Exchange 2010 Activesync will not connect to phone

Posted on 2012-09-09
Last Modified: 2012-09-11
A couple of accounts will not connect to Exchange Activesync.  Any advice is much appreciated.

Exchange 2010 SP1 installed on Windows 2008 R2.  Exchange Activesync is configured correctly and 99% of other accounts work both on Android and iPhones.  Configuration variables to connect phones are certain.  Activesync for the accounts in question are enabled.  We do not use POP.  We do have SSL in place.

A couple of accounts cannot connect to cell phones, both Android and iPhone.  Tried different phones and still same problem.  Getting server connection error and config variables are certain since we can connect to other accounts successfully.  SSL checkbox is checked.

Everything is pointing to the actual account settings.  Is there anything that I might have missed?  Pls advise.
Question by:gbksphere
    LVL 37

    Expert Comment

    by:Jamie McKillop

    A couple of things to check:

    Run get-casmailbox <user> |  select ActiveSyncAllowedDeviceID and make sure this is blank.

    Run Get-ActiveSyncDeviceStatistics -mailbox <email address> and make sure there are less than ten devices returned. Exchange 2010 has a limit of ten device partnerships. You will need to clear out any old partnerships if you reach ten.

    LVL 31

    Accepted Solution

    Do these users happen to be domain admins? In Exchange 2010 activesync does NOT work for users who are administrators because of the way the admin's permissions are inherited (or more correctly, how they are NOT inherited).

    You can check if this is the problem that is affecting you because there will be a whole pile of errors in the exchange server's error log reported "permission-denied" issues regarding the failed user.

    The best practice suggested by microsoft is to give admin two different accounts - one with admin privileges and used for admin purposes only, and one for their regular day-to-day use.

    It is NOT recommended to simply tick the "Include inheritable permissions from this object's parent" in active directory, because Windows will automatically reset that checkbox periodically, as described in the article above.

    I'm looking for the original microsoft KB article... will post it when I find it.

    Author Closing Comment

    Thank you for all the responses.  I managed to resolve the issue after fiddling with the issue for 2 hrs.  Frosty55 comment pointed me in the direction which eventually assisted me to resolve the problem.  The accounts in question were not admin accounts.  The problem turned out to having something to do with permission.  The steps I took eventually was to remove all security groups associated with the accounts except for domain users.  Then ticked the inherited permissions from parent.  Force replication throughout the DCs.  Went back and unticked the inherited permission.  Force replication again.  Connect to cell phones successfully after second try after clearing app cache/data on the phone (android).  Went back to AD and re-added all security groups the accounts had.

    Featured Post

    Give your grad a cloud of their own!

    With up to 8TB of storage, give your favorite graduate their own personal cloud to centralize all their photos, videos and music in one safe place. They can save, sync and share all their stuff, and automatic photo backup helps free up space on their smartphone and tablet.

    Join & Write a Comment

    Suggested Solutions

    Granting full access permission allows users to access mailboxes present in their database. By giving full access permission one can open and read the content of any mailbox but cannot send emails from that mailbox.
    Check out this infographic on what you need to make a good email signature that will work perfectly for your organization.
    In this video we show how to create an email address policy in Exchange 2013. We show this process by using the Exchange Admin Center. Log into Exchange Admin Center.:  First we need to log into the Exchange Admin Center. Navigate to the Mail Flow…
    The basic steps you have just learned will be implemented in this video. The basic steps are shown to configure an Exchange DAG in a live working Exchange Server Environment and manage the same (Exchange Server 2010 Software is used in a Windows Ser…

    729 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    18 Experts available now in Live!

    Get 1:1 Help Now