Jason Bevan
asked on
SBS 2011 Exchange Activesyc Failure
I have a new installation of Microsoft Small Business Server 2011. I am testing the functionality of Exchange Activesync using microsoft remote connectivity analyzer, and am getting a failure when using user credentials:
--------------------------
Attempting to send an Autodiscover POST request to potential Autodiscover URLs.
Autodiscover settings weren't obtained when the Autodiscover POST request was sent.
Test Steps
ExRCA is attempting to retrieve an XML Autodiscover response from URL https://********.xml for user ***@*************co.uk.
ExRCA failed to obtain an Autodiscover XML response.
Additional Details
None of the expected XML elements were found in the XML response.
My *’s !
--------------------------
I am getting success when I use my own admin credentials though, so this must be a permissions thing somewhere. I did a fair bit of googling yesterday and I’m ruling out certificate, DNS, or path problems (!)
My understanding is that the .xml document is produced on a per user basis ‘on the fly’ whenever a request is generated, so maybe a write permission for Authenticated Users?
Any ideas?
--------------------------
Attempting to send an Autodiscover POST request to potential Autodiscover URLs.
Autodiscover settings weren't obtained when the Autodiscover POST request was sent.
Test Steps
ExRCA is attempting to retrieve an XML Autodiscover response from URL https://********.xml for user ***@*************co.uk.
ExRCA failed to obtain an Autodiscover XML response.
Additional Details
None of the expected XML elements were found in the XML response.
My *’s !
--------------------------
I am getting success when I use my own admin credentials though, so this must be a permissions thing somewhere. I did a fair bit of googling yesterday and I’m ruling out certificate, DNS, or path problems (!)
My understanding is that the .xml document is produced on a per user basis ‘on the fly’ whenever a request is generated, so maybe a write permission for Authenticated Users?
Any ideas?
ASKER
Thanks for that, I don't think it's a URL issue as the admin credentials work. I think it may be permissions.
Have you setup either an Autodiscover A record in external DNS or an SRV record pointing to a name in your SSL certificate?
Have you bought and installed a 3rd party SSL certificate including autodiscover.yourdomain.co
If not - please do, then it should work happily.
Use the SSL certificates wizards to request a certificate and once installed, you should be good to go.
GoDaddy are about the cheapest place to buy an SSL certifciate.
Have you bought and installed a 3rd party SSL certificate including autodiscover.yourdomain.co
If not - please do, then it should work happily.
Use the SSL certificates wizards to request a certificate and once installed, you should be good to go.
GoDaddy are about the cheapest place to buy an SSL certifciate.
this blog lists the permissions on the virtual directories so you could compare to yours
http://www.fixkar.com/articles/kb/1070/
no need to do any removable and re-add just double check at it looks like a permissions issue
http://www.fixkar.com/articles/kb/1070/
no need to do any removable and re-add just double check at it looks like a permissions issue
If it does turn out to be a permission issue, you should find the answer in my article:
https://www.experts-exchange.com/Software/Server_Software/Email_Servers/Exchange/A_2861-Activesync-Working-But-Only-For-Some-Users-On-Exchange-2007-2010.html
Alan
https://www.experts-exchange.com/Software/Server_Software/Email_Servers/Exchange/A_2861-Activesync-Working-But-Only-For-Some-Users-On-Exchange-2007-2010.html
Alan
ASKER
Thanks for the replies.
I have an commercial SSL cert and the Activesync test work with the admin credentials. It is the Domain Users that have the problem.
I have an SRV record in DNS is the Microsoft Remote Connectin tool finding the server correctly.
I have checked the authenitcation on the Autodiscover site and they conform to the reccomendations. Interestingly if I click on 'view virtual directories' none are listed. Howerver, since I can successfully test the admin account this seems unlikely to be a cause of the problem.
I have checked as per alanharditsy and the allow inheritable permission is already ticked.
I have an commercial SSL cert and the Activesync test work with the admin credentials. It is the Domain Users that have the problem.
I have an SRV record in DNS is the Microsoft Remote Connectin tool finding the server correctly.
I have checked the authenitcation on the Autodiscover site and they conform to the reccomendations. Interestingly if I click on 'view virtual directories' none are listed. Howerver, since I can successfully test the admin account this seems unlikely to be a cause of the problem.
I have checked as per alanharditsy and the allow inheritable permission is already ticked.
have you run the BPA on the inside to see if its ok?
can you run through and confirm you have internal and external ULR's for the web services that resemble the links you are using from outside and inside.
can you run through and confirm you have internal and external ULR's for the web services that resemble the links you are using from outside and inside.
Test-OutlookWebServices -identity:johnc@alpineskih
try running this on the inside to test and make sure it look ok - swapping ID for both non-admin and admin user
what have you got in the way of external to the exchange server - firewall, TMG ?
try running this on the inside to test and make sure it look ok - swapping ID for both non-admin and admin user
what have you got in the way of external to the exchange server - firewall, TMG ?
ASKER
irweazelwallis - have run BPA and find I behind with Exchange service packs! Will patch and post again.
Thanks.
Thanks.
ASKER
Now updated to Exchange SP2 but no differnet.
Every test in test-outlookwebservices for a regular user passed bar one, which was:
Error The certificate for the URL https://********.********.local/Autodiscover/Autodiscover.xml is incorrect. For SSL to work, the certificate needs to have a subject of *************.***********.
I think the error is probably spurious (Maybe?) as it's not failing with external SSL.
The external SSL is fully validated in the earlier parts of the MRCA when I test both admin and user externally.
I have only a BT Business Hub which I believe to be correctly configured - again, the admin users have no problem with the tests.
Cheers.
Every test in test-outlookwebservices for a regular user passed bar one, which was:
Error The certificate for the URL https://********.********.local/Autodiscover/Autodiscover.xml is incorrect. For SSL to work, the certificate needs to have a subject of *************.***********.
I think the error is probably spurious (Maybe?) as it's not failing with external SSL.
The external SSL is fully validated in the earlier parts of the MRCA when I test both admin and user externally.
I have only a BT Business Hub which I believe to be correctly configured - again, the admin users have no problem with the tests.
Cheers.
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
so do you have the right names in your cert to work internally and externally
it should work internally to begin with otherwise you would have issues with outlook
for you firewall ports you should have http/https/443 allowed in and forwards to your CAS server
what happens if you browse to your autodiscover url - externally and internally
it should work internally to begin with otherwise you would have issues with outlook
for you firewall ports you should have http/https/443 allowed in and forwards to your CAS server
what happens if you browse to your autodiscover url - externally and internally
Oh well - glad that you have resolved it and sorry we couldn't help you this time around. Maybe next time.
Alan
Alan
ASKER
The answer was an oversight on my part.
you can do this check easily internally as well first to make sure it works for non-admin user