle. TLS-inspecting proxies and security software that routes connections through a local proxy look exactly like an attack. Publishing OWA or ECP through Microsoft Entra application proxy isn't supported with Extended Protection.
• Modern Hybrid. Servers published through the Hybrid Agent must not have Extended Protection on the front-end EWS virtual directory. On the agent machine, Get-HybridApplication shows the TargetUri it uses.

Quick checks on each server:

Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\.NETFramework\v4.0.30319' | Select-Object SchUseStrongCrypto, SystemDefaultTlsVersions
Get-ItemProperty 'HKLM:\System\CurrentControlSet\Control\Lsa' | Select-Object LmCompatibilityLevel
Get-OutlookAnywhere | Format-List Server, SSLOffloading

Check the WOW6432Node equivalent of the .NET key too. Turn off offloading where needed with Set-OutlookAnywhere -Identity "EX01\Rpc (Default Web Site)" -SSLOffloading $false. The Exchange Health Checker reports all of these as well.

Step-by-step#

1. Get the script and check the current state#

Download the latest ExchangeExtendedProtectionManagement.ps1 from Microsoft's CSS-Exchange project. Run it from an elevated Exchange Management Shell as a member of Organization Management:

.\ExchangeExtendedProtectionManagement.ps1 -ShowExtendedProtection
.\ExchangeExtendedProtectionManagement.ps1 -PrerequisitesCheckOnly

The first command shows the configuration of every reachable server; the second runs the same checks as a real configuration, without changing anything.

2. Enable Extended Protection#

# All reachable servers
.\ExchangeExtendedProtectionManagement.ps1

# Servers published through the Hybrid Agent: skip front-end EWS
.\ExchangeExtendedProtectionManagement.ps1 -ExchangeServerNames MH01, MH02 -ExcludeVirtualDirectories "EWSFrontEnd"

The script lists scenarios with known issues and asks you to confirm. It stops if a prerequisite fails, such as a TLS mismatch, and skips servers it can't reach; run it on those later. For Hybrid Agent servers, Microsoft also recommends allowing inbound connections only from the agent machine and hosting no mailboxes on them. When you upgrade such a server with setup, use /DoNotEnableEP_FEEWS:

Setup.exe /IAcceptExchangeServerLicenseTerms_DiagnosticDataON /Mode:Upgrade /DoNotEnableEP_FEEWS

3. Roll back only as a stopgap#

-RollbackType "RestoreConfiguration" restores the previous configuration, and -DisableExtendedProtection (optionally with -ExchangeServerNames) sets every location to None. Both leave the servers exposed, so fix the cause and re-enable quickly.

Verify#

• The script's -ShowExtendedProtection output, or Health Checker, shows the values in the table above on every server.
• A spot check in IIS returns Require:
  PowerShell

  Import-Module WebAdministration
  Get-WebConfigurationProperty -PSPath 'MACHINE/WEBROOT/APPHOST' -Location 'Default Web Site/OWA' `
    -Filter 'system.webServer/security/authentication/windowsAuthentication/extendedProtection' -Name tokenChecking

• Outlook for Windows connects without password prompts, OWA and the Exchange admin center sign in, and Outlook for Mac, Outlook mobile and mobile mail apps sync.
• In hybrid, free/busy works in both directions and a test move succeeds (see hybrid free/busy troubleshooting).

Fixing broken clients#

Tips and gotchas#

• Certificate renewals with SSL bridging. Microsoft's process is to disable Extended Protection, assign the renewed certificate on Exchange and the load balancer, then re-enable it. See renewing Exchange certificates.
• Re-run the script after TLS changes. Changing TLS on one server after enabling Extended Protection is enough to break clients.
• Leave Default Web Site/PowerShell alone. Microsoft doesn't support changing it unless support asks you to.
• Modern authentication is unaffected. Hybrid Modern Authentication, AD FS claims-based OWA and Teams integration keep working.

References#

• Exchange Server support for Windows Extended Protection (Microsoft Learn)