I have a strange issue where he EWS website will prompt for credentials, but not accept them. This only happens if I go to the published url https://mail.mycompany.com/ews/Exchange.asmx

If I go to the server name, it goes right through after a certificate warning. https://casservername.mycompany.com/EWS/Exchange.asmx

Anyone have a thought on this?

This is causing Outlook to prompt. Autodiscover works fine, it just prompts for logging onto the mailbox. OWA and ECP working fine as well.

Thanks,

Rich

Can you run Test-autoconfiguration in outlook and post the results? You can use this site to reference how to run the test. https://kb.intermedia.net/article/2150

I cannot test it that way since it will not let me build a profile. Never gets past the credential prompt

Was this a migration or a clean install of Exchange?

clean install. I was working up until recently

Can you check the EWS virtual directory in IIS and see if anonymous authentication is set to enable? If not set it to enable along with windows authentication and do an iiisreset. In the ECP make sure the EWS virtual directory is set to integrated windows authentication. Autodiscover virtual directory should be set to integrated and basic authentication.

yes, they are setup that way. Why do you think it would work via the server name, but not the certificate name? Seems to indicate an SSL issue

Is your virtual directory for EWS set correctly? Also have you configured autodiscover Uri using set-clientaccessserver? Out of the Box it should work. If you are using the FQDN in the cert for your virtual directories do you have the appropriate DNS entries in place?

I would also agree with checking the Authentication settings on the EWS virtual directory.

Have you also tried to use the Remote Connectivty Analyzer?

https://testconnectivity.microsoft.com/

Will.

Hi,

You can run the following command to check your certificate settings and EWS settings on Exchange server:
Get-ExchangeCertificate | fl
Get-WebServicesVirtualDirectory | fl Identity,name,*url*,*auth*

Also please double check your DNS records on DNS zone.

Regards,

David