Exchange 2007-SP1 OWA: How to restrict access for some users to local only?   

Hi,

Please, who can tell us what is the best way to have full access for all 
domain users via OWA on the local LAN, but to restrict access to OWA from 
outside for only a sub-set of users?

Some background info:
We have one Windows 2003-R2 Active Directory domain with one Exchange 
2007-SP1 server.
With the current set-up we allow OWA access for all users via the Mailbox 
Features Properties, to enable the users to use OWA on the LAN.
Further, we have made some firewall rules to only allow https access from 
some external IP addresses to use OWA from there. This works, but is not 
very flexible. We would prefer to make the external access user dependent 
i.s.o. IP dependent.

Some ideas we have are:
Set the default OWA virtual directory to only allow internal access from the 
LAN.
Add another OWA virtual directory, specifically for external access, and 
control the access in IIS by setting Permissions on the virtual directory.
Would this work, and is this the best way to do it? Or is there a better 
solution for this?

Thanks for any help you can give.

Ed

date: Tue, 13 May 2008 17:22:56 +0200   author:   Ed