A recent penetration test report indicated that accessing /EWS is a vulnerability.  I know that /EWS indicates access to Exchange Web Services.

My Question basically is:

1) Is this really a vulnerability?  From what I see here, this does not really sound much like a vulnerability https://msdn.microsoft.com/en-us/library/office/dd877045%28v=exchg.140%29.aspx, it mostly shows details that I could already access using my credentials on Outlook Web Access.

2) Assuming it is really a vulnerability, how do I go by disabling it.

A recent penetration test report indicated that accessing /EWS is a vulnerability.  I know that /EWS indicates access to Exchange Web Services.

My Question basically is:

1) Is this really a vulnerability?  From what I see here, this does not really sound much like a vulnerability https://msdn.microsoft.com/en-us/library/office/dd877045%28v=exchg.140%29.aspx, it mostly shows details that I could already access using my credentials on Outlook Web Access.

2) Assuming it is really a vulnerability, how do I go by disabling it.

I would ask have who conducted the test explain why this is a vulnerability. If you disable EWS, you essentially render Exchange useless so I would not do th

I would think that disabling it would not make sense.  They ask that /EWS be restricted to a few workstations only, which also does not make sense.

Asking might not be a good idea sense they will go out of their way explaining why it is a vulnerability in order to show they weren't wrong.

I would think that disabling it would not make sense.  They ask that /EWS be restricted to a few workstations only, which also does not make sense.

Asking might not be a good idea sense they will go out of their way explaining why it is a vulnerability in order to show they weren't wrong.

Well, then you can choose to define it as an "acceptable risk"  :)