RPC over HTTP(S) issues for Outlook Anywhere

[EightySix Four]

So, I'm going a bit insane on this one. Now that my server (SBS2008 SP2, Exchange SP3 RU2) set-up is complete, I've started working to connect outlook anywhere clients and I'm completely unable to do so. Utilizing testexchangeconnectivity.com I get this result,

Testing RPC/HTTP connectivity.
The RPC/HTTP test failed.
Test Steps
Attempting to resolve the host name remote.*****.com in DNS.
The host name resolved successfully.
Additional Details
IP addresses returned:

Testing TCP port 443 on host remote.*****.com to ensure it's listening and open.
The port was opened successfully.
Testing the SSL certificate to make sure it's valid.
The certificate passed all validation requirements.
Test Steps
Validating the certificate name.
The certificate name was validated successfully.
Additional Details
Host name remote.*****.com was found in the Certificate Subject Common name.

Certificate trust is being validated.
The test passed with some warnings encountered. Please expand the additional details.
Additional Details
ExRCA can only validate the certificate chain using the Root Certificate Update functionality from Windows Update. Your certificate may not be trusted on Windows if the "Update Root Certificates" feature isn't enabled.

Testing the certificate date to confirm the certificate is valid.
Date validation passed. The certificate hasn't expired.
Additional Details
The certificate is valid. NotBefore = 1/30/2011 8:26:23 PM, NotAfter = 1/30/2012 8:26:23 PM



Checking the IIS configuration for client certificate authentication.
Client certificate authentication wasn't detected.
Additional Details
Accept/Require Client Certificates isn't configured.

Testing HTTP Authentication Methods for URL https://remote.*****.com/rpc/rpcproxy.dll.
The HTTP authentication methods are correct.
Additional Details
ExRCA found all expected authentication methods and no disallowed methods. Methods found: Basic, Negotiate, NTLM

Testing SSL mutual authentication with the RPC proxy server.
Mutual authentication was verified successfully.
Additional Details
Certificate common name remote.*****.com matches msstd:remote.*****.com.

Attempting to ping RPC proxy remote.*****.com.
RPC Proxy can't be pinged.
Additional Details
A Web exception occurred because an HTTP 401 - Unauthorized response was received from IIS7.

I can open the website directly for remote.****.com/rpc/, it asks me to authenticate and then opens a blank page. This happened on a fully unpatched SBS 2008 server all the way through it being patched up (was hoping a patch would fix it ). Activesync clients (iphones, android, and WP7) all work, as does IMAP and OWA.

Any thoughts?

 

[drebo]

Exchange 2007 sucks.

Exchange 2007 is to Exchange 2010 as Vista is to Windows 7. 2010 is what 2007 should have been.

The only tips I can really offer are to make sure that your InternalURL and ExternalURLs are correctly set for Outlook Anywhere. I believe the "Get-OutlookAnywhere | fl" cmdlet will list them for you.

 

[EightySix Four]

Exchange 2007 sucks.

Exchange 2007 is to Exchange 2010 as Vista is to Windows 7. 2010 is what 2007 should have been.

The only tips I can really offer are to make sure that your InternalURL and ExternalURLs are correctly set for Outlook Anywhere. I believe the "Get-OutlookAnywhere | fl" cmdlet will list them for you.

All the info is correct...

I get the same 401 error when testing auto discovery. It seems like IIS is not allowing clients to authenticate. Is there a log for IIS authentication attempts somewhere?

 

[drebo]

Only the web logs, which aren't too great.

What type of authentication are you trying to use? Generally, "basic" works best. Also, make sure that you have the appropriate authentication providers installed for IIS (though in an SBS install, you'd think that'd all be automatic).

 

[EightySix Four]

Only the web logs, which aren't too great.

What type of authentication are you trying to use? Generally, "basic" works best. Also, make sure that you have the appropriate authentication providers installed for IIS (though in an SBS install, you'd think that'd all be automatic).

The authentication providers are all installed and I'm currently using NTLM (just switched back to basic), though I've been through basic and both.

If I go to https://autodiscover.*****.com/autodiscover/autodiscover.xml from outside the network, it asks for my credentials and then gives me an HTML 600 error, which is what I believe I'm supposed to receive.

ExRCA is attempting to test Autodiscover for ******@******.com.
Testing Autodiscover failed.
Test Steps
Attempting each method of contacting the Autodiscover service.
The Autodiscover service couldn't be contacted successfully by any method.
Test Steps
Attempting to test potential Autodiscover URL https://******.com/AutoDiscover/AutoDiscover.xml
Testing of this potential Autodiscover URL failed.
Test Steps
Attempting to resolve the host name ******.com in DNS.
The host name resolved successfully.
Additional Details
IP addresses returned:

Testing TCP port 443 on host ******.com to ensure it's listening and open.
The specified port is either blocked, not listening, or not producing the expected response.
Tell me more about this issue and how to resolve it
Additional Details
A network error occurred while communicating with the remote host.
Exception details:
Message: No connection could be made because the target machine actively refused it
Type: System.Net.Sockets.SocketException
Stack trace:
at System.Net.Sockets.TcpClient.Connect(String hostname, Int32 port)
at Microsoft.Exchange.Tools.ExRca.Tests.TcpPortTest.PerformTestReally()




Attempting to test potential Autodiscover URL https://autodiscover.******.com/AutoDiscover/AutoDiscover.xml
Testing of this potential Autodiscover URL failed.
Test Steps
Attempting to resolve the host name autodiscover.******.com in DNS.
The host name resolved successfully.
Additional Details
IP addresses returned:

Testing TCP port 443 on host autodiscover.******.com to ensure it's listening and open.
The port was opened successfully.
Testing the SSL certificate to make sure it's valid.
The certificate passed all validation requirements.
Test Steps
Validating the certificate name.
The certificate name was validated successfully.
Additional Details
Host name autodiscover.******.com was found in the Certificate Subject Alternative Name entry.

Certificate trust is being validated.
The test passed with some warnings encountered. Please expand the additional details.
Additional Details
ExRCA can only validate the certificate chain using the Root Certificate Update functionality from Windows Update. Your certificate may not be trusted on Windows if the "Update Root Certificates" feature isn't enabled.

Testing the certificate date to confirm the certificate is valid.
Date validation passed. The certificate hasn't expired.
Additional Details
The certificate is valid. NotBefore = 2/1/2011 6:08:11 AM, NotAfter = 1/30/2012 8:26:23 PM



Checking the IIS configuration for client certificate authentication.
Client certificate authentication wasn't detected.
Additional Details
Accept/Require Client Certificates isn't configured.

Attempting to send an Autodiscover POST request to potential Autodiscover URLs.
Autodiscover settings weren't obtained when the Autodiscover POST request was sent.
Test Steps
ExRCA is attempting to retrieve an XML Autodiscover response from URL https://autodiscover.******.com/AutoDiscover/AutoDiscover.xml for user ******@******.com.
ExRCA failed to obtain an Autodiscover XML response.
Additional Details
A Web exception occurred because an HTTP 401 - Unauthorized response was received from Unknown.

 

[EightySix Four]

Making progress...

Fixed the 401 (I'm an idiot, was using the wrong username format), now I get an HTTP 405 - Method Not Allowed, and I think I've narrowed that down to a broken TSGateway.

 

[EightySix Four]

Ok, so I have made a connection to the server via RPC over HTTP(S) and subsequently lost it. I have figured out why I lose it and regain it momentarily, after a short period of time, the RPC directory's SSL settings change to "accept" client certificated instead of ignore.

If I change it back to ignore, everything works, 20 mins later, it's on accept. Some process is checking the settings to make sure they're what it thinks is right, and changing them.

*FIXED*
So my initial issue was not using a properly formatted login (domain\user)
My second issue was repaired by reinstalling the RPC over HTTP and terminal services which has VERY particular settings for SBS 2008
The final issue was caused by the RPC folder deciding that it was going to inherit all of the SSL settings from the parent directory, even though no other folder does.

Phew.