Solved

Exchange 2013 - Accidentally installed Client Access role on new Mailbox server - users get certificate pop-ups

Posted on 2016-11-17
10
81 Views
Last Modified: 2016-11-17
Installing a new mailbox server but accidentally installed Client Access Role too. As soon as the installation neared completion users started getting certificate errors from the new server.

1. Don't understand how this can be. We point all our clients to a load balancer which points to our existing CAS servers so I don't understand how outlook clients can see this new one.

2. Server is offline now because of the problems its caused. How do I remove the CAS role from it? I assume I need to be online to do this properly (so it can access AD)? Will need to do out of hours I guess.
0
Comment
Question by:paulfoel
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 5
  • 3
  • 2
10 Comments
 
LVL 7

Expert Comment

by:Andy
ID: 41891264
Hi,

I'm assuming this isn't your only mailbox server as it's offline so you would need to remove all roles then reinstall the mailbox role only.
(The uninstall unfortunately doesn't support single role removal.)
Before removing, ensure any mailboxes are moved to another mailbox server meaning you can do this in hours (although always best to work out of hours for nay major exchange work)
Also, ensure the other mailbox server(s) has/have enough storage.
0
 
LVL 1

Author Comment

by:paulfoel
ID: 41891266
Thanks Andy. Assume its advisable for the server to be back on the network for when I do the uninstall so that it clears out of AD properly?

Still don't understand why the clients saw it as a CAS server though when they'd pointed to a loadbalancer?
0
 
LVL 7

Accepted Solution

by:
Andy earned 500 total points
ID: 41891272
Yeah that would be a good idea to clean up AD.

No, unless it adds itself to the autodiscover.
0
PeopleSoft Has Never Been Easier

PeopleSoft Adoption Made Smooth & Simple!

On-The-Job Training Is made Intuitive & Easy With WalkMe's On-Screen Guidance Tool.  Claim Your Free WalkMe Account Now

 
LVL 16

Expert Comment

by:Ivan
ID: 41891283
Hi,

since you have installed CAS role, then you should reconfigure or disable AutoDiscoverService on it.
From Exchange Shell type:
[PS] C:\>Get-ClientAccessServer <server name that you just installed> | fl to see autodiscoverserviceinternaluri
If it is not pointing to location where all other are pointing, then you can quickly disable it, so that users don't get certificate errors.
To do that:
Set-ClientAccessServer -Identity “<new_server_name>” -AutoDiscoverServiceInternalUri $NULL

If you want to reconfigure it, then use:
[PS] C:\>Get-clientaccessserver <server name that you just installed> | set-clientaccessserver -autodiscoverserviceinternaluri "https://servername.domain.com/autodiscover/autodiscover.xml"

PS: When you install CAS, it will store autodiscoverserviceuri into AD, and that is why all users can see it.

Regards,
Ivan.
0
 
LVL 1

Author Comment

by:paulfoel
ID: 41891323
Thanks all. Looks like even offline it caused problems because I guess it had inserted itself into AD.

So Ive not added it back onto network and uninstalled. This should fix?

Build document will be updated! Need to ensure CAS is not selected - would suggest Microsoft put a warning here that the addition of CAS server will cause a problem maybe.
0
 
LVL 7

Expert Comment

by:Andy
ID: 41891328
some people love a multi role server (especially cost wise), personally I agree it's not a great idea, extra planning is needed for that scenario.
That should be fine.
0
 
LVL 1

Author Comment

by:paulfoel
ID: 41891339
Only problem is users are still getting pop-ups relating to certificates on the new server and if I run test email configuration on my outlook its still finding the new server. Or is it just a case of waiting for propagation etc?
0
 
LVL 16

Expert Comment

by:Ivan
ID: 41891361
Hi, as I wrote:

type command bellow on any exchange server, to see autodiscoverserviceinternaluri settings on that new server
Get-ClientAccessServer <server name that you just installed> | fl

Or type directly this command to disable autodiscoverserviceuri on new server:
Set-ClientAccessServer -Identity “<new_server_name>” -AutoDiscoverServiceInternalUri $NULL
After that, you can simple turn that server on, and do what you intended to do.

Regards,
Ivan.
0
 
LVL 1

Author Comment

by:paulfoel
ID: 41891388
Did that Ivan. Also completely uninstalled exchange on that new server so its gone in console and in AD.

Still looks like some users are getting errors. propagation?
0
 
LVL 1

Author Closing Comment

by:paulfoel
ID: 41891580
Excellent advice given. Saved my bacon,.,
0

Featured Post

Free learning courses: Active Directory Deep Dive

Get a firm grasp on your IT environment when you learn Active Directory best practices with Veeam! Watch all, or choose any amount, of this three-part webinar series to improve your skills. From the basics to virtualization and backup, we got you covered.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
Exchange 2016 - How to setup a Catch All account to receive *@domain.com 2 36
Hosted Exchage 3 22
exchange 2007, exchange 2010, exchange 2013 9 25
office 365 5 23
What does UTC stand for?  “Coordinated Universal Time” – Think of this as the true time on Planet Earth that never changes with the exception of minor leap seconds here and there to account for the changes in the planet's rotation.   What does th…
A list of top three free exchange EDB viewers that helps the user to extract a mailbox from an unmounted .edb file and get a clear preview of all emails & other items with just a single click on mailboxes.
In this video we show how to create an Address List in Exchange 2013. We show this process by using the Exchange Admin Center. Log into Exchange Admin Center.: First we need to log into the Exchange Admin Center. Navigate to the Organization >> Ad…
In this video we show how to create an Accepted Domain in Exchange 2013. We show this process by using the Exchange Admin Center. Log into Exchange Admin Center.: First we need to log into the Exchange Admin Center. Navigate to the Mail Flow >> Ac…

730 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question