Solved

Some phones not connecting to server after Exchange 2007 to 2013 migration and cert change

Posted on 2013-10-29
7
433 Views
Last Modified: 2014-01-04
After we migrated our Exchange from a Windows Server 2003 R2 server running Outlook 2007 SP3 to a new server running Windows Server 2012 and Exchange 2013, some phones cannot reconnect to the server.

We have tried removing the Exchange account from the phone and adding it back. This worked for some phones but not others. One user even wiped his phone and tried to add the account but it did not work.

There is no problem with any desktop user or OWA user.

One clue may that on a couple of the phones it pointed to a certificate authority that was on the old cert in its error message. We had had to change the UCC cert to point to the new server (and remove the old), and also repointed DNS as part of the migration but these phones are not taking the new path.

Anybody have an idea on troubleshooting steps we could take? Problem phones are mostly LG Lucid and older iPhones + a couple older Motorolas.

I did try mobile device management in the old Exchange console but since we moved the mailboxes already it won't let us manage them. The phones don't exist in the new server mailboxes. I suspect the old association is in place but I don't know how to remove it, or if that is even the problem.


If anyone has any ideas please let me know, thanks!
0
Comment
Question by:FredNorth
  • 5
  • 2
7 Comments
 

Author Comment

by:FredNorth
ID: 39609297
I meant migrated from Exchange 2007 SP3
0
 
LVL 63

Expert Comment

by:Simon Butler (Sembee)
ID: 39609365
Who issued the SSL certificate?
There have been some odd results with SSL certificates from the more obscure providers with the roots not being in the devices.

Do check that the correct certificate is being handed out though. Browse to https://host.example.com/Microsoft-Server-ActiveSync - you will get some errors, but eventually you will be able to look at the SSL certificate.

Another option would be to run a test account through the Microsoft test site http://exrca.com/ and see if there are any SSL errors flagged.

Ensure that any iPhones are on the latest iOS available as well.

Simon.
0
 

Author Comment

by:FredNorth
ID: 39609813
Tried https://<host.example.com>/Microsoft-Server-ActiveSync - not sure what to do to get past errors.


http://exrca.com/  gave some clues, we think it might be still pointing at the old server. We are thinking about uninstalling Exchange from the old server and/or shutting it down.

Also, is it possible to update root certificates on phones and also add/import a ucc cert to a phone?
0
IT, Stop Being Called Into Every Meeting

Highfive is so simple that setting up every meeting room takes just minutes and every employee will be able to start or join a call from any room with ease. Never be called into a meeting just to get it started again. This is how video conferencing should work!

 

Author Comment

by:FredNorth
ID: 39609869
Note: I can set up a test email account on these phones. The only account I can't set up is one that was already on the phone.
0
 
LVL 63

Expert Comment

by:Simon Butler (Sembee)
ID: 39612263
The whole point of using a trusted SSL certificate is that you don't have to install anything.
If a new account works, then I suggest that you ensure there are no existing ActiveSync partnerships on the account and then recreate.

Simon.
0
 

Accepted Solution

by:
FredNorth earned 0 total points
ID: 39612602
Simon, Thanks for your response.  It looks like the problem was security permissions for users in AD. Some of our users had inheritance disabled (On the Domain Controller, AD users & computers, user properties, Security tab, Advanced - Inheritance needed to be enabled for the problem users).
0
 

Author Closing Comment

by:FredNorth
ID: 39755815
Microsoft site had the answer
0

Featured Post

Why spend so long doing email signature updates?

Do you spend loads of your time carrying out email signature updates? Not very interesting are they? Don’t let signature updates get you down. Let Exclaimer Cloud - Signatures for Office 365 make managing email signatures a breeze.

Join & Write a Comment

Follow this checklist to learn more about the 15 things you should never include in an email signature from personal quotes, animated gifs and out-of-date marketing content.
This article explains in simple steps how to renew expiring Exchange Server Internal Transport Certificate.
This tutorial will walk an individual through the process of configuring their Windows Server 2012 domain controller to synchronize its time with a trusted, external resource. Use Google, Bing, or other preferred search engine to locate trusted NTP …
In this Micro Video tutorial you will learn the basics about Database Availability Groups and How to configure one using a live Exchange Server Environment. The video tutorial explains the basics of the Exchange server Database Availability grou…

760 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

21 Experts available now in Live!

Get 1:1 Help Now