Configuring Outlook Anywhere for Exchange 2007 SP1
This post has been moved to
http://www.exchange-genie.com/2008/02/configuring-outlook-anywhere-for-exchange-2007-sp1/
This blog is dedicated to posting information about Microsoft Exchange Server
This post has been moved to
http://www.exchange-genie.com/2008/02/configuring-outlook-anywhere-for-exchange-2007-sp1/
Posted by
Exchange_Genie
at
11:07 PM
Labels: exchange 2007, exchange 2007 Service Pack 1, Outlook Anywhere, rpc over https, rpc proxy, rpc/https
60 comments:
hi Brian,
i discovered your blog 2 days ago and i have to say; it is now the first stop if i need to research anything on exchange 2007.
quick question about the first step: in my case we have a clustered mbx; would i install the rpc protocol on both nodes and the cas server as well?
thanks for your help
ignazio
hi Brian,
i discovered your blog two days ago and now i make it my first stop for e2k7 problems.
i have a quick question for you: in my environment we have a clusterd mbx role with two nodes. do i need to install the rpc component on both nodes?
thanks again for your help.
Ignazio,
I am assuming you are refering to an NLB cluster for your CAS servers. In that case I would say yes since both nodes will distrubte the inbound load and it will also provide you redundancy if a node is stopped from the NLB or goes down.
I am glad my blog has been of assistence to you. If there are any topics you would like to see p lease let me know.
Ignazio, I just saw your first comment... you do not install the rpc proxy on the mailbox servers only on the CAS servers. when the functionality is enable with OL Anywhere the mbx will listen on port 6001,6002,and 6004 and the CAS will put those ports wtih the mbx server names in the registry for you.
The only way you would put it on the mbx server is if you have an all in one box with CAS,mbx combined in a single server scenario.
I have been through this thoroughly and still cannot get past the initial password prompt when setting up a new outlook profile externally, internally all is good, the exchange 2007 server is not a dc as we use sbs but the cert is a real wilcard from digicert, autodiscover works fine but cannot login without VPN, I've cheched everything a million times but still cannot get past the password until I connect via VPN, then it works and on server 2008 as a client I can get it working through https once the mailbox is cached.
My tests, on XP with Outlook 2007 I get the password prompt, on Vista with Outlook 2007 I also get the password prompt, windows 2008 with Outlook 2007 will work after the initial VPN setup.
Autodiscover tests succeed, Test-Outlook from EWS is all good, do I need to do some configuring of the RPC ports to connect to my dc, on 2008 I can see all the connections test during your netstat tests. I do get an error about the cert not matching the site from time to time on the clients that are not on 2008 but its a wildcard and they are supposed to work!
julian,
post your email address, I wont publish it and I can email you offline.
Julian,
Also please reference my autodiscover article
http://exchange-genie.blogspot.com/2007/07/autodiscover-ad-attribute.html
This is a very great post. I made some headway on my Windows 2008/Exchange 2007 setup for the CASE side of things.
Only problem I have is when I try to setup the RPC/HTTPS profile, I keep getting the login popup box and my credentials don't work.
The popup most of the time is from certifiate problems are you using a wildcard cert or a private cert?
I have have Outlook Anywhere and Autodiscover working. However, when I look at connection status he mail lines corrrectly show HTTP but the directory lines always show TCP rather than HTTP and will not connect when out of the domain. Outlook still seems to work fine except you cannot save new appointments.utlook anywhere and autodiscover working. However, when I look at connection status while the mail lines corrrectly show HTTP the directory lines always show TCP and will not connect when out of the domain. Outlook still seems to work fine except you cannot save new appointments. Any ideas?
Im using a cert issued by comodo which has a specific name set but not a wildcard...
Also when I run the Test-OutlookWebServices I get some Successes but 401 Unauthorized errors as well.
mkraftman,
interesting, never seen it split tcp and http..... do have have both boxes checked to always use http first?
Yes, I have both boxes ticked. One clue - I have noticed that when inside the domain network the Directory connections over TCP/IP are to my two domain controllers, not the Exchange server (which is not a domain controller). When outside the domain, the failed attempts are to the Exchnage server.
Yes, I have both boxes ticked. One clue - I have noticed that when inside the domain network the Directory connections over TCP/IP are to my two domain controllers, not the Exchange server (which is not a domain controller). When outside the domain, the failed attempts are to the Exchnage server.
What server OS are you running? Also please test with rpcping, I bet you are failing on port 6004 to connect to the directory.
when its going tcp/ip the client is going direct to DC however when using rpc proxy , you hit the CAS via 443 -> mbx which on your behalf connects to dc/gc
hi Brian,
quick question;
when outside the lan the only thing that does not work is the "out of office assistant"; everything else works like a charm.
thanks for your help.
out of office usees web services, validate when you run a test from the OL client the proper url is being returned to Outlook
I am using Windows Server 2008 x64. It turned out to be a bug with IPv6. See the solution at http://blog.aaronmarks.com/?p=65 .
I disabled IPv6 on my LAN card network connection and added the FQDN of the server to my HOSTS file and it worked without the need to change the registry settings as described in this link. All connections are now made over HTTPS.
glad you resolved it, I figured thats what you where hitting which is why I ask about the OS version. I believe I have a note in this article about an IPv6 issue which causes the directory 6004 to have issues.
However MS still does not have an official kb on this yet :(
Brian. GREAT post. I need a bit of clarification though on one of your replies. We too are having problems getting out of office assistant to launch when using OA. What do you mean when you say "out of office uses web services, validate when you run a test from the OL client the proper url is being returned to Outlook."
How do I validate? What test am I running? What am I looking for?
Brian. GREAT post. I need a bit of clarification though on one of your replies. We too are having problems getting out of office assistant to launch when using OA. What do you mean when you say "out of office uses web services, validate when you run a test from the OL client the proper url is being returned to Outlook."
How do I validate? What test am I running? What am I looking for?
OL 2007 makes calles to the url you have configured https://yyy/EWS/Exchange.asmx you can open a web browser and attempt to logon to that url, you should get an xml return.
You can also look in the post how I demo testing using OL to get the urls attempted.
If Out of Office is not coming up there is either an authentication problem or misconfiguration.
i had a cert hostname error, so i used this link http://www.shudnow.net/2007/08/10/outlook-2007-certificate-error/
to fix that problem. basically pointing all my autodiscover addresses to a different auth point. is the reason my autodiscover will not work with rpc over http? i get auth errors when trying to login via rpc, the rpc connection seems fine as i tested the connection. just authentication is my problem...thanks for any help
can you provide me more info about your configuration
Our Configuration:
CAS,MB, and HT all on one box, fresh installation of Exchange 2007 on a windows 2003 R2 box.
the internal address is mail1.sea.lcl
the external address is owa.sea.org
all the SSL certifications are set to owa.sea.org
i have reconfigured all directories to auth through owa.sea.org
using the commands that i posted in the link of my prior post.
Thanks for any help, any additional information, please let me know
when trying to login via RPC ver HTTP, i get auth errors, tried both owa.sea.org and mail.sea.lcl as the internal address.
hello Brian
i have done all the configuration according to your instructions but unfertunatly when i trying to connect from out side its always geting "the connection to microsoft exchange server unavailable outlook must be online or connected to complete this action"
then i did the check via LAN and when i am trying to login via LAN its always connecting TCP/IP not the HTTPS
please help
Susika
Hello Brian
i have done all configuration according to your instructions but when i am tryng log from out side its always geting error "the connection to microsoft exchange is unavailable outlook must be online or connected to complete this action"
then tried via LAN also biut via LAN its connevct though tcp/ip
need your help
Susika
Susika,
This could be any number of items, are you using a public cert or private?
Are you using Windows 2003 or Windoows 2008?
Did you test rpc ping from the outside?
firewall blockage?
I have a quick question about outlook anywhere. I ran through your article and configured everything as required. I am able to connect internally but unable to connect externally. Do I need to open any ports in my firewall to let externally connections into my exchange server. Let me know what you think
Hi Brian, Im hoping you may have some more sage advice with this issues. Ive tried everything you suggest in your blogs that i have found with no success. Here is what i've been posting around the internet hoping i might get some help.
Hi Everyone.
So, I am in the process of creating an exchange 2007 server for our company. I have everything working internally and OWA works fine externally. The problem is I cannot configure Outlook externally to connect to the exchange server VIA RPC over HTTPS. When external, i get 'server cannot be resolved' error messages after it prompts me for user name and password multiple times. I can access all the websites (autodiscover.xml, ews etc.) externally through IE after entering a valid user name and password but cannot access the /rpc website (it just keeps asking for credentials). My set up is a little something like this:
- PDC, global catalogue server
- exchange server joined to the domain as a member server
- i purchased an SSL certificate for exchange.myextdomain.com
- i have changed all of the virtual directories to use exchange.myextdomain.com\therest
when i run a 'test-outlookwebservices | fl' from EMC i get the following returned:
Id : 1003
Type : Information
Message : About to test AutoDiscover with the e-mail address admin@myextdomain.com.
Id : 1007
Type : Information
Message : Testing server myserver.myintdomain.local with the published name https://exchange.myextdomain.com/EWS/Exchange.asmx & .
Id : 1019
Type : Information
Message : Found a valid AutoDiscover service connection point. The AutoDiscover URL on this object is https://exchange.myextdomain.com/Autodiscover/Autodiscover.xml.
Id : 1013
Type : Error
Message : When contacting https://exchange.myextdomain.com/Autodiscover/Autodiscover.xml received the error The remote server returned an error: (401) Unauthorized.
Id : 1006
Type : Error
Message : The Autodiscover service could not be contacted.
yet i can log into the autodiscover web site fine internally and externally using https://exchange.myextdomain.com/Autodiscover/Autodiscover.xml
In IIS, i have only 'basic' and 'windows integrated' authentication for all of these web services. the certificate works perfectly for OWA, i have an A record setup in DNS for autodiscover and have also tried a CNAME for autodiscover .
Can anyone see where i am going wrong here, this is driving me insane i tells ya.
Thanks a lot for any help
Colin
colin shoot me an email so we can chat offline
the only port that is required is 443 to the CAS server, there is a known issue with W2k8 and ipv6 that will cause issues as well as certificates. Are you using a private or public cert?
I am believe that I am using a private key that was generated by exchange on the install. I have port 443 open and I can get through with the owa in IE. Another question, do I need to have the Certifcate Services on my server running for it to work? Could that possibly be causing me problems.
I go through OWA on my laptop and accept the Cert through there and install it on my machine, but when I am internal and connect through using outlook anywhere I login and then I get a prompt for the cert even after I install it there. When I do the same test internally with my lap top I do the same thing but the don't get the prompt for the for the cert. But, I am still not able to connect externally
Heylo Brian, I hope that you can help me with a setup of Outlook via HTTP.
I have a single server running Windows Server 2008 SP1 and Exchange Server 2007. I have gotten local Exchange via Outlook as well as OWA working quite well.
One of our users has a laptop so I have been trying to get Outlook via HTTP working for him with no success. The problem seems to be with the security certificate. The error message when trying to use Outlook is as follows:
------------------
There is a problem with the proxy server's security certificate. The name on the security certificate is invalid or does not match the ame of the name of the target site xx.xx.xx.xx.
Outlook is unable to connect to the proxy server. (Error Code 10)
------------------
I am new to certificates, but as far as I can tell I have named it as the IP address of the server.
I have installed the certificate on the laptop using the instructions detailed on this page: http://blogs.technet.com/sbs/archive/2008/05/08/installing-a-self-signed-certificate-as-a-trusted-root-ca-in-windows-vista.aspx
Do you have any suggestions for me?
Thank you in advance!
Love and Light,
Kristoff
Hi Brian,
Thank you for the write up...I just despise the boring
Hi Brian,
Thank you for the post; so much better than those boring MS technet-type posts. :)
I wonder how I can get a bit of assistance with getting this to work as it should. I ran the "Test Email Autoconfig" from the sys tray and that seems ok, but when I do the RpcPing test, I get the "Error 12175 returned in the WinHttpSendRequest" error or if I try to change things in the cmd line here and there I get the "Response from server received: 401 Client is not authorized to ping RPC proxy" or "Exception 1722 (0x000006BA) RPC Server is unavailable" errors. I haven't yet tried to connect my Outlook from home yet...just wanted to make sure I have everything working locally (at work) first...all my "t's crossed and i's dotted". :) I have 2K7 SP1 and Outlook 2K7.
Thanks!
Shane
Hey Brian,
Amazing article, very well written. I am having very little luck lately getting my outlook anywhere to work which is how I discovered you in the first place =). I just recently had to reinstall the CAS roles into exchange and in doing so I had to run some commands in the MES to remove some virtual directories. I noticed when I started your tutorial that rpc had already been installed, but i figured i'd start from scratch and do it anyways. At one point, when I went to run my command to enable outlook anywhere from the shell, i was told that the rpc virtual directory already existed. So, I went and deleted it. As a moron, and a noob to exchange, I then realized its not super easy to recreate. Which leaves me where I am now. Outlook anywhere is fully configured and I'm at the point now where I'm just trying to test it using rpcping..but I'm getting this error: Exception 1722 (0x000006BA)
RPC Server is unavailable
Is this because my idiocracy removed that RPC virtual directory? Is there any way to get it back? I figured disabling and re-enabling outlook anywhere from MEC would recreate that vd if necessary. Apparently I'm wrong :/
Thanks again!
no a problem, I would start by uninstalling rpc proxy service from the server depending on 2003 or 2008 the steps are a bit different.
disable OLA and the reinstall rpc proxy and enable OLA.
That should get you on the right track.
fantastic. that did the trick, disabling outlookanywhere, uninstalling rpc proxy from appwiz.cpl and reinstalling it, then re-enabling outlookanywhere again. I'm able to test it using rpcping and everything, this is great and i do appreciate your help and tutorial!
glad you got it fixed up
Hi Brian,
Great BLOG as usual.
We are using ISA 2006 in front of our Exchange System and have Outlook Anywhere working from outside of our company using help from - http://www.isaserver.org/tutorials/Publishing-Exchange-2007-OWA-Exchange-ActiveSync-RPCHTTP-2006-ISA-Firewall-Part6.html
But when we connect over the LAN we get prompted for a username and password.
This is in a lab environment so it isn't impacting our production.
Any ideas why it is prompting us?
John.
I would need to know more about your configuration but sounds like you have NTLM setup on the outside and basic on the CAS.
Internal you are hitting the CAS direct?
Set both NTLM and Basic on the CAS with the set-outlookanywhere command
I am having similar issues to some of your other posters but cannot see a clear answer. I cannot successfully create a new Outlook profile using RPC over HTTPS. If I create the profile using VPN and make the initial connection, it works fine after that without the VPN. We are running Exchange 2007 on a single box with DC on there as well. Any help would be appreciated.
have you gone through the rpc ping tests in the blog to validate everything?
Are you running Windows 2008 or 2003?
What rollup are you running?
Have you added autodiscover.domainname.com to your external DNS pointing to your email server.
Nice blog, I have a question...
When logging into outlook users have to authenticate as domain\username. (not in OWA I found the setting to force a default domain there)
Is there any way to set this so by default they all use the default domain in outlook and only have to type their usernames?
Thanks.
I got the exception 1722 error message when running rpcping to port 6004. I reinstalled the rpcproxy, but that didn't help. The registry settings were wrong and the hosts file needed to be modified because of the ipv6 issue and loopback still being used.
Thanks for the help.
madengineer.blogspot.com
have you tried disabling OLA and enabling it....
Awesome Blog...I hope you can help me out. I have a 2008 Server running Exchange 2007 Sp1. I can't seem to get Outlook Anywhere up and running. Everything else on the server is running great. I can get all the way to the authentication part and it just tells me the server is unavailable. Thanks in advanced for any help with this.
What Exchange rollup are you running? I believe RU4 or RU5 fixes the ipv6 issue with windows 2008 and a ntlm prompting issue.
I have an interesting issue.
BTW great blog. Its on my favs.
Issue: I can connect to Outlook Anywhere just fine when on a standalone system outside of my domain, but when trying to get in on a domain member system it keeps prompting me for a password, over and over again. I enter the username and password, and it does not work, it keeps on prompting me.
Any ideas ? Thank you
are you running Winodws 2008? What RU are you running for Exchange?
sounds like 1 of 3 potential issues.
Thank you for the quick response.
I am running Windows 2003 R2 with Sp2.
Exchange 2007 w. sp1. I am not sure what roll up that takes me to. I believe it might be RU 4? How do i confirm the RU?
when i check for Updates on Windows i notice RU 5 is offered.
Thank u, I eagerly await.
post an email address I wont publish it so I can take this offline.
Has any one ever had a similar issue?
I also have Exchange 2007 running on Windows Server 2008. Everything work but rpc proxy. I get the unauthorized error no matter what I do. I've uninstall rpc and re-installed. I've checked the registry for the correct proxy ports, everything looks good but it doesn't work.
Help!!
What rollup are you running there is an issue with ipv6 pre rollup 4 or 5?
I don't have IP V6 configured. I am running rollup 5.
Thanks
Also, if I create the email profile while connected via vpn, it is created successfully. I can then disconnect from vpn and Outlook will then connect via rpc/https.
So there is obviously a step or two that works while on vpn to create the profile that doesn't work if I create the profile manually without vpn, even tho the Outlook config looks exactly the same.
Sigh....
Post a Comment