EXCHANGE: Autodiscover/Outlook Connectivity Issues (STILL)

[GRitchie]

Hello,

I'm back trying to troubleshoot my never ending Exchange problems again. I'm trying to fix everything in the Remote Connectivity Analyzer tool right now, to take all of those issues out of the equation.

When I run the Outlook Connectivity Test, I get an error on 'Testing MAPI over HTTP connectivity to server mail.myschool.co.uk :: MAPI over HTTP connectivity failed.' When I drop this down I get the error on 'Testing the MAPI Address Book endpoint on the Exchange server.'

Ideas?

 

The full error log:

 

Testing the address book "Check Name" operation for user [email protected] against server mail. myschool.co.uk.
	An error occurred while attempting to resolve the name.
	
Additional Details
	
A protocol layer error occured. HttpStatusCode: 500
FailureLID: 47372
FailureInfo: 

###### REQUEST [2016-04-26T08:07:57.2003714Z] ######

POST /mapi/nspi/[email protected] HTTP/1.1
Content-Type: application/octet-stream 
User-Agent: MapiHttpClient 
X-RequestId: 82f729da-91d0-488e-9cdd-3e8793128832:1 
X-ClientInfo: 109ee0ce-ad06-49bf-a5c3-08e968007bea:1 
X-ClientApplication: MapiHttpClient/15.1.478.0 
X-RequestType: Bind 
Authorization: Negotiate [truncated] 
Host: mail. myschool.co.uk 
Content-Length: 45 

--- REQUEST BODY [+0.223] ---
..[bODY SIZE: 45]

--- REQUEST SENT [+0.223] ---

###### RESPONSE [+0:03.359] ######

HTTP/1.1 500 Internal Server Error
Transfer-Encoding: chunked 
request-id: df77c5b0-fc42-4567-921a-167b1a6d0c2f 
X-CalculatedBETarget: cps-msx.cps.local 
X-RemotePS-FailureCategory: BackendRehydration-BackendRehydrationException 
X-DiagInfo: CPS-MSX 
X-BEServer: CPS-MSX 
Persistent-Auth: true 
X-FEServer: CPS-MSX 
Cache-Control: private 
Content-Type: text/html; charset=utf-8 
Date: Tue, 26 Apr 2016 08:09:50 GMT 
Set-Cookie: X-BackEndCookie=ab491b46-4476-48b0-b5c8-50f014a95ced=u56Lnp2ejJqBysaeyp6dnprSy8rNy9LLnsrJ0saZyZ3SnZyZy8mem5rGxp7MgYHPytDNydDNz87J38/Hxc/GxcrP; expires=Thu, 26-May-2016 07:09:50 GMT; path=/mapi; secure; HttpOnly 
Server: Microsoft-IIS/8.5 
X-AspNet-Version: 4.0.30319 
X-Powered-By: ASP.NET 

--- RESPONSE BODY [+0:03.360] ---
..[bODY SIZE: 5803]
  IIS 8.5 Detailed Error - 500.0 - Internal Server Error  <!-- body{margin:0;font-size:.7em;font-family:Verdana,Arial,Helvetica,sans-serif;} code{margin:0;color:#006600;font-size:1.1em;font-weight:bold;} .config_source code{font-size:.8em;color:#000000;} pre{margin:0;font-size:1.4em;word-wrap:break-word;} ul,ol{margin:10px 0 10px 5px;} ul.first,ol.first{margin-top:5px;} fieldset{padding:0 15px 10px 15px;word-break:break-all;} .summary-container fieldset{padding-bottom:5px;margin-top:4px;} legend.no-expand-all{padding:2px 15px 4px 10px;margin:0 0 0 -12px;} legend{color:#333333;;margin:4px 0 8px -12px;_margin-top:0px; font-weight:bold;font-size:1em;} a:link,a:visited{color:#007EFF;font-weight:bold;} a:hover{text-decoration:none;} h1{font-size:2.4em;margin:0;color:#FFF;} h2{font-size:1.7em;margin:0;color:#CC0000;} h3{font-size:1.4em;margin:10px 0 0 0;color:#CC0000;} h4{font-size:1.2em;margin:10px 0 5px 0; }#header{width:96%;margin:0 0 0 0;padding:6px 2% 6px 2%;font-family:"trebuchet MS",Verdana,sans-serif; color:#FFF;background-color:#5C87B2; }#content{margin:0 0 0 2%;position:relative;} .summary-container,.content-container{background:#FFF;width:96%;margin-top:8px;padding:10px;position:relative;} .content-container p{margin:0 0 10px 0; }#details-left{width:35%;float:left;margin-right:2%; }#details-right{width:63%;float:left;overflow:hidden; }#server_version{width:96%;_height:1px;min-height:1px;margin:0 0 5px 0;padding:11px 2% 8px 2%;color:#FFFFFF; background-color:#5A7FA5;border-bottom:1px solid #C1CFDD;border-top:1px solid #4A6C8E;font-weight:normal; font-size:1em;color:#FFF;text-align:right; }#server_version p{margin:5px 0;} table{margin:4px 0 4px 0;width:100%;border:none;} td,th{vertical-align:top;padding:3px 0;text-align:left;font-weight:normal;border:none;} th{width:30%;text-align:right;padding-right:2%;font-weight:bold;} thead th{background-color:#ebebeb;width:25%; }#details-right th{width:20%;} table tr.alt td,table tr.alt th{} .highlight-code{color:#CC0000;font-weight:bold;font-style:italic;} .clear{clear:both;} .preferred{padding:0 5px 2px 5px;font-weight:normal;background:#006633;color:#FFF;font-size:.8em;} -->      HTTP Error 500.0 - Internal Server Error The page cannot be displayed because an internal server error has occurred.   Most likely causes:  IIS received the request; however, an internal error occurred during the processing of the request. The root cause of this error depends on which module handles the request and what was happening in the worker process when this error occurred. IIS was not able to access the web.config file for the Web site or application. This can occur if the NTFS permissions are set incorrectly. IIS was not able to process configuration for the Web site or application. The authenticated user does not have permission to use this DLL. The request is mapped to a managed handler but the .NET Extensibility Feature is not installed.     Things you can try:  Ensure that the NTFS permissions for the web.config file are correct and allow access to the Web server's machine account. Check the event logs to see if any additional information was logged. Verify the permissions for the DLL. Install the .NET Extensibility feature if the request is mapped to a managed handler. Create a tracing rule to track failed requests for this HTTP status code. For more information about creating a tracing rule for failed requests, click here.      Detailed Error Information:   Module   MapiHttpBackendRehydrationModule Notification   AuthenticateRequest Handler   NspiHttpHandler Error Code   0x00000000     Requested URL   https://cps-msx.cps.local:444/mapi/nspi/[email protected] Physical Path   C:\Program Files\Microsoft\Exchange Server\V15\ClientAccess\mapi\nspi\ Logon Method   Negotiate Logon User   CPS\CPS-MSX$       More Information: This error means that there was a problem while processing the request. The request was received by the Web server, but during processing a fatal error occurred, causing the 500 error. 
View more information »

Microsoft Knowledge Base Articles: 294807      
--- RESPONSE DONE [+0:03.360] ---

###### EXCEPTION THROWN [+0:03.360] ######


HTTP Response Headers:
Transfer-Encoding: chunked
request-id: df77c5b0-fc42-4567-921a-167b1a6d0c2f
X-CalculatedBETarget: cps-msx.cps.local
X-RemotePS-FailureCategory: BackendRehydration-BackendRehydrationException
X-DiagInfo: CPS-MSX
X-BEServer: CPS-MSX
Persistent-Auth: true
X-FEServer: CPS-MSX
Cache-Control: private
Content-Type: text/html; charset=utf-8
Date: Tue, 26 Apr 2016 08:09:50 GMT
Set-Cookie: X-BackEndCookie=ab491b46-4476-48b0-b5c8-50f014a95ced=u56Lnp2ejJqBysaeyp6dnprSy8rNy9LLnsrJ0saZyZ3SnZyZy8mem5rGxp7MgYHPytDNydDNz87J38/Hxc/GxcrP; expires=Thu, 26-May-2016 07:09:50 GMT; path=/mapi; secure; HttpOnly
Server: Microsoft-IIS/8.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
HttpStatusCode: 500 InternalServerError
Elapsed Time: 3396 ms.

Edited April 26, 2016 by GRitchie

[CAWJames]

Hi Glen,

 

you are getting a 500 InternalServerError which is normally generic for cant find anything to show you. Are you sure you have tracked settings/mapping/NAT from your exchange server through the firewall and out to make sure that the external address can get back to the server? I assume you have changed mail.myschool.co.uk from your proper one in the error, if not there is a space in it!!

 

Thanks

 

James

[zag]

I'd move to office 365.

 

Running an exchange server is very old technology and connectivity problems are a thing of the past when you use the cloud.

[CAWJames]

I assume if you run Exchange 2016 and maybe 2013, it is exactly the same technology as Office 365, but with more access, governance and control... just my 2p

 

We run in Hybrid with staff on-prem and students in the cloud, EOP doing all the anti-spam. Works really well for us.

 

James

[GRitchie]

Hi Glen,

I assume you have changed mail.myschool.co.uk from your proper one in the error, if not there is a space in it!!

Yes - adjusted to hide the name.

@zag - I want to move to 365 like no tomorrow, but I also need to migrate the current mailboxes across. I can't do this because Autodiscover etc. doesn't work properly

I would also like to keep it linked with AD for synchronisation

[CAWJames]

can you get to the autodiscover service from external? ie https://mail.myschool.ac.uk/autodiscover/autodiscover.xml should spit out some xml

[zag]

Yes - adjusted to hide the name.

@zag - I want to move to 365 like no tomorrow, but I also need to migrate the current mailboxes across. I can't do this because Autodiscover etc. doesn't work properly

I would also like to keep it linked with AD for synchronisation

 

I migrated all staff users by exporting peoples mailboxes to pst. Took a couple of days for all teachers but worked well as a migration strategy.

[GRitchie]

@CAWJames just tried that on 3G on my phone, it asked for username and password and I've got the 600 Invalid Request (am I right in thinking that's what you should get?)

@zag any guides on how to go about that?

Does yours still link with AD though, or do you have to manage them separately?

 

Single-sign on and synchronisation is something we really need here as staff get tired of having multiple accounts/passwords to remember - which I do empathise with in their defense!

[Matt_Renato]

A guide on PST import for Office 365. The practicality of this will depend on the number and size of the PST files you need to import as well as the speed of your internet connection.

 

If you are setting up a new tenancy I would always recommend linking it back to your on site AD. It makes controlling accounts and password so much simpler. You can still do this if you import the old emails via PST.

[GRitchie]

A guide on PST import for Office 365. The practicality of this will depend on the number and size of the PST files you need to import as well as the speed of your internet connection.

 

If you are setting up a new tenancy I would always recommend linking it back to your on site AD. It makes controlling accounts and password so much simpler. You can still do this if you import the old emails via PST.

 

Sounds exactly how I want to go about it, looking at the state of my current Exchange.

[CAWJames]

600 internal is what you should get. so thats fine. Do you have an actual "autodiscover" A record pointing back to the server in DNS proper and internally? I find using the tools in Outlook are a good way to see what is or isnt happening, as it has a better readable log. Press CTRL down and right click the Outlook icon in the task bar and select Test Email Autoconfiguration, it will then test all possible autodiscover scenarios and hopefully tell you the problem.

[GRitchie]

Log here:

[CAWJames]

Hmmm, so what actually isn't working then?

 

I have found the analyzer to not work in all scenarios.

[GRitchie]

For example:

Outlook doesn't connect (gives an error about not seeing the server). However if I then re-install Office it's fine.

When you try and view members of Distribution Groups (expand the group etc. in outlook) it shows no members and errors. But you can send an email to that group and it will work...

[CAWJames]

What version Exchange, What version Outlook?

[GRitchie]

Exchange 2013

Office 2010 (I got 2013 working somehow, but doesn't work at all on 2016)

[zag]

@zag any guides on how to go about that?

Does yours still link with AD though, or do you have to manage them separately?

 

Single-sign on and synchronisation is something we really need here as staff get tired of having multiple accounts/passwords to remember - which I do empathise with in their defense!

 

I just went round the staffs desk and spent 5mins exporting each mailbox to a pst using outlook 2010. Setup a new tenant, setup a new outlook account and re-attached the pst the day we migrated.

 

We don't have any sync with AD here, never seemed worth it to me and adds complexity. Its just an email account at the end of the day. The main downside is setting up new users takes a couple of minutes, but when its students, they are all done via csv import anyway.

[GRitchie]

I just went round the staffs desk and spent 5mins exporting each mailbox to a pst using outlook 2010. Setup a new tenant, setup a new outlook account and re-attached the pst the day we migrated.

 

We don't have any sync with AD here, never seemed worth it to me and adds complexity. Its just an email account at the end of the day. The main downside is setting up new users takes a couple of minutes, but when its students, they are all done via csv import anyway.

 

Oh, I see! Might have to end up doing half of that and then looking into AD synchronisation afterwards

Thanks.

[CAWJames]

What version 2010? We had massive problems with authentication, as it changed from Exchange 2010 to 2013. We had to change a lot of the basic/ntlm/negotiate setting for it to work. And you have to be on SP1 and latest public update of Outlook 2010

[GRitchie]

Office 2010 SP2 - 14.0.7015.1000 on all the clients here.

[CAWJames]

Ok, if you go to the Outlook mailbox settings to the Outlook Anywhere settings(2013 is completely over HTTP now, so if this is unticked it shouldn't be!), what is the auth set to? NTLM, Basic or Negotiate? See if it differs on a client that works and one that doesnt

[CAWJames]

Also going back to my notes: AutoDiscover Troubleshooting- Default authentication for Exchange VDir?s aka Virtual directories on CAS and Mailbox role « MSExchangeGuru.com helped a lot

[pow]

You can write the XML file yourself and force Outlook to look at it (PreferLocalXML), I've had to do this while running both Exchange and staged migrating to Office365.

[GRitchie]

Ok, if you go to the Outlook mailbox settings to the Outlook Anywhere settings(2013 is completely over HTTP now, so if this is unticked it shouldn't be!), what is the auth set to? NTLM, Basic or Negotiate? See if it differs on a client that works and one that doesnt

 

Can't seem to find Outlook Anywhere settings. When I open the mailbox properties, it just has 'General' 'Advanced' and 'Security' tabs. I was expecting to see the 'Connection' tab, to find that information. But it's missing...(!)

[CAWJames]

ok according to https://support.microsoft.com/en-us/kb/3000090 you may not have the tab, so what logon security do you have listed at the bottom the security tab?