Internal and External Encryption

Hi,
I'm currently struggling at some probably basic encryption question. I hope someone can give me a hint...
I've got a customer migrating from Notes to Exchange 2013.
They are running a PGP gateway which takes care of external encryption.
In Notes they used to user-enforce encryption (PGP or S/MIME) by a button or adding "#" in the beginning of the subject field.
As the Notes guy told me, they are manipulating the Mail header so the original un-encrypted mail is delivered to the encryption gateway for external encryption if the mail is addressed to internal and external recipients. Internally it is encrypted by Notes
itself.
My question is, how can I achieve something similar with exchange and such a gateway? Is there a way to encrypt mails internally by utilizing
an internal Server 2008 PKI and externally by the encryption gateway (while addressing the mail to internal and external recipients at the same time)?
Thanks!

Hi Pano,
Unfortunately you cannot have all of these under one solution. There is no All in One feature at least that I know of.
However if you want your users to be able to read encrypted data when they are not in the corporate network AD RMS can still help you with this. If what you wanted to encrypt emails that are sent to external organisations you can either establish coexistence
by implementing TUDs and TPDs or use S/MIME for those. I doubt that company sensitive data would be sent out to external parties hence AD RMS might still help.
If S/MIME is used bear in mind that these messages cannot be decrypted during e-discovery searches however AD RMS protected messages can be. AD RMS provides protection to the document and can be incorporated with Exchange Transport Rules.
Cheers
CK

Similar Messages

  • SharePoint 2013 - Office Web Apps - Internal and External Use

    I have successfully installed SharePoint 2013 and Office Web Apps on Azure VMs inside an Azure Virtual Network (IaaS model). Everyting is working well. However, my testing has shown that external users and internal users can't use Office Web Apps at the
    same time.
    Office Web Apps, installed on its own vm, accomodates an external and internal URL quite well. However, SharePoint 2013 appears to only allow one setting for WOPI Zone, either internal or external but not both. I've set the WOPI zone to Internal-HTTPS (Set-SPWOPIZone
    –Zone “internal-https”). OWA works just fine if accessed from inside the Azure Virtual Network. However, if I try to access from outside the Virtual Network, from the Internet, Office Web Apps fails. The exact oppisite is also true. I can set WOPI Zone to
    External-HTTPS and accessing from the Internet works fine, but accessing inside the Virtual Network fails.
    Am I missing something? I, obviously, want Office Webs Apps to function properly for both internal and external users simultaneously.
    I appreciate any help anyone can provide here.
    Glenn

    Hi Glenn,
    To have both the use of Internet and Internal available to your end-users, you first need to configure AAM setting. Open Central Administration > Application Management > Configure alternate access mappings. Let's say there is an existing web application
    named http://sharepoint and my end-users from local network are able to access it using the URL http://sharepoint (root site collection). Here you need to add the Internet URL by select the web application and click Edit Public URLs. Add the Internet domain
    to the web application, e.g http://sharepoint.abc.com. You don't necessarily have to edit binding setting in IIS. Before continuing next steps, make sure you are able to access http://sharepoint.abc.com from the Internet while being able to access http://sharepoint
    from local network (aka Internal).
    On the machine where Office Web App (OWA) Server 2013 is installed, open PowerShell to add OWA module and use the following command to re-create a new OWA server farm if you've completed configuring it previously.
    New-OfficeWebAppsFarm -InternalUrl "http://owa" -ExternalUrl "http://owa.abc.com" -EditingEnabled.
    In this case, I'm not using SSL certificate to encrypt data over the Internet. You can use Internet-public IP of the OWA server like -ExternalUrl "http://198.xxx.xxx.xx". Add CertifcateName parameter if you want to use whether CA-issued certificate
    or self-signed certificate.
    On your SharePoint machine, you need to re-bind all WFE machines to WAC farm using the cmdlet New-SPWOPIBinding. Next, you need to set the WOPI zone for both internal and external.
    Set-SPWOPIZone -zone "external-http"
    Note: I'm not all using certificate in my guidance. But the steps to have it configured is just to add more parameter. 
    I've recently successfully deployed OWA multi-server farm for both internal and internet uses for two big clients. In real-world scenario, ideally OWA should be published through firewall (Forefront UAG, TMG, F5...etc). Please let me know if you still have
    issues after following my steps. My email: [email protected]
    Regards,
    -T.s
    Thuan Soldier
    A 23-year-old man loving Microsoft technologies and making crazy ideas on business journey.
    SharePoint Vietnam |
    Blog | Twitter

  • DNS Forwarding Same Internal and External Zone

    Hi,<o:p></o:p>
    So we have decided that we want our internal domain to be the same as our external domain e.g. domain.uk. I understand that split DNS can be used
    to fulfil this requirement but is it possible to set up a forward so if the DNS entry is not available in the internal zone it will forward onto one of our external name servers where it can resolve?<o:p></o:p>
    We are basically trying to avoid having to add the entry on both external and internal DNS servers for it to resolve. So far I have added the external name servers to
    the forwarders and disabled root hints which didn’t work. I’ve tried to add a conditional forwarder but it says the zone already exists. It seems the only to achieve the internal resolution is by creating the DNS entry both internally and externally.<o:p></o:p>
    Does anyone know if this is the case? It seems strange that you couldn’t point the DNS to another external name server for resolution? <o:p></o:p>
    Any help would be appreciated.<o:p></o:p>

    You must ask in networking forum
    https://social.technet.microsoft.com/Forums/en-US/home?forum=winserverNIS&filter=alltypes&sort=lastpostdesc

  • Delivery report shows status of Pending for external address. Email sent to both internal and external addresses.

    We have an Exchange 2013 on-premise server and seem to have an issue with emails sent to internal and external users at the same time.
    The issue came to light because someone sent an email to 44 recipients, of which one was internal. None of the external recipients received the email. I checked the delivery report in the EAC and found the internal email marked as 'Delivered' and all of
    the external ones marked as 'Pending'. I checked the queues and there were none. I did some testing and sent an email to just one of the external addresses on the list, it arrived. I tried sending the email again to all of the recipients, the external ones
    all showed 'Pending'. I tried it again, but this time excluded the internal email address and all of the 43 external emails were immediately delivered.
    So it seems that the issue only arises when we are sending to both internal and external addresses.
    I then tried a test email to one internal address and one external address. The Delivery report says that the internal address was delivered immediately, while the external address is 'Pending' and gives more information saying: 'Message delivery is taking
    longer than expected. There may be system delays. For more information, contact your helpdesk.'. To add further mystery to this, the email was actually delivered.
    So, I have two concerns:
    First is seems that some emails sent both internally and externally are only arriving internally. This is a huge problem because I don't know how many have been affected. There may be many lost emails we don't know about.
    Second, it looks like I can't trust the delivery report. It says pending for some emails which didn't arrive, but it also says pending for some which did arrive. That is no good at all.
    For info the server is running Windows Server 2012. I have run a Microsoft Update to check if there are any to apply and the only Exchange one is a spam filter update, which I doubt has any bearing but I will apply when I get chance.

    Hi Neil,
    According to the description, I find a related KB on Exchange 2010:
    https://support.microsoft.com/kb/2694474?wa=wsignin1.0
    It has the similar situation as yours.
    This issue occurs because a function in a message tracking component tries to obtain the information for the recipient instead of the external recipient.
    Please try to upgrade to the latest Exchange update to check whether this issue can be solved.
    Also please check whether Throttling has been set.
    Please run "Get-TransportService | fl" to check the MaxOutboundConnections parameter value.
    More details to see:
    Message throttling 
    http://technet.microsoft.com/en-us/library/bb232205(v=exchg.150).aspx
    Thanks
    If you have feedback for TechNet Subscriber Support, contact
    [email protected]
    Mavis Huang
    TechNet Community Support

  • Can I split my itunes music library between and internal and external hard drive?

    Is it possible to have music on the two different drives and still be able to make playlists from both drives to put on my ipod?  Here's my situation:  I'm using a Dell 32 bit computer running Vista Home Premium SP2 which I share with other users.  I have a large itunes library (40g+ of music only) that's starting to hog the hard disk space from other users. If possible, I would like to split off part of my itunes library to an external hard drive while still having access to the entire library for my ipod. Ideally I would like to have all my downloaded songs on both the internal and external drives so I'll have backups in case a drive fails, while putting all the music I have hard copies of solely on the external drive. Any help on how this can be done would be appreciated.

    If you manually manage your itues library, you can store parts of it on an external drive, or on an internal drive.  Just keep in mind that in iTunes that you must set a default location for iTunes to manage it's files, and that will be the default location for iTunes to store anything it downloads.  You would need to manuay manage moving things from there if tht is not where you want them stored.
    Perhaps a "better" solution would be for you to invest a little mone into 2 external drives.  One to hold your entire iTunes library, and the second to be your off-line backup of the first.  This is the method I have gone with and I like how it works for me.  My entire iTunes library is on an external (portable) 320GB drive.  Then, when iTunes is not running, I will clone my external drive onto a second drive I happen to have, this way if I have any failure of my primary drive, I lose at most about a weeks worth of content.  For me, I purchase little content during a week, but I do move a fairly large volume of podcasts.  With the entire library being on the external drive, if I ever have to swap to using my backup drive iTunes wil just think that it hasn't run and downloaded anything for a week, and all the "lost" content will be re-downloaded automatically.  This won't work for apps or purchased content, but for subscribed podcasts, it is great.

  • Front End internal and external web services

    Hi all,
    Can someone explain the purpose of internal and external web services URL in front end server. what does it do and what is it used for? and why the external traffic goes directly to it and not through reverse proxy?
    Thanks,

    They're for multiple purposes.  Address books, autodiscovery, meeting urls, mobile clients, etc.  There are two because they respond slightly differently based on whether the client is internal or external.  External traffic should always reach
    it through a reverse proxy, that reverse proxy should proxy traffic received on port 443 to port 4443 on your front end pool.
    Please remember, if you see a post that helped you please click "Vote As Helpful" and if it answered your question please click "Mark As Answer".
    SWC Unified Communications
    This forum post is based upon my personal experience and does not necessarily reflect the opinion or view of Microsoft, its employees, or other MVPs.

  • How to configure AD on windows 2012 server for Exchange 2013 internal and external email flow

    Dear Experts,
    I have to configure exchange 2013 on Windows server 2012 STD. Company has registered Static IP addresses and can get the MX record pointing to any of this Static IP.  
    The registered domain name is e.g.  contoso.com. 
    a. What should I use as domain name on AD? contoso.com or contoso.local
    b. Is it recommended to have two different servers  for AD and Exchange?
    c. What should be my connector settings for mail flow?
    d. how can I set 2 email servers in company for load balancing?

    Hi,
    a, I suggest use contoso.com as domain name. It is convenient to add urls into our certificate for internal and external mail flow.
    b, Recommended that installing AD
    and Exchange Server on two separate
    Servers. If Exchange Server downed unfortunately, it can prevent AD server from crushing at the same time.
    c, Found some articles for your reference:
    Configure Mail Flow and Client Access
    http://technet.microsoft.com/en-us/library/jj218640(v=exchg.150).aspx
    Configuring Outbound Mail Flow in Exchange Server 2013
    http://exchangeserverpro.com/configuring-outbound-mail-flow-in-exchange-server-2013/
    d, Load Balancing
    http://technet.microsoft.com/en-us/library/jj898588(v=exchg.150).aspx
    Hope it is helpful
    Thanks
    Mavis
    Mavis Huang
    TechNet Community Support

  • Leopard.  Did a full restore from Time Machine.  Now I can't access my other internal and external drives.  I get the following error: The folder "Capture Video" can't be opened because you don't have permission to see its contents.

    Leopard.  Did a full restore from Time Machine.  Now I can't access my other internal and external drives.  I get the following error: The folder “Capture Video” can’t be opened because you don’t have permission to see its contents.  I have repaired permissions pn the main harddrive.  When I try too click on a disk I get the previously stated error.  I can't even open up information to see what permission/access there is.  It simply will not let me see the content.  It shows the content of my main hard drive when I have clicked the other harddrive's name.

    Solved:
    sudo chflags 0 /Volumes/"FCP Time Machine BU"
    sudo chown 0:80 /Volumes/"FCP Time Machine BU"
    sudo chmod 775 /Volumes/"FCP Time Machine BU"
    sudo chmod -N /Volumes/"FCP Time Machine BU"

  • Cisco ISE with both internal and External RADIUS Server

    Hi
    I have ISE 1.2 , I configured it as management monitor and PSN and it work fine
    I would like to know if I can integrate an external radius server and work with both internal and External RADIUS Server simultanously
    So some computer (groupe_A in active directory ) will continu to made radius authentication on the ISE internal radius and other computer (groupe_B in active directory) will made radius authentication on an external radius server
    I will like to know if it is possible to configure it and how I can do it ?
    Thanks in advance for your help
    Regards
    Blaise

    Cisco ISE can function both as a RADIUS server and as a RADIUS proxy server. When it acts as a proxy server, Cisco ISE receives authentication and accounting requests from the network access server (NAS) and forwards them to the external RADIUS server. Cisco ISE accepts the results of the requests and returns them to the NAS.
    Cisco ISE can simultaneously act as a proxy server to multiple external RADIUS servers. You can use the external RADIUS servers that you configure here in RADIUS server sequences. The External RADIUS Server page lists all the external RADIUS servers that you have defined in Cisco ISE. You can use the filter option to search for specific RADIUS servers based on the name or description, or both. In both simple and rule-based authentication policies, you can use the RADIUS server sequences to proxy the requests to a RADIUS server.
    The RADIUS server sequence strips the domain name from the RADIUS-Username attribute for RADIUS authentications. This domain stripping is not applicable for EAP authentications, which use the EAP-Identity attribute. The RADIUS proxy server obtains the username from the RADIUS-Username attribute and strips it from the character that you specify when you configure the RADIUS server sequence. For EAP authentications, the RADIUS proxy server obtains the username from the EAP-Identity attribute. EAP authentications that use the RADIUS server sequence will succeed only if the EAP-Identity and RADIUS-Username values are the same.

  • Setup internal and external DNS namespaces best practice

    Is external name space (e.g. companydomain.com) and internal name space (e.g. corp.companydomain.com or companydomain.local) able to run on the same DNS server (using Microsoft Windows DNS servers)?
    MS said it is highly recommended to use a subdomain to handle internal name space - say corp.companydomain.com if the external namespace is companydomain.com.  How shall this be setup?  Shall I create my ADDS domain as corp.companydomain.com directly
    or companydomain.com then create a subdomain corp?
    Thanks in advanced.
    William Lee
    Honf Kong

    Is external name space (e.g. companydomain.com) and internal name space (e.g. corp.companydomain.com or companydomain.local)
    able to run on the same DNS server (using Microsoft Windows DNS servers)?
    Yes, it is technically feasible. You can have both of them running on the same DNS server(s). Just only your public DNS zone can be published for external resolution.
    MS said it is highly recommended to use a subdomain to handle internal name space - say corp.companydomain.com
    if the external namespace is companydomain.com.  How shall this be setup?  Shall I create my ADDS domain as corp.companydomain.com directly or companydomain.com then create a subdomain corp?
    What is recommended is to avoid having a split-DNS setup (You internal and external DNS names are the same). This is because it introduces extra complexity and confusion when managing it.
    My own recommendation is to use .local for internal zone and .com for external one.
    This posting is provided "AS IS" with no warranties or guarantees , and confers no rights.
    Get Active Directory User Last Logon
    Create an Active Directory test domain similar to the production one
    Management of test accounts in an Active Directory production domain - Part I
    Management of test accounts in an Active Directory production domain - Part II
    Management of test accounts in an Active Directory production domain - Part III
    Reset Active Directory user password

  • Unable to activate internal and external urls at the same time

    Hi,
    We have Configured EBS R12 in DMZ setup as described in Figure F-9 of metalink note 380490.1 ,Option 2.4: Using Reverse Proxy with no External Web Tier.
    refering to 726953.1 Case History: Implementing a Reverse Proxy Alone in the DMZ Configuration - R12.
    but Not able to activate internal and external urls at the same time in this configuration. Only the node where last autoconfig was run getting activated as web node.
    When trying to accees the url of the other node it gets redirected to the url (where autoconfig is last run).and for this error observed is Error Code:502 Proxy Error.The specified Secure Sockets Layer (SSL) port is not allowed.(12204).
    For both external and internal services are UP.opmn status is live no error.
    Using Apache as reverse proxy.
    EXTERNAL Reverse proxy settings:
    s_login_page http://LONWEB01.process.com:81/OA_HTML/AppsLogin
    <TIER_DB oa_var="s_isDB">NO</TIER_DB>
    <TIER_ADMIN oa_var="s_isAdmin">NO</TIER_ADMIN>
    <TIER_WEB oa_var="s_isWeb">YES</TIER_WEB>
    <TIER_FORMS oa_var="s_isForms">YES</TIER_FORMS>
    <TIER_NODE oa_var="s_isConc">NO</TIER_NODE>
    <TIER_FORMSDEV oa_var="s_isFormsDev">YES</TIER_FORMSDEV>
    <TIER_NODEDEV oa_var="s_isConcDev">NO</TIER_NODEDEV>
    <TIER_WEBDEV oa_var="s_isWebDev">YES</TIER_WEBDEV>
    INTERNAL Middle Tier settings:
    s_login_page http://stprojapp01.test.com:8005/OA_HTML/AppsLogin
    <TIER_DB oa_var="s_isDB">NO</TIER_DB>
    <TIER_ADMIN oa_var="s_isAdmin">YES</TIER_ADMIN>
    <TIER_WEB oa_var="s_isWeb">YES</TIER_WEB>
    <TIER_FORMS oa_var="s_isForms">YES</TIER_FORMS>
    <TIER_NODE oa_var="s_isConc">YES</TIER_NODE>
    <TIER_FORMSDEV oa_var="s_isFormsDev">YES</TIER_FORMSDEV>
    <TIER_NODEDEV oa_var="s_isConcDev">YES</TIER_NODEDEV>
    <TIER_WEBDEV oa_var="s_isWebDev">YES</TIER_WEBDEV>
    Are we missing anything....
    Thanks & Regards

    Hi,
    Finally it's resolved...Following is the solution thought to share in the forum:
    The configuration of the E-Business Suite environment for DMZ requires profile options hierarchy type to be set
    to SERVRESP.
    To change the profile options hierarchy type values to SERVRESP, execute the following SQL script as
    shown below:
    sqlplus / @/patch/115/sql/txkChangeProfH.sql SERVRESP
    After successfully completing the above sql script, run Autoconfig in all nodes to complete the profile options configuration.
    It's resolved after doing this..

  • Internal and External different set of menu for ESS

    Hi
    We have 2 portal server - Internal and External. The Portal are being used not.
    We are planning to implement ESS now in Portal. We are planning to provide two different set of options when the same user access internally and externally.
    For example, User XYZ access internally he will get menus ABCDE but the same user access from external he only gets manu AB.
    If anyone has implemented with similar concepts or know how to do it technically, kindly advice.
    Thanks
    Yuva

    Let us assume we have 3 internal groups :
    internalGroup_1 -> Role A, Role B
    internalGroup_2 -> Role C, Role D,
    internalGroup_3 -> Role E,
    and 2 external group :
    externalGroup_1 -> Role A,
    externalGroup_2 -> Role B,
    We add similar user under a group. and then roles are assigned to groups. in above example Role A , Role B is assigned to internalGroup_1.
    We can have a single user id in which is attached to interalGroup_1, interalGroup_2, interalGroup_3 , externalGroup_1and interalGroup_2.
    When user logon to Internal portal he will see role A, B,C,D and E
    and when user logon to internal  poral he will see role A,B.
    provided A,B,C,D,E roles should exist in internal protal and role A,B exist in External portal. You can use transport roles from external portal to internal portal.

  • All my hard drives (internal and external) have a small lock in the lower left corner of the icon and I don't have permissions to access. Permissions are set to 'Custom' in the get info window and I can't change them.

    All my hard drives (internal and external) have a small lock in the lower left corner of the icon and I don't have permissions to access. I have 3 user accounts set up and I cannot access any of them.   Permissions are set to 'Custom' in the get info window and I can't change them. Originally I had Snow Leopard installed on one hard drive and 10.5.8 installed on another.   I started to have some problems accessing data between them and so I tried changing the permissions on ONE hard drive partition.   The next thing I know, all my drives are locked (except the ones with the systems on them), the small lock appeared in the lower left corner of the drive icons and I don't have permissions to access any of them.   In the get info window, permissions are set to 'Custom' and I can't change them.

    There is suddenly a lock icon on my external backup drive!
    Custom Permissions

  • Internal and external reference voltage for DAC

    Hi
    For example: If we are using +10V as the internal reference voltage, the range of the DAC would be -10 to +10V. But if the signal goes only from -5 to +5 V, the resolution of DAC is not getting maximized. To maximize the Resolution, an external refernce voltage of +5V can be given. Now the range of the DAQ will be -5V to +5V, same as that of the signal..
    What is internal and external reference voltage for DAC ?????
    Somil Gautam
    Think Weird

    Hi,
    you're better post this question on the "multifunctional DAQ" section, quoting the P/N of your device, as well as your programming language

  • Internal and External Reconciliations

    I am looking to find out what the differences are with Internal and External Reconciliations.
    I am not sure if I need to use Internal or External when doing Manual Reconciliations in banking.
    Thanks!
    Dayna

    I am trying to figure out how to use the bank reconciliation process. I keep seeing reference to an "expert sesion" and a link to it.  However I get an Access Denied message when I try the link.
    Help. ? If this "expert session" is on the Partner Portal, how are we lowly Customer to get it?
    "External reconciliation is used for bank reconciliation , however when you go in detail , you have to use internal reconciliation for Business partner and Vendor .
    https://websmp206.sap-ag.de/~sapidb/011000358700000050892007E
    Review this expert session ,bank statement processing in CA...

Maybe you are looking for