SBS 2008, Exchange 2007 & Outlook 2007...

[Mikey]

Sorry for the cross-posting, but I'm hoping someone out there will
have an answer for me.
Last weekend, I completed a migration from a 2003 SBS to a 2008 SBS. A
few glitches here & there, but one of the major problems is users at a
remote office cannot get their email now using Outlook 2007. It worked
fine with Exchange 2003, but not Exchange 2007 - why?
I have been on the Technet forums & last I was told this is not a
certificate error, as these clients are able to connect via OWA with
no problems or any warnings. Blackberries, iPhones, or any other kind
of smart phones have no problems, either.
When users try to open Outlook, they are prompted for a username &
password. I entered domain\username & then was prompted, twice,
something like would I like to allow
autodiscover.exchange.mydomain.xml to configure the settings (can't
remember exactly & can't get message to come up again), but I said
yes, twice & the in the lower right I get an alternating 'trying to
connect' message, followed by a 'disconnected' message.
I created an SRV record & deleted the * (All others) out of my public
DNS records.
When running the Test Email Configuration from one of the clients, I
get the following:
Autodiscover to https://mydomain.com/autodiscover/autodiscover.xml
starting
Autodiscover to https://mydomain.com/autodiscover/autodiscover.xml
FAILED (0x800C8203)
Autodiscover to https://autodiscover.mydomain.com/autodiscover/autodiscover.xml
starting
Autodiscover to https://autodiscover.mydomain.com/autodiscover/autodiscover.xml
FAILED (0x800C8203)
Local autodiscover for mydomain.com starting
Local autodiscover for mydomain.com FAILED (0x8004010F)
Redirect check to http://mydomain.com/autodiscover/autodiscover.xml
starting
Redirect check to http://mydomain.com/autodiscover/autodiscover.xml
FAILED (0x80072EE7)
Srv Record lookup for mydomain.com starting
Autodiscover URL redirection to https://exchange.mydomain.com/autodiscover/autodiscover.xml
Autodiscover to https://exchange.mydomain.com/autodiscover/autodiscover.xml
starting
Autodiscover to https://exchange.mydomain.com/autodiscover/autodiscover.xml
succeeded (0x00000000)
Srv Record lookup for mydomain.com succeeded (0x00000000)

I've been told it's a certificate error & then it's not, that I need a
different 3rd party certificate & then no I don't - what do I need to
get this to work?!?!?

 

[Rich Matheisen [MVP]]

Sorry for the cross-posting, but I'm hoping someone out there will
have an answer for me.
Last weekend, I completed a migration from a 2003 SBS to a 2008 SBS. A
few glitches here & there, but one of the major problems is users at a
remote office cannot get their email now using Outlook 2007. It worked
fine with Exchange 2003, but not Exchange 2007 - why?

How about some more details?

Is the remote office part of your LAN, or are they on a network that's
considered to be "the Internet"?

Are they using Outlook Anywhere?

If they put your autodiscover URL into a browser do they get the
expected response?

<?xml version="1.0" encoding="utf-8" ?>
- <Autodiscover
xmlns="http://schemas.microsoft.com/exchange/autodiscover/responseschema/2006">
- <Response>
- <Error Time="23:28:32.2816569" Id="1143903022">
<ErrorCode>600</ErrorCode>
<Message>Invalid Request</Message>
<DebugData />
</Error>
</Response>
</Autodiscover>

[ snip ]

I've been told it's a certificate error & then it's not, that I need a
different 3rd party certificate & then no I don't - what do I need to
get this to work?!?!?

Visit http://testexchangeconnectivity.com and see what it tells you
about your configuration.

 

[Mikey]

Sorry for the cross-posting, but I'm hoping someone out there will
have an answer for me.
Last weekend, I completed a migration from a 2003 SBS to a 2008 SBS. A
few glitches here & there, but one of the major problems is users at a
remote office cannot get their email now using Outlook 2007. It worked
fine with Exchange 2003, but not Exchange 2007 - why?

How about some more details?

Is the remote office part of your LAN, or are they on a network that's
considered to be "the Internet"?

Are they using Outlook Anywhere?

If they put your autodiscover URL into a browser do they get the
expected response?

  <?xml version="1.0" encoding="utf-8" ?>
- <Autodiscover
xmlns="http://schemas.microsoft.com/exchange/autodiscover/responseschema/2006">
- <Response>
- <Error Time="23:28:32.2816569" Id="1143903022">
  <ErrorCode>600</ErrorCode>
  <Message>Invalid Request</Message>
  <DebugData />
  </Error>
  </Response>
  </Autodiscover>

                                        [ snip ]

I've been told it's a certificate error & then it's not, that I need a
different 3rd party certificate & then no I don't - what do I need to
get this to work?!?!?

Visithttp://testexchangeconnectivity.comand see what it tells you
about your configuration.

The remote office is not part of our LAN, they are 'on the internet'.
When trying to connect to the autodiscover URL, yes, that is the
response they get.
As far as the test exchange site, the outlook anywhere failed,
autodiscover passed, pretty much like the messages included in my
original post.

 

[Rich Matheisen [MVP]]

[ snip ]

The remote office is not part of our LAN, they are 'on the internet'.
When trying to connect to the autodiscover URL, yes, that is the
response they get.
As far as the test exchange site, the outlook anywhere failed,
autodiscover passed, pretty much like the messages included in my
original post.

Yes, but the web site usually tells you a bot more about the failure.

Is the certificate you're using a SAN certificate? Is the CN of the
certificate the same one that your Outlook clients are trying to
connect to? Do you fill in both edit boxes in Outlook's "Exchange
proxy settings"? Are they both referencing the same server name?

 

[Mikey]

                                        [ snip ]        

The remote office is not part of our LAN, they are 'on the internet'.
When trying to connect to the autodiscover URL, yes, that is the
response they get.
As far as the test exchange site, the outlook anywhere failed,
autodiscover passed, pretty much like the messages included in my
original post.

Yes, but the web site usually tells you a bot more about the failure.

Is the certificate you're using a SAN certificate? Is the CN of the
certificate the same one that your Outlook clients are trying to
connect to? Do you fill in both edit boxes in Outlook's "Exchange
proxy settings"? Are they both referencing the same server name?

No, it's not a san certificate, does it need to be?
I've heard yes & I've heard no. If buying a san certificate would fix
my problem, I'll do it, but I don't want to buy one & have the same
old problem.
Yes, both boxes reference the same server...

 

[Rich Matheisen [MVP]]

[ snip ]

No, it's not a san certificate, does it need to be?
I've heard yes & I've heard no. If buying a san certificate would fix
my problem, I'll do it, but I don't want to buy one & have the same
old problem.

No, it doesn't have to be. But if you use the SRV record then Outlook
needs a hot-fix if it's not been updated with SP1.

http://msexchangeteam.com/archive/2007/09/21/447067.aspx
http://support.microsoft.com/kb/940881

If that's all working okay then you may be looking at a mismatch in
the authentication methods. How is the Exchange Proxy Settings
configured for authentication, and how is the web site configured? If
the web site uses only "backic" and Outlook uses NTLM (or vice-versa),
well, you'll have problems authenticating.

 

[Mikey]

                                        [ snip ]

No, it's not a san certificate, does it need to be?
I've heard yes & I've heard no. If buying a san certificate would fix
my problem, I'll do it, but I don't want to buy one & have the same
old problem.

No, it doesn't have to be. But if you use the SRV record then Outlook
needs a hot-fix if it's not been updated with SP1.

http://msexchangeteam.com/archive/2007/09/21/447067.aspxhttp://support.microsoft.com/kb/940881

If that's all working okay then you may be looking at a mismatch in
the authentication methods. How is the Exchange Proxy Settings
configured for authentication, and how is the web site configured? If
the web site uses only "backic" and Outlook uses NTLM (or vice-versa),
well, you'll have problems authenticating.

Outlook shows as SP2.
This is really going to spound stupid, but where can I check the
authentication settings?
SBS 2008 & Exchange 2007 are quite a bit different than 2003!

 

[Rich Matheisen [MVP]]

                                        [ snip ]

No, it's not a san certificate, does it need to be?
I've heard yes & I've heard no. If buying a san certificate would fix
my problem, I'll do it, but I don't want to buy one & have the same
old problem.

No, it doesn't have to be. But if you use the SRV record then Outlook
needs a hot-fix if it's not been updated with SP1.

http://msexchangeteam.com/archive/2007/09/21/447067.aspxhttp://support.microsoft.com/kb/940881

If that's all working okay then you may be looking at a mismatch in
the authentication methods. How is the Exchange Proxy Settings
configured for authentication, and how is the web site configured? If
the web site uses only "backic" and Outlook uses NTLM (or vice-versa),
well, you'll have problems authenticating.

Outlook shows as SP2.
Good.

This is really going to spound stupid, but where can I check the
authentication settings?
SBS 2008 & Exchange 2007 are quite a bit different than 2003!

No, they're the same. What's different is the way that SBS deals with
managing it.

get-outlookanywhere is the cmdlet that will show you the
authentication settings. Pipe the out put into "fl".

 

[Russ SBITS.Biz [SBS-MVP]]

If the users are getting Prompted for a password
remotely and they are not a member of the domain
(This is because there is no Cached credentials to use and you have to
create one)
I f you need instructions I'll try to find them.

If the Remote systems are laptops that are configured with http://connect
(They shouldn't have an issue because it sets all configuration for you.)
if they were joined manually, then go into your RPC over HTTPS Connect
settings and select NTLM Authentication instead of Basic and they won't be
prompted anymore


On the Certificate:
Do yourself a Favor buy at least a 3 year Cheapest GoDaddy Cert for
remote.yourdomain.com
And install it
http://sbs.seandaniel.com/2009/02/installing-godaddy-standard-ssl.html
(Those instructions are close enough because GoDaddy has changed.)

That should fix everything
Russ

--
Russell Grover - SBITS.Biz [SBS-MVP]
MCP, MCPS, MCNPS, SBSC
Small Business Server/Computer Support - www.SBITS.Biz
BPOS - Microsoft Online Services - www.BPOSMadeEasy.com
Easy Redirect to Microsoft's New SBS Public Support Forum - SBSRepair.com

 

[Cliff Galiher - MVP]

Looks like you are getting good advice from Rich and I do believe too many
cooks can spoil, but since SBS is a somewhat unique beast, I'd like to jump
in.

Can you actually post your results from the testexchangeconnectivity
website? As Rich said, it actually provides quite a bit of detail, and
having a bit of experience setting this up with SBS, I think we can help get
you cleared up relatively quickly.

--
Cliff Galiher
Microsoft has opened the Small Business Server forum on Technet! Check it
out!
http://social.technet.microsoft.com/Forums/en-us/smallbusinessserver/threads
Addicted to newsgroups? Read about the NNTP Bridge for MS Forums.

 

[Mikey]

Looks like you are getting good advice from Rich and I do believe too many
cooks can spoil, but since SBS is a somewhat unique beast, I'd like to jump
in.

Can you actually post your results from the testexchangeconnectivity
website? As Rich said, it actually provides quite a bit of detail, and
having a bit of experience setting this up with SBS, I think we can help get
you cleared up relatively quickly.

--
Cliff Galiher
Microsoft has opened the Small Business Server forum on Technet!  Checkit
out!http://social.technet.microsoft.com/Forums/en-us/smallbusinessserver/....
Addicted to newsgroups?  Read about the NNTP Bridge for MS Forums.

Ok, here's the results of the two tests. Keep in mind, I have replaced
user names, domain names & IP addresses, as I don't know what kind of
bad guys could make use of any of that!
On both tests, it returns the IP address of my website in the first
part of the tests, which is hosted at another location. SRV records
returned are correct, though.
Will a UCC cert resolve a lot of this?

ExRCA is testing RPC/HTTP connectivity.
The RPC/HTTP test failed.
Test Steps
Attempting to test Autodiscover for (e-mail address removed)
Autodiscover was tested successfully.
Test Steps
ExRCA is attempting each method of contacting the Autodiscover
service.
The Autodiscover service was tested successfully.
Test Steps
Attempting to test potential AutoDiscover URL
https://mydomain.com/AutoDiscover/AutoDiscover.xml
Testing of this potential Autodiscover URL failed.
Test Steps
Attempting to resolve the host name mydomain.com in DNS.
Host successfully resolved
Additional Details
IP(s) returned: xxx.xxx.xxx.xxx

Testing TCP Port 443 on host mydomain.com to ensure it is listening
and open.
The port was opened successfully.
ExRCA is testing the SSL certificate to make sure it's valid.
The SSL certificate failed one or more certificate validation checks.
Test Steps
The certificate name is being validated.
Certificate name validation failed.
Tell me more about this issue and how to resolve it
Additional Details
Host name mydomain.com does not match any name found on the server
certificate CN=www.stratocentric.com, OU=Domain Control Validated,
O=www.stratocentric.com





Attempting to test potential AutoDiscover URL
https://autodiscover.mydomain.com/AutoDiscover/AutoDiscover.xml
Testing of this potential Autodiscover URL failed.
Test Steps
Attempting to resolve the host name autodiscover.mydomain.com in DNS.
The Host could not be resolved.
Tell me more about this issue and how to resolve it
Additional Details
Host autodiscover.mydomain.com could not be resolved in DNS Exception
details:
Message: The requested name is valid, but no data of the requested
type was found
Type: System.Net.Sockets.SocketException
Stack trace:
at System.Net.Dns.GetAddrInfo(String name)
at System.Net.Dns.InternalGetHostByName(String hostName, Boolean
includeIPv6)
at System.Net.Dns.GetHostAddresses(String hostNameOrAddress)
at
Microsoft.Exchange.Tools.ExRca.Tests.ResolveHostTest.PerformTestReally()




ExRCA is attempting to contact the Autodiscover service using the HTTP
redirect method.
The attempt to contact Autodiscover using the HTTP Redirect method
failed.
Test Steps
Attempting to resolve the host name autodiscover.mydomain.com in DNS.
The Host could not be resolved.
Tell me more about this issue and how to resolve it
Additional Details
Host autodiscover.mydomain.com could not be resolved in DNS Exception
details:
Message: The requested name is valid, but no data of the requested
type was found
Type: System.Net.Sockets.SocketException
Stack trace:
at System.Net.Dns.GetAddrInfo(String name)
at System.Net.Dns.InternalGetHostByName(String hostName, Boolean
includeIPv6)
at System.Net.Dns.GetHostAddresses(String hostNameOrAddress)
at
Microsoft.Exchange.Tools.ExRca.Tests.ResolveHostTest.PerformTestReally()




ExRCA is attempting to contact the Autodiscover service using the DNS
SRV redirect method.
Successfully contacted AutoDiscover using the DNS SRV redirect
method.
Test Steps
Attempting to locate SRV record _autodiscover._tcp.mydomain.com in
DNS.
The Autodiscover SRV record was successfully retrieved from DNS.
Additional Details
Srv Record returned host: exchange.mydomain.com

Attempting to test potential AutoDiscover URL
https://exchange.mydomain.com/Autodiscover/Autodiscover.xml
Testing of the Autodiscover URL was successful.
Test Steps
Attempting to resolve the host name exchange.mydomain.com in DNS.
Host successfully resolved
Additional Details
IP(s) returned: xxx.xxx.xxx.xxx

Testing TCP Port 443 on host exchange.mydomain.com to ensure it is
listening and open.
The port was opened successfully.
ExRCA is testing the SSL certificate to make sure it's valid.
The certificate passed all validation requirements.
Test Steps
The certificate name is being validated.
Successfully validated the certificate name
Additional Details
Found hostname exchange.mydomain.com in Certificate Subject Common
name

Certificate trust is being validated.
The test passed with some warnings encountered. Please expand the
additional details.
Additional Details
Only able to build certificate chain when using the Root Certificate
Update functionality from Windows Update. Your server may not be
properly configured to send down the required intermediate
certificates to complete the chain. Consult the certificate
installation instructions or FAQ's from your Certificate Authority for
more information.

The certificate date is being confirmed to ensure the certificate is
valid.
Date validation passed. The certificate hasn't expired.
Additional Details
Certificate is valid: NotBefore = 6/15/2010 1:24:15 PM, NotAfter =
8/6/2010 3:30:03 PM"



The IIS configuration is being checked for client certificate
authentication.
Client certificate authentication wasn't detected.
Additional Details
Accept/Require Client Certificates not configured.

ExRCA is attempting to send an Autodiscover POST request to potential
Autodiscover URLs.
Successfully Retrieved AutoDiscover Settings by sending AutoDiscover
POST.
Test Steps
Attempting to Retrieve XML AutoDiscover Response from url
https://exchange.mydomain.com/Autodiscover/Autodiscover.xml for user
(e-mail address removed)
The Autodiscover XML response was successfully retrieved.
Additional Details
AutoDiscover Account Settings
XML Response:
<?xml version="1.0"?>
<Autodiscover xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns="http://
schemas.microsoft.com/exchange/autodiscover/responseschema/2006">
<Response xmlns="http://schemas.microsoft.com/exchange/autodiscover/
outlook/responseschema/2006a">
<User>
<DisplayName>Mike Post</DisplayName>
<LegacyDN>/o=mydomain/ou=first administrative group/cn=Recipients/
cn=user</LegacyDN>
<DeploymentId>ca79c4fa-b816-4378-a70d-3fae9b2f7f98</DeploymentId>
</User>
<Account>
<AccountType>email</AccountType>
<Action>settings</Action>
<Protocol>
<Type>EXCH</Type>
<Server>exchange.mydomain.local</Server>
<ServerDN>/o=mydomain/ou=Exchange Administrative Group
(FYDIBOHF23SPDLT)/cn=Configuration/cn=Servers/cn=exchange</ServerDN>
<ServerVersion>720180F0</ServerVersion>
<MdbDN>/o=mydomain/ou=Exchange Administrative Group (FYDIBOHF23SPDLT)/
cn=Configuration/cn=Servers/cn=exchange/cn=Microsoft Private MDB</
MdbDN>
<ASUrl>https://sites/EWS/Exchange.asmx</ASUrl>
<OOFUrl>https://sites/EWS/Exchange.asmx</OOFUrl>
<OABUrl>Public Folder</OABUrl>
<UMUrl>https://sites/UnifiedMessaging/Service.asmx</UMUrl>
<Port>0</Port>
<DirectoryPort>0</DirectoryPort>
<ReferralPort>0</ReferralPort>
<PublicFolderServer>exchange.mydomain.local</PublicFolderServer>
<AD>exchange.mydomain.local</AD>
<EwsUrl>https://sites/EWS/Exchange.asmx</EwsUrl>
</Protocol>
<Protocol>
<Type>WEB</Type>
<Port>0</Port>
<DirectoryPort>0</DirectoryPort>
<ReferralPort>0</ReferralPort>
<Internal>
<OWAUrl AuthenticationMethod="Basic, Fba">https://sites/owa/</OWAUrl>
<Protocol>
<Type>EXCH</Type>
<ASUrl>https://sites/EWS/Exchange.asmx</ASUrl>
</Protocol>
</Internal>
</Protocol>
</Account>
</Response>
</Autodiscover>


Autodiscover settings for Outlook Anywhere are being validated.
ExRCA wasn't able to validate Outlook Anywhere Autodiscover settings.
Tell me more about this issue and how to resolve it
Additional Details
The EXPR Provider section is missing in the Autodiscover response.
Outlook Anywhere may not be enabled.



Second test results...

Attempting to test Autodiscover for (e-mail address removed)
Autodiscover was tested successfully.
Test Steps
ExRCA is attempting each method of contacting the Autodiscover
service.
The Autodiscover service was tested successfully.
Test Steps
Attempting to test potential AutoDiscover URL
https://mydomain.com/AutoDiscover/AutoDiscover.xml
Testing of this potential Autodiscover URL failed.
Test Steps
Attempting to resolve the host name mydomain.com in DNS.
Host successfully resolved
Additional Details
IP(s) returned: xxx.xxx.xxx.xxx

Testing TCP Port 443 on host mydomain.com to ensure it is listening
and open.
The port was opened successfully.
ExRCA is testing the SSL certificate to make sure it's valid.
The SSL certificate failed one or more certificate validation checks.
Test Steps
The certificate name is being validated.
Certificate name validation failed.
Tell me more about this issue and how to resolve it
Additional Details
Host name mydomain.com does not match any name found on the server
certificate CN=www.stratocentric.com, OU=Domain Control Validated,
O=www.stratocentric.com





Attempting to test potential AutoDiscover URL
https://autodiscover.mydomain.com/AutoDiscover/AutoDiscover.xml
Testing of this potential Autodiscover URL failed.
Test Steps
Attempting to resolve the host name autodiscover.mydomain.com in DNS.
The Host could not be resolved.
Tell me more about this issue and how to resolve it
Additional Details
Host autodiscover.mydomain.com could not be resolved in DNS Exception
details:
Message: The requested name is valid, but no data of the requested
type was found
Type: System.Net.Sockets.SocketException
Stack trace:
at System.Net.Dns.GetAddrInfo(String name)
at System.Net.Dns.InternalGetHostByName(String hostName, Boolean
includeIPv6)
at System.Net.Dns.GetHostAddresses(String hostNameOrAddress)
at
Microsoft.Exchange.Tools.ExRca.Tests.ResolveHostTest.PerformTestReally()




ExRCA is attempting to contact the Autodiscover service using the HTTP
redirect method.
The attempt to contact Autodiscover using the HTTP Redirect method
failed.
Test Steps
Attempting to resolve the host name autodiscover.mydomain.com in DNS.
The Host could not be resolved.
Tell me more about this issue and how to resolve it
Additional Details
Host autodiscover.mydomain.com could not be resolved in DNS Exception
details:
Message: The requested name is valid, but no data of the requested
type was found
Type: System.Net.Sockets.SocketException
Stack trace:
at System.Net.Dns.GetAddrInfo(String name)
at System.Net.Dns.InternalGetHostByName(String hostName, Boolean
includeIPv6)
at System.Net.Dns.GetHostAddresses(String hostNameOrAddress)
at
Microsoft.Exchange.Tools.ExRca.Tests.ResolveHostTest.PerformTestReally()




ExRCA is attempting to contact the Autodiscover service using the DNS
SRV redirect method.
Successfully contacted AutoDiscover using the DNS SRV redirect
method.
Test Steps
Attempting to locate SRV record _autodiscover._tcp.mydomain.com in
DNS.
The Autodiscover SRV record was successfully retrieved from DNS.
Additional Details
Srv Record returned host: exchange.mydomain.com

Attempting to test potential AutoDiscover URL
https://exchange.mydomain.com/Autodiscover/Autodiscover.xml
Testing of the Autodiscover URL was successful.
Test Steps
Attempting to resolve the host name exchange.mydomain.com in DNS.
Host successfully resolved
Additional Details
IP(s) returned: XXX.XXX.XXX.XXX

Testing TCP Port 443 on host exchange.mydomain.com to ensure it is
listening and open.
The port was opened successfully.
ExRCA is testing the SSL certificate to make sure it's valid.
The certificate passed all validation requirements.
Test Steps
The certificate name is being validated.
Successfully validated the certificate name
Additional Details
Found hostname exchange.mydomain.com in Certificate Subject Common
name

Certificate trust is being validated.
The test passed with some warnings encountered. Please expand the
additional details.
Additional Details
Only able to build certificate chain when using the Root Certificate
Update functionality from Windows Update. Your server may not be
properly configured to send down the required intermediate
certificates to complete the chain. Consult the certificate
installation instructions or FAQ's from your Certificate Authority for
more information.

The certificate date is being confirmed to ensure the certificate is
valid.
Date validation passed. The certificate hasn't expired.
Additional Details
Certificate is valid: NotBefore = 6/15/2010 1:24:15 PM, NotAfter =
8/6/2010 3:30:03 PM"



The IIS configuration is being checked for client certificate
authentication.
Client certificate authentication wasn't detected.
Additional Details
Accept/Require Client Certificates not configured.

ExRCA is attempting to send an Autodiscover POST request to potential
Autodiscover URLs.
Successfully Retrieved AutoDiscover Settings by sending AutoDiscover
POST.
Test Steps
Attempting to Retrieve XML AutoDiscover Response from url
https://exchange.mydomain.com/Autodiscover/Autodiscover.xml for user
(e-mail address removed)
The Autodiscover XML response was successfully retrieved.
Additional Details
AutoDiscover Account Settings
XML Response:
<?xml version="1.0"?>
<Autodiscover xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns="http://
schemas.microsoft.com/exchange/autodiscover/responseschema/2006">
<Response xmlns="http://schemas.microsoft.com/exchange/autodiscover/
outlook/responseschema/2006a">
<User>
<DisplayName>Mike Post</DisplayName>
<LegacyDN>/o=mydomain/ou=first administrative group/cn=Recipients/
cn=user</LegacyDN>
<DeploymentId>ca79c4fa-b816-4378-a70d-3fae9b2f7f98</DeploymentId>
</User>
<Account>
<AccountType>email</AccountType>
<Action>settings</Action>
<Protocol>
<Type>EXCH</Type>
<Server>exchange.mydomain.local</Server>
<ServerDN>/o=mydomain/ou=Exchange Administrative Group
(FYDIBOHF23SPDLT)/cn=Configuration/cn=Servers/cn=exchange</ServerDN>
<ServerVersion>720180F0</ServerVersion>
<MdbDN>/o=mydomain/ou=Exchange Administrative Group (FYDIBOHF23SPDLT)/
cn=Configuration/cn=Servers/cn=exchange/cn=Microsoft Private MDB</
MdbDN>
<ASUrl>https://sites/EWS/Exchange.asmx</ASUrl>
<OOFUrl>https://sites/EWS/Exchange.asmx</OOFUrl>
<OABUrl>Public Folder</OABUrl>
<UMUrl>https://sites/UnifiedMessaging/Service.asmx</UMUrl>
<Port>0</Port>
<DirectoryPort>0</DirectoryPort>
<ReferralPort>0</ReferralPort>
<PublicFolderServer>exchange.mydomain.local</PublicFolderServer>
<AD>exchange.mydomain.local</AD>
<EwsUrl>https://sites/EWS/Exchange.asmx</EwsUrl>
</Protocol>
<Protocol>
<Type>WEB</Type>
<Port>0</Port>
<DirectoryPort>0</DirectoryPort>
<ReferralPort>0</ReferralPort>
<Internal>
<OWAUrl AuthenticationMethod="Basic, Fba">https://sites/owa/</OWAUrl>
<Protocol>
<Type>EXCH</Type>
<ASUrl>https://sites/EWS/Exchange.asmx</ASUrl>
</Protocol>
</Internal>
</Protocol>
</Account>
</Response>
</Autodiscover>

 

[Cliff Galiher - MVP]

Well, it looks like you are getting a certificate chain error. Those can
cause serious problems depending on the OS level.

I'm gonna *guess* that you purchased a GoDaddy cert. This is fine, but you
must install the intermediate certificate chain as well to use this.

Documented here:
http://blogs.technet.com/b/sbs/arch...nstall-a-godaddy-certificate-on-sbs-2008.aspx

Do that then try to use outlook anywhere. If it still fails, re-run the
testexchangeconnectivity test and see if you can fix the errors it is
reporting (usually they are straightforward, but not always). Finally, if
you can't, repost the new error report as necessary.

--
Cliff Galiher
Microsoft has opened the Small Business Server forum on Technet! Check it
out!
http://social.technet.microsoft.com/Forums/en-us/smallbusinessserver/threads
Addicted to newsgroups? Read about the NNTP Bridge for MS Forums.

 

[Mikey]

Well, it looks like you are getting a certificate chain error. Those can
cause serious problems depending on the OS level.

I'm gonna *guess* that you purchased a GoDaddy cert. This is fine, but you
must install the intermediate certificate chain as well to use this.

Documented here:http://blogs.technet.com/b/sbs/archive/2009/02/11/sean-daniel-how-to-...

Do that then try to use outlook anywhere. If it still fails, re-run the
testexchangeconnectivity test and see if you can fix the errors it is
reporting (usually they are straightforward, but not always). Finally, if
you can't, repost the new error report as necessary.

--
Cliff Galiher
Microsoft has opened the Small Business Server forum on Technet!  Checkit
out!http://social.technet.microsoft.com/Forums/en-us/smallbusinessserver/....
Addicted to newsgroups?  Read about the NNTP Bridge for MS Forums.

I just purchased a UCC certificate from them & will be installing
shortly.
I'll re-run tests & post back with results.

 

[Mikey]

I just purchased a UCC certificate from them & will be installing
shortly.
I'll re-run tests & post back with results.

Installed certificate & still having problems...
I am once again getting warnings when using OWA, too.
When I ran the wizard, it put in the name remote.mydomain.com by
default, I guess, even though the machine is named
exchange.mydomain.com.
According to someone's blog out there, I was also to include the
following names on the certificate;
autodiscover.mydomain.com
exchange.mydomain.local
exchange
sites
Is this right?
I also have an SRV record in my public DNS records, but exchange test
website is still reporting errors, as well.
Needless to say, remote outlook clients aren't connecting, either.
I am really starting to regret moving from my good ol' reliable 2003
SBS....

 

[Mikey]

Installed certificate & still having problems...
I am once again getting warnings when using OWA, too.
When I ran the wizard, it put in the name remote.mydomain.com by
default, I guess, even though the machine is named
exchange.mydomain.com.
According to someone's blog out there, I was also to include the
following names on the certificate;
autodiscover.mydomain.com
exchange.mydomain.local
exchange
sites
Is this right?
I also have an SRV record in my public DNS records, but exchange test
website is still reporting errors, as well.
Needless to say, remote outlook clients aren't connecting, either.
I am really starting to regret moving from my good ol' reliable 2003
SBS....

Sorry, but one more stupid question.
When downloading the new certificate, it asked what type of server it
was going on.
With no SBS option, I chose IIS rather then Exchange 2007.
Was this right?
It seems that when I did this for 2003 many moons ago, I needed to
chose IIS, so OWA would work.

 

[Cliff Galiher - MVP]

IIS was correct. You actually don't need a UCC certificate for Outlook
Anywhere to work, so most of those names will do no good, but they'll also
do no harm.

I will ask, however, as I did before, that you post the contents of your
connectivity test in full so we can spot and then fix the problem. I don't
play guessing games.

--
Cliff Galiher
Microsoft has opened the Small Business Server forum on Technet! Check it
out!
http://social.technet.microsoft.com/Forums/en-us/smallbusinessserver/threads
Addicted to newsgroups? Read about the NNTP Bridge for MS Forums.

 

[Rich Matheisen [MVP]]

[ snip ]

ExRCA is testing the SSL certificate to make sure it's valid.
The SSL certificate failed one or more certificate validation checks.
Test Steps
The certificate name is being validated.
Certificate name validation failed.
Tell me more about this issue and how to resolve it
Additional Details
Host name mydomain.com does not match any name found on the server
certificate CN=www.stratocentric.com, OU=Domain Control Validated,
O=www.stratocentric.com

Is that the *REAL* name?
www.stratocentric.com


If it is, the certificate installed on that site has been revoked.

The warning also states that none of the names in the certificate
match the name you used to get to the server.

If it's not the real name then you're doing yourself no favors by not
disclosing the real name. Obfuscate the name if you like (e.g. "host"
<dot> domain d-o-t com") -- humans are pretty good at recognizing the
stuff that should be removed or replaced.

[ snip ]

Certificate is valid: NotBefore = 6/15/2010 1:24:15 PM, NotAfter =
8/6/2010 3:30:03 PM"

That's a pretty narrow date range for a commercial certificate! Are
you sure you've installed the certificate correctly? Have you
activated the certificate for the correct uses?

 

[Rich Matheisen [MVP]]

[ snip ]

Installed certificate & still having problems...
I am once again getting warnings when using OWA, too.

.. . . and that warning is?

When I ran the wizard, it put in the name remote.mydomain.com by
default, I guess, even though the machine is named
exchange.mydomain.com.
According to someone's blog out there, I was also to include the
following names on the certificate;
autodiscover.mydomain.com
exchange.mydomain.local
exchange
sites
Is this right?

You'll want the names in the certificate that you'll use to access the
resources you're offering:

Owa-host.externaldomainname.com
AutoDiscover.externaldomainname.com
server.internaldomainname.local

You may want to add to that list:
mail-server.externaldomainname.com
mail-server.internaldomainname.local


GoDaddy might be lenient enough to all you to use names without them
being fully qualified. but other CAs probably won't. It'd be a good
idea to have the name by which you access the resources from inside
you LAN be the same as the names you use from outside. Publish the
names and the LAN IP addresses you internal DNS and the names and
external IP address in your external DNS. There's no confusion among
the users as to what name should be used because they're the same
everywhere.

I also have an SRV record in my public DNS records, but exchange test
website is still reporting errors, as well.
Needless to say, remote outlook clients aren't connecting, either.
I am really starting to regret moving from my good ol' reliable 2003
SBS....

If you're having a problem getting the CSR generated for submission to
the CA, try using DigiCert's tool for that:

https://www.digicert.com/easy-csr/exchange2007.htm

 

[Cliff Galiher - MVP]

Alright, just to get everybody back on the same page, I received a private
email from "Mikey"with the results of his log. HE was concerned about
publishing the information publicly, so it isn't my place to supercede that
decision.

With that said, what I *can* share is that there AutoDiscover is configured
to work using the SRV record method and the domain name the SRV record
returns does not match the domain name on the certificate.

So the fix here is to update DNS and have the SRV record point to
remote.<domain-name>

That should resolve the issue.

--
Cliff Galiher
Microsoft has opened the Small Business Server forum on Technet! Check it
out!
http://social.technet.microsoft.com/Forums/en-us/smallbusinessserver/threads
Addicted to newsgroups? Read about the NNTP Bridge for MS Forums.

 

[Mikey]

                                        [ snip ]

Installed certificate & still having problems...
I am once again getting warnings when using OWA, too.

. . .  and that warning is?

When I ran the wizard, it put in the name remote.mydomain.com by
default, I guess, even though the machine is named
exchange.mydomain.com.
According to someone's blog out there, I was also to include the
following names on the certificate;
autodiscover.mydomain.com
exchange.mydomain.local
exchange
sites
Is this right?

You'll want the names in the certificate that you'll use to access the
resources you're offering:

Owa-host.externaldomainname.com
AutoDiscover.externaldomainname.com
server.internaldomainname.local

You may want to add to that list:
mail-server.externaldomainname.com
mail-server.internaldomainname.local

GoDaddy might be lenient enough to all you to use names without them
being fully qualified. but other CAs probably won't. It'd be a good
idea to have the name by which you access the resources from inside
you LAN be the same as the names you use from outside. Publish the
names and the LAN IP addresses you internal DNS and the names and
external IP address in your external DNS. There's no confusion among
the users as to what name should be used because they're the same
everywhere.

I also have an SRV record in my public DNS records, but exchange test
website is still reporting errors, as well.
Needless to say, remote outlook clients aren't connecting, either.
I am really starting to regret moving from my good ol' reliable 2003
SBS....

If you're having a problem getting the CSR generated for submission to
the CA, try using DigiCert's tool for that:

https://www.digicert.com/easy-csr/exchange2007.htm

I tried & am getting a message that either I can't over write the file
(there's nothing there with that currect name!) or I don't have
sufficient privelages!
Is an administrator acount not what it used to be?