Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm getting logged error messages about hits to /EWS/Exchange.asmx (does not exist) in the root of one of our web sites on our own server (IIS6 on Windows 2003)

The server does not run exchange at all.

Is this related to any attack that people know of?

From the questions below, this domain does not have any exchange email at all so it looks like a probe from a script. I'll filter it out so our error reporting logger ignores it.

share|improve this question
up vote 1 down vote accepted

Does the domain that points to the at site use an Exchange server at all (somewhere else)? That URL is the root URL for Exchange web services, in particular it as the Access point ofr the Availability service. In a properly setup Exchange environment the Exchange Auto discover Service provides the URL for the Availability Service, if they are using Exchange somewhere else it could be their Auto discover service is setup incorrectly.

Alternatively it could just be malicious persons probing for Exchange servers that have their Exchange Web Services open to attack. If you don't have exchange I wouldn’t worry to much.

share|improve this answer

It is the URL for exchange availability services so outlook will look at certain URLs on your domain by default. If it doesn't indicate a misconfiguration with outlook/exchange then you can just ignore it.

Do you have exchange running on the same domain name and wildcard dns pointing to your webserver?

share|improve this answer
Sorry, I accepted the top answer but this was very useful, too. There was very little between the two answers but thanks! – Neil Trodden Sep 16 '09 at 15:25

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.