Our sys admins have set up a new Exchange 2007 server. We want to use Exchange Web Services to access an email inbox from a web application. When we browse to /ews/exchange.asmx (using https) on the Exchange server, we get a 403 Error:

Error Code: 403 Forbidden. The server denied the specified Uniform Resource Locator (URL). Contact the server administrator. (12202) 

Should we be able to browse to this page? If so, what needs to happen for this to work properly?

  • Are you using the default certificate that was installed with Exchange or have you setup your own? – Sam Cogan Sep 30 '09 at 16:41

I just tested this URI on our company Exchange server. I was presented with a login dialog, and after entering my credentials, the webservice returned an XML response.

Do you get a logon dialog or does it redirect to the 403 page immediately?

You could try to verify the configuration of Exchange web services by using the Exchange Management Shell, by using the test-* cmdlets. A detailed article here: Testing Exchange 2007 With PowerShell (Part 1)

Not sure if this one will help you, but it's a real cool testing tool: :) https://www.testexchangeconnectivity.com/

  • I received the same XML page when i tested mine as well. – DanBig Sep 30 '09 at 20:01
  • Thanks for the feedback so far. I get the 403 page immediately. I'm waiting for a response from the sys admins on Sam Cogan's question above. – Bo Schatzberg Sep 30 '09 at 20:36
  • I believe that the question regarding the certificate is irrelevant. Are you able to browse to other URIs such as /owa/ ? Also look at the Properties for EWS virtual directory in IIS Manager, Directory Security pane - our server has ONLY Windows Authentication enabled here. Then, also in Directory Security pane, click Edit to see Secure Communications settings and check to see that the directory is set to Require secure channel and Require 128-bit encryption, Ignore client certificate... – tplive Oct 6 '09 at 8:05
  • Yes, I can get to /owa. I'll have to ask about the other details. – Bo Schatzberg Oct 7 '09 at 15:09
  • The end result seems to be that once we unchecked 'Basic Authentication' in IIS, our setting matched the settings listed by tptech and it is now working. Thanks! – Bo Schatzberg Oct 13 '09 at 13:46

Just a thought: Do you know if you're hitting the Exchange server directly, or by going through a reverse proxy such as ISA/Tmg? If you're going through a proxy there's a good chance the admins simply havent published all the required URIs for Exchange (this used to be very typical for Exchange 2003 to 2007 upgrades, as Exchange 2007 needs more URIs published than 2003 did)


Basic authentication may need to be turned on for the EWS directory if using a reverse proxy also. I know it needed to be on for me using TMG 2010 and my issues went away.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.