Exchange and Activesync error 400

Please have a run through my FAQ regarding Activesync and Exchange 2003:

http://www.it-eye.co.uk/faqs/readQuestion.php?qid=1

The OMA and Exchange-OMA virtual directories have no bearing on Activesync.  Only the Exchange and Microsoft-Server-Activesync are used with Activesync.

I have seen this happen with a corrupt mail message. try
remove (aka move) all mail from the persons inbox.
check if it works ok
then slowly move the mail back.

two users it may be a message sent to both of them.!

of course this assumes that everything is configured correctly - which it sounds like it is.

www.testexchangeconnectivity.com.

Try this site.  Enter your information and see where it fails.  Post the info here and we should be able to help you.

Please find IIS authentication type and the SSL requirement for Exchange 2003.
1) Default Website : Annonymous & Integrated     NO SSL
2) Exadmin : Integrated                                    NO SSL
3) Exchweb : Annonymous                              NO SSL
4) Exchange: Basic                                        SSL Optional
5) RPC     : Basic                                        SSL Required
6) OMA     : Basic                                       SSL Optional
7) Public  : Basic+Integrated                         SSL Optional
8) exchange-oma : Basic & Integrated             NO SSL
9) Microsoft-Server-ActiveSync : Basic           SSL Optional
After That restart IIS service.

LeeDerbyshire:

http://servername/exchange? works perfect no errors same as Exchange on outllook.

wolfcamel:

I have the same with about 5 users not seem to be with linked mails.

alanhardisty:

Activesync looks like configure correct include authentications

where can I check  IISADMPWD ? Other than that I checked all point as on the link and all looks as should be.

IISADMPWD is only there is you have manually allowed passwords to be set via OWA.

Does the testexchaneconnectivity test come back successfully?

Sorry about that - FAQ modified to include this info.

Can you post the IIS log entries (double-click the latest file in C:\Windows\System32\LogFiles\W3SVC1 - note the times are in GMT) generated when you try to use ActiveSync.  You should see a request for 'Microsoft-Server-ActiveSync'  followed by other requests (usually for 'Exchange', but may also be 'exchange-oma') with a 400 near the end of the logged line.

SatyaPathak:

all is as you wrote.

yardenm - If you have set the virtual directories as SatyaPathak has suggested - this is why it won't be working!

The correct settings needed are in my FAQ and as stated previously, the only two virtual directories used with Activesync are the Exchange and Microsoft-Server-Activesync ones.

Need to have integrated Auth and Basic for authentication.  If you have a FrontEnd and a Backend Server, you need to check the virtual directories on both servers.

AS will also use exchange-oma if the OP has done KB817379.  However, if they didn't turn off SSL and/or FBA before doing it (a small point neglected in the article), they will get the same error after doing it.

I checked

Ignore Trust for SSL and  Ignore Trust for SSL

I run the test here are the results:

Testing Exchange ActiveSync
 Exchange ActiveSync test Failed
Test Steps
Attempting to resolve the host name mail.domain.com in DNS.
Host successfully resolved
Additional Details
IP(s) returned: xxx.xxx.xxx.xxx
Testing TCP Port 443 on host mail.domain.com to ensure it is listening and open.
The port was opened successfully.
Testing SSL Certificate for validity.
The SSL Certificate failed one or more certificate validation checks.
Test Steps
Validating certificate name
Certificate name validation failed
Additional Details
Host name mail.domain.com does not match any name found on the server certificate CN=exchsrv.domain.com, OU=IT, O=Domain, L=CITY, S=CITY, C=XX  

Is it the same certificate I used for the Exchange over HTTPS?

This is a certificate problem.  If it is a celf-created certificate - you need to re-create a certificate with the correct name in it (as per my FAQ) or you can buy one from somewhere like GoDaddy which will make life much easier for you.

Yeah, thats a cert problem.  For Exchange 2003, get yourself a trusted 3rd party cert for a few bucks a year.  As Alan said, save yourself some heartache.  Becareful with GoDaddy certs though.  Especially if you have mobile 5 devices.

You can download a GoDaddy Trusted Root Cert for WM5 devices from:

http://help.godaddy.com/article/5251

alanhardisty:

If I recreate the certificate does it going to affect the current user using exchange under outlook?

How do I recreate the certificate (without to buy)?

as far as I rmember it was done on the IIS where can I reissue and how to check the current one?

What you mean on  FQDN that you are connecting to e.g., mail.microsoft.com.

alanhardisty:

If I take cert from GoDaddy again does it going to affect current users (I have no users with WM5 just iPhones and Nokia)

How do I install it after I buy it (again without to make a big mess for current users)

Thanks,

It depends on what is currently setup to use the existing certificate.

Either way - your certificate name is incorrect.  Is your current certificate a self-signed certificate?

There are full instructions on the GoDaddy site for requesting and installing an SSL certificate - I can provide you links if you would like them.

alanhardisty: thanks,

Where can I see my certificate name and what should I compare it to?

The certificate is used just for RPC over HTTPS for the exchange of outlook. If I will change it will I need to reinstall all the Exchange accounrs?

Can it affect my Blackberry server?

Open up IIS on the server then expand the websites until you can see the default website.

Right-click on the default website and choose properties.  Then click on the Directory Security tab and click on View Certificate button.

There you will see the name(s) on the certificate.

All Sorry the problem was not certificate I type incorrect my activesync domain here is the full error I'm getting any help, and sorry again for themistake.

Testing Exchange ActiveSync
 Exchange ActiveSync test Failed
Test Steps
Attempting to resolve the host name exchsrv.Domain.com in DNS.
Host successfully resolved
Additional Details
IP(s) returned: xxx.xxx.xxx.xxx
Testing TCP Port 443 on host exchsrv.Domain.com to ensure it is listening and open.
The port was opened successfully.
Testing SSL Certificate for validity.
The certificate passed all validation requirements.
Test Steps
Validating certificate name
Successfully validated the certificate name
Additional Details
Found hostname exchsrv.Domain.com in Certificate Subject Common name
Testing certificate date to ensure validity
Date Validation passed. The certificate is not expired.
Additional Details
Certificate is valid: NotBefore = 5/17/2008 6:59:00 PM, NotAfter = 5/17/2010 6:59:00 PM"
 
Testing Http Authentication Methods for URL https://exchsrv.Domain.com/Microsoft-Server-Activesync/
Http Authentication Methods are correct
Additional Details
Found all expected authentication methods and no disallowed methods. Methods Found: Basic
Attempting an ActiveSync session with server
Errors were encountered while testing the ActiveSync session
Test Steps
Attempting to send OPTIONS command to server
OPTIONS response was successfully received and is valid
Additional Details
Headers received: Pragma: no-cache
Public: OPTIONS, POST
Allow: OPTIONS, POST
MS-Server-ActiveSync: 6.5.7638.1
MS-ASProtocolVersions: 1.0,2.0,2.1,2.5
MS-ASProtocolCommands: Sync,SendMail,SmartForward,SmartReply,GetAttachment,GetHierarchy,CreateCollection,DeleteCollection,MoveCollection,FolderSync,FolderCreate,FolderDelete,FolderUpdate,MoveItems,GetItemEstimate,MeetingResponse,ResolveRecipients,ValidateCert,Provision,Search,Notify,Ping
Content-Length: 0
Date: Thu, 22 Oct 2009 17:31:05 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
 
Attempting FolderSync command on ActiveSync session
FolderSync command completed successfully.
Additional Details
Number of Folders: 147
Attempting initial sync (no data) for Inbox folder
Completed Sync Command successfully
Additional Details
Status: 1
Attempting to test GetItemEstimate command for Inbox Folder
Error received while processing GetItemEstimate Response
Additional Details
An HTTP 500 response was returned from Unknown  

This article (also in my FAQ - but usually referring to SBS which uses Forms Based Authentication will assist here):

http://support.microsoft.com/kb/817379

The www.testexchangeconnectivity.com passed now by using this link

http://www.experts-exchange.com/Software/Server_Software/Web_Servers/Microsoft_IIS/Q_24282272.html

at the end there are2 link to:

http://technet.microsoft.com/en-us/library/aa998162.aspx
http://technet.microsoft.com/en-us/library/aa998240.aspx

The first link solve the issue on the www.testexchangeconnectivity.com now all passed but still I'm getting the error on the sever nothing changed.

Which error are you getting now?  Can you please confirm.

Thanks - Alan

on the server same as on the top

Event Type:      Error
Event Source:      Server ActiveSync
Event Category:      None
Event ID:      3005
Date:            10/22/2009
Time:            4:50:14 PM
User:            domain\me
Computer:      EXCHSRV
Description:
Unexpected Exchange mailbox Server error: Server: [EXCHSRV.doamin.com] User: [me@domain.com] HTTP status code: [400]. Verify that the Exchange mailbox Server is working correctly.

on the test no error if I check ignore trust...

I already go over this KB but nothing.

One point that no one pay attention as I wrote is that the sync is working for about 10 min with out any problem than stop for about 5 min and I'm getting all the error (no other warnings or errors in between) it looks like some timeout or something like that. I checked all the time out on my Firewall and all set to 60 min but somehow the sync stop to work for few min after some time and goes on.

From that and all the test and checking configuration I think it's problem from timers but can't find nothing about it.

You say you did KB817379, but the article does not make clear that you have to have ActiveSync working with the normal Exchange VDir before you do it, otherwise you will just clone an Exchange VDir that has the wrong settings (i.e. with FBA and/or SSL enabled).  If you did the KB, then you will now have a VDir named exchange-oma in IIS.  Look at its properties and see if SSL is required on it.

SSL not selected

Can you find the IIS log entries generated by the attempt to use A/S?

how can I find it?