Fix-OWASSL.ps1

[CmdletBinding()]
Param
(
    [Parameter(Mandatory = $true)][string]$Server,
    [Parameter(Mandatory = $true)][string]$Hostname,
    [Parameter(Mandatory = $false)][string]$IntHost,
    [Parameter(Mandatory = $false)][string]$IntProtocol = "https:",
    [Parameter(Mandatory = $false)][switch]$ListOnly,
    [Parameter(Mandatory = $false)][switch]$ResetIIS,
    [Parameter(Mandatory = $false)][switch]$EnableSSLOffloading,
    [Parameter(Mandatory = $false)][switch]$SetSingleDomainLogon
)

if ($inthost -eq '') { $inthost = $hostname }
if (!$intprotocol.EndsWith(':')) { $intprotocol += ':' }
$version = (Get-ExchangeServer $server).AdminDisplayVersion.Major
$domain = (Get-WmiObject -Class Win32_ComputerSystem).Domain

If (!$ListOnly) {
    If ($version -eq 15) {
        Get-OutlookAnywhere -server $server | Set-OutlookAnywhere -ExternalHostname $hostname -InternalHostname $inthost -SSLOffloading $true `
            -IISAuthenticationMethods Basic,NTLM,Negotiate -ExternalClientAuthenticationMethod Negotiate -ExternalClientsRequireSsl $true -InternalClientAuthenticationMethod Negotiate `
            -InternalClientsRequireSsl $($intprotocol -eq 'https:')
        Set-MapiVirtualDirectory -Identity "$server\mapi (Default Web Site)" -InternalURL "$intprotocol//$inthost/mapi" -ExternalURL "https://$hostname/mapi"
    }
    If ($version -eq 14) {
        If ((Get-OutlookAnywhere -Server $server) -eq $null) {
            Enable-OutlookAnywhere -Server $server -DefaultAuthenticationMethod NTLM -ExternalHostname $hostname -SSLOffloading $false
        }
        else {
            Set-OutlookAnywhere -Identity "$server\Rpc (Default Web Site)" -ExternalHostname $hostname -IISAuthenticationMethods NTLM, Basic -ClientAuthenticationMethod NTLM
        }
    }

    Set-AutodiscoverVirtualDirectory -Identity "$server\Autodiscover (Default Web Site)" -InternalURL "$intprotocol//$inthost/autodiscover/autodiscover.xml" -ExternalURL "https://$hostname/autodiscover/autodiscover.xml"
    Set-ClientAccessServer -Identity $server -AutodiscoverServiceInternalUri "$intprotocol//$inthost/autodiscover/autodiscover.xml"
    Set-WebServicesVirtualDirectory -Identity "$server\EWS (Default Web Site)" -InternalUrl "$intprotocol//$inthost/ews/exchange.asmx" -ExternalUrl "https://$hostname/ews/exchange.asmx"
    Set-OABVirtualDirectory -Identity "$server\oab (Default Web Site)" -InternalUrl "$intprotocol//$inthost/oab" -ExternalUrl "https://$hostname/oab"
    Set-ActiveSyncVirtualDirectory -Identity "$server\Microsoft-Server-ActiveSync (Default Web Site)" -InternalURL "$intprotocol//$inthost/Microsoft-Server-ActiveSync" -ExternalURL "https://$hostname/Microsoft-Server-ActiveSync"
    Set-ECPVirtualDirectory -Identity "$server\ecp (Default Web Site)" -InternalURL "$intprotocol//$inthost/ecp" -ExternalURL "https://$hostname/ecp"
    Set-OWAVirtualDirectory -Identity "$server\owa (Default Web Site)" -InternalURL "$intprotocol//$inthost/owa" -ExternalURL "https://$hostname/owa"
    Set-PowerShellVirtualDirectory -Identity "$server\PowerShell (Default Web Site)" -InternalURL "$intprotocol//$inthost/powershell" -ExternalURL "https://$hostname/powershell"
    Set-MapiVirtualDirectory -Identity "$server\mapi (Default Web Site)" -IISAuthenticationMethods NTLM, Oauth, Negotiate
    Set-OutlookProvider -Identity WEB -Server $null -CertPrincipalName msstd:$hostname
    Set-OutlookProvider -Identity EXPR -Server $null -CertPrincipalName msstd:$hostname
    Set-OutlookProvider -Identity EXCH -Server $null -CertPrincipalName msstd:$hostname

    #Enable SSL Offloading
    if ($EnableSSLOffloading) {
        Set-OutlookAnywhere -Identity $server\Rpc* -Externalhostname $hostname -ExternalClientsRequireSsl $true -ExternalClientAuthenticationMethod Basic
        Set-OutlookAnywhere -Identity $server\Rpc* -SSLOffloading $true
        if ($env:ComputerName -eq $server) {
            Set-WebConfigurationProperty -Filter //security/access -name sslflags -Value "None" -PSPath IIS: -Location "Default Web Site"
            Set-WebConfigurationProperty -Filter //security/access -name sslflags -Value "None" -PSPath IIS: -Location "Default Web Site/API"
            Set-WebConfigurationProperty -Filter //security/access -name sslflags -Value "None" -PSPath IIS: -Location "Default Web Site/OWA"
            Set-WebConfigurationProperty -Filter //security/access -name sslflags -Value "None" -PSPath IIS: -Location "Default Web Site/ecp"
            Set-WebConfigurationProperty -Filter //security/access -name sslflags -Value "None" -PSPath IIS: -Location "Default Web Site/EWS"
            Set-WebConfigurationProperty -Filter //security/access -name sslflags -Value "None" -PSPath IIS: -Location "Default Web Site/Autodiscover"
            Set-WebConfigurationProperty -Filter //security/access -name sslflags -Value "None" -PSPath IIS: -Location "Default Web Site/Microsoft-Server-ActiveSync"
            Set-WebConfigurationProperty -Filter //security/access -name sslflags -Value "None" -PSPath IIS: -Location "Default Web Site/OAB"
            Set-WebConfigurationProperty -Filter //security/access -name sslflags -Value "None" -PSPath IIS: -Location "Default Web Site/MAPI"
        }
        else {
            Invoke-Command -ComputerName $Server -ScriptBlock {
                Set-WebConfigurationProperty -Filter //security/access -name sslflags -Value "None" -PSPath IIS: -Location "Default Web Site"
                Set-WebConfigurationProperty -Filter //security/access -name sslflags -Value "None" -PSPath IIS: -Location "Default Web Site/API"
                Set-WebConfigurationProperty -Filter //security/access -name sslflags -Value "None" -PSPath IIS: -Location "Default Web Site/OWA"
                Set-WebConfigurationProperty -Filter //security/access -name sslflags -Value "None" -PSPath IIS: -Location "Default Web Site/ecp"
                Set-WebConfigurationProperty -Filter //security/access -name sslflags -Value "None" -PSPath IIS: -Location "Default Web Site/EWS"
                Set-WebConfigurationProperty -Filter //security/access -name sslflags -Value "None" -PSPath IIS: -Location "Default Web Site/Autodiscover"
                Set-WebConfigurationProperty -Filter //security/access -name sslflags -Value "None" -PSPath IIS: -Location "Default Web Site/Microsoft-Server-ActiveSync"
                Set-WebConfigurationProperty -Filter //security/access -name sslflags -Value "None" -PSPath IIS: -Location "Default Web Site/OAB"
                Set-WebConfigurationProperty -Filter //security/access -name sslflags -Value "None" -PSPath IIS: -Location "Default Web Site/MAPI"
            }
        }
    }

    if ($SetSingleDomainLogon) {
        Set-OwaVirtualDirectory -LogonFormat 'UserName' -DefaultDomain $domain -Identity "$server\owa (Default Web Site)"
    }

    if ($ResetIIS) {
        if ($env:ComputerName -eq $server) {
            iisreset
        }
        else {
            Invoke-Command -ComputerName $Server -ScriptBlock { iisreset }
        }
        pause
    }
}

Get-OutlookAnywhere -Server $server | fl Identity, ExternalHostname, SSLOffloading
Get-ClientAccessServer $server | fl Identity, AutodiscoverServiceInternalUri
Get-WebServicesVirtualDirectory -Server $server | fl Identity, InternalUrl, ExternalUrl, InternalAuthenticationMethods, ExternalAuthenticationMethods
Get-OABVirtualDirectory -Server $server | fl Identity, InternalUrl, ExternalUrl, RequireSSL, InternalAuthenticationMethods, ExternalAuthenticationMethods
Get-ActiveSyncVirtualDirectory -Server $server | fl Identity, InternalUrl, ExternalUrl, WebSiteSSLEnabled
Get-AutodiscoverVirtualDirectory -Server $server | fl Identity, InternalUrl, ExternalUrl, InternalAuthenticationMethods, ExternalAuthenticationMethods
Get-ECPVirtualDirectory -Server $server | fl Identity, InternalUrl, ExternalUrl
Get-OWAVirtualDirectory -Server $server | fl Identity, InternalUrl, ExternalUrl
Get-PowershellVirtualDirectory -Server $server | fl Identity, InternalUrl, ExternalUrl
If ($version -eq 15) {
    Get-MapiVirtualDirectory -Server $server | fl Identity, InternalUrl, ExternalUrl, InternalAuthenticationMethods, ExternalAuthenticationMethods
}
Get-OutlookProvider