When an exchange related virtual directory has issue or become corrupted, most likely one of the troubleshooting steps is to Remove - X Virtual Directory and then New - X Virtual Directory to re-create it.  The External URL is the only value you need to re-populate in most case, unless you have Federation Trust setup with the Microsoft Federation Gateway. 

When you setup the trust the WSSecurityAuthentication property is change for the EWS and Autodiscover Virtual Directory from False to True.  When you just re-created the new virtual directory the default is False.

When external organization attempt to contact you Autodiscover or EWS URL, they use https://yourCASExtURL/ews/exchange.asmx/WSSecurity if the WSSecurityAuthentication is set to false IIS will just return HTTP 401 Unauthorized.

If you are having problem with other company not seeing your company’s free/busy run the follow command in Exchange Management Shell to verify if WSSecurityAuthentication is set to True.

                Get-AutodiscoverVirtualDirectory | fl Iden*,WSS*

                Get-WebServicesVirtualDirectory | fl Iden*,WSS*

Example result:

Identity                 : CLT-E2010-CAS01\EWS (Default Web Site)

WSSecurityAuthentication : True

Identity                 : CLT-E2010-CAS02\EWS (Default Web Site)

WSSecurityAuthentication : False

If you do see one of your server is set to False and the server external requests are load balanced to that server you should change that to true. 

                Get-WebServicesVirtualDirectory -server clt-e2010-cas02 | Set-WebServicesVirtualDirectory -WSSecurityAuthentication $true

It is always helpful to have result of the Get- X Virtual Directory | fl before you remove the old virtual directory so you can re-create it with the same Authentication method and URL that was previously set on the Virtual Directory.

Here are a few helpful links that can help you setup / troubleshot federation issues:

Cross Org Availability using Federation Trust and Organization Relationship

https://blogs.technet.com/b/exchange/archive/2011/06/28/cross-org-availability-using-federation-trust-and-organization-relationship.aspx

Understanding Federation

https://technet.microsoft.com/en-us/library/dd335047.aspx

Thanks,

John

It’s always been a challenge working with Autodiscover / EWS issue, especially if you don’t have an Exchange Web Services client, 3^rd party program that interface with EWS or Outlook 2011 for Mac to test connectivity.

There is a tool call EWSEditor:

https://ewseditor.codeplex.com/

In this current release of EWSEditor you can use Autodiscover to retrieve and connect to EWS ExternalURL. The logging was also improved to show the information that it retrieves
as well as each request and response to and from Autodiscover and EWS.

Here are some screen shots that show the process of how to test Autodiscover and EWS.

When you first launch EWSEditor, go to File > New Exchange Services…

Fill in your e-mail and Exchange version, then click OK.

After few seconds, if the autodiscover and EWS requests are successful, you should get prompted to add the mailbox root to the tree view, click Yes.

After you click yes, you should be able to see the content of your mailbox similar to another tool call MFCMAPI.

Now you may said what happen if you are can’t connect or get error messages while trying to connect.

Click Tools > EWSEditor Log Viewer…

In here you will be able to see each request and response and the steps and all the information EWSEditor retrieved during the Autodiscover process.

You will see the first EWS Request it issue to EWS is for blah@blah.com, this is normal.

The expected response for the blah@blah.com request is “Error”, “Data is corrupt.” and “ErrorCorruptData” this is normal.

The second EWS request you should see is getting the root of the mailbox.

The respond of the second EWS request should be “Success” and “NoError”.

If this tool have helped you, “Like” it on Facebook.

https://www.facebook.com/#!/pages/EWSEditor/374905589620

Another helpful tool for Autodiscover that was integrated into EWSEditor is Dan’s EWS Autodiscovery Checker, here is a link to his blog about the tool.

EWS Autodiscovery Checker

https://blogs.msdn.com/b/webdav_101/archive/2011/12/08/ews-autodiscovery-checker.aspx

Thanks,

John

When you open a support case there is usually home waiting time between when the case is open and when you actually get contacted by a support engineer that you can work with to troubleshoot your issue.  If you look at your e-mail or maybe check
your spam folder you may see an e-mail that look similar to this:

Dear Customer,

To allow us to better support you please click the web link below or copy and paste the HTTP line below into your Internet browser's address bar to run the Microsoft Support Diagnostic Tool. The tool gathers diagnostic information useful in resolving your issue. From a computer that is connected to the internet:


1. Click on the link below
https://support.microsoft.com/sdp/#######

2. Click on the Run Now button (recommended) to start the diagnostic process

3. Follow the onscreen instructions to run the diagnostics on this computer, or
a different computer.

Please note that this support key can be used to submit 1 time(s) the
diagnostics results back to Microsoft until time(UTC) :YYYY-MM-DDT00:00:00.000Z.


For frequently asked questions about diagnostic data collection and uploading
tools click the link below:
https://support.microsoft.com/kb/2598970

Thank you

Most people may just wait till an engineer to call them back, depending on the issue, product, and severity, it maybe hours to next business day before it will get assigned out for an engineer to contact you to get
started on your issue.

Would it be nice if the engineer that contact you already have some basic information and possibly the solution to your problem already in your case?

This is the idea behind that e-mail.

Let’s walkthrough the process and see what happen after you click on the link in the e-mail….

This is the page you should see, just click on the BIG “Run”

It will prompt you to Run or Save the unique support diagnostic package created especially for your case.

Next click “Run” to allow the package to start.

“Accept” the Terms

The package will download the report requested base on the Problem you reported when you open the case.

For this example I just happen to choose the Hyper-V
Diagnostic.

If the computer you need help on has internet access and you are running this page on that machine, just choose “This computer”

The report will install any tools needed to collect the diagnostic information.

When all the tools are ready, just click “Start” to begin.

The report will start to run to collect information.

Next you see what diagnostic results are from your machine. You can open and look at it yourself or just click “Next”

The result will be begin compressing

When it finishes compressing, you can choose to save a copy for yourself or just click “Send” to begin uploading the result to us.

Sending…

You are done, and automated diagnostic will begin comparing the result to all currently know issue and will deliver the result to the engineer that is assigned to your case.

When we find the solution to resolve the issue, we will be able to review the information collected to make improvement to the automated system can collect and identify issue.

Here is another blog about what we see after the result is uploaded to us:

What happens behind the scenes when using the Microsoft Support Diagnostic Tool

https://blogs.technet.com/b/sbs/archive/2010/09/27/what-happens-behind-the-scenes-when-using-the-microsoft-support-diagnostic-tool.aspx

Information about the Microsoft Automated Troubleshooting Services and Support Diagnostic Platform

https://support.microsoft.com/kb/2598970

Thanks,

John

When we use Remote Connectivity Analyzer (https://www.testexchangeconnectivity.com/) to test Outlook Autodiscover, all the External URL (items below the <Type>EXPR</Type> lines) was missing.

Normal Autodiscover response:

<?xml version="1.0"?>
<Autodiscover xmlns:xsd="https://www.w3.org/2001/XMLSchema" xmlns:xsi="https://www.w3.org/2001/XMLSchema-instance" xmlns="https://schemas.microsoft.com/exchange/autodiscover/responseschema/2006">
 <Response xmlns="https://schemas.microsoft.com/exchange/autodiscover/outlook/responseschema/2006a">
 <User>
 <DisplayName>John Mak</DisplayName>
 <LegacyDN>/o=First Organization/ou=First Administrative Group/cn=Recipients/cn=john</LegacyDN>
 <DeploymentId>2d00e1bb-74fd-49c2-bcac-dcd18e4aa95f</DeploymentId>
 </User>
 <Account>
 <AccountType>email</AccountType>
 <Action>settings</Action>
 <Protocol>
 <Type>EXCH</Type>
 <Server>CLT-E2010-CAS01.exchange.contoso.com</Server>
 <ServerDN>/o=First Organization/ou=Exchange Administrative Group (FYDIBOHF23SPDLT)/cn=Configuration/cn=Servers/cn=CLT-E2010-CAS01</ServerDN>
 <ServerVersion>7380827F</ServerVersion>
 <MdbDN>/o=First Organization/ou=Exchange Administrative Group (FYDIBOHF23SPDLT)/cn=Configuration/cn=Servers/cn=CLT-E2010-CAS01/cn=Microsoft Private MDB</MdbDN>
 <ASUrl>https://clt-e2010-cas01.exchange.contoso.com/EWS/Exchange.asmx</ASUrl>
 <OOFUrl>https://clt-e2010-cas01.exchange.contoso.com/EWS/Exchange.asmx</OOFUrl>
 <OABUrl>https://clt-e2010-cas01.exchange.contoso.com/OAB/83099da3-46bc-49e3-9e35-4353f0f95268/</OABUrl>
 <UMUrl>https://clt-e2010-cas01.exchange.contoso.com/EWS/UM2007Legacy.asmx</UMUrl>
 <Port>0</Port>
 <DirectoryPort>0</DirectoryPort>
 <ReferralPort>0</ReferralPort>
 <PublicFolderServer>CLT-E2010-MBX01.exchange.contoso.com</PublicFolderServer>
 <AD>CLT-DC.exchange.contoso.com</AD>
 <EwsUrl>https://clt-e2010-cas01.exchange.contoso.com/EWS/Exchange.asmx</EwsUrl>
 <SharingUrl>https://clt-e2010-cas01.exchange.contoso.com/EWS/Exchange.asmx</SharingUrl>
 <EcpUrl>https://clt-e2010-cas01.exchange.contoso.com/ecp/</EcpUrl>
 <EcpUrl-um>?p=customize/voicemail.aspx&amp;exsvurl=1</EcpUrl-um>
 <EcpUrl-aggr>?p=personalsettings/EmailSubscriptions.slab&amp;exsvurl=1</EcpUrl-aggr>
 <EcpUrl-mt>PersonalSettings/DeliveryReport.aspx?exsvurl=1&amp;IsOWA=&lt;IsOWA&gt;&amp;MsgID=&lt;MsgID&gt;&amp;Mbx=&lt;Mbx&gt;</EcpUrl-mt>
 <EcpUrl-ret>?p=organize/retentionpolicytags.slab&amp;exsvurl=1</EcpUrl-ret>
 <EcpUrl-sms>?p=sms/textmessaging.slab&amp;exsvurl=1</EcpUrl-sms>
 </Protocol>
 <Protocol>
 <Type>EXPR</Type>
 <Server>exchange.contoso.com</Server>
 <ASUrl>https://exchange.contoso.com/EWS/Exchange.asmx</ASUrl>
 <OOFUrl>https://exchange.contoso.com/EWS/Exchange.asmx</OOFUrl>
 <OABUrl>https://exchange.contoso.com/OAB/83099da3-46bc-49e3-9e35-4353f0f95268/</OABUrl>
 <UMUrl>https://exchange.contoso.com/EWS/UM2007Legacy.asmx</UMUrl>
 <Port>0</Port>
 <DirectoryPort>0</DirectoryPort>
 <ReferralPort>0</ReferralPort>
 <SSL>On</SSL>
 <AuthPackage>Basic</AuthPackage>
 <EwsUrl>https://exchange.contoso.com/EWS/Exchange.asmx</EwsUrl>
 <SharingUrl>https://exchange.contoso.com/EWS/Exchange.asmx</SharingUrl>
 <EcpUrl>https://exchange.contoso.com/ecp/</EcpUrl>
 <EcpUrl-um>?p=customize/voicemail.aspx&amp;exsvurl=1</EcpUrl-um>
 <EcpUrl-aggr>?p=personalsettings/EmailSubscriptions.slab&amp;exsvurl=1</EcpUrl-aggr>
 <EcpUrl-mt>PersonalSettings/DeliveryReport.aspx?exsvurl=1&amp;IsOWA=&lt;IsOWA&gt;&amp;MsgID=&lt;MsgID&gt;&amp;Mbx=&lt;Mbx&gt;</EcpUrl-mt>
 <EcpUrl-ret>?p=organize/retentionpolicytags.slab&amp;exsvurl=1</EcpUrl-ret>
 <EcpUrl-sms>?p=sms/textmessaging.slab&amp;exsvurl=1</EcpUrl-sms>
 </Protocol>
 <Protocol>
 <Type>WEB</Type>
 <Port>0</Port>
 <DirectoryPort>0</DirectoryPort>
 <ReferralPort>0</ReferralPort>
 </Protocol>
 </Account>
 </Response>
</Autodiscover>

After some troubleshooting we found that when we run Get-OutlookProvider we only see EXCH, WEB, but missing EXPR.

We needed to run New-OutlookProvider EXPR to recreate EXPR in order or the Autodiscover to return external URL in the <Type>EXPR</Type> section of the Autodiscover XML response.

My guess was that Outlook Anywhere was enabled but they decided they don't want users to be able to Autodiscover externally and setup Outlook Anywhere automatically
and found out that if they remove that Outlook Provider it stop the configuration from being included in the Autodiscover response, but that also broke Federation free busy because Autodiscover on the other external companies are not able to retrieve the EWS External URL.

Let me know if this information is helpful and leave comments below.

Thanks,

John

"The Exchange administrator has made a change that requires you quit and restart
Outlook."

We verify that the affected users have not been moved, and not changes were done on Exchange while
this message pops up.

After a few month of trying to collect data we found that Outlook was trying to contact public folders, and the customer do not really used public folders and we found a registry key that was not documented that is able to stop Outlook from trying to connect to public folders.

HasPublicFolders = 0

After settings this registry key we no longer get reports of users getting the pop up to ask them to restart Outlook, unless the mailbox is really moved.

Since I know that case I have use this key in other situation that help isolate if issue is related to public folder access.

Outlook client applications cannot connect to public folders after you install Exchange Server 2010 SP1
https://support.microsoft.com/kb/2535105

FIX: Application may stop responding after several HTTP requests are aborted if you use the HttpWebRequest class to send requests in the .NET Framework
https://support.microsoft.com/kb/2497453

In KB 2535105, If you are affected you may receive different symptoms such as:

Outlook getting prompted
for credentials

Connection failing over
from TCP/IP (MAPI) to HTTPS (Outlook Anywhere / RPC-HTTP)

High CPU usage on CAS
due to public folder referral

Using the registry key to stop Outlook from using Public folder the Outlook client symptom is workaround. (A good way to isolated if those issues is related to public folder
access.)

If this key help you or other scenario that you find this key helpful please leave a comment.

Thanks,

John