RPC connections stop on EBS

Posted on 2009-02-17
Last Modified: 2013-11-10
We've installed EBS 2008 for one of our clients.
we've configured 2 Servers:
1. Dell 2950 32GB + 2x15K 73GB SAS - aka HyperV
2. Dell 1950 4GB + 2x73GB SAS - aka GW
3. HP MSA2000i 2.4TB Storage - aka Storage
4. Hp Workstation 2GB + 1x500GB SATA - aka Backup

On the Hyper-V We've installed the Management & the Messaging servers
On the GW We've installed the security server
(on the Hyper-V we installed another TS server)
We've installed WindowsXP & a dedicated backup software on the backup so we can do a brick level and mailboxes backup on the Exchange and files.

We've installed EBS 2008 as mentioned.
We've used the name as their published external name.
We've configured the ISA and I can access the OWA and users have email - so far so good.

The problem started when we wanted to add external users which should use RPC over HTTPS (Outlook Anywhere) to access the Mail using Outlook client.

The Autodiscover was always failing (even though We've added the DNS record to point to the external IP of the security server) - we kept getting an error.

When we accessed the Portal we kept getting error on unknown certificate.
We've purchased a valid certificate from Thawte for which was ok for the Portal but not for the Autodiscover.

We've decided that I have 2 options:
1. purchase another name certificate
2. create a new Exchange 2007 certificate which will include both names (remote & Autodiscover).

Since we only have 1 external IP address (, and We've noticed that the security server is configured automatically with 1 WebListener (I need another one and another IP which I don't have) - we went with option #2:
We've issued a new Exchange07 certificate using the command:
New-ExchangeCertifiacte -GenerateRequest:$True -subjectname ......

We used the CA on the Management server for the issuing (I wanted to verify before committing another purchase at Thawte), installed the certificate on the IIS Msg and exported the chain to the WebListener on the security server.

We changed the redirect rule on the ISA to point to the Msg.

At the end, after installing the certificate on an external workstation We're able to Autodiscover it in the world and even connect using RPC over Https.  But with some errors:

The errors We've encountered are:
1.      The RPC stops with no valid reason. IIS service should be restarted
2.      Redirect on deny doesn't work for the (used to load the portal automatically) - now we need to use
3.      The SSO doesn't work.

The REAL problem is that the RPC stops and then the Outlook Anywhere service does not function. a restart to the IIS service on the Messaging (and sometimes a restart to all Exchange services) solves it till next time)

My questions are:
1. Did I work correctly?
2. Should EBS handle Autodiscover in a more elegant way?
3. How can I resolve my errors?
Please help as it is a major issue, the customer can not access the email from time to time when the RPC stops...


M. Bodik
Question by:Mbodik

    Expert Comment

    I have a very similar setup and am having similar issue - everything (OWA, Outlook Anywhere, TSGateway) works fine but I lose RPC via TSG connection about 3 or 4 times per day.  Sometimes I can just reconnect, others I have to restart IIS on MSG server.  Any help would be appreciated!

    Author Comment

    I'm closing this question, solved it

    Accepted Solution

    Oh, forgot to add the solution:
    On the MSG - Goto IIS7 / RPC virtual folder / Authentication / Windows Authentication  - right click and choose "advanced Settings",  uncheck the "enable kernel-mode authentication"
    As simple as this... the million dollas check mark :)

    M. Bodik

    Write Comment

    Please enter a first name

    Please enter a last name

    We will never share this with anyone.

    Featured Post

    Do email signature updates give you a headache?

    Constantly trying to correctly format email signatures? Spending all of your time at every user’s desk to make updates? Want high-quality HTML signatures on all devices, including on mobiles and Macs? Then, let Exclaimer solve all your email signature problems today!

    New Windows 7 Installations take days for Windows-Updates to show up and install. This can easily be fixed. I have finally decided to write an article because this seems to get asked several times a day lately. This Article and the Links apply to…
    Know what services you can and cannot, should and should not combine on your server.
    This tutorial will walk an individual through the steps necessary to enable the VMware\Hyper-V licensed feature of Backup Exec 2012. In addition, how to add a VMware server and configure a backup job. The first step is to acquire the necessary licen…
    This tutorial will show how to configure a single USB drive with a separate folder for each day of the week. This will allow each of the backups to be kept separate preventing the previous day’s backup from being overwritten. The USB drive must be s…

    737 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    17 Experts available now in Live!

    Get 1:1 Help Now