401 Unauthorized in Outlook Anywhere on SBS 2008
Hi all. We've got an SBS 2008 box here with clients connecting using Outlook 2007 over Outlook Anywhere. Whilst going about their daily business, users are randomly receiving a windows authentication dialog box stating "Connecting to remote.mydomain.com". When entering the user credentials the box comes back straight away (suggesting an authentication failed event). After clicking cancel a few times, the box disappears and the user is able to work as per usual. Outlook appears to continue to work, so it's not affecting anything in particular, but the authentication dialog box keeps coming back every 10 minutes or so which is very frustrating to the users. Taking a look at the IIS logs on the server, they're filled with a ton of 401.1 and 401.2 error messages, a small extract: 2010-12-31 00:21:37 192.168.0.30 POST /EWS/Exchange.asmx - 443 - 121.x.x.x Microsoft+Office/12.0+(Windows+NT+5.1;+Microsoft+Office+Outlook+12.0.6545;+Pro) 401 1 13 62 2010-12-31 00:21:37 192.168.0.30 POST /EWS/Exchange.asmx - 443 - 121.x.x.x Microsoft+Office/12.0+(Windows+NT+5.1;+Microsoft+Office+Outlook+12.0.6545;+Pro) 401 1 13 312 2010-12-31 00:21:37 192.168.0.30 POST /EWS/Exchange.asmx - 443 - 121.x.x.x Microsoft+Office/12.0+(Windows+NT+5.1;+Microsoft+Office+Outlook+12.0.6545;+Pro) 401 1 13 62 2010-12-31 00:21:37 192.168.0.30 POST /EWS/Exchange.asmx - 443 - 121.x.x.x Microsoft+Office/12.0+(Windows+NT+5.1;+Microsoft+Office+Outlook+12.0.6545;+Pro) 401 1 64 46 2010-12-31 00:21:38 192.168.0.30 POST /EWS/Exchange.asmx - 443 - 121.x.x.x Microsoft+Office/12.0+(Windows+NT+5.1;+Microsoft+Office+Outlook+12.0.6545;+Pro) 401 1 13 62 2010-12-31 00:21:38 192.168.0.30 POST /EWS/Exchange.asmx - 443 - 121.x.x.x Microsoft+Office/12.0+(Windows+NT+5.1;+Microsoft+Office+Outlook+12.0.6545;+Pro) 401 1 13 93 2010-12-31 00:21:38 192.168.0.30 POST /EWS/Exchange.asmx - 443 - 121.x.x.x Microsoft+Office/12.0+(Windows+NT+5.1;+Microsoft+Office+Outlook+12.0.6545;+Pro) 401 1 13 78 2010-12-31 00:21:38 192.168.0.30 POST /EWS/Exchange.asmx - 443 - 121.x.x.x Microsoft+Office/12.0+(Windows+NT+5.1;+Microsoft+Office+Outlook+12.0.6545;+Pro) 401 1 64 46 2010-12-31 00:21:42 192.168.0.30 POST /autodiscover/autodiscover.xml - 443 dja\kate 121.x.x.x Microsoft+Office/12.0+(Windows+NT+5.1;+Microsoft+Office+Outlook+12.0.6545;+Pro) 200 0 64 234 2010-12-31 00:28:02 192.168.0.30 POST /EWS/Exchange.asmx - 443 - 192.168.0.1 Microsoft+Office/12.0+(Windows+NT+6.1;+Microsoft+Office+Outlook+12.0.4518;+Pro) 401 2 5 0 2010-12-31 00:28:02 192.168.0.30 POST /EWS/Exchange.asmx - 443 - 192.168.0.1 Microsoft+Office/12.0+(Windows+NT+6.1;+Microsoft+Office+Outlook+12.0.4518;+Pro) 401 2 5 0 2010-12-31 00:28:02 192.168.0.30 POST /EWS/Exchange.asmx - 443 - 192.168.0.1 Microsoft+Office/12.0+(Windows+NT+6.1;+Microsoft+Office+Outlook+12.0.4518;+Pro) 401 1 13 203 2010-12-31 00:31:36 192.168.0.30 GET /_vti_bin/sitedata.asmx - 80 - 192.168.0.1 Mozilla/4.0+(compatible;+MSIE+8.0;+Windows+NT+6.1;+WOW64;+Trident/4.0;+SLCC2;+.NET+CLR+2.0.50727;+.NET+CLR+3.5.30729;+.NET+CLR+3.0.30729;+InfoPath.2) 404 0 0 156 2010-12-31 00:32:13 192.168.0.30 POST /EWS/Exchange.asmx - 443 - 192.168.0.1 Microsoft+Office/12.0+(Windows+NT+6.1;+Microsoft+Office+Outlook+12.0.4518;+Pro) 401 1 13 203 2010-12-31 00:33:26 192.168.0.30 GET /EWS/Exchange.asmx - 80 - 192.168.0.1 Mozilla/4.0+(compatible;+MSIE+8.0;+Windows+NT+6.1;+WOW64;+Trident/4.0;+SLCC2;+.NET+CLR+2.0.50727;+.NET+CLR+3.5.30729;+.NET+CLR+3.0.30729;+InfoPath.2) 403 4 5 218 2010-12-31 00:34:38 192.168.0.30 POST /Microsoft-Server-ActiveSync/default.eas Cmd=Sync&DeviceId=-----snip-------Translated=T 443 dja\dennis 114.75.78.16 - 200 0 0 810883 2010-12-31 00:35:46 192.168.0.30 POST /EWS/Exchange.asmx - 443 - 192.168.0.1 Microsoft+Office/12.0+(Windows+NT+6.1;+Microsoft+Office+Outlook+12.0.4518;+Pro) 401 1 13 203 I've taken a look at the IIS configuration and can't see any obvious problems, both Basic and Windows authentication is enabled on the sites in questions -- but I could easily be missing something due to the huge amount of sites and virtual directories SBS uses. I'm not entirely sure if the problem lies with Outlook Anywhere, OWA or something else. If this were a straight Exchange box I'd probably look at doing remove-OwaVirtualDirectory and set-OwaVirtualDirectory or similar, but I'm very aware of the fact that this is an SBS box and IIS has been configured for it rather than Exchange. Given that users are actually able to work at the moment (although annoyed by the dialog boxes), I don't want to break things further. Anyone have any suggestions as to where the problem may lie?
December 30th, 2010 9:42pm

Hi What auth mecanism is used for Outlook ANywhere? Is it published with ISA/TMG or just port forwarded? Is there any certificate installed, if yes, what names are included Run these commands and post the result in the thread get-OwaVirtualDirectory | fl get-ecpVirtualDirectory | fl get-webservicesVirtualDirectory | fl get-OABVirtualDirectory | fl get-ActiveSyncVirtualDirectory | fl Jonas Andersson MCTS: Microsoft Exchange Server 2007/2010 | MCITP: EMA 2007/2010 | MCSE/MCSA Blog: http://www.testlabs.se/blog
Free Windows Admin Tool Kit Click here and download it now
January 2nd, 2011 11:50am

Just a shot in the dark. At what patch level are you for Exchange? If you are still on Exchange SP1 Rollup 7, this is a well-known problem which was discussed much by the end of 2009 and the first half of 2010. Outlook 2007 Credential Prompts in Small Business Server 2008 http://blogs.technet.com/b/sbs/archive/2010/02/16/outlook-2007-credential-prompts-in-small-business-server-2008.aspx If that should be the issue, upgrade to at least Exchange 2007 SP2. Then download and install the rollups. Do so from an elevated Administrator prompt ("DOS prompt"). Description of the Microsoft Exchange Server 2007 Service Pack 2 Installation Tool for Windows Small Business Server 2008 http://support.microsoft.com/kb/974271/ As you can see from the KB above, with SBS 2008 it is not always straight forward to upgrade components. Am not running SBS 2008 myself anymore, so I'm not quite familiar with what issues you might run into with Exchange 2007 SP3 (see below), but Exchange 2007 SP2 with the Microsoft tool works very well. How to install Exchange 2007 SP3 on SBS 2008 http://www.sbsfaq.com/?p=2140MCTS: Messaging | MCSE: S+M | Small Business Specialist
January 2nd, 2011 2:25pm

Jon-Alfred, I think you might be exactly right. We were running Exchange on SP1. Your linked blog post appears to exactly describe the issue we were running into. I've since installed SP3 and update rollup 2 for SP3 and confirmed that applicationHost now says "<windowsAuthentication enabled="false" useKernelMode="false">" All our users are currently on holidays (as you two should be!) so I'll report back in a couple of days when they're back in the office as to if this has resolved their issue. Thanks to both of you for your prompt responses when you should in fact be on holidays :)
Free Windows Admin Tool Kit Click here and download it now
January 3rd, 2011 2:23am

Hi Alan, How about your question? Any updates?Please remember to click Mark as Answer on the post that helps you, and to click Unmark as Answer if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.
January 6th, 2011 9:09pm

Sorry guys, I had planned on getting back to you yesterday but work got a little busy. We're not longer experiencing this issue so it appears Jon-Alfred was on the ball with his suggestion. Thanks all very much for your assistance.
Free Windows Admin Tool Kit Click here and download it now
January 6th, 2011 9:33pm

This topic is archived. No further replies will be accepted.

Other recent topics Other recent topics