Forum Discussion
HTTP Response Headers Hardening for Exchange 2019 on Windows Server 2022
Dear Davis,
Thank you for the PowerShell script; however, it seems that that script has a syntax error, which is taking time to correct. I have created these response headers manually.
Thank you
b.l
I don't believe the above commands are going to work because Exchange doesn't have a customheaders section added to the web.config by default. I'd be sure to make a backup of your web.config 1st, and then manually add the customheaders section or try adding each individual value via PS using the Add-WebConfiguration property (Set-WebConfigurationProperty requires the property to exist, it won't create it) and specifying a collection to add the custom headers into.
I'm testing adding headers by hand and trying to use:
Add-WebConfigurationProperty -PSPath “IIS:\Sites\Default Web Site” -Filter "system.webServer/httpProtocol/customHeaders" -Name "collection" -Value @{name="X-Frame-Options";value="SAMEORIGIN"}
Here's a script from the PS Gallery that is checking for the existence of headers and using Set-WebConfigurationProperty if found or Add-WebConfigurationProperty if not found. Just a matter of repeating the same Add-WebVConfigurationProperty cmdlet and changing the -Value @{name="header",value="value"} to include the header and corresponding value you want to add. Should just be able to run those cmdlets 4 or 5 times to set what you want, no script needed.
https://www.powershellgallery.com/packages/Outsystems.SetupTools/1.6.30.0/Content/Functions%5CSet-OSPlatformSecuritySettings.ps1#:~:text=Else%20%7B-,Add%2DWebConfigurationProperty%20%2DPSPath%20%22IIS:%5CSites%5CDefault%20Web,Output%20%22Security%20settings%20successfully%20applied%22