Start Free Trial

asked on

AutoDiscover or Outlook Anywhere in Coexixiting envornment with(Exchange 2010 and Exchange 2016)

All Virtual Directories in Exchange 2010 and Exchange 2016 has been configured with same name(mail.contoso.com)
Both Outlook Anywhere has been configued with same name(mail.contoso.com)
Exchange 2010 with Basic Authentication and Exchange 2016 with NTLM(SSL) client authentication for IIS both Basic and NTLM(2010 and 2016)
DNS has only one entry(mail)
SCP has been configured with same name on Exchange 2010 and Exchange 2016(https://mail.contoso.com/autodisocver/autodiscover.xml)

While DNS point to Exchange 2010, mailboxes on Exchange 2010 works fine without any issue,
While DNS point to Exchange 2016, Mailboxes(test) on Exchange 2016 works fine without any problem.

But Exchange 2016 is not proxying Traffic to Exchange 2010 while we forward traffic to Exchange 2016(mail point to Exchange 2016 IP)

Message while opening outlook: cannot start Microsoft outlook. cannot open the outlook window. the set of folders cannot be opened. The attempt to log on to Microsoft Exchange has failed.

Message while configuring outlook for logged in user: first asking for the credential then: outlook cannot log on. Verify you are connected to the network and are using the proper server and mailbox name.

Outlook 2016

We are working on this but not yet figured it out.

https://www.experts-exchange.com/questions/29017777/MS-Exchange-2010-to-2016-Migration-DNS-and-Outlook-Error.html?anchor=a42113514¬ificationFollowed=188288705&anchorAnswerId=42113514#a42113514

https://social.technet.microsoft.com/Forums/ie/en-US/36e89222-46ea-44ef-9aae-412b43d66e1b/exchange-2016-does-not-proxy-outlook-requests-to-exchange-2010?forum=Exch2016CM

http://windowstechpro.com/exchange-2010-to-exchange-2016-migration-part-7-moving-namespaces/

Please help.

Regards

can you run this script and post the results (redacted please for your privacy)

https://gallery.technet.microsoft.com/scriptcenter/Exchange-Virtual-Directory-93839d75

rename the script to get-virdirinfo.ps1

then run

. .\get-virdirinfo.ps1

Get-VirDirInfo –FilePath c:\temp

Open in new window

note above there is a space
dot space dot . .\

Also please run the test when forwarding to 2016

https://testconnectivity.microsoft.com

Run the test Outlook Autodiscover and Outlook Connectivity and post results redacted

(There is a link in top right corner to download HTML version - as that is best to post)

ASKER

Hello K B,

Attached please find the script result, i am not sure why the exchange version detail for 2016 is wrong:

Regards
Page1.JPG
Page2.JPG
Page3.JPG

What cu for each?

ASKER

Exchange 2010 Version 14.3(Build 123.4) and Exchange 2016 Version 15.1 Build 669.32

SOLUTION

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

Start Free Trial

Also can you provide:

Get-ExchangeServer | FT -a

Open in new window

I am rereading what you are saying.. you are saying MAILFLOW?

I apologize I thought this was client connectivity.

What happens when an email is sent? Does it end up in the Queue?

Internal email flow or external?

Can you describe in more detail please?

ASKER

Here is the connectivity and Autodiscover result...
connectivity1.JPG
connectivity2.JPG
Auto1.JPG
auto2.JPG

Even though that is client connectivity, those are a bit revealing actually

What is the NAT rules on the firewall?
Is there a load balancer involved or just DNS Round Robin
Can you telnet

telnet webmail.contoso.com 25

telnet webmail.contoso.com 443

telnet (whatever your MX records are) 25

ASKER

Here is the -a Result, While using outlook connectivity test its using MAPI/HTTP for wemail.domain.com
-.JPG

I think i need to better understand what is going on.

You are having connectivity issues and mailflow issues when you cutover to 2016.

Can you telnet internally to port 25 and 443?
In the Services Applet, did you disable the firewall service on the server? If so, re-enable it.

ASKER

Telnet is not working
telnet : The term 'telnet' is not recognized as the name of a cmdlet, function, script file, or operable program.
Check the spelling of the name, or if a path was included, verify that the path is correct and try again.

we are using Barracuda for External relay and there is no loadbancer for Exchange 2016 only DNS round Robin but for Exchange 2010 we are using NLB(windows)

if i send an email from current flow it will send but when i redirect to Exchange 2016 not because not yet add Exchange 2016 in SMTP still only two Exchange 2010 CAS servers are there.

External Emails are using barracuda for send/receive, on the top of Barracuda we have CISCO firewall. but the problem is with autodiscovery once this solved we can check farther.

pkgmgr /iu:"TelnetClient"

Open in new window

Wait 3-5 minutes and you will now have Telnet for checking in the inside.

So you want to first solve for autodiscover issue?

telnet to port 443 to autodiscover.contoso.com and webmail.contoso.com when pointed to 2016

telnet webmail.contoso.com 443

Open in new window

do this from an elevated cmd prompt

ASKER

Yes, if we first solve Autodiscover or outlook Anywhere to make me able to proxy outlook clients through Exchange 2016

ASKER

Here is the Telnet result
Telnet.JPG

For one EX 2016 and one EX 2010 mailboxes run these tests and post results (when autodiscover/webmail is pointed to 2016)

Post screenshots of Log tab of both tests please

User generated image

User generated image

ASKER

Here is the Screen shot,

I Tested outlook connectivity as shown please check the screen shot, then ran Set-OrganizationConfig -MapiHttpEnabled $false and changed the DNS entry(Forward trafic to Exchange 2016) closed the outlook and try to open received the message in attached image....

Test was first then changed the DNS
Test.png

I think you forgot to attach image?

ASKER

when DNS pointing to Exchange 2016 it wont allowing me to open outlook asking for credential when i enter the credential it gives me a message :cannot start Microsoft outlook. cannot open the outlook window. the set of folders cannot be opened. The attempt to log on to Microsoft Exchange has failed.

Please run tests in my most recent post (with screenshots

One mailbox that lives on 2016 and one that lives on 2010

ASKER

All Virtual directories and SCP are pointing to webmail (Exchange 2010 and Exchange 2016) and DNS webmail is pointing to Exchange 2010 then how to bring mailbox on 2016 live? or you want me to change the VDs

ASKER

if i forward traffic to Exchange 2016 then users on Exchange 2016 will give me the same result(https://webmail.domains.com/auto.../...xml) i tested it before.

You should only be pointing all vdirs (webmail and autodiscover) to 2010 OR 2016
Meaning the ip addresses. One or the other. Where are they pointed now?

Point ip addresses for webmail AND autodiscover to ex 2016 then test the outlook test with exchange 2010 mailbox username and password and post screenshots of LOG tab

ASKER

I have only one DNS entry webmail, currently webmail is pointing to Exchange 2010 and mailboxes are working fine.

but i cannot configure outlook for mailboxes on exchange 2016 because wenmail is pointing to exchange 2010 not 2016, so it mean i can test only mailboxes on 2010 not 2016. right?

I test Exchange 2010 now and Exchange 2016 a two hours ago the log result was the same while the traffic was forwarded to 2016.

Example
: when forward traffic to 2010 log result: https://webmail.domain.com/auto...
when forward to Exchange 2016 log result: https://webmail.domain.com/aut....

Regards

ASKER

Mean they are working fine individually but Exchange 2016 is not working as proxy for Exchange 2010 mailboxes.

no autodiscover record?

autodiscover.contoso.com ==>> IP ADDRESS OF ONE EX2016 CAS (MAILBOX)

Add a DNS entry - (A) record for autodiscover (make sure TTL is low as pictured) pointing to one CAS 2016 server (when webmail is pointed to CAS 2016 also)

User generated image

User generated image

Then please provide the exact detail of the LOG tab (you will have to scroll and then take several screenshots). I cannot help without that test.. and yes it is fine to just give me the Exchange 2010 mailbox test:

User generated image

ASKER

No we don't have Autodiscover recover everything is using only one record that is webmail.

Ok if i add autodiscover record and forward it to exchange 2016 then i may need to change SCP to https://autodiscover.domain.com/auto... right?
currently exchange 2016 SCP is https://webmail.domain.com/auto

Regard

No don't change scp. Outlook 2016 looks at all methods of auotodiscover at one time.

Set dns TTL to 1 minute for autodiscover.contoso.com

Then after that please run the test pictured above.

ASKER

Here is the both outlook test (Exchange 2010 and Exchange 2016)
Final.png

So with new DNS record what is the outlook error?

Set up a new outlook profile?

ASKER

That is only DNS record Exchange don't know that as autodiscover until not make any changes to SCP, because SCP is set to webmail, as you said above(Add a DNS entry - (A) record for autodiscover (make sure TTL is low as pictured) pointing to one CAS 2016 server (when webmail is pointed to CAS 2016 also))

when i forward webmail to exchange 2016 it will work for exchange 2016 but the problem is that exchange 2016 is not forwarding 2010 request...

ASKER

Do you think if i separate virtual directories and forward their traffic to webmail and change SCP to Autodiscover only will help??

Regards

no. The reason i suggested autodiscover record is that Outlook 2016 checks in that location regardless of SCP record.. and I couldn't tell if your SCP record was working until your most recent post

ASKER

So what do you think, what could be the reason, any authentication issue?///

ASKER CERTIFIED SOLUTION

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

Start Free Trial

please provide:

Get-ClientAccessArray | fl

Open in new window

ASKER

Yes, first it opened owa on exchange 2016 format but when i entered the user name and password it proxy it to old OWA exchange 2010. but when i open outlook it gives me attached message asking for credential when add it give me that message in attached screen shot
Outlook-Error.JPG
outlook-error1.JPG
Arry.JPG

ASKER

I Ran the command from Exchange 2010 it shows me both Exchange 2010 and Exchange 2106 in Members portion, but while i ran the same command from Exchange 2016 it showing me only Exchange 2010s.
Arry-from-Exchange-2010.JPG

Your cas array is the same name as your other services.

#4 talks about this in Brian Day's article https://blogs.technet.microsoft.com/exchange/2012/03/28/demystifying-the-cas-array-object-part-2/

Then Brian Day himself speaks about it here: https://social.technet.microsoft.com/Forums/exchange/en-US/c7530310-0cd1-41b8-8b2e-fcd003eb6ca3/exchange-2010-and-exchange-2013-coexisting-ssl-problem?forum=exchangesvrgeneral

I am not sure how to rectify this.

Is every port open between all Exchange servers and all domain controllers?

ASKER

yes, nothing is blocked even the firewall is turned off on all exchanges and DCs, and its working fine individually but the only problem is with proxy.

The virtual directories are properly setup for Exchange 2010. The only thing that is out of the norm is Outlook Anywhere ExternalClientAuthenticationMethod & InternalClientAuthenticationMethod should be $null but I don't think that is your problem

I would try to add the A Record for autodiscover.contoso.com and change the SCP to https://autodiscover.contoso.com/Autodiscover/Autodiscover.xml

again make sure the TTL is 1 minute in case you need to change something later.

please run this powershell:

Get-MailboxDatabase | ft name,rpcclientaccessserver -a

Open in new window

So if you point IP to Exchange 2016

Can you create a brand new profile in Outlook for Exchange 2010 mailbox?

ASKER

I am out of office right now,will perform above and will update you accordingly...
Regards

ASKER

No I can't create new prifile, I tired that twice today while forwarded the traffic to ex 2016, it stucked on Searching for mailbox and keep asking for credential

ASKER

Get-MailboxDatabase | ft name,rpc

I tried this today on both and the result was the same for each database:
Webmail.domian.com/rpc

There won't be a slash in it
please post results.

One would typically find issues if the name matched external DNS for external clients. So I'm puzzled why this is happening. Interested to hear the results from several items above.

When you run

NSLOOKUP WEBMAIL.CONTOSO.COM

what do you get?

Please try this:

CAS2010 - OA Client authentication: Basic / OA IIS authentication: Must include NTLM

Get-OutlookAnywhere -Server <server> | Set-OutlookAnywhere -ExternalClientAuthenticationMethod Basic -InternalClientAuthenticationMethod Basic -IISAuthenticationMethods NTLM

CAS2013 - OA Client authentication: Basic / OA IIS authentication: Basic

Get-OutlookAnywhere -Server <server> | Set-OutlookAnywhere -ExternalClientAuthenticationMethod Basic -InternalClientAuthenticationMethod Basic -IISAuthenticationMethods Basic

source: http://www.expta.com/2014/01/exchange-2013-client-access-coexistence_28.html

ASKER

Hello K B,

Attached please find all the requested commands result,

but changing authentication on Exchange 2010 Cas will it affect current connected user on CAS2010? if yes we may need a maintenance window.

REgards
RPCExchange2010.JPG
Nslookup.JPG
RPCExchange2016.JPG
RPC-with--a-Exchange-2016.JPG
RPC-with--a-Exchange-2010.JPG

Always you should have a maintenance window.

Is the IP address from the NSLOOKUP a private/internal IP Address or Public IP Address?

Do your workstations DNS all point to Domain Controllers and not public DNS like 8.8.8.8?

There should be no public dns in your network

ASKER

They are private/internal IP addresses, both pointing to Internal DNS not 8.8.8.8 or public.

Regards

ASKER

Hello K B,

This problem confused me, and forgot to tell you that i already enabled NTLM on both Cas2010 servers please check the screen shot.

Regards
NTLMcheck.JPG

That does not show everything in the command I provided:

Get-OutlookAnywhere | select ExternalClientAuthenticationMethod,InternalClientAuthenticationMethod,IISAuthenticationMethods[/code]

ASKER

here is the result of this command.
newcommandNTLM.JPG

Please take [/code] out

ASKER

Here is the new result
NTLM2.JPG

So I would recommend running the script as there are missing values

ASKER

Which Script?

Regards

CAS2010 - OA Client authentication: Basic / OA IIS authentication: Must include NTLM

Get-OutlookAnywhere -Server <server> | Set-OutlookAnywhere -ExternalClientAuthenticationMethod Basic -InternalClientAuthenticationMethod Basic -IISAuthenticationMethods NTLM

Open in new window

CAS2013 - OA Client authentication: Basic / OA IIS authentication: Basic

Get-OutlookAnywhere -Server <server> | Set-OutlookAnywhere -ExternalClientAuthenticationMethod Basic -InternalClientAuthenticationMethod Basic -IISAuthenticationMethods Basic

Open in new window

source: http://www.expta.com/2014/01/exchange-2013-client-access-coexistence_28.html

ASKER

I have this result on Exchange 2016
NTLM_Exchange2016.JPG

you need to specify the servers. Just because you run the command on a server does not mean it will only give you that server

so when you run this command specify one at a time the exchange 2010 CAS servers (there are ways to circumvent this but this is easiest for this circumstance)

Get-OutlookAnywhere -Server ExchangeCAS2010Server01 | Set-OutlookAnywhere -ExternalClientAuthenticationMethod Basic -InternalClientAuthenticationMethod Basic -IISAuthenticationMethods NTLM

Get-OutlookAnywhere -Server ExchangeCAS2010Server02 | Set-OutlookAnywhere -ExternalClientAuthenticationMethod Basic -InternalClientAuthenticationMethod Basic -IISAuthenticationMethods NTLM

then do the same for the Exchange 2016 servers

Get-OutlookAnywhere -Server ExchangeMBX2016Server01| Set-OutlookAnywhere -ExternalClientAuthenticationMethod Basic -InternalClientAuthenticationMethod Basic -IISAuthenticationMethods Basic

Get-OutlookAnywhere -Server ExchangeMBX2016Server02| Set-OutlookAnywhere -ExternalClientAuthenticationMethod Basic -InternalClientAuthenticationMethod Basic -IISAuthenticationMethods Basic

make sense?

Run this connectivity tool, might help you to give some point: https://testconnectivity.microsoft.com/

Also get help from below links:

Client Connectivity in an Exchange 2016 Coexistence Environment with Exchange 2010: https://blogs.technet.microsoft.com/exchange/2015/10/26/client-connectivity-in-an-exchange-2016-coexistence-environment-with-exchange-2010/

Installing Exchange Server 2016 in co-existence with Exchange 2010: https://www.frenchitguy.com/installing-exchange-server-2016-in-co-existence-with-exchange-2010/

Hope this helps!

ASKER

K B

I made those changes last night and switch the traffic back to Exchange 2016 but no luck and same result, please check the screen shot.

note i just added Basic back to IIS for Exchange 2010(first two are Exchange 2010 and second two Exchange 2016.

Ajit we try all these testing and configuration is the same...

Regards
NTLM_Changes.JPG

Do you currently allow Outlook anywhere access from the outside?

Please provide:

Get-ExchangeServer | FT ServerRole, Edition, AdminDisplayVersion

Open in new window

When you provided this image.. where was webmail.contoso.com pointing?

User generated image

ASKER

Please have the result in attached image.

That time pointing to Exchange 2010.

Regards
Exchange-Versions.JPG

you are 17 Updates behind. Please patch Exchange 2010..

https://technet.microsoft.com/en-us/library/hh135098(v=exchg.150).aspx#Exchange Server 2010

Also, where are the Exchange 2016 servers with the same command please.

Let me know when all Exchange Servers have either latest Patch or N-1 version. Until then you are running in an unsupported configuration.

ASKER

Please check the attached files
Exchange10-and-Exchange16.JPG

2016 is fine but you must patch all of your Exchange 2010 servers.

ASKER

Ok then let me try that too. Do you think it will be OK to patch exchange 2010 in current coexisting environment? just want to make sure.

Regards

yes as there is nothing "coexisting" no mailboxes

ASKER

Ok, then i will update the exchange 2010 nodes and will update this post once i done.

Thank you for your help.

Regards

If you have a DAG: https://practical365.com/exchange-server/how-to-install-updates-on-exchange-server-2010-database-availability-groups/

ASKER

All Exchange server has been updated,
while i am trying to configuring new profile its asking for credential, i entered the credentials and configured. but when i tried to open the outlook after the configuration and the one was already configured gives me the error or messages please check screen shots...

Exchange 2010 IIS is NTLM and Exchange 2016 is Basic as instructed,
111111.JPG
22222.JPG

Is there any update?

ASKER

Still working on it... not yet confirmed the solution