VERY slow connecting Outlook 2007/10 to Office 365... only when logged onto Domain

[themightymrp]

OK, long title but sums it up I think.

 

I am having issues getting MS Outlook 2007 or 2010 to connect to our Office 365 system. At least, I'm only getting problems when I'm logging into the school domain.

 

If I try setting up Outlook on a home PC, it works like a charm. If I log into the machine locally whilst in the school, put in our proxy settings and try setting up Outlook ..... works like a charm.

 

However, if I log into the domain I get SERIOUS slowdown!! Connecting to an account can take up to 10 minutes!!

 

We are using ADFS for SSO and for Outlook Web Apps it's all working lovely, no issues at all. But, in order to migrate some things from our old email system I need to use .PST files in Outlook to act as the go-between.

 

I have added the CNAME of autodiscover to our DNS to point to autodiscover.outlook.com and practically anything else I can think of.

 

Anybody have some insights on what it might be? I have tried moving a computer account to an area of the AD with minimal GPO's applied and still get it.

[themightymrp]

Bumpty bump

 

Anyone???

[Cache]

Don't know whether this will help or not as I don't know how ADFS impacts on everything.

 

You could try installing KB2817574 (Description of the Outlook 2010 hotfix package (Outlook-x-none.msp): August 13, 2013) and see if that helps, it certainly helped a lot of our connection issues.

[themightymrp]

Sounds interesting thanks - I will give it a go

[zag]

Check your proxy server as well.

 

We have problems using transparent authentication for the initial connect. After that its fine.

[themightymrp]

We don't have a transparent proxy, its entered manually (well, via GPO anyway). Hoever using the same proxy settings while logged in locally allows it to work :-/ So I don't *think* its that.. Never know though

[themightymrp]

The hotfix didn't work

 

Still the same problem; when logged onto the domain, Outlook 2007 or 2010 take AGES to find and connect to a 365 account. Once it eventually goes in and you get as far as the Inbox it all works fine (which I think is odd??).

 

If I do the same setup logged in locally to the machine or do it from home - no problem. Takes just a few seconds and it's ready.

 

This is driving me nuts!!! For one things, when I'm logged in locally it is using the same DNS settings and the same proxy settings as when I'm on the domain. Could it be any part of the SSO setup which is causing the issue? SSO for the Web App is working lovely and I don't want to tinker and potentially screw something up.

 

Cheers

[Cache]

Well if it doesn't happen on a local account I guess it is something to do with your SSO setup (but that's beyond me).

 

It might be worth downloading the new Microsoft Connectivity Analyzer from the Tools section of the Office 365 portal and see if that brings forth any issues?

 

You'll need to install .net 4.5 before it will run however.

[themightymrp]

Will def take a look at that! Didn't know it was there - cheers!

 

Will report back my findings....

[themightymrp]

OK. Ran the test both logged in locally and on the domain. Got the same results back for each!?

 

I am attaching the HTML results (in a zip file) if anyone feels like telling me what the errors mean and how to fix them. I have adjusted the code to hide my actual email address.

 

Any help is appreciated

MCATestResultsDomain - Copy.zip

[themightymrp]

I'm wondering about a DNS setup issue.

 

Internally, the domain is of the form domain.local - but our emails are school.sch.uk

 

The SSO is working because I added the alternative UPN to the system and all user accounts UPNs match the [email protected]

 

However.... my URL of adfs.school.sch.uk when in the school resolves to the external IP address. Should this resolve to my 10.*.*.* internal address?? If so how do I add that to my DNS server? Do I need to create a second DNS zone for the .sch.uk part?

[Cache]

Sorry, that's now beyond me, but you could be on the right lines.

 

I would *guess* that if you create a forward lookup zone of adfs.school.sch.uk on your internal dns server and then create a blank host record and enter your internal ip address that might do it? But I'm really really not certain....

[xenonive]

Sorry, that's now beyond me, but you could be on the right lines.

 

I would *guess* that if you create a forward lookup zone of adfs.school.sch.uk on your internal dns server and then create a blank host record and enter your internal ip address that might do it? But I'm really really not certain....

 

 

I would think doing something similar might help things or make firewall rule to keep ADFS internal rather than going out to proxy depending how you have things setup

[kmount]

Whilst internally yeah, you would want your ADFS name to resolve to the internal side, saves it going 'out and back'.

 

Though, if your 'off domain but in school' test still uses the same DNS servers it's likely this is a red herring but still sensible to do.

 

You can add a DNS zone to your internal DNS that is just "adfs.school.co.uk" with the 10.x.y.z IP so you don't need to reinvent the wheel for the whole zone.

[Trapper]

I have this and our internal domain is the same as the external (schname.county.sch.uk).

 

Outlook either won't connect using autodiscover CNAME, or errors. It then uses the "backup" via SRV record which takes forever as it hits the CNAME autodiscover for ages before trying the SRV record.

 

As for a solution - no idea!

[EduTech]

Your Internal DNS Forward Lookup Zone should be pointing to "autodiscover.outlook.com" ; are you saying that it is taking a long time for that to resolve?

 

obviously if your domain is the same as your external domain just ensure that it is the same both internal / external, usual stuff.

 

In regards to ADFS you need to ensure that you have a A record in place for your ADFS.DOMAIN.CO.UK or which ever you have used so that your internal clients can hit your ADFS Server without going via the proxy, and then when your clients go external they should resolve using public DNS and then go via the ADFS Proxy.

 

If your clients use Internal DNS when External also, i.e. Direct Access then you could setup an exclusion. If they are using a VPN Service then you could probably setup an exclusion on this also so that it forces your clients to use the External IP of that A Record.

 

James.

[kellow87]

I'm having the same issue as themightymrp. Outlook 2010/2013 slow connecting to Office 365 when PC is connected to the domain. When not connected it works fine. Anyone had any luck on this one yet?

[Trapper]

Is your internal FQDN the same as your external?

[kellow87]

I've just found some entries in AD Sites and Services that are linked to our old Exchange server which I think might be causing the issue. I'll post back my results.

[themightymrp]

I've just found some entries in AD Sites and Services that are linked to our old Exchange server which I think might be causing the issue. I'll post back my results.

 

If you figure this out please let me know!! I am still having the same issues.

 

I have tried, as a test, adding the internal IP address mapped to the adfs.school.co.uk by modifying my local HOSTS file. This hasn't made any difference though

[kellow87]

I have removed all records relating to our old Exchange server in Sites and Services and Outlook setup is still slow...grrrrrrr. Ran out of options but will keep investigating.

[themightymrp]

Boooo! You were supposed to be my saviour Will keep trying things here too and will post any results

[kellow87]

Sorry about that. Just tried Office 365 support. Because the issue is a domain issue rather than an Office 365 issue they weren't able to help. Just out of interest, did you add those entries to a HOST file on your DC's?

[themightymrp]

No, just on my local PC. Wasn't sure what the impact would be if I did it on the server tbh? I didn't want to down everyones email by mistake lol

[kellow87]

Just an idea, is your Exchange server still on your domain? We have yet to remove it from our domain.