I have a mailbox which i'm accessing via "outlook anywhere" through exchange 2007, via outlook 2003.. They get the synch. log with: "not downloading offline address book files" "A server (URL) could not be located" synchronization 0x8004010f I'm not really sure why.. I think it is certificate url related, but not sure. I've enabled web distribution of the OAB as well.. Any tips out there? Thanks

I found the solution.. it was rather easy.. i just needed to add a public dns entry for my domain: autodiscover.domain.com Only thing is.. when i open outlook on the rpc client, they now get a security warning for the autodiscover.domain.com not matching wan1.domain.com ssl certificate we have registered Anyone know how to make this go away? Does it involve using the powershell and issuing an ssl internal url command setting change? Thanks!

Hi Mark, To make the warning go away you would have to generate a new certificate request on the Client Access Server so that it can respond to different FQDN's. This is achieved using the Subject Alternative Name (SAN) field of the certificate. There are lots of references in these forums on certificates and the SAN field. Cheers, Rhys

Hi.. thanks for the reply.. so I would just do the certreq to godaddy.com and specify autodiscover.domain.com as the san name ultimately I take it? (per http://support.microsoft.com/kb/931351)

Hi, in the new certificate, also you need to add the FQDN Names for your CAS Servers, the internal server names. make sure that , Autodiscover.yourdomain.XXX is accessable from inside as well as outside. another important thing, make sure that the public name of the SSL Cert, is the name that the users are using from internal and external, for OWA, RPCoverHTTP or outlook Anywhere. this name should be the public name of the certificate. Regards,

I read somewhere that you have to configure a SAN entry for the SSL certificate.. but i'm not sure that this is even possible with a cert from godaddy.com though? (to fix the autodiscover.domain.com warning prompt).

Well, as per Microsoft Article # 929395: Unified Communications Certificate Partners for Exchange 2007 and for Communications Server 2007 , the following are the Only Microsoft Partner till now that thier Certificates supports the Subject Alternative Name, and your SSL Ceritificate Provider is not one of these CA Providers, check the above article to confirm that. what you can do , is to contact your Certificate Provider and check with them if thier Certificate does support the new Exchange Unified Communication Certificates or not. Here the name and the Web site for the certification authorities that issue Unified Communications Certificates for Microsoft Exchange and for Communications Server 2007: Certification authority Web site Entrust http://www.entrust.net/microsoft/ (http://www.entrust.net/microsoft/) Comodo http://www.comodo.com/msexchange (http://www.comodo.com/msexchange) DigiCert http://www.digicert.com/unified-communications-ssl-tls.htm (http://www.digicert.com/unified-communications-ssl-tls.htm) please let me know if you need more help on this issue. Regards,

markm75c wrote: I found the solution.. it was rather easy.. i just needed to add a public dns entry for my domain: autodiscover.domain.com Only thing is.. when i open outlook on the rpc client, they now get a security warning for the autodiscover.domain.com not matching wan1.domain.com ssl certificate we have registered Anyone know how to make this go away? Does it involve using the powershell and issuing an ssl internal url command setting change? Thanks! No Powershell needed. Delete thatpublic DNS entry and instead create a public CNAME record pointing autodiscover.domain.com to wan1.domain.com. Outlook 2007 will definitely complain and throw the certificate name mismatch if you use an A record, but if you use a CNAME instead it seems to be happy.

This may not be an option in our case.. I have the mx record set to wan1.domain.com.. I dont think i can change this to a cname and still have it be an mx record.. though i will test this later on. Great idea though.. never would have thought of that Thanks

Tom Pacyk wrote: markm75c wrote: I found the solution.. it was rather easy.. i just needed to add a public dns entry for my domain: autodiscover.domain.com Only thing is.. when i open outlook on the rpc client, they now get a security warning for the autodiscover.domain.com not matching wan1.domain.com ssl certificate we have registered Anyone know how to make this go away? Does it involve using the powershell and issuing an ssl internal url command setting change? Thanks! No Powershell needed. Delete thatpublic DNS entry and instead create a public CNAME record pointing autodiscover.domain.com to wan1.domain.com. Outlook 2007 will definitely complain and throw the certificate name mismatch if you use an A record, but if you use a CNAME instead it seems to be happy. Ok.. so i was able to create a cname.. autodiscover.domain.com which pointed to the a record wan1.domain.com.. so far this hasnt worked.. its been 10 hours.. i'm sure the dns propogated by now too...

Tom Pacyk wrote: markm75c wrote: I found the solution.. it was rather easy.. i just needed to add a public dns entry for my domain: autodiscover.domain.com Only thing is.. when i open outlook on the rpc client, they now get a security warning for the autodiscover.domain.com not matching wan1.domain.com ssl certificate we have registered Anyone know how to make this go away? Does it involve using the powershell and issuing an ssl internal url command setting change? Thanks! No Powershell needed. Delete thatpublic DNS entry and instead create a public CNAME record pointing autodiscover.domain.com to wan1.domain.com. Outlook 2007 will definitely complain and throw the certificate name mismatch if you use an A record, but if you use a CNAME instead it seems to be happy. Definitely didnt make a difference for me, using a cname.. for whatever reason

Did you flush your DNS on the client and server? Do you have a forward lookup zone created for your external domain name on your internal DNS servers? I would create the CNAME there first so you don't have to deal with waiting on replication. But you have the right idea. Once that CNAME is in place if you try to ping autodiscover.domain.com it should resolve to wan1.domain.com for the replies. The other thing is to delete the Outlook profile and try to recreate it.

Tom Pacyk wrote: Did you flush your DNS on the client and server? Do you have a forward lookup zone created for your external domain name on your internal DNS servers? I would create the CNAME there first so you don't have to deal with waiting on replication. But you have the right idea. Once that CNAME is in place if you try to ping autodiscover.domain.com it should resolve to wan1.domain.com for the replies. The other thing is to delete the Outlook profile and try to recreate it. I made this change on the network solutions website.. under dns management, created the Cname.. Are you saying the only reason to create this new forward lookup zone is to avoid the 24 hour delay on the new record creation? Its been a week or so, with no luck, but i didnt create the zone, didnt think i needed to. I could also try a different profile and see what that does..

I tried the new profile.. but the same thing happens

Can you run these commands and copy the output in here? get-oabvirtualdirectory | fl get-webservicesvirtualdirectory | fl get-clientaccesserver | fl Also, what's the external hostname for Outlook anywhere? wan1.domain.com?

Can you run these commands and paste the result here? get-oabvirtualdirectory | fl get-webservicesvirtualdirectory | fl get-clientaccessserver | fl Also, what's the external address for Outlook Anywhere and OWA? wan1.domain.com?

Tom Pacyk wrote: Can you run these commands and copy the output in here? get-oabvirtualdirectory | fl get-webservicesvirtualdirectory | fl get-clientaccesserver | fl Also, what's the external hostname for Outlook anywhere? wan1.domain.com? get-oabvirtualdirectory | fl Name : OAB (Default Web Site)PollInterval : 480OfflineAddressBooks : {Default Offline Address List}RequireSSL : FalseMetabasePath : IIS://exchange02.domain.local/W3SVC/1/ROOT/OABPath : C:\Program Files\Microsoft\Exchange Server\Clie ntAccess\OABServer : EXCHANGE02InternalUrl : https://exchange02.domain.local/OABInternalAuthenticationMethods : {WindowsIntegrated}ExternalUrl : https://wan1.domain.com/OABExternalAuthenticationMethods : {WindowsIntegrated}AdminDisplayName :ExchangeVersion : 0.1 (8.0.535.0)DistinguishedName : CN=OAB (Default Web Site),CN=HTTP,CN=Protocols, CN=EXCHANGE02,CN=Servers,CN=Exchange Administra tive Group (FYDIBOHF23SPDLT),CN=Administrative Groups,CN=domain-org,CN=Microsoft Exchange,CN=Serv ices,CN=Configuration,DC=domain,DC=localIdentity : EXCHANGE02\OAB (Default Web Site)Guid : b17ebf42-5f27-4743-8c01-adb747b921ccObjectCategory : domain.local/Configuration/Schema/ms-Exch-OAB-Virt ual-DirectoryObjectClass : {top, msExchVirtualDirectory, msExchOABVirtualD irectory}WhenChanged : 10/4/2007 9:49:10 AMWhenCreated : 9/24/2007 2:51:05 PMOriginatingServer : pstdc.domain.localIsValid : True get-webservicesvirtualdirectory | fl Name : EWS (Default Web Site)InternalAuthenticationMethods : {Basic, Ntlm}ExternalAuthenticationMethods : {Basic, Ntlm}BasicAuthentication : TrueDigestAuthentication : FalseWindowsAuthentication : TrueMetabasePath : IIS://exchange02.domain.local/W3SVC/1/ROOT/EWSPath : C:\Program Files\Microsoft\Exchange Server\Clie ntAccess\exchweb\EWSServer : EXCHANGE02InternalUrl : https://wan1.domain.com/EWS/Exchange.asmxExternalUrl :AdminDisplayName :ExchangeVersion : 0.1 (8.0.535.0)DistinguishedName : CN=EWS (Default Web Site),CN=HTTP,CN=Protocols, CN=EXCHANGE02,CN=Servers,CN=Exchange Administra tive Group (FYDIBOHF23SPDLT),CN=Administrative Groups,CN=domain-org,CN=Microsoft Exchange,CN=Serv ices,CN=Configuration,DC=domain,DC=localIdentity : EXCHANGE02\EWS (Default Web Site)Guid : e64bdb58-c21f-4b2d-9b9d-7b2dd8eab893ObjectCategory : domain.local/Configuration/Schema/ms-Exch-Web-Serv ices-Virtual-DirectoryObjectClass : {top, msExchVirtualDirectory, msExchWebServices VirtualDirectory}WhenChanged : 10/3/2007 12:03:42 PMWhenCreated : 9/24/2007 2:51:28 PMOriginatingServer : pstdc.domain.localIsValid : True get-clientaccessserver Name : EXCHANGE02OutlookAnywhereEnabled : TrueAutoDiscoverServiceCN : exchange02AutoDiscoverServiceClassName : ms-Exchange-AutoDiscover-ServiceAutoDiscoverServiceInternalUri : https://wan1.domain.com/autodiscover/autodisco ver.xmlAutoDiscoverServiceGuid : 77378f46-2c66-4aa9-a6a6-3e7a48b19596AutoDiscoverSiteScope : {Default-First-Site-Name}IsValid : TrueOriginatingServer : pstdc.domain.localExchangeVersion : 0.1 (8.0.535.0)DistinguishedName : CN=EXCHANGE02,CN=Servers,CN=Exchange Administr ative Group (FYDIBOHF23SPDLT),CN=Administrativ e Groups,CN=domain-org,CN=Microsoft Exchange,CN=S ervices,CN=Configuration,DC=domain,DC=localIdentity : EXCHANGE02Guid : 8b22a862-51bb-4954-aa97-a51c0ae1482cObjectCategory : domain.local/Configuration/Schema/ms-Exch-Exchang e-ServerObjectClass : {top, server, msExchExchangeServer}WhenChanged : 10/15/2007 2:43:41 PMWhenCreated : 9/24/2007 2:45:17 PM

You're missing an external URL for your Exchange Web Services.

Which command do I run to set that one? Is it this:? Set-WebServicesVirtualDirectory -Identity Exchange02.domain.local\EWS (Default Web Site) -ExternalURL https://wan1.domain.com/EWS/Exchange.asmx -BasicAuthenticationtrue I was pretty sure i ran that though...?

well you can pipe line the output of Get-WebServicesVritualDirectory with the Set-WebServicesVirtualDirectory, i used it and it works, i always use the following command: get-webservicesvirtualdirectory | Set-webservicesvirtualdirectory -ExternalURL https://wan1.domain.com/EWS/Exhcange.asmx also i noticed that you are using the internal server name as InternalURL for your Offline Address Book (OAB), do you have the internal FQDN Name of your exchange server part of your SAN Names in your SSL ? if not, then you need to change this InternalURL to point to wan1.domain.com/OAB, use the following command to change it: get-oabvirtualdirectory | Set-oabvirtualdirectory -InternalURL https://wan1.domain.com/OAB let me know if the above commands were ran successfully. Regards,

Unfortunately this didnt fix my issue.. again the issue is.. offsite.. no vpn.. using outlook anywhere (rpc over http).. i get a warning about autodiscover.domain.com not matching the name on the certificate (of wan1.domain.com).. It was suggested at one point to create a cname for autodiscover.domain.com pointing at wan1.domain.com.. but this didnt fix the issue.. i then reran the command above.. still the same prompt unfortunately.

Hi, i thought all of us were clear about this issue, that you should have autodiscover.domain.com as part of the names listed in your SSL. however , microsoft published a new update for the autodiscover techniquies in the following link: http://msexchangeteam.com/archive/2007/10/03/447176.aspx this link talks about how to configure your exchange server 2007 with your single name SSL certificate. Regards,

I am having the same issues as described in on this thread, however i do have both the internal FQDN, Netbios, and external urls attached to my SSL cert. For some reason the OAB URL is not showing up on the autodiscover service. Here are my results from the cmdlets Get-ClientAccessServer | fl-----------------------------------------------------------------------------------------------------------------------Name : <CASServer>OutlookAnywhereEnabled : TrueAutoDiscoverServiceCN : <CASServer>AutoDiscoverServiceClassName : ms-Exchange-AutoDiscover-ServiceAutoDiscoverServiceInternalUri : https://outlook.mydomain.com/Autodiscover/Autodiscover.xmlAutoDiscoverServiceGuid : 77378f46-2c66-4aa9-a6a6-3e7a48b19596AutoDiscoverSiteScope : {<Default First Site Name>}IsValid : TrueOriginatingServer : ds-app1.corp.mydomain.comExchangeVersion : 0.1 (8.0.535.0)DistinguishedName : CN=CASServer,CN=Servers,CN=Exchange Administrative Group OHF23SPDLT),CN=Administrative Groups,CN=<OrganizationName>,C osoft Exchange,CN=Services,CN=Configuration,DC=corp,DC=mydomain,DC=comIdentity : CASServerGuid : d29ec49e-7f8c-414c-81c1-80e7ad322638ObjectCategory : corp.mydomain.com/Configuration/Schema/ms-Exch-Exchange-SeObjectClass : {top, server, msExchExchangeServer}WhenChanged : 10/4/2007 5:24:51 PMWhenCreated : 8/28/2007 4:04:22 PM Get-WebServicesDirectory | fl-----------------------------------------------------------------------------------------------------------------------InternalNLBBypassUrl :Name : EWS (Default Web Site)InternalAuthenticationMethods : {Basic, Ntlm, WindowsIntegrated}ExternalAuthenticationMethods : {Basic, Ntlm, WindowsIntegrated}BasicAuthentication : TrueDigestAuthentication : FalseWindowsAuthentication : TrueMetabasePath : IIS://CASServer.corp.mydomain.com/W3SVC/1/ROOT/EWSPath : C:\Program Files\Microsoft\Exchange Server\ClientAccess\exchwServer : <CASServer>InternalUrl : https://outlook.mydomain.com/EWS/Exchange.asmxExternalUrl : https://outlook.mydomain.com/EWS/Exchange.asmxAdminDisplayName :ExchangeVersion : 0.1 (8.0.535.0)Identity : <CASServer>\EWS (Default Web Site)Guid : 41c65fc5-3ec2-4b21-b9d6-eadb69ff4376ObjectCategory : corp.mydomain.com/Configuration/Schema/ms-Exch-Web-Services al-DirectoryObjectClass : {top, msExchVirtualDirectory, msExchWebServicesVirtualDirectoWhenChanged : 9/11/2007 2:50:01 PMWhenCreated : 8/28/2007 4:07:24 PMOriginatingServer : ds-app1.corp.mydomain.comIsValid : True Get-OabVirtualdirectory | fl---------------------------------------------------------------------------------------------------------------Name : OAB (Default Web Site)PollInterval : 5OfflineAddressBooks : {Offline Address Book}RequireSSL : TrueMetabasePath : IIS://CASServer.corp.mydomain.com/W3SVC/1/ROOT/OABPath : C:\Program Files\Microsoft\Exchange Server\ClientAccess\OABServer : <CASServer>InternalUrl : https://CASServer.corp.mydomain.com/oabInternalAuthenticationMethods : {WindowsIntegrated}ExternalUrl : https://outlook.mydomain.com/OABExternalAuthenticationMethods : {WindowsIntegrated}AdminDisplayName :ExchangeVersion : 0.1 (8.0.535.0)DistinguishedName : CN=OAB (Default Web Site),CN=HTTP,CN=Protocols,CN=CasSERVER ervers,CN=Exchange Administrative Group (FYDIBOHF23SPDLT),CN=A strative Groups,CN=Dynasplint Systems,CN=Microsoft Exchange,CN ices,CN=Configuration,DC=corp,DC=mydomain,DC=comIdentity : CASServer\OAB (Default Web Site)Guid : 1477428c-6b87-4991-bf4e-ce29e94e6ea5ObjectCategory : corp.mydomain.com/Configuration/Schema/ms-Exch-OAB-Virtual-D oryObjectClass : {top, msExchVirtualDirectory, msExchOABVirtualDirectory}WhenChanged : 11/16/2007 10:17:46 AMWhenCreated : 11/15/2007 3:04:41 PMOriginatingServer : ds-app1.corp.mydomain.comIsValid : True Test-OutlookWebServices -identity administrator | ft * -AutoSize -Wrap-------------------------------------------------------------------------------------------------------------- Id Type Message -- ---- -------1003 Information About to test AutoDiscover with the e-mail address Administrator@mydomain.com.1013 Error When contacting https://mydomain.com/Autodiscover/Autodiscover.xml received the error The remote server returned an error: (401) Unauthorized.1006 Error Failed to contact AutoDiscover

Can anyone comment on whether i have the syntax of this command correct, for renewing our certificate (godaddy ssl, single name).. I was a little confused on the domain names.. but i think its correct.. where domain.local is just the local names, obviously: New-ExchangeCertificate -generaterequest -subjectname "c=United States, l=City, s=State, o=Org,cn=domain.com" -domainname domain.local,exchange02.domain.local,wan1.domain.com,autodiscover.domain.com -PrivateKeyExportable $true -path D:\Data\Scripts\certrequest.txt Thanks

Alaa Alian Al-Ankar wrote: Hi, i thought all of us were clear about this issue, that you should have autodiscover.domain.com as part of the names listed in your SSL. however , microsoft published a new update for the autodiscover techniquies in the following link: http://msexchangeteam.com/archive/2007/10/03/447176.aspx this link talks about how to configure your exchange server 2007 with your single name SSL certificate. Regards, Actually .. following these steps in that article didnt work for me.. I think this article is the only one that would work (two internal ips.. another web site creation): http://www.sembee.co.uk/archive/2007/01/21/34.aspx quoting this article: You could look to purchase an SSL certificate that supports the additional names. However none of the cheap SSL certificate providers (RapidSSL and GoDaddy) issue certificates that allow you to have the additional names. The only certificate that I have found that does is one of the US$600 certificates from Geotrust. Having to pay $600 for a certificate just to secure OWA seems very expensive and is not something that many sites will accept. Therefore the resolution to this problem I have found is to use multiple web sites. This isn't as hard as it may sound and I will give you the brief steps here. (More comprehensive instructions will appear on the amset.info web site at some point in the future). Setup Outlook Anywhere as required. This is important as it is the one feature that cannot have its virtual directory recreated using the Exchange Management Shell. Add an additional internal IP addresses to your Exchange server's network card. For example, if 192.168.1.1 was the default address for the server, you would add 192.168.1.2 as an additional address. It does not have to be the next address, just as long as it is on the same subnet (192.168.1.x)You need additional IP addresses as you cannot use host headers with SSL. Adjust the configuration of IIS so that the default IP address is bound to the default web site. This is a change from the "All unassigned" setting. Create a new web site in IIS Manager. In this example I will call it External. Set it to use the additional IP address, using the default ports. When asked for the path, use the same as the default (C:\Inetpub\wwwroot). When asked for permissions, select Read and Run Scripts only. Open the Exchange Management Shell and run the following commands:If you are supporting Exchange 2007 Mailboxes ONLY:New-OWAVirtualDirectory -OwaVersion:Exchange2007 -Name "owa" -WebSite "External"If you are also supporting Exchange 2003 mailboxes, then you need to run these additional commands:New-OwaVirtualDirectory -OwaVersion:"Exchange2003or2000" -Name "Exchange" -WebSite "External" -VirtualDirectoryType:MailboxesNew-OwaVirtualDirectory -OwaVersion:"Exchange2003or2000" -Name "Public" -WebSite "External" -VirtualDirectoryTypeublicFoldersNew-OwaVirtualDirectory -OwaVersion:"Exchange2003or2000" -Name "Exadmin" -WebSite "External" -VirtualDirectoryType:ExadminNew-OwaVirtualDirectory -OwaVersion:"Exchange2003or2000" -Name "Exchweb" -WebSite "External" -VirtualDirectoryType:ExchwebFor ActiveSync, run the following command:New-ActiveSyncVirtualDirectory -WebSiteName "External"When you refresh the configuration in Exchange Management Console, you should see two sets of virtual directories under Server Configuration, Client Access, Outlook Web Access and Exchange ActiveSync. To add Outlook Anywhere to the web site, open up IIS Manager. In the default web site, find the /rpc virtual directory. Right click on it and choose All Tasks, Save Configuration to a File and save the configuration. Then on the new web site that you have just created, right click on the root and choose New, Virtual Directory (from file) When prompted select the file that you exported from the default web site. Important note - any configuration changes to Outlook Anywhere do not appear to be reflected in this exported file, so it is important that any configuration is done before the export/import. If you make any changes to the Outlook Anywhere configuration then the export/import will need to be repeated. Delete the imported virtual directory and replace it with a freshly exported configuration file. Once you have created the virtual directories, you can then put an SSL certificate on to the new web site and then point external traffic to that address. Internal traffic can also be pointed to the new web site. Leave the self generated certificate on the default web site, as Outlook 2007 will continue to connect to it.

Hi Alian,I have followed the steps somewhere in this forum to make DNS A Record "autodiscover" to point into my Exchange CAS IP Address, but then my Outlook client give me dialog box to accept the certificate.the reason is because my current certificate is self signed by my mail server for my mail server.in order to get rid of this thing, should I purchase wild card SSL with these entries:autodiscover.domain.comwebmail.domain.comservername.domain.com?but eventhough I accept that self signed certificate, my Outlook 2007 still give me this error message:"Task 'Microsoft Exchange' reported error (0x8004010F) : 'The operation failed. An object cannot be found.'".please shed some light here for this problem.

after I bought the UCC certificate from COMODO, and I put the autodiscover and servername in my certificate, the problem still exist ? then I tried to do Autodiscover test by holding down Ctrl and right click on the outlook tray Icon, the result is "Autoconfiguration was unable to determine your settings!"

Couple of questions: What is Autodiscovery and why do we need it in 2007 Exchange? What are the pros and cons from the user end? Do most people use it or not? I have seen videos about it and want to hear from end users. When it comes to installing the certificate(s). I know we got the autodiscovery added to our dns and now when we open up outlook, we get this autodiscovery.pinnergy.com Information you exchange with this site cannot be viewed or changed by others. However, there is a problem with the site's sercurity certificate. there is a check by the following: The security certicate is from a trusted certifying authority, the security certificate date is valid. there is an x next to the name on the sercurity certificate is invbalid or does not match the name of the site. Do you want to proceed? You can press yes, no or view certificate and when you view certificate then you have the option to install it on the location machine. you can do so, however the popup still comes up with the same error. Thanks