Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

How can I allow Skype to function correctly with restricted outbound ports, HTTPS inspection and the IE proxy enabled? All the documentation I've come across suggest disabling at least one of these features.

Ideally it should be as simple as setting the proxy in Skype to the forefront server at port 8080 but their use of self signed certificates renders this impossible due to the administrative overhead of constantly adding new destination and source HTTPS inspection exclusions.

What I really hope to achieve is allowing all traffic out for Skype and Skype alone.

share|improve this question
up vote 1 down vote accepted

In the end I opted for a method to allow all traffic out from the Skype executable but not from anything else. Since Forefront cannot reliably determine the executable that is being executed under I opted to create a rule that allows all traffic outbound for a specific user / user group and force Skype to execute under that user / group. The following AutoIT script provides the necessary functions to do so reliably.

#include <Crypt.au3>
; #RequireAdmin ; only for setting the password

Func SetEncrypted($vPassword,$Field)
$Key=_Crypt_DeriveKey($vPassword, $CALG_AES_256 )

Func GetEncrypted($vPassword,$Field)
$Key=_Crypt_DeriveKey($vPassword, $CALG_AES_256 )
Return $decrypted

$EncryptionPassword="super password which will be buried in the exe itself, set this yourself "


; Find the executable name.
$Skype = RegRead("HKLM\SOFTWARE\Skype\Phone", "SkypePath") 
If( $Skype = "" ) Then
    ; 64 bit support
    $Skype= RegRead("HKLM\SOFTWARE\Wow6432Node\Skype\Phone", "SkypePath")

; Run Skype under alternate credentials. 
RunAs($User,$Domain,$Pass, 4, $Skype, @SystemDir )

By storing the ID and password in the registry it makes it very easy to do a password update for the account(s) associated with the alternate credentials - a GPP registry item does the trick.

EDIT - The outbound rule that utilizes authentication for all outbound traffic must be at the very bottom of the priority list, directly above the default rule. If this is not done any non authenticated traffic from the inside out (such as email to outside parties) will be killed off.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.