MAPI over HTTP not working correctly, Outlook 2013 clients prompting for credentials during profile creation or opening depending on security of virtual directory

ENVIRONMENT

-1 Exchange 2013 SP1 CU7 server with all roles that is also a hybrid server with Office 365 tenant, mailboxes are all on premise only LYNC online is being utilized right now.

-Exchange 2013 public folders

-Mix of Outlook 2013 SP1 and Outlook 2010 SP3 clients all fully update to day as of Feb 2015

Outlook anywhere is working perfectly across all clients both internally and externally using autodiscover.  Both Outlook 2013 and 2010 clients can open the program and create a profile automatically via autodiscover and no additional logon prompts are seen.

We set the internal and external mapi virtual directory URLs to a valid URL that also matches the Exchange 2013 SSL certificate.  We set the security to ntlm, negotiate on the mapi virtual directory.  We reset IIS and enabled mapi over http in the org config.  We run in to problems here.

Outlook 2010 clients appear to be working fine.  We can create a new profile and open and close Outlook without any logon prompts and verify that MAPIHTTP and Negotiate are used to connect to Exchange.

Outlook 2013 clients are having problems.  As soon as we try to create a profile it says your administrator has made a change that requires you to restart outlook and then a windows logon prompt appears. If we authenticate Outlook will open and connect.   This logon prompt should not occur.    We can confirm that it is connecting via MAPI HTTP and Negotiate.

If we set the mapi virtual directory to NTLM only then a logon prompt also appears during every open of Outlook 2013.  We can confirm that it is trying to connect with MAPIHTTP via NTLM in the outlook connection test screen.

I do not understand this behavior by Outlook 2013 which was supposed to be designed with MAPI HTTP in mind.  I would think the same issues would occur with Outlook 2010 but they do not.  I am not sure how to resolve this and I am looking for help.





  • Edited by davidbwi Wednesday, March 25, 2015 12:28 AM
March 25th, 2015 12:24am

Sorry it took so long.  Working with Microsoft was not fun.

Microsoft would not determine a root cause with my level of support.

The only way we got this working was to make the user's primary SMTP email address match the user's logon UPN.

Right now we are set up like this:

Joe Smith

UPN logon:  jsmith@domain.com
Primary SMTP address:  joes@domain.com

Results in logon box when using MAPI over HTTPS but works perfectly with outlook anywhere.

If we change the user's UPN logon to joes@domain.com to match the primary SMTP address we no longer experience logon prompts in Outlook 2013.

This is not ideal and obviously is a big change but so far it was pretty seamless.  They could provide no documentation and could not even tell me if this was a bug or not.

I've never heard of the logon UPN needing to be the same of the primary SMTP to make this work before...
Free Windows Admin Tool Kit Click here and download it now
May 12th, 2015 4:28pm

On all sour AD-sites, UPN and primary SMTP address are the same. They have never been diverse.

My Resolution was to set the "MapiHttpDisabled" registry key by Group policy (to simply disable Mapi over HTTP on the client side).

Because i got the same stupid answers from Microsoft like david (concerning other problems within Outlook) i decided not to contact them again.

May 13th, 2015 3:05am

Hello,

same problem here. Ive http MAPI running in my test/home environment I get this prompts every time when opening Outlook. I can click cancel then Outlook says Need password. When I wait a minute and just click this text Outlook connects without any issue. Its not on all computers. Ive tried to remove the MAPI virtual directory and recreate it. I deleted the Outlook profile on the client. Ive removed the Outlook folder in the profile. Problem does not go away. Funny thing. Just installed Exchange Server 2016 Beta and Outlook 2016 into my VM lab and guess what. Exactly the same problem here! Http MAPI is the default in Exchange 2016. Havent tried the registry trick to force Outlook into the RPC mode. We are running Exch 2013 at work together with Outlook 2013 but I really dont dare to start using MAPI.

Cheers

Robert

Free Windows Admin Tool Kit Click here and download it now
July 24th, 2015 2:06pm

This topic is archived. No further replies will be accepted.

Other recent topics Other recent topics