Exchange Server 2019 Cannot configure mobile devices

Al Amran 326

Error Message: The connection to your email server is timed out.
Exchange Environment:
Exchange Server 2019
Reverse Proxy
Edge Server

Microsoft Connectivity Analyzer Test ActiveSync Report details,

Accepted answer

Al Amran 326 Reputation points

2021-06-27T19:42:57.51+00:00

Resolution of this issue:

We have identified the issue was in our Network side where the network team has blocked all countries except only one country(Bangladesh) to access the network.

After unblocking the location-based policy from the firewall, this issue got resolved.

Thank you.
Please sign in to rate this answer.

1 person found this answer helpful.
Kael Yao-MSFT 37,711 Reputation points Microsoft Vendor

2021-06-27T23:55:10.813+00:00

Glad to hear the issue get resolved!

Please feel free to mark your reply as the answer to the question.
It may be helpful to other community members who come up with the same issue.
Thanks for your sharing.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

2 additional answers

Robert Sparnaaij [MVP] 1,816 Reputation points MVP

2021-06-02T14:31:47.333+00:00

From the results shown, it suggest that you haven't properly configured or published the Autodiscover service.
See; Autodiscover service in Exchange Server
Please sign in to rate this answer.
Al Amran 326 Reputation points

2021-06-06T07:37:56.867+00:00

Hello anonymous userSparnaaij,

Thanks for your reply.

I think the Autodiscover service is configured properly because the Outlook client in desktop/laptop is configuring automatically from the non-domain joined device(internal and external network)

Any action item or command to verify that the Autodiscover service is not configured properly?
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.
Kael Yao-MSFT 37,711 Reputation points Microsoft Vendor

2021-06-03T03:51:12.537+00:00
Hi @Al Amran

Note:
Since the screenshot contains your personal information, I have edited the question and covered the personal information for you.
Please don't forget to hide your personal information in your post for security.
Thanks for your understanding!

As Robert mentioned, did you have a A or CNAME record in the public DNS for autodiscover.domain.com to point to the internet-facing server in your environment?

If you have set the correct autodiscover record, can you test with Outlook on a non-domain joined device to access the mailbox?
If Outlook doesn't work either, do you have some websites on the root domain(domain.com)?

To narrow down the issue, you may also test with Outlook

open Registry on the device which has Outlook installed

locate HKEY_CURRENT_USER\Software\Microsoft\Office\x.0\Outlook\AutoDiscover
(x.0 in this registry path corresponds to the Outlook version (16.0 = Outlook 2016, 15.0 = Outlook 2013, 14.0 = Outlook 2010, 12.0 = Outlook 2007).)

add a DWORD value named ExcludeHttpsRootDomain and set its value to 1

restart Outlook and check if Outlook can connect successfully

In addition, I noticed that you asked a similar question before:
Outlook 2016/2019 Client Profile is not configuring from External network, don't retrieve user profile information

I suppose the cause may be the same in this case.
And you may need to configure a redirect on the website to redirect all the requests sent to domain.com/autodiscover to autodiscover.domain.com.

If the response is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.
Please sign in to rate this answer.
Al Amran 326 Reputation points

2021-06-06T05:25:25.14+00:00

Hello @Kael Yao-MSFT ,

Thanks for hiding the personal information of this post.

We have A record in the Public DNS for autodiscover.domain.com to point internet-facing server. We can configure Outlook from a non-domain joined device internal and external network.

The only problem we are facing to configure Outlook for mobile devices. We are getting the below error message to configure Outlook for Mobile devices,

The connection to your email server is timed out.

My previous question is not the same as this post. Because the redirection is already in place and Outlook client in desktop/laptop is configuring properly from the non-domain joined device.

Kael Yao-MSFT 37,711 Reputation points Microsoft Vendor

2021-06-08T07:58:26.107+00:00

Hi,

Thanks for the information!

I suppose that the Microsoft Connectivity Analyzer Test ActiveSync Report should contain some more information about the reason why the test failed.
Would you please post the complete result of the report?

Kael Yao-MSFT 37,711 Reputation points Microsoft Vendor

2021-06-14T08:48:32.323+00:00

Hi @Al Amran

I am writing here to confirm with you how thing going now?
If you need further help, please provide more detailed information, so that we can give more appropriate suggestions.

Al Amran 326 Reputation points

2021-06-17T04:23:27.89+00:00

Al Amran 326 Reputation points

2021-06-17T06:21:07.557+00:00

@Kael Yao-MSFT

We are getting the below error,

Kael Yao-MSFT 37,711 Reputation points Microsoft Vendor

2021-06-17T06:54:23.737+00:00

Hi,

Thanks for the information!

I noticed in the screenshot the URL is https://mail.domain.com/owa.
Did you configure this URL to be the external URL of the activesync directory?

By default it is supposed to be https://mail.domain.com/Microsoft-Server-ActiveSync.

Al Amran 326 Reputation points

2021-06-17T07:24:28.733+00:00

Hello @Kael Yao-MSFT ,

Already we had configured the external URL like this below,

https://mail.domain.com/Microsoft-Server-ActiveSync

Shell I check by using the below command to verify active sync connectivity?

Test-ActiveSyncConnectivity -URL "https://mail.domain.com/Microsoft-Server-ActiveSync " -MailboxCredential (Get-Credential test3@keyman .com)

Kael Yao-MSFT 37,711 Reputation points Microsoft Vendor

2021-06-17T07:25:27.24+00:00

Hi,

Yes please test with this URL.

Al Amran 326 Reputation points

2021-06-17T07:31:42.277+00:00

Getting the below error,

Al Amran 326 Reputation points

2021-06-17T07:33:57.513+00:00

It passes all tests except for the Ping test.

Kael Yao-MSFT 37,711 Reputation points Microsoft Vendor

2021-06-17T07:58:07.757+00:00

Sorry please use this command instead:

Test-ActiveSyncConnectivity -URL "https://mail.domain.com/Microsoft-Server-ActiveSync " -MailboxCredential (Get-Credential Domain\test3)

Al Amran 326 Reputation points

2021-06-17T12:57:24.047+00:00

We have executed the below command and got the error of my last screenshot.

Test-ActiveSyncConnectivity -URL "https://mail.domain.com/Microsoft-Server-ActiveSync " -MailboxCredential (Get-Credential Domain\test3)

Kael Yao-MSFT 37,711 Reputation points Microsoft Vendor

2021-06-18T08:11:16.563+00:00

Please locate C:\Program Files\Microsoft\Exchange Server\V15\Scripts and run this command to create a test user account:

./new-TestCasConnectivityUser.ps1

And run this command without specifying a mailbox credential (it will use the test account)

Test-ActiveSyncConnectivity -URL "https://mail.domain.com/Microsoft-Server-ActiveSync "

Al Amran 326 Reputation points

2021-06-21T12:22:30.653+00:00

Please see the below error,

Kael Yao-MSFT 37,711 Reputation points Microsoft Vendor

2021-06-22T09:00:05.853+00:00

Hi,
I suppose the test user wasn't created successfully.

By default the result should be like:

Did you click enter to continue?

Al Amran 326 Reputation points

2021-06-22T12:47:18.53+00:00

Yes, I have tried to click enter, and getting the below error looks like a screenshot,

Kael Yao-MSFT 37,711 Reputation points Microsoft Vendor

2021-06-23T06:29:40.687+00:00

This error may indicate the password doesn't meet complexity requirements.
Did you use a simple password? For example, the password only contains numbers. (1234)

You may use some string like 123.com(characters from three of the following categories) to see if the test user can be created successfully.

Al Amran 326 Reputation points

2021-06-23T12:41:00.643+00:00

Hi @Kael Yao-MSFT

Thanks for your continuous reply.

Please see the below result,

Kael Yao-MSFT 37,711 Reputation points Microsoft Vendor

2021-06-25T09:37:40.887+00:00

Hi,

Thank you for your patience.

I think this error may be caused either by the credentials of the test account are incorrect or the basic authentication is disabled on the ActiveSync virtual directory.
While since the mailbox test3 can pass this first step, I suppose the cause should be with the test account.

Please delete the mailbox extest_47beeb6787114 in EAC and rerun the new-TestCasConnectivityUser.ps1 script.

Besides, have you tested with internal device connecting to Exchange using ActiveSync?
Will it work fine or have the same error(connection timeout)?

Al Amran 326 Reputation points

2021-06-26T04:12:34.37+00:00

Hello!

How could i delete extest user?

Can we test with internal device connecting to Exchange using ActiveSync?

Al Amran 326 Reputation points

2021-06-27T19:41:26.873+00:00

Hello @Kael Yao-MSFT ,

Thanks for your great support.

We have identified the issue was in our Network side where the network team has blocked all countries except Bangladesh to access the network.

After unblocking the location-based policy from the firewall, this issue got resolved.

Thanks & Regards
Amran

Al Amran 326 Reputation points

2021-06-30T05:10:29.067+00:00

Hi @Kael Yao-MSFT ,

Hope you are doing good and safe amid this pandemic.

As you already knew that our network had blocked all countries except Bangladesh to access our network. Do you have any idea which specific URL needs to be allowing in our firewall for Outlook for Android/iOS??

In the same scenario, Gmail & Other client is working well but Outlook for Android/iOS is not working because Outlook for Android uses REST protocol.

Kael Yao-MSFT 37,711 Reputation points Microsoft Vendor

2021-06-30T07:29:34.777+00:00

Hi,

I think the URL should be the same as external URL on ActiveSync virtual directory.
It should be like https://mail.domain.com/Microsoft-Server-ActiveSync.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.