Upgrading to Exchange 2013 - test-outlookwebservices returns a 401 error

ThomasBrentnall · September 11, 2014

Hello,

We are currently in the final stages of migrating from Exchange 2010 on a Server 2008 R2 environment to Exchange 2013 on a Server 2012 R2 virtual server. Outlook Web Access and EAC is working fine however auto discover isn't. When running the test-outlookwebservices command we are getting a 401 error.

We have a valid certificate on the server, I have disabled IPv6 and loopback on the server as this has caused issue for other people.

Any ideas what could be causing this?

Thanks

Tom

EMC command output:


[PS] C:\Windows\system32>test-outlookwebservices | fl


RunspaceId          : ea25e9dc-4cec-4745-aa47-dcdaeeb701a4
Source              : Exchange.Haslandhall.local
ServiceEndpoint     : has-exch.haslandhall.local
Scenario            : AutoDiscoverOutlookProvider
ScenarioDescription : Autodiscover: Outlook Provider
Result              : Failure
Latency             : 116
Error               : System.Net.WebException: The remote server returned an error: (401) Unauthorized.
                        at System.Net.HttpWebRequest.GetResponse()
                        at
                     Microsoft.Exchange.Management.SystemConfigurationTasks.ServiceValidatorBase.InternalInvoke()
                        at Microsoft.Exchange.Management.SystemConfigurationTasks.ServiceValidatorBase.Invoke()
Verbose             : [2014-09-11 09:40:06Z] Autodiscover connecting to
                     'https://has-exch.haslandhall.local/Autodiscover/Autodiscover.xml'.
                     [2014-09-11 09:40:06Z] Test account: [email protected] Password: ******
                     [2014-09-11 09:40:06Z] Autodiscover request:
                     User-Agent: EXCHANGE/Test-OutlookWebServices/[email protected]
                     Content-Type: text/xml; charset=utf-8
                     Host: exchange.haslandhall.local
                     Connection: Keep-Alive
                     [2014-09-11 09:40:06Z] Autodiscover request:
                     
                                           xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
                     xmlns="http://schemas.microsoft.com/exchange/autodiscover/outlook/requestschema/2006">
                       
                         [email protected]
                         http://schemas.microsoft.com/exchange/autodiscover/outlook/response
                     schema/2006a
                       
                     
                     [2014-09-11 09:40:06Z] Autodiscover response:
                     request-id: 77e764da-3e10-4349-b9cc-8da134218b85
                     Server: Microsoft-IIS/8.5
                     WWW-Authenticate: Negotiate,NTLM
                     X-Powered-By: ASP.NET
                     X-FEServer: EXCHANGE
                     Date: Thu, 11 Sep 2014 09:40:06 GMT
                     Content-Length: 0
                     [2014-09-11 09:40:06Z] Autodiscover response:
                     System.Net.WebException: The remote server returned an error: (401) Unauthorized.
                        at System.Net.HttpWebRequest.GetResponse()
                        at
                     Microsoft.Exchange.Management.SystemConfigurationTasks.ServiceValidatorBase.InternalInvoke()
                        at Microsoft.Exchange.Management.SystemConfigurationTasks.ServiceValidatorBase.Invoke()
MonitoringEventId   : 6001

RunspaceId          : ea25e9dc-4cec-4745-aa47-dcdaeeb701a4
Source              : Exchange.Haslandhall.local
ServiceEndpoint     :
Scenario            : ExchangeWebServices
ScenarioDescription : Exchange Web Services
Result              : Skipped
Latency             : 0
Error               : Skipped testing Exchange Web Services because the Autodiscover step failed.
Verbose             :
MonitoringEventId   : 5002

RunspaceId          : ea25e9dc-4cec-4745-aa47-dcdaeeb701a4
Source              : Exchange.Haslandhall.local
ServiceEndpoint     :
Scenario            : AvailabilityService
ScenarioDescription : Availability Service
Result              : Skipped
Latency             : 0
Error               : Skipped testing Availability Service because the Autodiscover step failed.
Verbose             :
MonitoringEventId   : 5003

RunspaceId          : ea25e9dc-4cec-4745-aa47-dcdaeeb701a4
Source              : Exchange.Haslandhall.local
ServiceEndpoint     :
Scenario            : OfflineAddressBook
ScenarioDescription : Offline Address Book
Result              : Skipped
Latency             : 0
Error               : Skipped testing Offline Address Book because the Autodiscover step failed.
Verbose             :
MonitoringEventId   : 5004

ThomasBrentnall · September 11, 2014

To add to this, when trying to connect to EWS we get this error:

Exception details:
Message: The request failed. The remote server returned an error: (413) Request Entity Too Large.

Ben-BSH · September 11, 2014

https://has-exch.haslandhall.local/Autodiscover/Autodiscover.xml

If you browse to that, what happens? and is that the hostname of your Exchange 2013 server?

cscc · September 11, 2014

http://www.exchange-genie.com/2007/07/401-error-when-attempting-test-outlookwebservices/

ThomasBrentnall · September 11, 2014

https://has-exch.haslandhall.local/Autodiscover/Autodiscover.xml
If you browse to that, what happens? and is that the hostname of your Exchange 2013 server?

Error 600 which I believe is normal. However has-exch is the old 2010 server, the new one is exchange.haslandhall.local which also returns the same result

ThomasBrentnall · September 11, 2014

http://www.exchange-genie.com/2007/07/401-error-when-attempting-test-outlookwebservices/

Thank you for the link, however as mentioned above I've already disabled ipv6 and loopback check!

Ben-BSH · September 11, 2014

Error 600 which I believe is normal. However has-exch is the old 2010 server, the new one is exchange.haslandhall.local which also returns the same result

Ok, and that is with the same credentials powershell is using? the "[email protected]"

if you connect to your 2010 server instead and run the same command are you successful? can you check the actual directory and permissions on the 2013 server.

Also - have a peek here http://blogs.technet.com/b/exchdxb/archive/2012/05/10/troublshooting-autodiscover-exchange-2007-2010.aspx

Edited September 11, 2014 by Ben-BSH

cscc · September 11, 2014

What does the following command return?

Get-ClientAccessServer | FL AutoDiscoverServiceInternalUri

If it isnt correct you can use the following to set it:

Set-ClientAccessServer -Identity YOUR2013EXCHHOST -AutoDiscoverServiceInternalUri https://YOUR2013EXCHHOST/Autodiscover/Autodiscover.xml

Another link that may be of interest for the second issue:

http://social.technet.microsoft.com/Forums/exchange/en-US/e5bb6ad7-b18b-4c30-80c8-15b8ae519052/testoutlookwebservices-returns-413-request-entity-too-large-for-ews

Edited September 11, 2014 by cscc

ThomasBrentnall · September 11, 2014

Ok, and that is with the same credentials powershell is using? the "[email protected]"

That's on my account, although I reset the password on the extest account, logged on with that and it connected fine. Is there any other method of testing using them credentials?

if you connect to your 2010 server instead and run the same command are you successful?

This is the output of test-outlookwebservices on the 2010 server

[PS] C:\Windows\system32>Test-OutlookWebServices | fl


RunspaceId : 950e9a22-6473-4d9a-8255-6f9aff7cecd7
Id         : 1019
Type       : Information
Message    : A valid Autodiscover service connection point was found. The Autodiscover URL on this object is https://ha
            s-exch.haslandhall.local/Autodiscover/Autodiscover.xml.

RunspaceId : 950e9a22-6473-4d9a-8255-6f9aff7cecd7
Id         : 1013
Type       : Error
Message    : When contacting https://has-exch.haslandhall.local/Autodiscover/Autodiscover.xml received the error The re
            mote server returned an error: (401) Unauthorized.

RunspaceId : 950e9a22-6473-4d9a-8255-6f9aff7cecd7
Id         : 1023
Type       : Error
Message    : The Autodiscover service couldn't be contacted.

RunspaceId : 950e9a22-6473-4d9a-8255-6f9aff7cecd7
Id         : 1011
Type       : Error
Message    : When querying Availability for the recipient e-mail address [email protected], the fo
            llowing error code and message were received: ErrorProxyRequestProcessingFailed:System.Web.Services.Protoc
            ols.SoapException: The authenticated user doesn't have sufficient permissions to issue this request.
               at System.Web.Services.Protocols.SoapHttpClientProtocol.ReadResponse(SoapClientMessage message, WebResp
            onse response, Stream responseStream, Boolean asyncCall)
               at System.Web.Services.Protocols.SoapHttpClientProtocol.EndInvoke(IAsyncResult asyncResult)
               at Microsoft.Exchange.InfoWorker.Common.Availability.Proxy.Service.EndGetUserAvailability(IAsyncResult
            asyncResult)
               at Microsoft.Exchange.InfoWorker.Common.Availability.FreeBusyApplication.EndProxyWebRequest(ProxyWebReq
            uest proxyWebRequest, QueryList queryList, Service service, IAsyncResult asyncResult)
               at Microsoft.Exchange.InfoWorker.Common.Availability.ProxyWebRequest.EndInvoke(IAsyncResult asyncResult
            )
               at Microsoft.Exchange.InfoWorker.Common.Availability.AsyncWebRequest.EndInvokeWithErrorHandling(). The
            request information is ProxyWebRequest type = IntraSite, url = https://exchange.haslandhall.local:444/ews/
            exchange.asmx
            Mailbox list = SMTP:[email protected], Parameters: windowStart
            = 11/09/2014 01:00:00, windowEnd = 11/09/2014 02:00:00, MergedFBInterval = 30, RequestedView = FreeBusy
            ., inner exception: The authenticated user doesn't have sufficient permissions to issue this request.

RunspaceId : 950e9a22-6473-4d9a-8255-6f9aff7cecd7
Id         : 1025
Type       : Error
Message    : [EXCH] Error contacting the AS service at https://has-exch.haslandhall.local/EWS/Exchange.asmx. Elapsed ti
            me was 951 milliseconds.

RunspaceId : 950e9a22-6473-4d9a-8255-6f9aff7cecd7
Id         : 1026
Type       : Success
Message    : [EXCH] Successfully contacted the UM service at https://has-exch.haslandhall.local/EWS/Exchange.asmx. The
            elapsed time was 31 milliseconds.

RunspaceId : 950e9a22-6473-4d9a-8255-6f9aff7cecd7
Id         : 1111
Type       : Error
Message    : When querying Availability for the recipient e-mail address [email protected], the fo
            llowing error code and message were received: ErrorProxyRequestProcessingFailed:System.Web.Services.Protoc
            ols.SoapException: The authenticated user doesn't have sufficient permissions to issue this request.
               at System.Web.Services.Protocols.SoapHttpClientProtocol.ReadResponse(SoapClientMessage message, WebResp
            onse response, Stream responseStream, Boolean asyncCall)
               at System.Web.Services.Protocols.SoapHttpClientProtocol.EndInvoke(IAsyncResult asyncResult)
               at Microsoft.Exchange.InfoWorker.Common.Availability.Proxy.Service.EndGetUserAvailability(IAsyncResult
            asyncResult)
               at Microsoft.Exchange.InfoWorker.Common.Availability.FreeBusyApplication.EndProxyWebRequest(ProxyWebReq
            uest proxyWebRequest, QueryList queryList, Service service, IAsyncResult asyncResult)
               at Microsoft.Exchange.InfoWorker.Common.Availability.ProxyWebRequest.EndInvoke(IAsyncResult asyncResult
            )
               at Microsoft.Exchange.InfoWorker.Common.Availability.AsyncWebRequest.EndInvokeWithErrorHandling(). The
            request information is ProxyWebRequest type = IntraSite, url = https://exchange.haslandhall.local:444/ews/
            exchange.asmx
            Mailbox list = SMTP:[email protected], Parameters: windowStart
            = 11/09/2014 01:00:00, windowEnd = 11/09/2014 02:00:00, MergedFBInterval = 30, RequestedView = FreeBusy
            ., inner exception: The authenticated user doesn't have sufficient permissions to issue this request.

RunspaceId : 950e9a22-6473-4d9a-8255-6f9aff7cecd7
Id         : 1125
Type       : Error
Message    : [server] Error contacting the AS service at https://has-exch.haslandhall.local/ews/exchange.asmx. Elapsed
            time was 218 milliseconds.

RunspaceId : 950e9a22-6473-4d9a-8255-6f9aff7cecd7
Id         : 1126
Type       : Success
Message    : [server] Successfully contacted the UM service at https://has-exch.haslandhall.local/ews/exchange.asmx. Th
            e elapsed time was 15 milliseconds.

can you check the actual directory and permissions on the 2013 server.

For Autodiscover?

http://i58.tinypic.com/1zuph2.png

Also - have a peek here Troublshooting Autodiscover (Exchange 2007/2010) - EXCHDXB - Site Home - TechNet Blogs

Cheers, ill have a look now

ThomasBrentnall · September 11, 2014

What does the following command return?

Get-ClientAccessServer | FL AutoDiscoverServiceInternalUri

This is the output on the 2013 box:

[PS] C:\Program Files\Microsoft\Exchange Server\V15\scripts>Get-ClientAccessServer | FL AutoDiscoverServiceInternalUri


AutoDiscoverServiceInternalUri : https://has-exch.haslandhall.local/Autodiscover/Autodiscover.xml

AutoDiscoverServiceInternalUri : https://exchange.haslandhall.local/Autodiscover/Autodiscover.xml

and on the 2010 box

[PS] C:\Windows\system32>Get-ClientAccessServer | FL AutoDiscoverServiceInternalUri


AutoDiscoverServiceInternalUri : https://has-exch.haslandhall.local/Autodiscover/Autodiscover.xml

If it isnt correct you can use the following to set it:

Set-ClientAccessServer -Identity YOUR2013EXCHHOST -AutoDiscoverServiceInternalUri https://YOUR2013EXCHHOST/Autodiscover/Autodiscover.xml

Another link that may be of interest for the second issue:

Test-OutlookWebServices returns (413) Request Entity Too Large for EWS

Cheers, I've had a look at the link but I'm unsure where to set the variables?

Thanks!

cscc · September 11, 2014

I’m guessing IIS 8.5 if your on 2012? You can try using the following to change the value:

appcmd.exe set config -section:system.webServer/serverRuntime/uploadReadAheadSize:"xxxxxx" /commit:apphost

Below link is a bit more helpful for setting SSL conditions depending on IIS version:

Access Security : The Official Microsoft IIS Site

Just a thought but you mention you have a valid SSL certificate, is for the your internal FQDN or an external address?

Edited September 11, 2014 by cscc

ThomasBrentnall · September 11, 2014

I’m guessing IIS 8.5 if your on 2012? You can try using the following to change the value:

That command isn't working :/

C:\Windows\System32\inetsrv>appcmd.exe set config -section:system.webServer/serv
erRuntime/uploadReadAheadSize:"9999" /commit:apphost
ERROR ( message:Unknown config section "system.webServer/serverRuntime/uploadRea
dAheadSize:9999".  Replace with ? for help. )

Below link is a bit more helpful for setting SSL conditions depending on IIS version:

Access Security : The Official Microsoft IIS Site

Thank you will take a look at that now!

cscc · September 11, 2014

Ok you may need to edit the IIS config file directly and look for the entry, if it doesn't exist you will need to add it manually:

uploadReadAheadSize="100000"

This is double the default value

Another link that directly relates to the issue:

You receive error 401.1 when you browse a Web site that uses Integrated Authentication and is hosted on IIS 5.1 or a later version

This appcmd code should work:

appcmd.exe set config "Default Web Site" -section:system.webServer/serverRuntime/uploadReadAheadSize:"100000" /commit:apphost

I'm sure you already are but make sure you do a reset of IIS after making these changes.

Edited September 11, 2014 by cscc

ThomasBrentnall · September 12, 2014

Ok you may need to edit the IIS config file directly and look for the entry, if it doesn't exist you will need to add it manually:

This is double the default value

Another link that directly relates to the issue:

You receive error 401.1 when you browse a Web site that uses Integrated Authentication and is hosted on IIS 5.1 or a later version

This appcmd code should work:

I'm sure you already are but make sure you do a reset of IIS after making these changes.

I have tried manually setting the value but still getting an error;

http://i.imgur.com/wOVsVs7.png

Thanks

Tom

ThomasBrentnall · September 15, 2014

Didn't manage to get any further with this on Friday, so I'm going to remove it and start again

Roberto · September 15, 2014

Why are you disabling IPv6? That's not at all a recommended or tested scenario for Exchange 2013, and can cause unpredictable errors. Not saying its the problem here of course but it's one more source of potential problems that should be nailed down.

ThomasBrentnall · September 15, 2014

Why are you disabling IPv6? That's not at all a recommended or tested scenario for Exchange 2013, and can cause unpredictable errors. Not saying its the problem here of course but it's one more source of potential problems that should be nailed down.

We don't use IPv6 in our environment.

In other news, I've now fixed my problem!

shreeramdk · February 4, 2015

How did you fix the problem ???

ThomasBrentnall · February 4, 2015

Hi, I ended up starting from scratch. I spent hours searching for a solution but gave in and just set up another server!

barrettrc · March 6, 2015

Just ran into the "413 Request Entity Too Large" issue myself and wanted to post the fix in my case. Of course, it was a single radio button:

Ensure that the Autodiscover virtual directory is set to "Ignore" Client Certificates. The deployment I was working on was somehow set to "Accept" and it caused all kinds of craziness, including completely taking down autoconfiguration of Outlook, and registering that error when running Test-OutlookWebServices |fl.

Upgrading to Exchange 2013 - test-outlookwebservices returns a 401 error

Recommended Posts

ThomasBrentnall

ThomasBrentnall

Ben-BSH

cscc

ThomasBrentnall

ThomasBrentnall

Ben-BSH

cscc

ThomasBrentnall

ThomasBrentnall

cscc

ThomasBrentnall

cscc

ThomasBrentnall

ThomasBrentnall

Roberto

ThomasBrentnall

shreeramdk

ThomasBrentnall

barrettrc

Create an account or sign in to comment

Create an account

Sign in

Recent Threads

iOS 27 BYOD and Smoothwall web filtering - Connectivity Assist causing issues?

3rd Party Warranty on Existing Panels

Edge Auto Sign in Broken / Cloud Filter

Home

Forums

What's New