RPC connections stop on EBS

Posted on 2009-02-17
Medium Priority
Last Modified: 2013-11-10
We've installed EBS 2008 for one of our clients.
we've configured 2 Servers:
1. Dell 2950 32GB + 2x15K 73GB SAS - aka HyperV
2. Dell 1950 4GB + 2x73GB SAS - aka GW
3. HP MSA2000i 2.4TB Storage - aka Storage
4. Hp Workstation 2GB + 1x500GB SATA - aka Backup

On the Hyper-V We've installed the Management & the Messaging servers
On the GW We've installed the security server
(on the Hyper-V we installed another TS server)
We've installed WindowsXP & a dedicated backup software on the backup so we can do a brick level and mailboxes backup on the Exchange and files.

We've installed EBS 2008 as mentioned.
We've used the name remote.domain.com as their published external name.
We've configured the ISA and I can access the OWA and users have email - so far so good.

The problem started when we wanted to add external users which should use RPC over HTTPS (Outlook Anywhere) to access the Mail using Outlook client.

The Autodiscover was always failing (even though We've added the autodiscover.domain.com DNS record to point to the external IP of the security server) - we kept getting an error.

When we accessed the Portal we kept getting error on unknown certificate.
We've purchased a valid certificate from Thawte for remote.domain.com which was ok for the remote.domain.com Portal but not for the Autodiscover.

We've decided that I have 2 options:
1. purchase another autodiscover.domain.com name certificate
2. create a new Exchange 2007 certificate which will include both names (remote & Autodiscover).

Since we only have 1 external IP address (, and We've noticed that the security server is configured automatically with 1 WebListener (I need another one and another IP which I don't have) - we went with option #2:
We've issued a new Exchange07 certificate using the command:
New-ExchangeCertifiacte -GenerateRequest:$True -subjectname ......

We used the CA on the Management server for the issuing (I wanted to verify before committing another purchase at Thawte), installed the certificate on the IIS Msg and exported the chain to the WebListener on the security server.

We changed the redirect rule on the ISA to point to the Msg.

At the end, after installing the certificate on an external workstation We're able to Autodiscover it in the world and even connect using RPC over Https.  But with some errors:

The errors We've encountered are:
1.      The RPC stops with no valid reason. IIS service should be restarted
2.      Redirect on deny doesn't work for the remote.domain.com (used to load the portal automatically) - now we need to use remote.domain.com/remote.
3.      The SSO doesn't work.

The REAL problem is that the RPC stops and then the Outlook Anywhere service does not function. a restart to the IIS service on the Messaging (and sometimes a restart to all Exchange services) solves it till next time)

My questions are:
1. Did I work correctly?
2. Should EBS handle Autodiscover in a more elegant way?
3. How can I resolve my errors?
Please help as it is a major issue, the customer can not access the email from time to time when the RPC stops...


M. Bodik
Question by:Mbodik
  • 2

Expert Comment

ID: 23746412
I have a very similar setup and am having similar issue - everything (OWA, Outlook Anywhere, TSGateway) works fine but I lose RPC via TSG connection about 3 or 4 times per day.  Sometimes I can just reconnect, others I have to restart IIS on MSG server.  Any help would be appreciated!

Author Comment

ID: 23756926
I'm closing this question, solved it

Accepted Solution

Mbodik earned 0 total points
ID: 23757019
Oh, forgot to add the solution:
On the MSG - Goto IIS7 / RPC virtual folder / Authentication / Windows Authentication  - right click and choose "advanced Settings",  uncheck the "enable kernel-mode authentication"
As simple as this... the million dollas check mark :)

M. Bodik

Featured Post

Industry Leaders: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Stellar Exchange Toolkit: this 5 in 1 toolkit comes loaded with mega-software tool. Here’s an introduction to tools’ usage and advantages:
Exchange administrators are always vigilant about Exchange crashes and disasters that are possible any time. It is quite essential to identify the symptoms of a possible Exchange issue and be prepared with a proper recovery plan. There are multiple…
This Micro Tutorial hows how you can integrate  Mac OSX to a Windows Active Directory Domain. Apple has made it easy to allow users to bind their macs to a windows domain with relative ease. The following video show how to bind OSX Mavericks to …
This video shows how to quickly and easily deploy an email signature for all users in Office 365 and prevent it from being added to replies and forwards. (the resulting signature is applied on the server level in Exchange Online) The email signat…
Suggested Courses
Course of the Month14 days, 17 hours left to enroll

839 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question