Parallels Virtualization and Automation Software

RESOLUTION

Reason:
User token, used for OWA access, are cached by IIS. When user logs on to Exchange mailbox via a Web browser, the user's token is created. If the account's credentials (login or password) are subsequently changed, or account is disabled, the user can still access the mailbox during some period of time using the old credentials. Acording with the Microsoft documentation this cache expiration time is about 15 minutes. Actually this value can be grater.

Resolution:

You can force the expiration of the IIS token cache by restarting the IIS services:

1. On each Exchange Front-end servers run the "Internet Information Services (IIS) Manager" snap-in (Start / Programs / Administrative Tools / Internet Information Services (IIS) Manager).
2. In the left pane left click on the local computer node (for EXFE01 it was "EXFE01 (local computer)").
3. Select "All Tasks" / "Restart IIS...". Message box will be opened.
   
4. In the list box select "Restart Internet Services on ..." (selected by default) and click "OK".

You can change the default interval for the token cache:

1. On each Exchange Front-end servers run the registry editor (regedit.exe).
2. Locate the followin key: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\InetInfo\Parameters
3. Within this key add DWORD value UserTokenTTL with decimal value 300 (IIS refresh tokens cache every 300 seconds = 5 minutes).