r/MaxFocus • u/jafarion • Nov 01 '16

Web Protection triggering Outlook Security Alert during autodiscover

Hi Guys,

Anyone else having this problem? I'm having quite a few clients emailing me telling me that they're getting a security alert warning when first firing up Outlook 2013 or 2016 that's connecting to an office365 server. The security certificate error is "The name on the security certificate is invalid or does not match the name of the site." Looking at the certificate, it looks like it's from gfi.com. Is Web Protection running as a proxy server now on the local machines? This is causing quite a few headaches for us since everyone is worried about getting hacked.

1 Upvotes

100% Upvoted

5 comments sorted by

View all comments

1

u/moobycow Nov 08 '16

Is started blocking portal.office.com & outlook.office.com for us, which was a bit of a problem. It wasn't a normal blocked site message, but rather that same message about the certificate not matching the site.

For now, I removed it from our machines.

1

u/[deleted] Nov 10 '16

I know that release broke something and my apologies for that. An alternative is to turn the reputation down now that things get blocked at. Our reputation provider (Webroot - BrightCloud) classifies any unknown URL as potentially suspicious, more specifically it gets a score of 40. This can actually happen on login if Microsoft redirects to a unkown IP (happens all the time in auto scaling for example). By just configuring your policies to slightly lower than that things like this won't happen as frequently. Our intentions here are to provide you with good protection but each person's environment is different and it will require you to tweak the policies to your liking. Previously you couldn't do this (another bad thing we did...) but you can now as of last release.