We've been running an Exchange 2010 R2 server for the past 6 months and had no issues activating a new Android or iPhone user. Suddenly we are no longer able to create new ActiveSync accounts on any device, but those that have already been activated are synchronizing just fine. I've looked up some of the suggestions, but found that the inheritance issue is not the problem and it is not related to admincount issue either. It happens to all accounts we want to activate, whether old or new. This is what ExRCA shows at the last step that fails.
*(domain x-ed to protect privacy)
The server was restarted several times, but to no avail. These are some of the observations and facts:
All users are allowed to utilize ActiveSync, it's enabled on all mailbox accounts. The server creates a sub-container in AD for each account that tries to activate a phone, as it should.
The server also nicely cleans it up if we remove the ActiveSync partnership.
We are using self-issued SSL certificate, but that's not the problem because the phones ask if it's okay to continue or cancel during the setup process.
The part where each phone fails is when it tries to create the account and folders at the finishing phase stating "Failed to create the account. Please try again later.".
This is the only Exchange server in our organisation and it is also our domain controller.
We migrated from Exchange 2003 Standard Edition and the old server is no longer an Exchange server, but remain in the AD as a domain controller.
Our WatchGuard firewall doesn't seem to be the culprit either because if I connect my phone directly to the LAN via WiFi, effectively bypassing the firewall, and I use the FQDN of the server instead of our publicly known domain name, I get the same exact error on the phone.
Any help would be appreciated.