Some phones not connecting to server after Exchange 2007 to 2013 migration and cert change

After we migrated our Exchange from a Windows Server 2003 R2 server running Outlook 2007 SP3 to a new server running Windows Server 2012 and Exchange 2013, some phones cannot reconnect to the server.

We have tried removing the Exchange account from the phone and adding it back. This worked for some phones but not others. One user even wiped his phone and tried to add the account but it did not work.

There is no problem with any desktop user or OWA user.

One clue may that on a couple of the phones it pointed to a certificate authority that was on the old cert in its error message. We had had to change the UCC cert to point to the new server (and remove the old), and also repointed DNS as part of the migration but these phones are not taking the new path.

Anybody have an idea on troubleshooting steps we could take? Problem phones are mostly LG Lucid and older iPhones + a couple older Motorolas.

I did try mobile device management in the old Exchange console but since we moved the mailboxes already it won't let us manage them. The phones don't exist in the new server mailboxes. I suspect the old association is in place but I don't know how to remove it, or if that is even the problem.


If anyone has any ideas please let me know, thanks!
Alex ScarfoneInternal IT ManagerAsked:
Who is Participating?
 
Alex ScarfoneConnect With a Mentor Internal IT ManagerAuthor Commented:
Simon, Thanks for your response.  It looks like the problem was security permissions for users in AD. Some of our users had inheritance disabled (On the Domain Controller, AD users & computers, user properties, Security tab, Advanced - Inheritance needed to be enabled for the problem users).
0
 
Alex ScarfoneInternal IT ManagerAuthor Commented:
I meant migrated from Exchange 2007 SP3
0
 
Simon Butler (Sembee)ConsultantCommented:
Who issued the SSL certificate?
There have been some odd results with SSL certificates from the more obscure providers with the roots not being in the devices.

Do check that the correct certificate is being handed out though. Browse to https://host.example.com/Microsoft-Server-ActiveSync - you will get some errors, but eventually you will be able to look at the SSL certificate.

Another option would be to run a test account through the Microsoft test site http://exrca.com/ and see if there are any SSL errors flagged.

Ensure that any iPhones are on the latest iOS available as well.

Simon.
0
Problems using Powershell and Active Directory?

Managing Active Directory does not always have to be complicated.  If you are spending more time trying instead of doing, then it's time to look at something else. For nearly 20 years, AD admins around the world have used one tool for day-to-day AD management: Hyena. Discover why

 
Alex ScarfoneInternal IT ManagerAuthor Commented:
Tried https://<host.example.com>/Microsoft-Server-ActiveSync - not sure what to do to get past errors.


http://exrca.com/  gave some clues, we think it might be still pointing at the old server. We are thinking about uninstalling Exchange from the old server and/or shutting it down.

Also, is it possible to update root certificates on phones and also add/import a ucc cert to a phone?
0
 
Alex ScarfoneInternal IT ManagerAuthor Commented:
Note: I can set up a test email account on these phones. The only account I can't set up is one that was already on the phone.
0
 
Simon Butler (Sembee)ConsultantCommented:
The whole point of using a trusted SSL certificate is that you don't have to install anything.
If a new account works, then I suggest that you ensure there are no existing ActiveSync partnerships on the account and then recreate.

Simon.
0
 
Alex ScarfoneInternal IT ManagerAuthor Commented:
Microsoft site had the answer
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.