Need Help In Setting Up AutoDiscover For Microsoft ActiveSync In Multi-Domain Environment

You can reference this question for background on what I am asking here.

We have an old domain and a new one.
olddomain.local
newdomain.local

Both domains have Exchange 2010 SP3

Email on the public side goes through owa.domain.com to olddomain.local and then internal relays to any migrated users on the newdomain.local exchange server.

I have all mail flow working fine for everyone EXCEPT this:
Users migrated to the newdomain.local exhange server can't set up their email on smartphones via Microsoft ActiveSync. The AutoDiscover query for autodiscover.domain.com resolves via public DNS/NAT to the olddomain.local exchange server.

Even though the olddomain.local server/domain is going away, we will need simultaneous communication for both servers.

We can't migrate everyone at once due to some other projects so we can only move groups of people at a time.

My thoughts are to direct the IP address of autodiscover.domain.com to the address of newdomain.local's exchange server so the new users can authenticate their phones.

Question: Will doing that cause all existing configurations of smartphones in olddomain.local to stop working or is autodiscover only used for initial setup and once they're set up, the connection will remain?

Am I overthinking this? Is there an easier way to get both domains autodiscovered?
LVL 5
Paul WagnerFriend To Robots and RocksAsked:
Who is Participating?
 
Berkson WeinTech FreelancerCommented:
Hello again...

My thoughts are to direct the IP address of autodiscover.domain.com to the address of newdomain.local's exchange server so the new users can authenticate their phones.

Question: Will doing that cause all existing configurations of smartphones in olddomain.local to stop working or is autodiscover only used for initial setup and once they're set up, the connection will remain?

It is possible (likely IMO) that existing phones (windows, android, ios) and any remote Outlook installations (rpc over http) will update their settings after you make this change, pointing to the new server and causing a problem.  

You have a couple of options as I see it:
1) Have the new or migrated users manually configure their phones.  Don't use autodiscover.  Enter in the server name, email address (UPN really, could be domain\username instead), and password.

2) The other way around, new and migrated use autodiscover, old will likely have to enter the old server name

3) Depending on the size of your userbase, migrate the remaining folks right away?

4) Use a different UPN for new users, maybe something like user@newsrv.domain.com.  set the default address as just user@domain.com, but the address specified at setup would be the @newsrv one.  Then it'll look to autodiscover.newsrv.domain.com.  You'll need that in the SAN too.  I haven't thought this out completely, but it's my least favorite option.  Too messy.
0
 
Paul WagnerFriend To Robots and RocksAuthor Commented:
1. I have tested a couple of migrated users in two different android apps. They won't connect to the server since they use activesync and probably depend on the right autodiscover file being there. Even when I manually enter the credentials, it doesn't work. The OWA site works, though.

2.  We will probably have the reverse of #1 above.

3. ?? You mean move everyone at once? I WISH!! Ran that by the "suits and ties" and since we have a lot of other things happening, they want to piece it out by divisions at a time.

4. Way too much happening there. I'm trying to do it as clean as possible and have it clean even after the migration.

There's no way to split the autodiscover.domain.com based on user account is there?
0
 
Berkson WeinTech FreelancerCommented:
Domain joined computers let you use a GPO to have different autodiscover settings by user, but I don't know of any way to have phones use different autodiscover settings based on the user.  I'll go so far to say that I'm (almost) absolutely certain that's there's no way.

Autodiscover's nice when it fits what you need, but it's not required.  I don't understand why you wouldn't be able to use oldmailserver.domain.org or newmailserver.domain.org as the server name (provided that each is in the appropriate certificate).  What's the error?

Have you tried the https://testconnectivity.microsoft.com/ test for Exchange Activesync, not the autodiscover one, just the one where you enter server name and credentials?  If that works, so should a phone.
0
On-Demand: Securing Your Wi-Fi for Summer Travel

Traveling this summer?Check out our on-demand webinar to learn about the importance of Wi-Fi security and 3 easy measures you can start taking immediately to protect your private data while using public Wi-Fi. Follow us today to learn more!

 
Paul WagnerFriend To Robots and RocksAuthor Commented:
I tried testconnectivity and it works. Not every app works like that, though.

It seems the default android email app forces the use of autodiscover. activesync sets up the account but it isn't ever loading the inbox, or allowing messages to be sent. The "thinking" wheel just spins forever.
0
 
Berkson WeinTech FreelancerCommented:
Don't know which Android phone / rom you're using, but any that I've ever tried including those from Samsung, HTC, and a myriad of custom roms allows you to enter settings manually.  usually there's a button at the bottom when you enter the username and password that lets you do manual.  

What if you enter incorrect everything, including the server name, something that doesn't even resolve?  I'd think at least then that you'd be able to go back in and specify the correct settings.
0
 
Paul WagnerFriend To Robots and RocksAuthor Commented:
It let's me enter the server name manually, but the account still doesn't work right. (Tested on a few migrated accounts). The inbox never finishes spinning. iPhone set up fine without a problem.  [Scratches head]
0
 
Berkson WeinTech FreelancerCommented:
It's not for me, but would MS's new Outlook app for Android (re-branded acompli) be an option for a bit?

Any errors on the exchange server?  Does the device show up in the user profile?

Do new test accounts on the new server work?  Wondering if there might be some funky setting that migrated over that's stopping activesync from working right.
0
 
Paul WagnerFriend To Robots and RocksAuthor Commented:
... I don't know why, but migrated accounts started working on Android...
Was only doing information gathering.
Device is showing up in the mailbox
Not sure what happened...

So it seems the migrated users can configure their devices manually and then all will be good in the hood.
0
 
Berkson WeinTech FreelancerCommented:
Maybe something hadn't replicated through AD yet or something.  Glad it's working for you now.  Hopefully we were all of some help.
0
 
Paul WagnerFriend To Robots and RocksAuthor Commented:
Great help as always @weinberk. Thanks!
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.