Exchange2019 in a test environment

Question

Exchange2019 in a test environment

Brian Jesteadt 1

We have been trying to verify our Exchange2019 backups are working properly, so we recently restored a few VMs to a spare server as a "Test Environment". Everything appeared ok at first, as all the mailbox databases mounted and OWA works normally.

I started a client VM to see if Outlook would connect, and that's when I found that Outlook clients that were 2013 or newer would not authenticate to the server correctly. Strangely, Outlook 2010 still works in the test lab network. But 2013 and 2016 give me an error with new Outlook profiles and with existing Outlook profiles. Setting up a new profile gets to the "Logging on to the mail server" step, and pops up an error dialog box with this text:

"Outlook cannot log on. Verify you are connected to the network and are using the proper server and mailbox name. The connection to Microsoft Exchange is unavailable. Outlook must be online or connected to complete this action."

So why would OWA and Outlook 2010 work, but not 2013 and 2016? Is there some certificate validation in the newer versions? Why would it fail at the authentication step? The same systems in our production environment work perfectly. I'm stumped!

Yuki Sun-MSFT 41,376 Reputation points Moderator

2022-01-05T09:09:36.777+00:00
Hi @Brian Jesteadt ,

Have you tried running the "Test E-Mail Autoconfiguration" on Outlook 2013 or Outlook 2016 and see if there would be any clues related to Autodiscover?

Create a new Outlook profile with no account or any other accounts which can make Outlook open and running.

While Outlook is running, click the CTRL key and then right-click the Outlook icon in the system tray, select “Test Email Autoconfiguration”.

Enter the user's email address and password, uncheck “Use Guessmart” and “secure Guessmart authentication” boxes. Then click the “Test” button.

Once it runs, Check output in the Log tab and Results tab.

Besides, it's recommended to checking for and installing all available updates for Outlook 2013 and Outlook 2016 to see if there would be any improvement.
Brian Jesteadt 1 Reputation point

2022-01-05T13:53:25.697+00:00

I can run it in my production environment, and it returns that it is successful, which seems obvious because it works there. I haven't been able to get a working outlook profile in the test environment. Is there a way to run the "Test Email Autoconfiguration" without running Outlook first?
Brian Jesteadt 1 Reputation point

2022-01-05T13:55:07.693+00:00

I also found an article talking about the Exchange Powershell command "Test-OutlookWebServices" but that fails in both the production and the test environments. Not sure what to think of that.
Yuki Sun-MSFT 41,376 Reputation points Moderator

2022-01-07T07:50:27.3+00:00
Hi @Brian Jesteadt ,

The "Test-OutlookWebServices" is functional only in Exchange Server 2010, see this document. So it's expected that it fails in your environments running Exchange 2019.

Regarding the "Test E-Mail Autoconfiguration", it requires Outlook to run first. As mentioned earlier, aside from get Outlook working using another account, you can create an Outlook profile with "no" account. Below are the steps I used in my Outlook 2016 client:

Create a new Outlook profile via Control Panel. You may refer to the Create a new profile section in this article.

Click Cancel in the page below:

Click OK when you are prompted to confirm if you want to create a profile with no account:

Open Outlook using the new blank profile, when prompted, select "No":

Tick the checkbox of "Use Outlook without an email account", Finish:
Brian Jesteadt 1 Reputation point

2022-01-07T16:31:53.647+00:00

Great tip, I never knew I could do that. The test ran successfully, so it appears that Autoconfiguration is not the problem.

4 answers

Your answer

Yuki Sun-MSFT 41,376 Reputation points Moderator

2022-01-05T09:09:36.777+00:00

Hi @Brian Jesteadt ,

Have you tried running the "Test E-Mail Autoconfiguration" on Outlook 2013 or Outlook 2016 and see if there would be any clues related to Autodiscover?

Create a new Outlook profile with no account or any other accounts which can make Outlook open and running.

While Outlook is running, click the CTRL key and then right-click the Outlook icon in the system tray, select “Test Email Autoconfiguration”.

Enter the user's email address and password, uncheck “Use Guessmart” and “secure Guessmart authentication” boxes. Then click the “Test” button.

Once it runs, Check output in the Log tab and Results tab.

Besides, it's recommended to checking for and installing all available updates for Outlook 2013 and Outlook 2016 to see if there would be any improvement.
Brian Jesteadt 1 Reputation point

2022-01-05T13:53:25.697+00:00

I can run it in my production environment, and it returns that it is successful, which seems obvious because it works there. I haven't been able to get a working outlook profile in the test environment. Is there a way to run the "Test Email Autoconfiguration" without running Outlook first?
Brian Jesteadt 1 Reputation point

2022-01-05T13:55:07.693+00:00

I also found an article talking about the Exchange Powershell command "Test-OutlookWebServices" but that fails in both the production and the test environments. Not sure what to think of that.
Yuki Sun-MSFT 41,376 Reputation points Moderator

2022-01-07T07:50:27.3+00:00

Hi @Brian Jesteadt ,

The "Test-OutlookWebServices" is functional only in Exchange Server 2010, see this document. So it's expected that it fails in your environments running Exchange 2019.

Regarding the "Test E-Mail Autoconfiguration", it requires Outlook to run first. As mentioned earlier, aside from get Outlook working using another account, you can create an Outlook profile with "no" account. Below are the steps I used in my Outlook 2016 client:

Create a new Outlook profile via Control Panel. You may refer to the Create a new profile section in this article.

Click Cancel in the page below:

Click OK when you are prompted to confirm if you want to create a profile with no account:

Open Outlook using the new blank profile, when prompted, select "No":

Tick the checkbox of "Use Outlook without an email account", Finish:
Brian Jesteadt 1 Reputation point

2022-01-07T16:31:53.647+00:00

Great tip, I never knew I could do that. The test ran successfully, so it appears that Autoconfiguration is not the problem.

Answer 1

Andy David - MVP 157.8K MVP Volunteer Moderator

How are you restoring to the Test site?
If you are restoring the vm snapshot that includes the Exchange database, that isnt supported.

https://learn.microsoft.com/en-us/exchange/plan-and-deploy/virtualization?view=exchserver-2019

The only supported method would be to build a new test server and forest that match the prod AD forest and restore the databases from an Exchange aware backup or copied edb database.

Example:

https://learn.microsoft.com/en-us/exchange/high-availability/disaster-recovery/restore-data-using-recovery-dbs?view=exchserver-2019

or run the recoverserver option assuming the test forest was a clone of the prod:

https://learn.microsoft.com/en-us/exchange/high-availability/disaster-recovery/recover-exchange-servers?view=exchserver-2019

If the test environment is a server in the prod AD forest, then you could also use database portability:

https://learn.microsoft.com/en-us/exchange/high-availability/disaster-recovery/database-portability?view=exchserver-2019

Brian Jesteadt 1 Reputation point

2022-01-04T21:55:53.613+00:00

Thanks for that information. We are using an Exchange-aware backup software (Veeam) to do the backups and restores. I would speculate that would be a supported method, since it is a well documented feature of the Veeam software.
Andy David - MVP 157.8K Reputation points MVP Volunteer Moderator

2022-01-04T22:09:50.937+00:00

This sounds like a separate AD forest as a test correct?

Is autodiscover setup correctly in the test forest?

Does this apply at all?
https://learn.microsoft.com/en-us/exchange/troubleshoot/client-connectivity/outlook-connection-issue-caused-by-rpc-encryption-requirement
Brian Jesteadt 1 Reputation point

2022-01-05T13:36:24.657+00:00

No, we have not setup a separate forest. This is an isolated test lab environment with no connectivity to the production network, or to the internet.

We are simply mirroring a subset of the production environment in the test lab server Hyper-V.
Andy David - MVP 157.8K Reputation points MVP Volunteer Moderator

2022-01-05T13:40:50.863+00:00

and is autodiscover set up correctly?

If you run a fiddler trace on the client, what is it trying to connect to when it fails?
Brian Jesteadt 1 Reputation point

2022-01-05T14:27:11.19+00:00

Great suggestion. Fiddler shows that the Outlook client is trying to reach out to check the Certificate Revocation List for our Exchange SSL certificate. It's sending a request to crl.godaddy.com, and GoDaddy is who we purchased our certificate from. Can I disable certificate revocation checks in Outlook?
Andy David - MVP 157.8K Reputation points MVP Volunteer Moderator

2022-01-05T14:31:59.553+00:00

Does this work?

https://www.stigviewer.com/stig/microsoft_office_365_proplus/2020-09-11/finding/V-223358
Brian Jesteadt 1 Reputation point

2022-01-05T19:35:26.123+00:00

I have setup group policies to apply the settings recommended in the article you mentioned. However, when I look in Fiddler, it still shows Outlook trying to check the certificate revocation status with GoDaddy. Outlook does produce a slightly different error message (something about the .OST file), but no, it didn't fix the issue. The .OST file error is strange, since this is a new profile. Not sure what to think about that.
Andy David - MVP 157.8K Reputation points MVP Volunteer Moderator

2022-01-05T19:44:17.863+00:00

Yea, Not sure if you need to also disable IE checking for that as you did in the old days. I would hate to put you on a wild goose chas.
Still wondering about the autodiscover setting. It this a domain-joined workstation? Does it work differently if its not domain-joined and are all the required DNS settings for autodiscover set in the isolated subnet?
Brian Jesteadt 1 Reputation point

2022-01-06T15:48:14.21+00:00

I've tried disabling checking in Internet Options under the Control Panel (like the old days), but to no avail. The autodiscover on my one test system is completing successfully, albeit after taking a very long time. It still fails to open Outlook, even when not joined to the domain. The error message currently is:

"Cannot start Microsoft Outlook. Cannot open the Outlook window. The set of folders cannot be opened. The file C:\Users[user name]\Appdata\Local\Microsoft\Outlook\Outlook.ost is not an Outlook data file (.ost)."

It's a new profile, so I have no clue why it would be tossing an OST file error. I'm going to assume that it couldn't connect to Exchange, so it couldn't create the OST file.
Andy David - MVP 157.8K Reputation points MVP Volunteer Moderator

2022-01-06T18:00:38.21+00:00
Is the isolated subnet in the same AD site as prod? Or a separate AD site?

Is the internal Autodiscover record discoverable by the domain-joined client?

Get-clientaccessservice <testServer> |FL AutoDiscoverServiceInternalUri

Can you create a hosts file on a non-domain joined client that points to the test server for autodiscover.yourdomain.com? Even if it throws an error about the cert, wonder if it finds it quicker then
Brian Jesteadt 1 Reputation point

2022-01-07T16:26:35.537+00:00

Same AD site, because the isolated subnet is an exact clone of the production environment. I've restored our Exchange Server and also our primary Active Directory/DNS/DHCP server from backup to the test Hyper-V server, so everything AD or DNS related should be identical.

The client doesn't have the Exchange powershell commands, but if I run your query on the Exchange server, it does return the correct autodiscover address.

I don't need to point a hosts file to the address, because my DNS is resolving autodiscover.[mydomain].com normally on all clients, because I have the DNS server running on my test AD VM that I restored from backup.

Answer 2

Andy David - MVP 157.8K MVP Volunteer Moderator

I know it doesnt appear to be an Autodiscover issue, but can you try this?

HKEY_CURRENT_USER\Software\Microsoft\Office\X\Outlook\AutoDiscover

Add the ExcludeExplicitO365Endpoint DWORD key to Outlook and set to 1

https://learn.microsoft.com/en-us/outlook/troubleshoot/profiles-and-accounts/unexpected-autodiscover-behavior

This should apply to Outlook 2016, and I know that 2013 isnt working either, but thought at least worth trying.

These sort of issue are really hard to troubleshoot from here as you can imagine :)

Brian Jesteadt 1 Reputation point

2022-01-10T19:03:20.337+00:00

Without a doubt, this is a particularly baffling issue. I can't say that I see any change after adding the registry key you mentioned. I even tried one or two other keys from that article, but no difference at all.

Could it be a SSL/TLS version negotiation/compatibility issue? Not sure why that would be a problem only in offline test environments, but I'm really grasping at straws here.
Yuki Sun-MSFT 41,376 Reputation points Moderator

2022-01-13T07:28:00.41+00:00

Hi @Brian Jesteadt ,

Are there are any potentially relevant events recorded in the Event Viewer on the Exchange server in test environment?
Brian Jesteadt 1 Reputation point

2022-01-13T13:20:26.203+00:00

I'm afraid there aren't any events that seem to correlate with this issue. Should I check any of the Exchange Log files?
Yuki Sun-MSFT 41,376 Reputation points Moderator

2022-01-18T08:24:57.603+00:00

Hi @Brian Jesteadt ,

Considering that it only occurs to Outlook 2013 and Outlook 2016, none of the Exchange log files I can think of for further analysis. Just wondering have you tried testing on one of the problematic clients by uninstalling Outlook 2013 or 2016, then install Outlook 2010 and see if it can still work?

Answer 3

Brian Jesteadt 1

I think I mentioned in a different reply that Outlook 2010 does work on another client that I had setup for testing. I did not uninstall 2013/2016 first, but I think that answers your question?

Answer 4

B-squared 1

Experiencing the same thing here: cannot figure out how to get Outlook 2019 client to connect to Exchange in a restored test/lab environment.

Share via

Exchange2019 in a test environment

4 answers

Your answer