Hello,
I have been asked to look at a clients exchange environment, this environment has been a bit of a nightmare, all in all they had 3 different consultants configure different parts of the environment and things are a little on the messy side.
2 CAS servers EXCAS1 and EXCAS2 in an array named CASARRAY. Two mailbox servers EXMBX1 and EXMBX2 in a DAG.
They are not using Outlook Anywhere, their remote users VPN into the network.
OAB down
Autodiscover succeeds as follows:
SMTP=admin@example.com
Attempting URL https://casarray.contoso.com/autodiscover/autodiscover.xml found through SCP
Autodiscover to https://casarray.contoso.com/autodiscover/autodiscover.xml starting
getlasterror=0; httpstatus=200.
Autodiscover to https://casarray.contoso.com/autodiscover/autodiscover.xml Succeeded (0x00000000)
Symptoms :
Password prompt when opening outlook, at first cancelling this would occasionally lock out the user account. I have since deployed kerberos and this can now be cancelled without affecting outlook usage.
Password prompt when clicking on public folders before kerberos you could not access the folders if this was cancelled, now even if cancelled it functions fine.
If a computer is rebooted, the credentials cleared (credential manager), klist purge and outlook profile repaired. The machine runs perfectly with no password prompts for approximately half an hour and then the issue begins to recurs.
What I have done so far......
Confirmed all virtual directories are set to windows authentication with ignore SSL. I also recreated the autodiscover directory from scratch.
Deployed Kerberos to the CAS array - since this has been done the password prompts no longer affect access or lock out accounts but they are still a major annoyance.
Set the CASARRAY RPCclientaccess to encryption required and restarted the RPC and AB services.
The addressbook logging shows kerberos as the authentication method but I found it unusually that some log entries were from contosogroup/contoso/recipients and some were from contosogroup/exchange administrative group/recipients .
Now I know that there was a botched outlook 2003 decommissioning by a previous consultant and I have attempted to remedy to the best of my abilities, (ADSI, Registry, Manual Removal, etc etc) but I believe something may still remain somewhere.
If anyone has any questions I am ready and willing to try pretty much anything to get this resolved.
I really appreciate any input anyone has on these issues as I am rapidly running out of ideas.
Regards,
Adam Cooperman - MCP - MCSA - MCSE - MCTS x 4