Solved

Some phones not connecting to server after Exchange 2007 to 2013 migration and cert change

Posted on 2013-10-29
7
447 Views
Last Modified: 2014-01-04
After we migrated our Exchange from a Windows Server 2003 R2 server running Outlook 2007 SP3 to a new server running Windows Server 2012 and Exchange 2013, some phones cannot reconnect to the server.

We have tried removing the Exchange account from the phone and adding it back. This worked for some phones but not others. One user even wiped his phone and tried to add the account but it did not work.

There is no problem with any desktop user or OWA user.

One clue may that on a couple of the phones it pointed to a certificate authority that was on the old cert in its error message. We had had to change the UCC cert to point to the new server (and remove the old), and also repointed DNS as part of the migration but these phones are not taking the new path.

Anybody have an idea on troubleshooting steps we could take? Problem phones are mostly LG Lucid and older iPhones + a couple older Motorolas.

I did try mobile device management in the old Exchange console but since we moved the mailboxes already it won't let us manage them. The phones don't exist in the new server mailboxes. I suspect the old association is in place but I don't know how to remove it, or if that is even the problem.


If anyone has any ideas please let me know, thanks!
0
Comment
Question by:Alex Scarfone
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 5
  • 2
7 Comments
 

Author Comment

by:Alex Scarfone
ID: 39609297
I meant migrated from Exchange 2007 SP3
0
 
LVL 63

Expert Comment

by:Simon Butler (Sembee)
ID: 39609365
Who issued the SSL certificate?
There have been some odd results with SSL certificates from the more obscure providers with the roots not being in the devices.

Do check that the correct certificate is being handed out though. Browse to https://host.example.com/Microsoft-Server-ActiveSync - you will get some errors, but eventually you will be able to look at the SSL certificate.

Another option would be to run a test account through the Microsoft test site http://exrca.com/ and see if there are any SSL errors flagged.

Ensure that any iPhones are on the latest iOS available as well.

Simon.
0
 

Author Comment

by:Alex Scarfone
ID: 39609813
Tried https://<host.example.com>/Microsoft-Server-ActiveSync - not sure what to do to get past errors.


http://exrca.com/  gave some clues, we think it might be still pointing at the old server. We are thinking about uninstalling Exchange from the old server and/or shutting it down.

Also, is it possible to update root certificates on phones and also add/import a ucc cert to a phone?
0
Optimizing Cloud Backup for Low Bandwidth

With cloud storage prices going down a growing number of SMBs start to use it for backup storage. Unfortunately, business data volume rarely fits the average Internet speed. This article provides an overview of main Internet speed challenges and reveals backup best practices.

 

Author Comment

by:Alex Scarfone
ID: 39609869
Note: I can set up a test email account on these phones. The only account I can't set up is one that was already on the phone.
0
 
LVL 63

Expert Comment

by:Simon Butler (Sembee)
ID: 39612263
The whole point of using a trusted SSL certificate is that you don't have to install anything.
If a new account works, then I suggest that you ensure there are no existing ActiveSync partnerships on the account and then recreate.

Simon.
0
 

Accepted Solution

by:
Alex Scarfone earned 0 total points
ID: 39612602
Simon, Thanks for your response.  It looks like the problem was security permissions for users in AD. Some of our users had inheritance disabled (On the Domain Controller, AD users & computers, user properties, Security tab, Advanced - Inheritance needed to be enabled for the problem users).
0
 

Author Closing Comment

by:Alex Scarfone
ID: 39755815
Microsoft site had the answer
0

Featured Post

The Ultimate Checklist to Optimize Your Website

Websites are getting bigger and complicated by the day. Video, images, custom fonts are all great for showcasing your product/service. But the price to pay in terms of reduced page load times and ultimately, decreased sales, can lead to some difficult decisions about what to cut.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

A list of top three free exchange EDB viewers that helps the user to extract a mailbox from an unmounted .edb file and get a clear preview of all emails & other items with just a single click on mailboxes.
This article will help to fix the below errors for MS Exchange Server 2013 I. Certificate error "name on the security certificate is invalid or does not match the name of the site" II. Out of Office not working III. Make Internal URLs and Externa…
This tutorial will walk an individual through the steps necessary to join and promote the first Windows Server 2012 domain controller into an Active Directory environment running on Windows Server 2008. Determine the location of the FSMO roles by lo…
This tutorial will walk an individual through the process of installing the necessary services and then configuring a Windows Server 2012 system as an iSCSI target. To install the necessary roles, go to Server Manager, and select Add Roles and Featu…

724 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question