Exchange 2010 SP2 – 2019 and Subscription Edition (SE). The Data & More scan server connects over HTTPS to https://<host>/EWS/Exchange.asmx, authenticates as one service account, and impersonates the mailboxes in scope. No Autodiscover, no MAPI/RPC, no agent installed on your Exchange servers.
Choose your hosting model
The Exchange configuration (§1–§5) is the same in both cases. Only the network part (§6) and a few fields in the send-back form (§7) differ.
A – Hosted by Data & More | B – Self-hosted toolbox | |
|---|---|---|
Where the scan server runs | Data & More infrastructure (Hetzner, EU) | Your network (VM or server you provide) |
Who connects to EWS | Data & More, over the internet | The toolbox, inside your network |
EWS published to the internet | Yes | No – internal URL is enough |
Firewall rule | TCP 443 from Data & More egress IPs | TCP 443 from the toolbox IP |
Hostname | Must resolve publicly (or give us hostname → IP) | Must resolve from the toolbox (internal DNS is fine) |
Pre-auth reverse proxy (WAP, F5 APM, NetScaler) | Must pass the service account through | Usually not involved – connect directly to the Exchange server or internal load balancer |
Prerequisites
Exchange Server 2010 SP2, 2013, 2016, 2019 or Subscription Edition (SE), on-premise
A mailbox-enabled AD service account the scan server authenticates as (§1)
ApplicationImpersonation and Mailbox Search roles on that account (§2)
The EWS virtual directory with Basic or NTLM enabled (§3, §4)
A throttling policy for the account that a full scan will not exhaust (§5)
Network path from the scan server to EWS on TCP 443, valid TLS certificate (§6)
A – Hosted: EWS reachable from the internet for our egress IPs
B – Self-hosted: EWS reachable from the toolbox; no internet exposure
Sections 1–6 are the setup. Section 7 is the form to send back.
1. Service account
One dedicated AD account, mailbox-enabled (it authenticates as itself before impersonating), password set not to expire. No local admin, no interactive logon.
powershell
New-Mailbox -Name "svc-dataandmore" `
-UserPrincipalName "svc-dataandmore@example.com" `
-Password (Read-Host "Password" -AsSecureString)2. Roles
Impersonation – one assignment covers every mailbox:
powershell
New-ManagementRoleAssignment -Name "DataAndMore-Impersonation" `
-Role "ApplicationImpersonation" `
-User "svc-dataandmore@example.com"Scope it if only part of the organisation is in scope:
powershell
New-ManagementScope -Name "DataAndMore-Scope" `
-RecipientRoot "example.com/Company Users" `
-RecipientRestrictionFilter { RecipientType -eq "UserMailbox" }
New-ManagementRoleAssignment -Name "DataAndMore-Impersonation" `
-Role "ApplicationImpersonation" `
-User "svc-dataandmore@example.com" `
-CustomRecipientWriteScope "DataAndMore-Scope"Mailbox discovery – mailboxes are enumerated with the EWS GetSearchableMailboxes operation, which requires the Mailbox Search role:
powershell
New-ManagementRoleAssignment -Name "DataAndMore-MailboxSearch" `
-Role "Mailbox Search" `
-User "svc-dataandmore@example.com"Prefer this over the Discovery Management role group, which also grants Legal Hold. If you won't grant it, send us the mailbox list instead – only auto-discovery is lost.
Role changes are cached; allow an hour or recycle MSExchangeServicesAppPool.
Without impersonation: Add-MailboxPermission -AccessRights FullAccess -AutoMapping:$false per mailbox works too, but must be re-run for every new mailbox.
3. EWS endpoint
powershell
Get-WebServicesVirtualDirectory | fl Server,InternalUrl,ExternalUrl,BasicAuthentication,WindowsAuthenticationWhich URL to send us:
A – Hosted: the
ExternalUrl(externally reachable).B – Self-hosted: the
InternalUrl, or any internal hostname that reaches the EWS virtual directory from the toolbox (e.g. the internal load balancer name).
Basic or NTLM must be enabled – Kerberos-only, certificate-only and OAuth/ADFS-only are not supported. If a pre-auth reverse proxy (WAP, F5 APM, NetScaler) sits in the path, it must pass the service account through. In a self-hosted setup, point the toolbox past the proxy where possible.
powershell
Set-WebServicesVirtualDirectory -Identity "EXCH01\EWS (Default Web Site)" -BasicAuthentication $true
iisreset /noforceVersion header values we accept: EXCHANGE_2007 … EXCHANGE_2013_SP1, EXCHANGE_2016. Exchange 2019 and SE use EXCHANGE_2016 – there is no separate value.
4. EWS access policy
powershell
Get-OrganizationConfig | fl EwsEnabled,EwsApplicationAccessPolicy,EwsAllowList,EwsBlockList
Get-CASMailbox svc-dataandmore | fl EwsEnabled,EwsApplicationAccessPolicyEwsEnabled must not be $false. If the policy is EnforceAllowList, add our client – its User-Agent is JWebServices for Exchange 2.2.140, www.independentsoft.com:
powershell
Set-OrganizationConfig -EwsAllowList @{Add="JWebServices*"}5. Throttling
Default EWS budgets are sized for interactive clients and will stall a full-mailbox scan. Assign a policy to the service account only (2013+):
powershell
New-ThrottlingPolicy -Name "DataAndMore-EWS" -ThrottlingPolicyScope Regular `
-EwsMaxConcurrency Unlimited -EwsMaxBurst Unlimited `
-EwsRechargeRate Unlimited -EwsCutoffBalance Unlimited
Set-ThrottlingPolicyAssociation -Identity "svc-dataandmore@example.com" `
-ThrottlingPolicy "DataAndMore-EWS"Capped alternative: EwsMaxConcurrency 50, EwsMaxBurst 300000, EwsRechargeRate 900000, EwsCutoffBalance 600000. Tell us which you used – we match our concurrency to it. On 2010 SP2 the parameters are EWSMaxConcurrency, EWSPercentTimeInAD, EWSPercentTimeInCAS, EWSPercentTimeInMailboxRPC; set them to $null.
The scan server runs 3–8 parallel connections per source, backs off automatically on 429 / "server cannot service this request right now", and can throttle during a business-hours window you choose.
6. Network and TLS
Applies to both models
The scan server only connects to EWS. Nothing connects into the scan server from Exchange.
Read/connect timeout is 300 s – no firewall, proxy or load balancer between the scan server and EWS may cut idle connections sooner.
TLS 1.2+, certificate valid for the hostname the scan server connects to.
A – Hosted by Data & More
TCP 443 inbound to the EWS endpoint from our egress IPs (supplied separately).
The EWS hostname must resolve publicly, or give us hostname → IP and we map it in our runtime.
Certificate from an internal CA: send us the chain as PEM.
B – Self-hosted toolbox
No internet exposure of EWS is needed. The toolbox only has to reach your Exchange server (or internal load balancer) on TCP 443.
Allow TCP 443 from the toolbox's IP address to the EWS host on any internal firewall or segment boundary in between.
The toolbox must resolve the EWS hostname – via your internal DNS, or give us hostname → IP and we map it on the toolbox.
If the toolbox uses an outbound HTTP proxy, exclude the EWS host from it (direct connection).
Certificate from an internal CA (common for internal URLs): send us the chain as PEM so it can be trusted on the toolbox. The hostname in the URL must match the certificate – use the name on the certificate, not an IP address.
7. Send back
Credentials via password vault or another secure channel, not plain e-mail.
Field | Value |
|---|---|
Hosting model | A – Hosted by Data & More / B – Self-hosted toolbox |
EWS URL |
|
Exchange version |
|
Auth method | Basic / NTLM (+ NetBIOS domain if NTLM) |
Service account |
|
Access model | Impersonation / Full Access |
Mailbox Search granted | yes / no – if no, attach mailbox list |
Archives in scope | yes / no |
Test mailbox for our access check |
|
Throttling policy values | |
Business-hours throttle window | e.g. 07:00–18:00 CET |
Internal CA chain attached | yes / no / n-a |
Hostname → IP mapping needed | no / yes: |
A: Firewall opened for our egress IPs | yes / no / n-a |
B: Toolbox IP and firewall opened to EWS | toolbox IP + yes / no / n-a |
Technical contact | name, e-mail, phone |
Verify before sending
On the Exchange server:
powershell
Test-WebServicesConnectivity -ClientAccessServer EXCH01 `
-MailboxCredential (Get-Credential example\svc-dataandmore) -TrustAnySSLCertificateThen from where the scan server will connect – A: a machine outside your network; B: the toolbox itself:
bash
curl -sS -o /dev/null -w '%{http_code}\n' -u 'svc-dataandmore@example.com' \
https://mail.example.com/EWS/Exchange.asmx # 200 = ok, 401 = auth wrongFor NTLM, add --ntlm and use DOMAIN\svc-dataandmore. A timeout means the network path is blocked (§6); a certificate error means the CA chain or hostname is wrong (§6).
Impersonation itself we verify from our side against the test mailbox.
Archives
In-place archives need no extra permission – impersonation covers them. Confirm which mailboxes have one (Get-Mailbox -Archive) and that they are hosted on-premise; a cloud archive on an on-premise mailbox is a separate source. Mailboxes without an archive are skipped automatically.
Enforcement (only if contracted)
With retention enforcement enabled, the scan server deletes items that match a deletion policy you define and activate. Nothing is moved, copied or written into the mailbox. Impersonation already grants the delete right; nothing extra to configure. Say so if you want ingestion only.
EWS operations used
Operation | Purpose | Type |
|---|---|---|
| enumerate mailboxes | read |
| walk the folder tree, incl. archive root | read |
| list items, fetch message with body | read |
| fetch attachment for analysis | read |
| delete an item under a retention policy | write – enforcement only |
No subscriptions, no SendItem, no UpdateItem, no MoveItem, no folders created in the mailbox, and no access outside the configured scope.
Errors
Message | Cause | Fix |
|---|---|---|
401 Unauthorized | password wrong, Basic/NTLM off, pre-auth proxy | §3 |
The account does not have permission to impersonate the requested user. | role missing, cached, or mailbox outside the scope | §2 |
Access is denied on discovery | Mailbox Search missing | §2 |
429 / The server cannot service this request right now / Too many concurrent connections opened | throttling budget exhausted | §5 |
Read timed out / Connect timed out / Socket closed | idle timeout below 300 s, firewall blocking the scan server (A: egress IPs, B: toolbox IP), or endpoint unreachable | §6 |
UnknownHostException / name not resolved | hostname not resolvable from the scan server (B: toolbox not using internal DNS) | §6 |
PKIX / certificate errors | internal CA not trusted, or hostname doesn't match the certificate | §6 |
The SMTP address has no mailbox associated with it. / Mailbox does not exist. | mail-enabled user, or mailbox moved to cloud | expected, skipped |
The defaultFolder cannot be created by XSO | archive requested, mailbox has none | expected, skipped |
The message exceeds the maximum supported size. | item over the processing limit | expected, recorded as skipped |