Exchange server activesync connectivity testing for iphone not working

You can use this site to test exchange activesync connectivity

https://www.testexchangeconnectivity.com/

The site is an official Microsoft site specifically for testing Exchange installations and connectivity. The test will fail if you use a self-signed SSL certificate, in which case, you’ll need to check the “Ignore Trust for SSL” checkbox. On the ActiveSync test page, you are asked whether you wish to use Autodiscover to detect the settings or to manually specify server settings. Exchange 2003 does not have native autodiscover, so you will most likely need to choose the latter option and provide the server name.

If you are getting failures check the following:

Firstly, you need to make sure that you have Exchange Server 2003 Service Pack 2 Installed. To check if you have it installed, open up Exchange System Manager – Start, Programs, Microsoft Exchange, System Manager. Then expand Servers, Right-Click your server and choose Properties. This will display whether you have SP2 installed or not. If you do not have SP2 installed you can download it here – http://www.microsoft.com/downloads/details.aspx?FamilyID=535BEF85-3096-45F8-AA43-60F1F58B3C40&displaylang=en

If you are trying to make an iPhone work, then you can also download the free iPhone App ‘Activesync Tester’ and this should identify any problems with your configuration or you can click on the following link: https://store.accessmylan.com/main/diagnostic-tools

You also need to ensure that TCP Ports 443 is open and forwarded to your Exchange server. If you are not using SSL make sure port 80 is forwarded.

Please check  the settings below (Open up IIS, expand the default website then expand the relevant Virtual Directory, right-click on the Virtual Directory and choose properties, then click on the Directory Security Tab):

Exchange Virtual Directory
• Authentication = Integrated & Basic
• Default Domain = NETBIOS domain name – e.g., yourcompany
• Realm = yourcompany.com
• IP Address Restrictions = Granted Access
• Secure Communications = Require SSL NOT ticked

Microsoft-Server-Activesync Virtual Directory
• Authentication = Basic
• Default Domain = NETBIOS domain name – e.g., yourcompany
• Realm = NETBIOS name
• IP Address Restrictions = Granted Access
• Secure Communications = Require SSL and Require 128-Bit Encryption IS ticked

ASP.NET should be set to version 1.1 for all virtual directories listed above. If you cannot see the ASP.NET tab, you only have v 1.1 installed so do not worry. If any version other than 1.1 is selected, please change it to v 1.1.4322.

No other virtual directories are involved when using Activesync (apart from exchange-oma on SBS 2003 or when Forms Based Authentication is enabled) – despite having seen other postings suggesting that there are.

Also, make sure that you have HTTP Keep-Alives enabled – http://www.microsoft.com/technet/prodtechnol/WindowsServer2003/Library/IIS/d7e13ea5-4350-497e-ba34-b25c0e9efd68.mspx?mfr=true

Although requiring SSL on the virtual directories mentioned above would be recommended, Microsoft actually recommend disabling it as per the following article in their knowledgebase: http://support.microsoft.com/kb/817379 Nevertheless, ActiveSync and OWA access should still run over a secure HTTPS session (port 443), as standard procedure states you should not open port 80 to the Exchange Server through your firewall.

Please also check that Ignore Client Certificates is selected under the IISADMPWD virtual directory / Directory Security Tab / Edit Secure Communications Button. This Virtual Direcory may not exist if you have not setup the ability to reset passwords via Outlook Web Access (OWA).

For Small Business Server 2003 Users to make sure that the virtual directory settings are correct, follow these steps:

1. Start the Internet Information Services (IIS) Microsoft Management Server (MMS) snap-in on the Windows SBS 2003-based computer.
2. Expand Server_Name\Web Sites\Default Web Site.
3. Right-click Exchange-OMA, and then follow these steps:
   1. Verify the following settings on the Virtual Directory tab:
      • The following check boxes are selected:
        • Script source access
        • Read
        • Write
        • Directory browsing
        • Log visits
        • Index this resource
      • Application name is unavailable, and Default Application is listed.
      • The Execute permissions setting is None.
      • The Application pool setting is unavailable, and ExchangeApplicationPool is listed.
   2. Verify the following settings on the Directory Security tab:
      • The Enable anonymous access check box is not selected.
      • The Integrated Windows authentication check box is selected.
      • The Basic authentication check box is selected.
      • The Require secure channel (SSL) check box is not selected.
   3. Close the Exchange-OMA Properties dialog box.
4. Right-click OMA, and then follow these steps:
   1. Verify the following settings on the Virtual Directory tab:
      • The following check boxes are selected:
        • Read
        • Log visits
        • Index this resource
      • The Application name setting is /LM/W3SVC/1/root/OMA.
      • The Execute permissions setting is Scripts only.
      • The Application pool setting is ExchangeMobileBrowseApplicationPool.
   2. Verify the following settings on the Directory Security tab:
      • The Enable anonymous access check box is not selected.
      • The Integrated Windows authentication check box is not selected.
      • The Basic authentication check box is selected.
      • The Require secure channel (SSL) check box is not selected.
   3. Close the OMA Properties dialog box.
5. Right-click Microsoft-Server-ActiveSync, and then follow these steps:
   1. Verify the following settings on the Virtual Directory tab:
      • The following check boxes are selected:
        • Log visits
        • Index this resource
      • The Application name setting is /LM/W3SVC/1/root/Microsoft-Server-ActiveSync.
      • The Execute permissions setting is Scripts and Executables.
      • The Application pool setting is ExchangeApplicationPool.
   2. Verify the following settings on the Directory Security tab:
      • The Enable anonymous access check box is not selected.
      • The Integrated Windows authentication check box is not selected.
      • The Basic authentication check box is selected.
      • The Require secure channel (SSL) check box is not selected.
6. Run the iisreset /noforce computer_name command to restart IIS on the Windows SBS 2003-based computer.

Make sure that the name on the SSL certificate you have installed matches the Fully Qualified Domain Name (FQDN) that you are connecting to for ActiveSync – for example, mail.microsoft.com. If it does not match, either re-issue the certificate if you created it yourself, or re-key the certificate from your SSL certificate provider.

Activesync is much easier to get working with a purchased SSL certificate.

Ensure that the IP for the Default Website is set to All Unassigned and using port 80 (open up IIS, Right-Click the Default Website). If your default website is using any port other than port 80, it simply will not work, so if you have changed this to make something else work, either change it back to port 80 or stop trying to use Activesync!

If you make any changes to IIS, you will need to reset IIS settings. Please click on Start, Run and type IISRESET then press enter.

Ensure that Forms Based Authentication is NOT turned on under Exchange Virtual Server under Exchange Protocols (Exchange System Manager, Servers, Protocols, HTTP, Exchange Virtual Server properties, Settings Tab). If it is — read http://support.microsoft.com/kb/817379

Once all of the above has been checked, if you have made any changes, please re-visit https://testexchangeconnectivity.com and your test should now pass all checks and Activesync should be working happily for you.

If you still cannot get Activesync to work or keep getting an HTTP 500 error, please follow Method 2 in KB Article 883380 http://support.microsoft.com/kb/883380 and this should resolve the issues. This essentially deletes the Metabase (which can be corrupted) and rebuilds it. Rebuilding it often clears up problems that all the other steps above does not resolve.

After following KB883380 and if Activesync still does not work and it keeps coming up with HTTP 500 errors, please do the following:

• Disable Forms Based Authentication – Exchange HTTP Protocol (if enabled)
• Remove SSL settings from the Exchange IIS virtual directory
• Run iisreset
• Test activesync without SSL selected – hopefully this should work or give the OK result
• If okay – right-click on the Exchange Virtual Directory and select all Tasks> Save Configuration to a file. Name the file Exchange and save to the desktop
• Run Regedit (and be extremely careful here as you can kill your server very easily) then right-click on My Computer and select Export. Name the file as ‘EntireRegistry’ and save the backup of the registry to the desktop
• In regedit – locate HKLM \ System \ CurrentControlSet \ Services \ MasSync \ Parameters and delete the ExchangeVDir key from the right-hand pane.
• Close Regedit
• Right-click on the default-website and select New> Virtual Directory fom File. Browse to the desktop and click on the Exchange.xml that you created above, then click on Read file, select Exchange from the ‘Select a configuration to import’ section and click on OK. Select ‘Create a new virtual Directory’ and name the directory ‘exchange-oma’ and click OK.
• Right-click on Exchange-OMA virtual directory you just created and click Browse – you should see OWA open up happily
• Open Regedit and add the ExchangeVDir key back that you recently deleted as a String Value and then change the value to read /exchange-oma
• Close regedit
• Enable SSL and require 128-Bit Encryption on the Exchange Virtual Directory
• Enable Forms Based Authentication (if you want to use it) on Exchange> Protocols> HTTP
• Make sure that Integrated Authentication is enabled on the Exchange Virtual Directory
• Check that the Exchweb virtual directory does not have SSL enabled
• Run iisreset
• Test Activesync – should hopefully be working now

Please also check the LAN Adapter Binding order to make sure the NIC that Exchange is bound to is at the top of the list (Start> Run> [type] ncpa.cpl [press enter]> Advanced> Advanced Settings> Connections).

I have had Activesync work despite seeing “An HTTP 403 forbidden response was received. The response appears to have come from Unknown. Body is: HTTP/1.1 403 Forbidden” at the end of the test above. To resolve this (if you like things tidy), please open up Exchange System Manager, Global Settings, Mobile Services Properties, Device Security Button, Exceptions Button, then add your account to the exceptions list.

A recently discovered fix for some 0×85010014 errors is to install MSXML 3.0 Service Pack 7 – http://www.microsoft.com/downloads/details.aspx?FamilyID=28494391-052B-42FF-9674-F752BDCA9582&displaylang=en I have not personally had to implement this fix yet, but it has been reported to resolve such problems for a few people.

This article is mostly based on Experts exchange articles created by Alan Hardisty from

http://www.it-eye.co.uk/faqs/readQuestion.php?qid=1

The latest version of Alans article can be found at the following two sites and has been slightly re-written and pictures have been added:

http://www.experts-exchange.com/Software/Server_Software/Email_Servers/Exchange/A_1798-Exchange-2003-Activesync-Connection-Problems-FAQ.html

and on his blog site at:

http://alanhardisty.wordpress.com/2010/02/28/exchange-2003-and-activesync-configuration-and-troubleshooting/

Other parts of the article are copied from Microsoft support which have been copied  to enable easy following of all the steps from the one place rather than having to jump to external articles.