• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 4985
  • Last Modified:

HTC Droid Eris - Exchange

I have a user that purchased an HTC Droid Eris this week and needs it hooked up to out Exchange server for email.
I enabled active sync and got it working on a windows mobile phone fine verifying active sync works.

This is a SBS 2003 with Exchange 2003 and a self signed SSL certificate

I tried to setup the droid using the built in mail client and it fails (gives error to check with exchange admin - me)

Tried installing K-9 mail and it accepted the self ssl and said it configured properly but no emails are being received (it has been 24hrs)

How to I hook up this phone to get emails via ActiveSync or OMA?

IIS logs show:
GET /oma - 443 - OUTSIDEIP Mozilla/5.0+(Windows;+U;+Windows+NT+5.1;+en-US;+rv: 401 2 2148074254 1900 390

PROPFIND /exchange-oma/ACCTNAME/ - 80 DOMAIN\User SERVER IP - 207 0 0 1483 2390
PROPFIND /exchange-oma/ACCTNAME/ - 80 DOMAIN\User SERVER IP - 207 0 0 901 2146
PROPFIND /exchange-oma/ACCTNAME/ - 80 DOMAIN\User SERVER IP - 207 0 0 909 2148
PROPFIND /exchange-oma/ACCTNAME/ - 80 DOMAIN\User SERVER IP - 207 0 0 896 2147
PROPFIND /exchange-oma/ACCTNAME/ - 80 DOMAIN\User SERVER IP - 207 0 0 901 2152

POST /oma/oma.aspx __ufps=196023 443 USERNAME OUTSIDEIP Mozilla/5.0+(Windows;+U;+Windows+NT+5.1;+en-US;+rv: 200 0 0 1451 683
  • 3
  • 2
1 Solution
Alan HardistyCo-OwnerCommented:
Please have a read of my Exchange 2003 and Activesync FAQ article which should get you up and running:
stealthwifi12Author Commented:
Thanks that did it, for everyone else in case the link above goes out here is the text that got me setup.

Firstly, you need to make sure that you have Exchange Server 2003 Service Pack 2 Installed. To check if you have it installed, open up Exchange System Manager - Start, Programs, Microsoft Exchange, System Manager. Then expand Servers, Right-Click your server and choose Properties. This will display whether you have SP2 installed or not. If you do not have SP2 installed you can download it here - http://www.microsoft.com/downloads/details.aspx?FamilyID=535BEF85-3096-45F8-AA43-60F1F58B3C40&displaylang=en

If you have got SP2 installed, check on https://testexchangeconnectivity.com to see if everything is working properly by running the Exchange Activesync check. The site is an official Microsoft site specifically for testing Exchange installations and connectivity. The test will fail if you use a self-signed SSL certificate, in which case, you'll need to check the "Ignore Trust for SSL" checkbox. On the ActiveSync test page, you are asked whether you wish to use Autodiscover to detect the settings or to manually specify server settings. Exchange 2003 does not have native autodiscover, so you will most likely need to choose the latter option and provide the server name.

If you are trying to make an iPhone work, then you can also download the free iPhone App 'Activesync Tester' and this should identify any problems with your configuration or you can click on the following link: https://store.accessmylan.com/main/diagnostic-tools

You also need to ensure that TCP Port 443 is open and forwarded on your firewall to your Exchange server. You don't need to open up any other ports to get Activesync working, just TCP port 443.

Please check and mirror the settings below (Open up IIS, expand the default website then expand the relevant Virtual Directory, right-click on the Virtual Directory and choose properties, then click on the Directory Security Tab):

Exchange Virtual Directory
" Authentication = Integrated & Basic
" Default Domain = NETBIOS domain name - e.g., yourcompany
" Realm = yourcompany.com
" IP Address Restrictions = Granted Access
" Secure Communications = Require SSL NOT ticked

Microsoft-Server-Activesync Virtual Directory
" Authentication = Basic
" Default Domain = NETBIOS domain name - e.g., yourcompany
" Realm = NETBIOS name
" IP Address Restrictions = Granted Access
" Secure Communications = Require SSL and Require 128-Bit Encryption IS ticked

ASP.NET should be set to version 1.1 for all virtual directories listed above. If you cannot see the ASP.NET tab, you only have v 1.1 installed so do not worry. If any version other than 1.1 is selected, please change it to v 1.1.4322.

No other virtual directories are involved when using Activesync (apart from exchange-oma on SBS 2003 or when Forms Based Authentication is enabled) - despite having seen other postings suggesting that there are.

Although requiring SSL on the virtual directories mentioned above would be recommended, Microsoft actually recommend disabling it as per the following article in their knowledgebase: http://support.microsoft.com/kb/817379 Nevertheless, ActiveSync and OWA access should still run over a secure HTTPS session (port 443), as standard procedure states you should not open port 80 to the Exchange Server through your firewall.

Please also check that Ignore Client Certificates is selected under the IISADMPWD virtual directory / Directory Security Tab / Edit Secure Communications Button. This Virtual Direcory may not exist if you have not setup the ability to reset passwords via Outlook Web Access (OWA).

For Small Business Server 2003 Users - please check this MS article - http://support.microsoft.com/kb/937635

Make sure that the name on the SSL certificate you have installed matches the Fully Qualified Domain Name (FQDN) that you are connecting to for ActiveSync - for example, mail.microsoft.com. If it does not match, either re-issue the certificate if you created it yourself, or re-key the certificate from your SSL certificate provider.

Activesync is much easier to get working with a purchased SSL certificate (installed on the default website but you can generate your own and still make it work). GoDaddy seem to be offering the cheapest SSL certificates (at the time of writing this article).

Ensure that the IP for the Default Website is set to All Unassigned and using port 80 (open up IIS, Right-Click the Default Website). If your default website is using any port other than port 80, it simply will not work, so if you have changed this to make something else work, either change it back to port 80 or stop trying to use Activesync!

If you make any changes to IIS, you will need to reset IIS settings. Please click on Start, Run and type IISRESET then press enter.

Ensure that Forms Based Authentication is NOT turned on under Exchange Virtual Server under Exchange Protocols (Exchange System Manager, Servers, Protocols, HTTP, Exchange Virtual Server properties, Settings Tab). If it is -- read http://support.microsoft.com/kb/817379

Once all of the above has been checked, if you have made any changes, please re-visit https://testexchangeconnectivity.com and your test should now pass all checks and Activesync should be working happily for you.

If you still cannot get Activesync to work or keep getting an HTTP 500 error, please follow Method 2 in KB Article 883380 http://support.microsoft.com/kb/883380 and this should resolve the issues. This essentially deletes the Metabase (which can be corrupted) and rebuilds it. Rebuilding it often clears up problems that all the other steps above does not resolve.

After following KB883380 and if Activesync still does not work and it keeps coming up with HTTP 500 errors, please do the following:

" Disable Forms Based Authentication - Exchange HTTP Protocol (if enabled)
" Remove SSL settings from the Exchange IIS virtual directory
" Run iisreset
" Test activesync without SSL selected - hopefully this should work or give the OK result
" If okay - right-click on the Exchange Virtual Directory and select all Tasks> Save Configuration to a file. Name the file Exchange and save to the desktop
" Run Regedit (and be extremely careful here as you can kill your server very easily) then right-click on My Computer and select Export. Name the file as 'EntireRegistry' and save the backup of the registry to the desktop
" In regedit - locate HKLM \ System \ CurrentControlSet \ Services \ MasSync \ Parameters and delete the ExchangeVDir key from the right-hand pane.
" Close Regedit
" Right-click on the default-website and select New> Virtual Directory fom File. Browse to the desktop and click on the Exchange.xml that you created above, then click on Read file, select Exchange from the 'Select a configuration to import' section and click on OK. Select 'Create a new virtual Directory' and name the directory 'exchange-oma' and click OK.
" Right-click on Exchange-OMA virtual directory you just created and click Browse - you should see OWA open up happily
" Open Regedit and add the ExchangeVDir key back that you recently deleted as a String Value and then change the value to read /exchange-oma
" Close regedit
" Enable SSL and require 128-Bit Encryption on the Exchange Virtual Directory
" Enable Forms Based Authentication (if you want to use it) on Exchange> Protocols> HTTP
" Make sure that Integrated Authentication is enabled on the Exchange Virtual Directory
" Check that the Exchweb virtual directory does not have SSL enabled
" Run iisreset
" Test Activesync - should hopefully be working now

Please also check the LAN Adapter Binding order to make sure the NIC that Exchange is bound to is at the top of the list (Start> Run> [type] ncpa.cpl [press enter]> Advanced> Advanced Settings> Connections).

I have had Activesync work despite seeing "An HTTP 403 forbidden response was received. The response appears to have come from Unknown. Body is: HTTP/1.1 403 Forbidden" at the end of the test above. To resolve this (if you like things tidy), please open up Exchange System Manager, Global Settings, Mobile Services Properties, Device Security Button, Exceptions Button, then add your account to the exceptions list.
Alan HardistyCo-OwnerCommented:
Was there one particular part of the FAQ that sorted the problem for you?
Also, there is a (not quite so up-to-date) link here:
stealthwifi12Author Commented:
Setting the below IIS virtual directory to match and verifiying settings with a temp account via https://testexchangeconnectivity.com 

Microsoft-Server-Activesync Virtual Directory
" Authentication = Basic
" Default Domain = NETBIOS domain name - e.g., yourcompany
" Realm = NETBIOS name
" IP Address Restrictions = Granted Access
" Secure Communications = Require SSL and Require 128-Bit Encryption IS ticked
Alan HardistyCo-OwnerCommented:
Ah - the old IIS Settings - thank for the info - may possibly help others in the future.
Happy New Year.
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

Join & Write a Comment

Featured Post

Upgrade your Question Security!

Your question, your audience. Choose who sees your identity—and your question—with question security.

  • 3
  • 2
Tackle projects and never again get stuck behind a technical roadblock.
Join Now