From: Brett on
Your problem is a LocalLoopback Disable it

Why? Do it it works.
And install Exchange 2007 SP2.

Disable Loopback Check

HKLM\SYSTEM\ControlSet001\Control\Lsa
Dword value: DisableLoopbackCheck
Value data (Decimal): 00000001

Why? An issue has been found on Enterprise Vault servers that have been configured with Aliases. When you use the fully qualified domain name (FQDN) or a custom host header to browse a local Web site that is hosted on a computer that is running Microsoft Internet Information Services (IIS) 5.1 or IIS 6, you may receive an error message that resembles the following: HTTP 401.1 - Unauthorized: Logon Failed. This issue occurs when the Web site uses Integrated Authentication and has a name that is mapped to the local loopback address. Windows Servers include a loopback check security feature that is designed to help prevent reflection attacks on your computer. Therefore, authentication fails if the FQDN or the custom host header that you use does not match the local computer name. By disabling the loopback check, you avoid "Access Denied" errors in the VAC and Event ID 40974 in the Event Logs.



Rich Matheisen [MVP] wrote:

Have you used http://testexchangeconnectivity.com at all?
15-Oct-09

Have you used http://testexchangeconnectivity.com at all? it is pretty
good at pointing out where there are problems.
---
Rich Matheisen
MCSE+I, Exchange MVP

Previous Posts In This Thread:

On Saturday, November 08, 2008 11:42 AM
David Chadwick wrote:

Exchange 2007 & Outlook 2007 autodiscover service
Hi,

I believe I have a pretty good handle on how the autodiscover service works
in Exchange 2007. I have everything setup so that autodiscover works
externally - it successfully gives the right configuration for the various
Exchange web services (availability service, OOF, OAB and Unifed Messaging
service) and they all work fine. Outlook Anywhere even works correctly (as
configured by the autodiscover service).

These services are all published externally using ISA 2006 and basic
authentication over HTTPS.

I have different URLs configured for the internal and external versions of
each of the Exchange web services. If I choose the "test autoconfiguration"
option in Outlook 2007 I can see that these are all set correctly.

My issue is that my internal clients are getting a password prompt. The
password prompt is for access to the external URL supplied by the
autodiscover service. It is actually entirely correct that trying to access
this URL would require credentials as I am publishing these services to the
internet using basic authentication.

What I do not understand is why Outlook 2007 is ever trying to access the
external versions of the various Exchange web service URLs. When using the
"test autoconfiguration" option internally I can see that Outlook looks at
the SCP in Active Directory and then correctly reads the autodiscover
information from the internal autodiscover service. No credential prompt
happens at this stage. Surely the fact that Outlook has successfully found
the SCP entry in Active Directory should tell it that it is currently
"internal" and therefore it should only use the internal version of the URLs
for each of the Exchange web services?

However, once Outlook receives the URLs from the autodiscover service it now
tries to access the external versions, which of course require a credential
prompt! Why does Outlook want to access the external versions of the URLs?
If Outlook chose only to use the internal versions then everything would
work correctly.

My question is - what determines which of the URLs (internal vs external)
Outlook will use? Perhaps Outlook always tries to lookup both versions of
the URLs and the behaviour I am seeing is normal (in which case the whole
reason for having a separate internal and external URL for the Exchange web
services seems pointless).

I hope I have explained this clearly. Any pointers would be greatly
appreciated!

Cheers,
David

On Saturday, November 08, 2008 5:03 PM
Elan Shudnow wrote:

It knows to hand out InternalURLs vs ExternalURLs through Outlook Providers.
It knows to hand out InternalURLs vs ExternalURLs through Outlook
Providers. If a client is on the internal network, it'll contact AD
directly and utilize the AutodiscoverInternalURI to contact the
Autodiscover which in return utilizes the Outlook Provider EXPH. The
EXPH provider will hand out InternalURLs to the client. If you're
connecting through Autodiscover.domain.com through Outlook Anywhere,
non-domain joined, Internet, you'll end up using the EXPR provider which
will return ExternalURLs. So in essence, the Autodiscover service knows
how to tell which method you used to connect and then utilizes the
correct Outlook provider which will in return hand out InternalURLs or
ExternalURLs.

--
Elan Shudnow
http://www.shudnow.net



"David Chadwick" <david(a)opticsenses.com> wrote in message
news:OhPL6DcQJHA.588(a)TK2MSFTNGP06.phx.gbl:

On Saturday, November 08, 2008 5:45 PM
Andy David {MVP} wrote:

Re: Exchange 2007 & Outlook 2007 autodiscover service
On Sun, 9 Nov 2008 03:42:24 +1100, "David Chadwick"
<david(a)opticsenses.com> wrote:


It depends how they connect.
MAPI, they get the internal URL
HTTPS over RPC then get the externalURL


On the clients that get prompted, is OUtlook Anywhere enabled and
configured for them? If so, uncheck , restart Outlook and test.

On Saturday, November 08, 2008 7:36 PM
David Chadwick wrote:

Hi Elan,That's a good theory and also how I understand that it SHOULD work.
Hi Elan,

That's a good theory and also how I understand that it SHOULD work.

However, I am seeing internal clients (not just a few either, all 500 of
them!) which still attempt to connect to the external URLs. This is the
behavior that I do not understand.

If I use the "test autoconfiguration" option in Outlook, I can clearly see
that it is using the SCP autodiscover URL (and not autodiscover.domain.com).
Despite using the internal SCP and returning the correct URLs for internal
and external, Outlook still pops up with a credential prompt to the external
URL.

The prompt itself is not the issue as there actually should be a prompt when
trying to access the external URL (basic authentication over HTTPS). The
problem is that Outlook when loaded internally should never attempt to hit
this URL in the first place.

What I am observing is that Outlook appears to try and connect to the
external URL regardless of whether the AutodiscoverInternalURI or
autodiscover.domain.com was used.

Regards,
David

"Elan Shudnow" <SubstituteThisWithMyFirstName(a)shudnow.net> wrote in message
news:e6EDy3eQJHA.3404(a)TK2MSFTNGP05.phx.gbl...

On Saturday, November 08, 2008 7:45 PM
David Chadwick wrote:

Re: Exchange 2007 & Outlook 2007 autodiscover service
"Andy David {MVP}" <adavid(a)pleasekeepinngcheesebucket.com> wrote in message
news:0g5ch4t66j27c1633s84ila73jkie64vfv(a)4ax.com...

Hi Andy,

All of my clients get prompted (500 of them) - it's not only some of them.

Outlook Anywhere is not enabled on any of them. They are all connecting
using MAPI - yet still attemping to hit the external URL.

Incidentally - even if Outlook Anywhere was enabled it should still work
anyway...? I thought the whole point of Outlook Anywhere was that you can
essentiallly have a client configured for MAPI and RPC over HTTPS. That way
a laptop user can take their machine home and plug into the internet and
Outlook will detect that it is no longer on the internal network and use RPC
over HTTPS instead of MAPI. Outlook should attempt to use MAPI first - if
that fails it should attempt to use RPC over HTTPS.

If you couldn't have Outlook Anywhere enabled all the time (and then rely on
Outlook to detect whether to use it or not), then Outlook Anywhere would be
pointless. It is the ability to detect between the two methods which makes
Outlook Anywhere useful in the first place. I have tried Outlook 2007 both
with and without Outlook Anywhere configured and I get the credential prompt
regardless (when the client is connecting internally).

Cheers,
David

On Saturday, November 08, 2008 10:04 PM
Rich Matheisen [MVP] wrote:

Re: Exchange 2007 & Outlook 2007 autodiscover service
[ snip ]


Do you have RPC-over-HTTPS configured for BOTH high- and low-speed
connections in the profile? That would certainly cause the problem you
mention.
---
Rich Matheisen
MCSE+I, Exchange MVP

On Saturday, November 08, 2008 10:35 PM
David Chadwick wrote:

Re: Exchange 2007 & Outlook 2007 autodiscover service
Hi Rich,

No - I have RPC over HTTPS completely off and not configured at all in
Outlook. I would have thought that this completely rules it out as the
cause.

Regards,
David

On Saturday, November 08, 2008 11:16 PM
Rich Matheisen [MVP] wrote:

Re: Exchange 2007 & Outlook 2007 autodiscover service
On Sun, 9 Nov 2008 14:35:57 +1100, "David Chadwick"
<david(a)opticsenses.com> wrote:


It does. I mention it only because you were asking about it.

As to your other statement that Outlook Anywhere is "not enabled for
any of them", do you mean that you've disabled it at the CAS? Outlook
2007 is still going to contact the CAS if it can to do its houskeeping
at startup, get the OAB (if that's the distribution point), check
calendars for free/busy info, etc. If you have the authentication
types set incorrectly then Outlook may be challenged for credentials
instead of being able to use the credentials of the logged-on user.
---
Rich Matheisen
MCSE+I, Exchange MVP

On Sunday, November 09, 2008 8:18 AM
David Chadwick wrote:

Re: Exchange 2007 & Outlook 2007 autodiscover service
"Rich Matheisen [MVP]" <richnews(a)rmcons.com.NOSPAM.COM> wrote in message
news:6hoch4dtphb8fcf0nbdbadncptqmir66ig(a)4ax.com...

Hi Rich,

I meant that Outlook Anywhere is not configured in Outlook 2007 on any of my
clients ("Connect to Microsoft Exchange using HTTP" is unchecked). Outlook
Anywhere itself is enabled on the CAS. If I take an Outlook 2007 client
externally and configure it for RPC over HTTPS it works fine - I have it
published through ISA 2006.

I guess the real issue from my point of view is that the popup that Outlook
2007 produces is only for the external URL listed for the various Exchange
web services. I can watch the logs on my firewall/reverse proxy and see
these internal clients hitting the external URLs. From every observation I
have made (on multiple sites) it looks to me as if Outlook 2007 tries to
"touch" the external URLs regardless of whether Outlook believes it is
internal or external at that particular moment. It is this behaviour that I
find very confusing.

If I am loading Outlook internally, it shouldn't matter what the external
URLs are at all, should it? In theory I could put absolute rubbish settings
into them - Outlook shouldn't touch these external URLs anyway... but it
does.

In fact, if I do put rubbish settings into the external URLs then the popup
actually goes away (I just tried it then)! It is like Outlook tries to
touch the rubbish external URLs, fails and then continues using the internal
URLs (which work fine). It is only when the external URLs are legitimate
that the popup prompt comes back.

I can even fix it by splitting my DNS in such a way that the external URLs
simply do not resolve internally. If I do this, then once again the popup
prompt goes away. Outlook uses the internal URLs as expected. I shouldn't
have to do this though - Outlook should not be accessing the external URLs
when it is loaded internally. I can reproduce this on multiple client sites
and in my test lab also.

Maybe I have set something up wrong in every environment. :) Thanks so much
for your responses so far, I appreciate it!

Cheers,
David

On Sunday, November 09, 2008 1:03 PM
Rich Matheisen [MVP] wrote:

Re: Exchange 2007 & Outlook 2007 autodiscover service
On Mon, 10 Nov 2008 00:18:23 +1100, "David Chadwick"
<david(a)opticsenses.com> wrote:

[ snip ]


Do you have a split DNS? What about the SCPs? The name of the machine
they point to is going to be resolved by DNS. If you have the same
name for internal and external URLs then there should be an internal
and external DNS.


Outlook just looks for the SCP. From there it's up to DNS to supply
the right IP address. If you have just one DNS zone for everything
then the IP address is probably going to be resolved to the external
address.


See above for DNS comments.


Yup. Check the SCPs.
---
Rich Matheisen
MCSE+I, Exchange MVP

On Sunday, November 09, 2008 5:12 PM
David Chadwick wrote:

Re: Exchange 2007 & Outlook 2007 autodiscover service
"Rich Matheisen [MVP]" <richnews(a)rmcons.com.NOSPAM.COM> wrote in message
news:9t8eh41rda85fft7kl229g1ibas85ncucn(a)4ax.com...

Hi Rich,

My internal AD DNS namespace is different from my external namespace. The
SCP points to an internal autodiscover URL. The internal and external URLs
set for the various Exchange web services are different (the internal ones
use the internal namespace, the external ones use the external namespace).


I have two zones due to the fact that the namespaces are totally different.
When I referred to "splititng my DNS" to fix this issue, I was actually
referring to splitting my external DNS zone only. In other words, I have
created an internal "version" of the external zone such that Outlook is
unable to resolve the DNS for my external URLs when it is used internally.
I just leave out the record. If I delete the internal version of my
external zone (which is how I normally have things), Outlook is now able to
correctly resolve the external URLs from the real external zone which then
causes it to touch the external URL and get a password prompt.


I have checked the SCPs and from what I can tell they are fine. I do not
believe that this is an autodiscover/SCP problem - I can trace that Outlook
is looking up the SCP correctly, and then querying the internal URL for the
autodiscover service correctly. I can see all this in the "test
autoconfiguration" area of Outlook. I also know that it is not hitting
autodiscover.domain.com.

Despite all this Outlook then hits the external URL (if it can). If I
thwart Outlook from being able to hit the external URL (either by splitting
external DNS, or using a rubbish setting for external URLs, or configuring
the firewall so that it disallows access to the external URL from internal)
then everything works and the prompt goes away. It is my belief though that
Outlook should not be trying to hit this URL in the first place.

Am I right about that? Maybe Outlook hits the external URL regardless of
everything else (this is the behavior I appear to be seeing).

Cheers,
David

On Friday, March 13, 2009 11:16 AM
Djiewan Soekhai wrote:

hosts
Hello, i had the same problem, solved it by adding an entry in the hosts file

192.168.60.85 autodiscover.domail.nl

Not the most sophisticated solution i know, but it works

On Thursday, October 15, 2009 4:16 PM
shahid iqbal wrote:

Rpc over Http working but autodiscover nope...
hello,

i am unable to get autodiscover in exchange 2007 with ISA 2006. rpc over http is working fine....can i know what are steps needed for autodiscover to work.

do i need 2 certificate , 1 for owa and other for autodiscover ? or only 1 ceritificare is ok.i have 1 cetificate which includes dns names owa.domain.com, autodiscover.domain.com.....

can i know in ISA where i might have to do settings ?



David Chadwick wrote:

Exchange 2007 & Outlook 2007 autodiscover service
08-Nov-08

Hi,

I believe I have a pretty good handle on how the autodiscover service works
in Exchange 2007. I have everything setup so that autodiscover works
externally - it successfully gives the right configuration for the various
Exchange web services (availability service, OOF, OAB and Unifed Messaging
service) and they all work fine. Outlook Anywhere even works correctly (as
configured by the autodiscover service).

These services are all published externally using ISA 2006 and basic
authentication over HTTPS.

I have different URLs configured for the internal and external versions of
each of the Exchange web services. If I choose the "test autoconfiguration"
option in Outlook 2007 I can see that these are all set correctly.

My issue is that my internal clients are getting a password prompt. The
password prompt is for access to the external URL supplied by the
autodiscover service. It is actually entirely correct that trying to access
this URL would require credentials as I am publishing these services to the
internet using basic authentication.

What I do not understand is why Outlook 2007 is ever trying to access the
external versions of the various Exchange web service URLs. When using the
"test autoconfiguration" option internally I can see that Outlook looks at
the SCP in Active Directory and then correctly reads the autodiscover
information from the internal autodiscover service. No credential prompt
happens at this stage. Surely the fact that Outlook has successfully found
the SCP entry in Active Directory should tell it that it is currently
"internal" and therefore it should only use the internal version of the URLs
for each of the Exchange web services?

However, once Outlook receives the URLs from the autodiscover service it now
tries to access the external versions, which of course require a credential
prompt! Why does Outlook want to access the external versions of the URLs?
If Outlook chose only to use the internal versions then everything would
work correctly.

My question is - what determines which of the URLs (internal vs external)
Outlook will use? Perhaps Outlook always tries to lookup both versions of
the URLs and the behaviour I am seeing is normal (in which case the whole
reason for having a separate internal and external URL for the Exchange web
services seems pointless).

I hope I have explained this clearly. Any pointers would be greatly
appreciated!

Cheers,
David

Previous Posts In This Thread:

David Chadwick wrote:

Exchange 2007 & Outlook 2007 autodiscover service
Hi,

I believe I have a pretty good handle on how the autodiscover service works
in Exchange 2007. I have everything setup so that autodiscover works
externally - it successfully gives the right configuration for the various
Exchange web services (availability service, OOF, OAB and Unifed Messaging
service) and they all work fine. Outlook Anywhere even works correctly (as
configured by the autodiscover service).

These services are all published externally using ISA 2006 and basic
authentication over HTTPS.

I have different URLs configured for the internal and external versions of
each of the Exchange web services. If I choose the "test autoconfiguration"
option in Outlook 2007 I can see that these are all set correctly.

My issue is that my internal clients are getting a password prompt. The
password prompt is for access to the external URL supplied by the
autodiscover service. It is actually entirely correct that trying to access
this URL would require credentials as I am publishing these services to the
internet using basic authentication.

What I do not understand is why Outlook 2007 is ever trying to access the
external versions of the various Exchange web service URLs. When using the
"test autoconfiguration" option internally I can see that Outlook looks at
the SCP in Active Directory and then correctly reads the autodiscover
information from the internal autodiscover service. No credential prompt
happens at this stage. Surely the fact that Outlook has successfully found
the SCP entry in Active Directory should tell it that it is currently
"internal" and therefore it should only use the internal version of the URLs
for each of the Exchange web services?

However, once Outlook receives the URLs from the autodiscover service it now
tries to access the external versions, which of course require a credential
prompt! Why does Outlook want to access the external versions of the URLs?
If Outlook chose only to use the internal versions then everything would
work correctly.

My question is - what determines which of the URLs (internal vs external)
Outlook will use? Perhaps Outlook always tries to lookup both versions of
the URLs and the behaviour I am seeing is normal (in which case the whole
reason for having a separate internal and external URL for the Exchange web
services seems pointless).

I hope I have explained this clearly. Any pointers would be greatly
appreciated!

Cheers,
David

Elan Shudnow wrote:

Re: Exchange 2007 & Outlook 2007 autodiscover service
It knows to hand out InternalURLs vs ExternalURLs through Outlook
Providers. If a client is on the internal network, it will contact AD
directly and utilize the AutodiscoverInternalURI to contact the
Autodiscover which in return utilizes the Outlook Provider EXPH. The
EXPH provider will hand out InternalURLs to the client. If you are
connecting through Autodiscover.domain.com through Outlook Anywhere,
non-domain joined, Internet, you will end up using the EXPR provider which
will return ExternalURLs. So in essence, the Autodiscover service knows
how to tell which method you used to connect and then utilizes the
correct Outlook provider which will in return hand out InternalURLs or
ExternalURLs.

--
Elan Shudnow
http://www.shudnow.net




Andy David {MVP} wrote:

Re: Exchange 2007 & Outlook 2007 autodiscover service


It depends how they connect.
MAPI, they get the internal URL
HTTPS over RPC then get the externalURL


On the clients that get prompted, is OUtlook Anywhere enabled and
configured for them? If so, uncheck , restart Outlook and test.

David Chadwick wrote:

Re: Exchange 2007 & Outlook 2007 autodiscover service
Hi Elan,

That's a good theory and also how I understand that it SHOULD work.

However, I am seeing internal clients (not just a few either, all 500 of
them!) which still attempt to connect to the external URLs. This is the
behavior that I do not understand.

If I use the "test autoconfiguration" option in Outlook, I can clearly see
that it is using the SCP autodiscover URL (and not autodiscover.domain.com).
Despite using the internal SCP and returning the correct URLs for internal
and external, Outlook still pops up with a credential prompt to the external
URL.

The prompt itself is not the issue as there actually should be a prompt when
trying to access the external URL (basic authentication over HTTPS). The
problem is that Outlook when loaded internally should never attempt to hit
this URL in the first place.

What I am observing is that Outlook appears to try and connect to the
external URL regardless of whether the AutodiscoverInternalURI or
autodiscover.domain.com was used.

Regards,
David


David Chadwick wrote:

Re: Exchange 2007 & Outlook 2007 autodiscover service

Hi Andy,

All of my clients get prompted (500 of them) - it is not only some of them.

Outlook Anywhere is not enabled on any of them. They are all connecting
using MAPI - yet still attemping to hit the external URL.

Incidentally - even if Outlook Anywhere was enabled it should still work
anyway...? I thought the whole point of Outlook Anywhere was that you can
essentiallly have a client configured for MAPI and RPC over HTTPS. That way
a laptop user can take their machine home and plug into the internet and
Outlook will detect that it is no longer on the internal network and use RPC
over HTTPS instead of MAPI. Outlook should attempt to use MAPI first - if
that fails it should attempt to use RPC over HTTPS.

If you could not have Outlook Anywhere enabled all the time (and then rely on
Outlook to detect whether to use it or not), then Outlook Anywhere would be
pointless. It is the ability to detect between the two methods which makes
Outlook Anywhere useful in the first place. I have tried Outlook 2007 both
with and without Outlook Anywhere configured and I get the credential prompt
regardless (when the client is connecting internally).

Cheers,
David

Rich Matheisen [MVP] wrote:

Re: Exchange 2007 & Outlook 2007 autodiscover service

[ snip ]


Do you have RPC-over-HTTPS configured for BOTH high- and low-speed
connections in the profile? That would certainly cause the problem you
mention.
---
Rich Matheisen
MCSE+I, Exchange MVP

David Chadwick wrote:

Re: Exchange 2007 & Outlook 2007 autodiscover service

Hi Rich,

No - I have RPC over HTTPS completely off and not configured at all in
Outlook. I would have thought that this completely rules it out as the
cause.

Regards,
David

Rich Matheisen [MVP] wrote:

Re: Exchange 2007 & Outlook 2007 autodiscover service


It does. I mention it only because you were asking about it.

As to your other statement that Outlook Anywhere is "not enabled for
any of them", do you mean that you have disabled it at the CAS? Outlook
2007 is still going to contact the CAS if it can to do its houskeeping
at startup, get the OAB (if that is the distribution point), check
calendars for free/busy info, etc. If you have the authentication
types set incorrectly then Outlook may be challenged for credentials
instead of being able to use the credentials of the logged-on user.
---
Rich Matheisen
MCSE+I, Exchange MVP

David Chadwick wrote:

Re: Exchange 2007 & Outlook 2007 autodiscover service

Hi Rich,

I meant that Outlook Anywhere is not configured in Outlook 2007 on any of my
clients ("Connect to Microsoft Exchange using HTTP" is unchecked). Outlook
Anywhere itself is enabled on the CAS. If I take an Outlook 2007 client
externally and configure it for RPC over HTTPS it works fine - I have it
published through ISA 2006.

I guess the real issue from my point of view is that the popup that Outlook
2007 produces is only for the external URL listed for the various Exchange
web services. I can watch the logs on my firewall/reverse proxy and see
these internal clients hitting the external URLs. From every observation I
have made (on multiple sites) it looks to me as if Outlook 2007 tries to
"touch" the external URLs regardless of whether Outlook believes it is
internal or external at that particular moment. It is this behaviour that I
find very confusing.

If I am loading Outlook internally, it should not matter what the external
URLs are at all, should it? In theory I could put absolute rubbish settings
into them - Outlook should not touch these external URLs anyway... but it
does.

In fact, if I do put rubbish settings into the external URLs then the popup
actually goes away (I just tried it then)! It is like Outlook tries to
touch the rubbish external URLs, fails and then continues using the internal
URLs (which work fine). It is only when the external URLs are legitimate
that the popup prompt comes back.

I can even fix it by splitting my DNS in such a way that the external URLs
simply do not resolve internally. If I do this, then once again the popup
prompt goes away. Outlook uses the internal URLs as expected. I should not
have to do this though - Outlook should not be accessing the external URLs
when it is loaded internally. I can reproduce this on multiple client sites
and in my test lab also.

Maybe I have set something up wrong in every environment. :) Thanks so much
for your responses so far, I appreciate it!

Cheers,
David

Rich Matheisen [MVP] wrote:

Re: Exchange 2007 & Outlook 2007 autodiscover service

[ snip ]


Do you have a split DNS? What about the SCPs? The name of the machine
they point to is going to be resolved by DNS. If you have the same
name for internal and external URLs then there ishould be an internal
and external DNS.


Outlook just looks for the SCP. From there it is up to DNS to supply
the right IP address. If you have just one DNS zone for everything
then the IP address is probably going to be resolved to the external
address.


See above for DNS comments.


Yup. Check the SCPs.
---
Rich Matheisen
MCSE+I, Exchange MVP

David Chadwick wrote:

Re: Exchange 2007 & Outlook 2007 autodiscover service

Hi Rich,

My internal AD DNS namespace is different from my external namespace. The
SCP points to an internal autodiscover URL. The internal and external URLs
set for the various Exchange web services are different (the internal ones
use the internal namespace, the external ones use the external namespace).


I have two zones due to the fact that the namespaces are totally different.
When I referred to "splititng my DNS" to fix this issue, I was actually
referring to splitting my external DNS zone only. In other words, I have
created an internal "version" of the external zone such that Outlook is
unable to resolve the DNS for my external URLs when it is used internally.
I just leave out the record. If I delete the internal version of my
external zone (which is how I normally have things), Outlook is now able to
correctly resolve the external URLs from the real external zone which then
causes it to touch the external URL and get a password prompt.


I have checked the SCPs and from what I can tell they are fine. I do not
believe that this is an autodiscover/SCP problem - I can trace that Outlook
is looking up the SCP correctly, and then querying the internal URL for the
autodiscover service correctly. I can see all this in the "test
autoconfiguration" area of Outlook. I also know that it is not hitting
autodiscover.domain.com.

Despite all this Outlook then hits the external URL (if it can). If I
thwart Outlook from being able to hit the external URL (either by splitting
external DNS, or using a rubbish setting for external URLs, or configuring
the firewall so that it disallows access to the external URL from internal)
then everything works and the prompt goes away. It is my belief though that
Outlook should not be trying to hit this URL in the first place.

Am I right about that? Maybe Outlook hits the external URL regardless of
everything else (this is the behavior I appear to be seeing).

Cheers,
David

Djiewan Soekhai wrote:

hosts
Hello, i had the same problem, solved it by adding an entry in the hosts file

192.168.60.85 autodiscover.domail.nl

Not the most sophisticated solution i know, but it works

EggHeadCafe - Software Developer Portal of Choice
A Better CAPTCHA Control (Look Ma - NO IMAGE!)
http://www.eggheadcafe.com/tutorials/aspnet/79e023b6-124f-4f63-865c-6d357cddbe56/a-better-captcha-control.aspx

On Thursday, October 15, 2009 5:16 PM
Rich Matheisen [MVP] wrote:

Have you used http://testexchangeconnectivity.com at all?
Have you used http://testexchangeconnectivity.com at all? it is pretty
good at pointing out where there are problems.
---
Rich Matheisen
MCSE+I, Exchange MVP


Submitted via EggHeadCafe - Software Developer Portal of Choice
Entity Framework 4.0 and the AJAX Autocomplete Extender.
http://www.eggheadcafe.com/tutorials/aspnet/77429274-e89f-49c2-a93a-b290f013f649/entity-framework-40-and.aspx