Autodiscover Problem to connect Outlook from Non Domain

Debmallya Sanyal 1

Hi ,
We are having one issue with outlook autodiscover configuration from non domain system.

We have unidirectional connectivity on port 443 from a desktop to exchange server. We are able to connect successfully through webmail.

But we are facing some issue with autodiscover configuration. It is asking for authentication in outlook but after that it is failing
The following is showing on httpproxy/Autodiscover log on exchange server.

<desktopIP>,<exchange serverIP>,401,,UnauthenticatedRequest,POST,,,,,,,,,356,,,,0,,,0,,0,,0,0,,0,1,0,,,,,,,,,0,1,0,,1,,1,1,,,,BeginRequest=2021-12-15T13:00:29.849Z;CorrelationID=<empty>;ProxyState-Run=None;ProxyState-Complete=CalculateBackEnd;EndRequest=2021-12-15T13:00:29.865Z;,

Please help..

2 answers

Manu Philip 17,671 Reputation points MVP

2021-12-15T17:38:51.16+00:00

Do a test on the configuration from the Microsoft test connectivity portal, by selecting 'Use Audodiscover...' This will show you the point at which the connectivity fails like Certificate, DNS records, authentication etc.

If it looks as an IIS permission issue, the reference documentation can help to correct it is here: https://learn.microsoft.com/en-us/exchange/clients/default-virtual-directory-settings?view=exchserver-2019

https://testconnectivity.microsoft.com/tests/Ola/input
Please sign in to rate this answer.
Debmallya Sanyal 1 Reputation point

2021-12-15T18:28:21.397+00:00

Hi ,
Thanks for the reply. The desktop has no internet connection.
I am running fiddler trace. It is going to autodiscover.<domain>. But the response is coming as 502 and showing connection to autodiscover is failed.

Manu Philip 17,671 Reputation points MVP

2021-12-15T18:39:46.603+00:00

Have you also checked the IIS authentication settings are correct or not?

Debmallya Sanyal 1 Reputation point

2021-12-15T18:58:29.583+00:00

Thanks..

1)We can access the same mailbox from the same desktop using webmail... Only Outlook not working
2) We are also able to access the same mailbox by outlook from another domain joined desktop.

Based on above scenario can you please suggest where in IIS authentication i need to check.

Manu Philip 17,671 Reputation points MVP

2021-12-15T19:19:28.497+00:00

Looks like you don't have the necessary DNS records so that outlook can find autodiscover settings
autodiscover.domain.com to be pointed to the email server

Debmallya Sanyal 1 Reputation point

2021-12-16T10:54:15.51+00:00

Hi ,
We have published mail.domain.com and autodiscover.domain.com in DNS..
Sign in to comment
KyleXu-MSFT 26,246 Reputation points

2021-12-16T02:47:56.633+00:00
@Debmallya Sanyal

Since you could connect to Exchange server from domain-joined computer, we can know this issue is related with the DNS record. The OWA only needs to use the mail.domain.com, but the Outlook client needs to use both "mail.domain.com" and "autodisocver.domain.com".

If you are using Outlook 2016 and later version, you use command below to create a blank profile

outlook.exe /pim "No Account"

The use the "Test E-mail AutoConfiguration" to check the Autodiscover service, make sure it could resolution successfully:

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.
Please sign in to rate this answer.
Debmallya Sanyal 1 Reputation point

2021-12-16T10:28:12.487+00:00

Hi ,
Thanks for this. Autodiscover record is been set. I can see the autodiscover is getting succeeded by the above mentioned step.
It is asking for authentication while configuring outlook from that desktop(Non Domain). But that authentication is getting failed while the password is correct. Same is working from a domain joined desktop.

So looks like the problem is happening with outlook authentication from the non domain system.

<desktopIP>,<exchange serverIP>,401,,UnauthenticatedRequest,POST,,,,,,,,,356,,,,0,,,0,,0,,0,0,,0,1,0,,,,,,,,,0,1,0,,1,,1,1,,,,BeginRequest=2021-12-15T13:00:29.849Z;CorrelationID=<empty>;ProxyState-Run=None;ProxyState-Complete=CalculateBackEnd;EndRequest=2021-12-15T13:00:29.865Z;,

KyleXu-MSFT 26,246 Reputation points

2021-12-20T08:43:14.33+00:00

Could you help us troubleshoot further?
Try to configure a new profile, check whether could configurate successfully. If you cannot configure successful, which step do you get error?

I also suggest have a check about the Outlook Anywhere or MAPI Over HTTP configuration (Decided by the version of Exchange you used). I guess you may forget to configure the URL or authentication method for external client.

Get-OutlookAnywhere | fl Identity,*ExternalHostname*,*AuthenticationMethod* Get-MapiVirtualDirectory | fl Identity,*URL*,*Methods*

KyleXu-MSFT 26,246 Reputation points

2021-12-22T09:19:37.07+00:00

Any update about this thread now? Whether the external authentication and URL configured?

Debmallya Sanyal 1 Reputation point

2021-12-23T16:37:47.083+00:00

Hi ,
Thanks for looking into. I was a bit busy.

Looks like we are getting closer.

When I am creating new profile in outlook it is asking for userid and password. After typing same it is not progressing and throwing "an error an encrypted connection not found..." in outlook. Sometimes in AD the account is getting locked out. Webmail from same system is working properly.

We are using exchange 2013 and Outlook Anywhere. In Org config mapihttpenabled is false.

You are right. ExternalUrl is showing as blank..

1)

Get-MapiVirtualDirectory | fl identity,url,*methods

Identity : <servername>\mapi (Default Web Site)
InternalUrl : https://<servername>/mapi
ExternalUrl :
IISAuthenticationMethods : {Ntlm, OAuth, Negotiate}
InternalAuthenticationMethods : {Ntlm, OAuth, Negotiate}
ExternalAuthenticationMethods : {Ntlm, OAuth, Negotiate}

2)

Get-OutlookAnywhere | fl Identity,ExternalHostname,*AuthenticationMethod
Creating a new session for implicit remoting of "Get-OutlookAnywhere" command...

Identity : <servername>\Rpc (Default Web Site)
ExternalHostname : <name>
ExternalClientAuthenticationMethod : Ntlm
InternalClientAuthenticationMethod : Ntlm

Please Help...

Debmallya Sanyal 1 Reputation point

2021-12-27T10:38:05.683+00:00

Hi ,
Please advise me on this.

KyleXu-MSFT 26,246 Reputation points

2021-12-28T09:07:29.627+00:00

I would suggest you enable MAPI, then configure ExternalURL for it：

Set-OrganizationConfig -MapiHttpEnabled $true Get-MapiVirtualDirectory | Set-MapiVirtualDirectory -ExternalUrl https://ExternalName.contoso.com/mapi

If you want to use Outlook Anywhere, you need to use the command below:

Get-OutlookAnywhere | Set-OutlookAnywhere -ExternalHostname ExternalName.domain.com -ExternalClientsRequireSsl $true -ExternalClientAuthenticationMethod Negotiate

Debmallya Sanyal 1 Reputation point

2021-12-28T18:25:44.217+00:00

Hi ,
Please let me know if you can help here.

Debmallya Sanyal 1 Reputation point

2021-12-29T09:40:17.49+00:00

Hi ,
Thanks for reply. If i run below command I am getting.

Get-OutlookAnywhere | fl external

ExternalHostname : externalname.domain name
ExternalClientAuthenticationMethod : Ntlm
ExternalClientsRequireSsl : True

So you suggest me to change the AuthenticationMethod to Negotiate if i want to use outlook anywhere from Ntlm.

So if i change same on one exchange CAS server and will try to create outlook profile for any mailbox located on that server from the non domain system - to give a try?
I can use hostfile entry on that non domain system to redirect the autodiscover /mail traffic towards that server where i will make the change.

Please let me know if i am correct. Actually i want to test on one server before changing same for all CAS servers. Please let me know if that will be correct.

KyleXu-MSFT 26,246 Reputation points

2021-12-31T09:47:40.097+00:00

it is suggested to have a try about it. You can also try with the MAPI Over Http, it is more stable than Outlook Anywhere.

Debmallya Sanyal 1 Reputation point

2022-01-04T10:05:52.78+00:00

Hi ,
I tried it on one server. I put host file entry on the non domain based system to redirect the autodiscover traffic to the server where i changed it to negotiate.
It is not working. It is getting stopped in same area while trying authentication through outlook. In IIS log and autodiscover log on RPC/Https on exchange server we are getting same 401 error..

2022-01-03 11:40:29 <exchange server IP> POST /autodiscover/autodiscover.xml &CorrelationID=<empty>;&ClientId=MCHHAGS0ZODFCLHTMW&cafeReqId=dcb73831-91ce-4584-9da4-2d0fc4ea9e83; 443 <mail address> 10.23.5.114 Outlook/16.0+(16.0.5197.1000;+MSI;+x86) - 401 1 1326 93
2022-01-03 11:40:50 <exchange server IP> POST /autodiscover/autodiscover.xml &CorrelationID=<empty>;&ClientId=TDZRRC9EABAIWBDNAA&cafeReqId=86554a83-bf7a-47f8-9236-ca3a01e83d31; 443 - <workstation IP> Microsoft+Office/16.0+(Windows+NT+10.0;+MAPI+16.0.5254;+Pro) - 401 0 0 62

I believe next i have to try enabling MAPI .Can we do same for a single mailbox without enabling same for full Org using (Set-OrganizationConfig -MapiHttpEnabled $true ) ?

Please suggest..

KyleXu-MSFT 26,246 Reputation points

2022-01-07T09:18:26.67+00:00

About MAPI Over HTTP, you need to enable it from the organization level first. Otherwise, it will not work on mailbox. You can choose a free time to test it in your organization.

Debmallya Sanyal 1 Reputation point

2022-01-10T11:30:30.68+00:00

Hi ,
Thanks for this. Can there be any issue of we change MAPI Over HTTP for full organization from outlook anywhere? Do i need to check anything before?
Sorry i do not know much about it.
We are having exchange 2013 CU23...

I am getting below in event log while trying to login from outlook from the non domain based system. Where as webmail is working fine from same system.

The computer attempted to validate the credentials for an account.

Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account: <mail adrress of the account>
Source Workstation: <server Name>
Error Code: 0xC0000064

Debmallya Sanyal 1 Reputation point

2022-01-10T11:40:11.567+00:00

An account failed to log on.

Subject:
Security ID: SYSTEM
Account Name: <server Name>$
Account Domain: <domain name>

Logon Type: 8

Account For Which Logon Failed:
Security ID: NULL SID
Account Name: <mail adrress of the account>
Account Domain: <server Name>

Failure Information:
Failure Reason: Unknown user name or bad password.
Status: 0xC000006D
Sub Status: 0xC0000064

Process Information:
Caller Process ID: 0x7bb4
Caller Process Name: C:\Windows\System32\inetsrv\w3wp.exe

Network Information:
Workstation Name: <server Name>
Source Network Address: <work station IP>
Source Port: 49691
Detailed Authentication Information:
Logon Process: Advapi
Authentication Package: Negotiate

Looks like when authentication is coming from non domain outlook the security ID is showing NULL SID which may be causing the problem.

KyleXu-MSFT 26,246 Reputation points

2022-01-25T06:52:45.72+00:00

This log isn't for Outlook logon. The Security ID is SYSTEM, it isn't user logon action. It is a logon action for "Advapi".

Here is the logon action in my lab:

About analyzing Event log, it is suggested to open a ticket to Microsoft, you will could send logs in email to them which beneficial to log analysis.
Sign in to comment

Share via

Autodiscover Problem to connect Outlook from Non Domain

2 answers