[Webinar] Streamline your web hosting managementRegister Today

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 387
  • Last Modified:

Why can't WAN Outlook 2007/2010 users connect to Exchange 2007 server after Domain Admin password change?

I changed the Domain Administrator password (7 sites, 8 DCs, 7 subnets) a couple of days ago, now none of my remote sites can connect to Exchange 2007 with Outlook 2007 or 2010 clients.  The primary location of the Exchange server, email flow works perfectly.  The sites are connected thru an MPLS cloud & I can remotely administer all DCs & User workstations.  I can telnet to port 25 from the remote sites (intermittently), but I cannot telnet to port 587.  We also use receive connectors for each server to allow relay.  Please help.
0
Keith Atkinson
Asked:
Keith Atkinson
  • 9
  • 5
  • 4
1 Solution
 
Gareth GudgerCommented:
So just to clarify. All the users at the main location are fine. They can still connect with Outlook no problem.

Its just the users at remote sites over an MPLS connection that can't connect to Outlook?

What is the error when they try and connect? Is it just server unavailable? What do you see from one of the remote users if you right click+hold SHIFT on the Outlook icon in the systry and select Connection Status or Test Autoconfiguration.

Changing the admin password should have no bearing.

Can these remote users connect to Outlook Web App?
0
 
Keith AtkinsonNetwork AdministratorAuthor Commented:
So just to clarify. All the users at the main location are fine. They can still connect with Outlook no problem.  (Correct)

Its just the users at remote sites over an MPLS connection that can't connect to Outlook? (Correct)

What is the error when they try and connect? Is it just server unavailable? What do you see from one of the remote users if you right click+hold SHIFT on the Outlook icon in the systry and select Connection Status or Test Autoconfiguration. (It drops compatiblity mode Windows XP & attempts to reconfigure the client via autodiscovery)

Can these remote users connect to Outlook Web App? (YES)
Outlook-Error.docx
0
 
Gareth GudgerCommented:
I assume the remote sites with the problem can ping the mail server by FQDN?

From the remote sites with the problem can they get to the URL you have specified for autodiscover in their web browser?

For example.... https://autodiscover.yourdomain.com/Autodiscover/autodiscover.xml
0
Simplify Active Directory Administration

Administration of Active Directory does not have to be hard.  Too often what should be a simple task is made more difficult than it needs to be.The solution?  Hyena from SystemTools Software.  With ease-of-use as well as powerful importing and bulk updating capabilities.

 
Keith AtkinsonNetwork AdministratorAuthor Commented:
Yes.  We can ping by FQDN.
0
 
Zacharia KurianAdministrator- Data Center & NetworkCommented:
Have you tried Exchange Remote Connectivity Analyzer? If not try it to get more details of the connection error.
0
 
Gareth GudgerCommented:
What about access to autodiscover via the web browser?
0
 
Keith AtkinsonNetwork AdministratorAuthor Commented:
I opened a case with M$ last night & worked until 2am (still no resolution). I have tried the ERCA which was inconclusive.  I did not try auto discover from the client's browser, as we experienced port connectivity issues telnetting to TCP 25, 135 & 587.  We ran several packet captures & sent data to the network team.  I have a scheduled callback @ 9am.  Please continue to offer suggestions until this matter is resolved.  Thanks!
0
 
Zacharia KurianAdministrator- Data Center & NetworkCommented:
Just a couple of  questions;

Have verified all the exchange DNS records in your AD? Have checked the event logs both in PDC and exchange for a clue? Did you try restarting IIS in your exchange?
0
 
Gareth GudgerCommented:
This almost doesn't even sound like an Exchange problem. But possibly a coincidence with a problem on the network. Maybe an issue with the MPLS network at your main site. If you do a continuous ping between sites, are you getting any packet loss?
0
 
Zacharia KurianAdministrator- Data Center & NetworkCommented:
Now sum up the issue;

remotely administer all DCs & User workstations at remote site is fine.
connectivity issues telnetting to TCP 25, 135 & 587 still persists.

Is the exchange box behind any FWs/UTMs etc..? can you give bit more details of your network?
0
 
Keith AtkinsonNetwork AdministratorAuthor Commented:
I have verified the DNS records.  I have restarted Exchange IIS, as well as uninstalled Rollup 14.

We have 0% packet loss while sending continuous pings from each MPLS Branch to the main site (IP, Nebios & FQDN)

We have an MPLS network which connects each branch  (no ACL with branch communication).  It routes our "core processor" packets to the Data Center (with an ACL), but routes internet packets to our firewall cluster at the main branch.
0
 
Zacharia KurianAdministrator- Data Center & NetworkCommented:
but routes internet packets to our firewall cluster at the main branch.

Just for a test purpose;

Do you have any mobile users, using active sync? can you check if they are able to send and receive emails?

What about your SSL?
0
 
Keith AtkinsonNetwork AdministratorAuthor Commented:
All exchange traffic from the internet works properly.  SSL & Activesync work with no problems routing into the network.
0
 
Zacharia KurianAdministrator- Data Center & NetworkCommented:
So it seems to be a kind of   Exchange firewall issues.  Have you tested the  connectivity between Exchange and Active Directory  using  PortQueryUI tool?
0
 
Keith AtkinsonNetwork AdministratorAuthor Commented:
Zacharia - No I have not.  Can you detail please?
0
 
Keith AtkinsonNetwork AdministratorAuthor Commented:
I used the port query tool & queried 25, 80, 135, 443 587 from 3 sites (main, branch1, branch2) to the Exchange Server.  From the main branch, all ports replied "listening".  From the branch1 & branch2, the ports replied "filtered".  I also open 3 ports on another Server in the main branch: 80, 135, 3389.  I queried those 3 ports from the main branch, all ports replied "listening".  I queried the same 3 ports from branch1 & branch2, all ports replied "filtered".  The test I just performed eliminates the MPLS issue.  I am now 100% certain it is on the Exchange Server.  Any thoughts?
0
 
Keith AtkinsonNetwork AdministratorAuthor Commented:
We finally resolved the issue after determining a manual route was missing from the Exchange Server which routed internal traffic to the MPLS Cloud & Internet Traffic thru the SRX Juniper Firewall.  I re-added the route & and made it persistent on the Exchange Server.  I will investigate the formal solution with the route problem.  Thanks for all who contributed.
0
 
Keith AtkinsonNetwork AdministratorAuthor Commented:
The hotfix installation required a reboot of the Servers, thus the manual route was deleted from the Exchange Server.  After thorough analysis & historic documentation, we re-added the route.
0

Featured Post

Easily manage email signatures in Office 365

Managing email signatures in Office 365 can be a challenging task if you don't have the right tool. CodeTwo Email Signatures for Office 365 will help you implement a unified email signature look, no matter what email client is used by users. Test it for free!

  • 9
  • 5
  • 4
Tackle projects and never again get stuck behind a technical roadblock.
Join Now