Users are continually prompted for login credentials and security certificates.
-
quarta-feira, 13 de junho de 2012 13:55
I recently took over at a new office and saw that all of our users have been needing to log in continually and confirm security certificates. After trying for a while to fix it a permanent fix seems to allude me. Looking for any help I can get here to try and fix this issue.
Here is a copy of the basic information of the server:
===============================================================================================================
[PS] C:\Windows\system32>Get-WebServicesVirtualDirectory | fl
RunspaceId : 2b64e329-956e-44e1-ad2b-a9ebc10fe33b
CertificateAuthentication :
InternalNLBBypassUrl : https://sbs.hoffent.local/ews/exchange.asmx
GzipLevel : High
Name : EWS (Default Web Site)
InternalAuthenticationMethods : {Basic, Ntlm, WindowsIntegrated, WSSecurity}
ExternalAuthenticationMethods : {Basic, Ntlm, WindowsIntegrated, WSSecurity}
LiveIdSpNegoAuthentication : False
WSSecurityAuthentication : True
LiveIdBasicAuthentication : False
BasicAuthentication : True
DigestAuthentication : False
WindowsAuthentication : True
MetabasePath : IIS://SBS.hoffent.local/W3SVC/1/ROOT/EWS
Path : C:\Program Files\Microsoft\Exchange Server\V14\ClientAccess\exchweb\EWS
ExtendedProtectionTokenChecking : None
ExtendedProtectionFlags : {}
ExtendedProtectionSPNList : {}
Server : SBS
InternalUrl : https://mail.hoffent.com/EWS/Exchange.asmx
ExternalUrl : https://mail.hoffent.com/EWS/Exchange.asmx
AdminDisplayName :
ExchangeVersion : 0.10 (14.0.100.0)
DistinguishedName : CN=EWS (Default Web Site),CN=HTTP,CN=Protocols,CN=SBS,CN=Servers,CN=Exchange Administ
rative Group (FYDIBOHF23SPDLT),CN=Administrative Groups,CN=First Organization,CN=Micr
osoft Exchange,CN=Services,CN=Configuration,DC=hoffent,DC=local
Identity : SBS\EWS (Default Web Site)
Guid : 6da2e16b-3630-4deb-8caa-f6b92bfefbe0
ObjectCategory : hoffent.local/Configuration/Schema/ms-Exch-Web-Services-Virtual-Directory
ObjectClass : {top, msExchVirtualDirectory, msExchWebServicesVirtualDirectory}
WhenChanged : 6/8/2012 10:08:13 AM
WhenCreated : 3/28/2011 3:21:03 PM
WhenChangedUTC : 6/8/2012 2:08:13 PM
WhenCreatedUTC : 3/28/2011 7:21:03 PM
OrganizationId :
OriginatingServer : SBS.hoffent.local
IsValid : True
[PS] C:\Windows\system32>Get-OABVirtualDirectory | fl
RunspaceId : 2b64e329-956e-44e1-ad2b-a9ebc10fe33b
Name : OAB (Default Web Site)
PollInterval : 480
OfflineAddressBooks : {\Default Offline Address Book}
RequireSSL : True
BasicAuthentication : True
WindowsAuthentication : True
MetabasePath : IIS://SBS.hoffent.local/W3SVC/1/ROOT/OAB
Path : C:\Program Files\Microsoft\Exchange Server\V14\ClientAccess\OAB
ExtendedProtectionTokenChecking : None
ExtendedProtectionFlags : {}
ExtendedProtectionSPNList : {}
Server : SBS
InternalUrl : https://mail.hoffent.com/OAB
InternalAuthenticationMethods : {Basic, WindowsIntegrated}
ExternalUrl : https://mail.hoffent.com/OAB
ExternalAuthenticationMethods : {Basic, WindowsIntegrated}
AdminDisplayName :
ExchangeVersion : 0.10 (14.0.100.0)
DistinguishedName : CN=OAB (Default Web Site),CN=HTTP,CN=Protocols,CN=SBS,CN=Servers,CN=Exchange Administ
rative Group (FYDIBOHF23SPDLT),CN=Administrative Groups,CN=First Organization,CN=Micr
osoft Exchange,CN=Services,CN=Configuration,DC=hoffent,DC=local
Identity : SBS\OAB (Default Web Site)
Guid : f6bd498c-0b56-4a45-8cd5-c8cdc252d4d9
ObjectCategory : hoffent.local/Configuration/Schema/ms-Exch-OAB-Virtual-Directory
ObjectClass : {top, msExchVirtualDirectory, msExchOABVirtualDirectory}
WhenChanged : 6/8/2012 10:08:18 AM
WhenCreated : 3/28/2011 3:20:34 PM
WhenChangedUTC : 6/8/2012 2:08:18 PM
WhenCreatedUTC : 3/28/2011 7:20:34 PM
OrganizationId :
OriginatingServer : SBS.hoffent.local
IsValid : True
[PS] C:\Windows\system32>Get-UMVirtualDirectory | f
The term 'Get-UMVirtualDirectory' is not recognized as the name of a cmdlet, function, script file, or operable program
. Check the spelling of the name, or if a path was included, verify that the path is correct and try again.
At line:1 char:23
+ Get-UMVirtualDirectory <<<< | f
+ CategoryInfo : ObjectNotFound: (Get-UMVirtualDirectory:String) [], CommandNotFoundException
+ FullyQualifiedErrorId : CommandNotFoundException
[PS] C:\Windows\system32>Get-UMVirtualDirectory | fl
The term 'Get-UMVirtualDirectory' is not recognized as the name of a cmdlet, function, script file, or operable program
. Check the spelling of the name, or if a path was included, verify that the path is correct and try again.
At line:1 char:23
+ Get-UMVirtualDirectory <<<< | fl
+ CategoryInfo : ObjectNotFound: (Get-UMVirtualDirectory:String) [], CommandNotFoundException
+ FullyQualifiedErrorId : CommandNotFoundException
[PS] C:\Windows\system32>Get-WebServicesVirtualDirectory | fl
RunspaceId : 2b64e329-956e-44e1-ad2b-a9ebc10fe33b
CertificateAuthentication :
InternalNLBBypassUrl : https://sbs.hoffent.local/ews/exchange.asmx
GzipLevel : High
Name : EWS (Default Web Site)
InternalAuthenticationMethods : {Basic, Ntlm, WindowsIntegrated, WSSecurity}
ExternalAuthenticationMethods : {Basic, Ntlm, WindowsIntegrated, WSSecurity}
LiveIdSpNegoAuthentication : False
WSSecurityAuthentication : True
LiveIdBasicAuthentication : False
BasicAuthentication : True
DigestAuthentication : False
WindowsAuthentication : True
MetabasePath : IIS://SBS.hoffent.local/W3SVC/1/ROOT/EWS
Path : C:\Program Files\Microsoft\Exchange Server\V14\ClientAccess\exchweb\EWS
ExtendedProtectionTokenChecking : None
ExtendedProtectionFlags : {}
ExtendedProtectionSPNList : {}
Server : SBS
InternalUrl : https://mail.hoffent.com/EWS/Exchange.asmx
ExternalUrl : https://mail.hoffent.com/EWS/Exchange.asmx
AdminDisplayName :
ExchangeVersion : 0.10 (14.0.100.0)
DistinguishedName : CN=EWS (Default Web Site),CN=HTTP,CN=Protocols,CN=SBS,CN=Servers,CN=Exchange Administ
rative Group (FYDIBOHF23SPDLT),CN=Administrative Groups,CN=First Organization,CN=Micr
osoft Exchange,CN=Services,CN=Configuration,DC=hoffent,DC=local
Identity : SBS\EWS (Default Web Site)
Guid : 6da2e16b-3630-4deb-8caa-f6b92bfefbe0
ObjectCategory : hoffent.local/Configuration/Schema/ms-Exch-Web-Services-Virtual-Directory
ObjectClass : {top, msExchVirtualDirectory, msExchWebServicesVirtualDirectory}
WhenChanged : 6/8/2012 10:08:13 AM
WhenCreated : 3/28/2011 3:21:03 PM
WhenChangedUTC : 6/8/2012 2:08:13 PM
WhenCreatedUTC : 3/28/2011 7:21:03 PM
OrganizationId :
OriginatingServer : SBS.hoffent.local
IsValid : True
[PS] C:\Windows\system32>Get-ClientAccessServer | fl
RunspaceId : 2b64e329-956e-44e1-ad2b-a9ebc10fe33b
Name : SBS
Fqdn : SBS.hoffent.local
OutlookAnywhereEnabled : True
AutoDiscoverServiceCN : SBS
AutoDiscoverServiceClassName : ms-Exchange-AutoDiscover-Service
AutoDiscoverServiceInternalUri : https://mail.hoffent.com/autodiscover/autodiscover.xml
AutoDiscoverServiceGuid : 77378f46-2c66-4aa9-a6a6-3e7a48b19596
AutoDiscoverSiteScope : {Default-First-Site-Name}
AlternateServiceAccountConfiguration :
IrmLogEnabled : True
IrmLogMaxAge : 30.00:00:00
IrmLogMaxDirectorySize : 250 MB (262,144,000 bytes)
IrmLogMaxFileSize : 10 MB (10,485,760 bytes)
IrmLogPath : C:\Program Files\Microsoft\Exchange Server\V14\Logging\IRMLogs
MigrationLogLoggingLevel : Information
MigrationLogFilePath :
MigrationLogMaxAge : 180.00:00:00
MigrationLogMaxDirectorySize : 10 GB (10,737,418,240 bytes)
MigrationLogMaxFileSize : 100 MB (104,857,600 bytes)
IsValid : True
ExchangeVersion : 0.1 (8.0.535.0)
DistinguishedName : CN=SBS,CN=Servers,CN=Exchange Administrative Group (FYDIBOHF23SPDLT),CN=Administ
rative Groups,CN=First Organization,CN=Microsoft Exchange,CN=Services,CN=Configu
ration,DC=hoffent,DC=local
Identity : SBS
Guid : 53eb908a-1598-43e1-a3e3-6ba4d9502111
ObjectCategory : hoffent.local/Configuration/Schema/ms-Exch-Exchange-Server
ObjectClass : {top, server, msExchExchangeServer}
WhenChanged : 4/4/2012 9:41:33 AM
WhenCreated : 3/28/2011 3:16:04 PM
WhenChangedUTC : 4/4/2012 1:41:33 PM
WhenCreatedUTC : 3/28/2011 7:16:04 PM
OrganizationId :
OriginatingServer : SBS.hoffent.local
Todas as Respostas
-
quarta-feira, 13 de junho de 2012 17:31
I don't have the time to comb through all those settings, and honestly I wouldn't necessarily be able to tell you whether they're right.
If you're being prompted for logon credentials, it may be a networking issue, such is when a network change like a wired to wireless connection causes a connection to a different CAS, or it could be an incompatibility between the authentication method being used.
If you are getting certificate warnings, it's because your certificate isn't being accepted for the URL that's being accessed. I would fix this one first because it can lead to extra logon prompts.
Ed Crowley MVP "There are seldom good technological solutions to behavioral problems."
-
quarta-feira, 13 de junho de 2012 18:20Well I can't begin to think where to look to fix this certificate error, from what I can see the certificates int he store are all good and functioning, the certificate it continues to pop up is a self signed cert that seems to cause issues.
-
quarta-feira, 13 de junho de 2012 20:32Make sure the self-signed certificate is not bound to any services except for SMTP.
Ed Crowley MVP "There are seldom good technological solutions to behavioral problems."
-
quinta-feira, 14 de junho de 2012 06:16
Hi,
can you post what you get when typing "get-autodiscoveryvirtualdirectory".
Is Outlook Anywhere activated?
Can you also post the names on your certificate: get-exchangecertificate | fl subject*
Regards,
markus
MCSE:Messaging
-
quinta-feira, 14 de junho de 2012 08:37
Hi,
First please clarify where do you get the certificate warning, opening outlook/OWA/outlook anywhere?
Please run test e-mail autoconfiguration and then post the log tab information here.
I noted that you have set your autodiscoverinternaluri as https://mail.hoffent.com/autodiscover/autodiscover.xml, then please verify if you have add mail.hoffent.com to your certificate domian name.
You can run get-exchangecertificate |fl and then post the result here.
Xiu Zhang
TechNet Community Support
-
quinta-feira, 14 de junho de 2012 13:12
Hi,
can you post what you get when typing "get-autodiscoveryvirtualdirectory".
Is Outlook Anywhere activated?
Can you also post the names on your certificate: get-exchangecertificate | fl subject*
Regards,
markus
MCSE:Messagin
Get-autodiscoveryvirtualdirectory did not seem to work, however I did the exchange certificate command, here is the results:
AccessRules :
CertificateDomains : {SBS.hoffent.local}
HasPrivateKey : True
IsSelfSigned : False
Issuer : CN=hoffent-SBS-CA
NotAfter : 2/13/2013 4:16:45 PM
NotBefore : 2/14/2012 4:16:45 PM
PublicKeySize : 2048
RootCAType : Registry
SerialNumber : 5267879700000000000D
Services : IMAP, POP
Status : Valid
Subject : CN=SBS.hoffent.local
Thumbprint : 7418D415EC6F65459CDCEC362556C462310DFBE0
AccessRules :
CertificateDomains : {mail.hoffent.com, hoffent.com, SBS.hoffent.local}
HasPrivateKey : True
IsSelfSigned : False
Issuer : CN=hoffent-SBS-CA
NotAfter : 3/28/2013 12:02:38 PM
NotBefore : 3/29/2011 12:02:38 PM
PublicKeySize : 2048
RootCAType : Registry
SerialNumber : 1449E90D000000000006
Services : IMAP, POP, SMTP
Status : Valid
Subject : CN=mail.hoffent.com
Thumbprint : CB13F573EF2E64084E5B564B9E64746F771246DC
AccessRules :
CertificateDomains : {remote.hoffent.com, hoffent.com, SBS.hoffent.local}
HasPrivateKey : True
IsSelfSigned : False
Issuer : CN=hoffent-SBS-CA
NotAfter : 3/28/2013 11:55:36 AM
NotBefore : 3/29/2011 11:55:36 AM
PublicKeySize : 2048
RootCAType : Registry
SerialNumber : 14437D7E000000000005
Services : IMAP, POP, SMTP
Status : Valid
Subject : CN=remote.hoffent.com
Thumbprint : A3F829EE43E91869F0765C4E20EC86ACEC916038
AccessRules :
CertificateDomains : {remote.hoffent.com, hoffent.com, SBS.hoffent.local}
HasPrivateKey : True
IsSelfSigned : False
Issuer : CN=hoffent-SBS-CA
NotAfter : 3/28/2013 11:16:34 AM
NotBefore : 3/29/2011 11:16:34 AM
PublicKeySize : 2048
RootCAType : Registry
SerialNumber : 141FC22B000000000004
Services : IMAP, POP, SMTP
Status : Valid
Subject : CN=remote.hoffent.com
Thumbprint : A4070E92CD7043FA27476665F5CF5AE5C0156DAE
AccessRules :
CertificateDomains : {mail.hoffent.com, hoffent.com, SBS.hoffent.local, remote.hoffent.com, autodiscover.hoffent.com}
HasPrivateKey : True
IsSelfSigned : False
Issuer : CN=DigiCert High Assurance CA-3, OU=www.digicert.com, O=DigiCert Inc, C=US
NotAfter : 4/2/2014 8:00:00 AM
NotBefore : 3/28/2011 8:00:00 PM
PublicKeySize : 2048
RootCAType : ThirdParty
SerialNumber : 0E1F0F58E61CED38ADE9421589133384
Services : IMAP, POP, IIS, SMTP
Status : Valid
Subject : CN=mail.hoffent.com, OU=HOFF Enterprises Inc., O=HOFF Enterprises Inc., L=Johnstown, S=Pennsylvani
a, C=US
Thumbprint : 92B3B5196CC3E9F4DC8F580D216DCE29121AE704
AccessRules :
CertificateDomains : {WMSvc-WIN-SI0IB5RGGJB}
HasPrivateKey : True
IsSelfSigned : True
Issuer : CN=WMSvc-WIN-SI0IB5RGGJB
NotAfter : 3/25/2021 5:09:13 PM
NotBefore : 3/28/2011 5:09:13 PM
PublicKeySize : 2048
RootCAType : Registry
SerialNumber : 31F4FFC7F754048D4E837AE2F38A0135
Services : None
Status : Valid
Subject : CN=WMSvc-WIN-SI0IB5RGGJB
Thumbprint : 7143C25FA0C51764BD083F1CBB3D2AF34F88C1CA
AccessRules :
CertificateDomains : {Sites, SBS.hoffent.local}
HasPrivateKey : True
IsSelfSigned : False
Issuer : CN=hoffent-SBS-CA
NotAfter : 3/27/2013 2:54:25 PM
NotBefore : 3/28/2011 2:54:25 PM
PublicKeySize : 2048
RootCAType : Registry
SerialNumber : 61037F7B000000000002
Services : IMAP, POP, SMTP
Status : Valid
Subject : CN=Sites
Thumbprint : 54FB0468526C175DF12A36349B62D2F241A71E4F
AccessRules :
CertificateDomains : {hoffent-SBS-CA}
HasPrivateKey : True
IsSelfSigned : True
Issuer : CN=hoffent-SBS-CA
NotAfter : 3/28/2016 3:04:05 PM
NotBefore : 3/28/2011 2:54:06 PM
PublicKeySize : 2048
RootCAType : Registry
SerialNumber : 0BC64810AB671C8147460452CAF359F4
Services : None
Status : Valid
Subject : CN=hoffent-SBS-CA
Thumbprint : 5BFD0E10BB0C2C775A50BEE4960D554F12C72F08
-
quinta-feira, 14 de junho de 2012 13:21
Hi,
First please clarify where do you get the certificate warning, opening outlook/OWA/outlook anywhere?
Please run test e-mail autoconfiguration and then post the log tab information here.
I noted that you have set your autodiscoverinternaluri as https://mail.hoffent.com/autodiscover/autodiscover.xml, then please verify if you have add mail.hoffent.com to your certificate domian name.
You can run get-exchangecertificate |fl and then post the result here.
Xiu Zhang
TechNet Community Support
Here is a screenshot of the results from the test configuration. http://i.imgur.com/0OENb.png
The error arises when logging into outlook, random times while outlook is open, and almost every time you open a new email. The certificate never shows up when using OWA.
and here is the XML code. The results from the get-exchangecertificate |fl are posted above.
<?xml version="1.0" encoding="utf-8"?> <Autodiscover xmlns="http://schemas.microsoft.com/exchange/autodiscover/responseschema/2006"> <Response xmlns="http://schemas.microsoft.com/exchange/autodiscover/outlook/responseschema/2006a"> <User> <DisplayName>Nick Arrington</DisplayName> <LegacyDN>/o=First Organization/ou=Exchange Administrative Group (FYDIBOHF23SPDLT)/cn=Recipients/cn=Nick Arrington8b6</LegacyDN> <AutoDiscoverSMTPAddress>Narrington@hoffent.com</AutoDiscoverSMTPAddress> <DeploymentId>c6b1934a-7f70-42f6-a4e9-4c15a53adcf1</DeploymentId> </User> <Account> <AccountType>email</AccountType> <Action>settings</Action> <Protocol> <Type>EXCH</Type> <Server>SBS.hoffent.local</Server> <ServerDN>/o=First Organization/ou=Exchange Administrative Group (FYDIBOHF23SPDLT)/cn=Configuration/cn=Servers/cn=SBS</ServerDN> <ServerVersion>738180DA</ServerVersion> <MdbDN>/o=First Organization/ou=Exchange Administrative Group (FYDIBOHF23SPDLT)/cn=Configuration/cn=Servers/cn=SBS/cn=Microsoft Private MDB</MdbDN> <PublicFolderServer>SBS.hoffent.local</PublicFolderServer> <AD>SBS.hoffent.local</AD> <ASUrl>https://mail.hoffent.com/EWS/Exchange.asmx</ASUrl> <EwsUrl>https://mail.hoffent.com/EWS/Exchange.asmx</EwsUrl> <EcpUrl>https://mail.hoffent.com/ecp/</EcpUrl> <EcpUrl-um>?p=customize/voicemail.aspx&exsvurl=1</EcpUrl-um> <EcpUrl-aggr>?p=personalsettings/EmailSubscriptions.slab&exsvurl=1</EcpUrl-aggr> <EcpUrl-mt>PersonalSettings/DeliveryReport.aspx?exsvurl=1&IsOWA=<IsOWA>&MsgID=<MsgID>&Mbx=<Mbx></EcpUrl-mt> <EcpUrl-ret>?p=organize/retentionpolicytags.slab&exsvurl=1</EcpUrl-ret> <EcpUrl-sms>?p=sms/textmessaging.slab&exsvurl=1</EcpUrl-sms> <OOFUrl>https://mail.hoffent.com/EWS/Exchange.asmx</OOFUrl> <UMUrl>https://mail.hoffent.com/EWS/UM2007Legacy.asmx</UMUrl> <OABUrl>https://mail.hoffent.com/OAB/2ebb91eb-6e4e-4334-a9c6-5c215c1352c5/</OABUrl> </Protocol> <Protocol> <Type>EXPR</Type> <Server>mail.hoffent.com</Server> <SSL>On</SSL> <AuthPackage>Basic</AuthPackage> <ASUrl>https://mail.hoffent.com/EWS/Exchange.asmx</ASUrl> <EwsUrl>https://mail.hoffent.com/EWS/Exchange.asmx</EwsUrl> <EcpUrl>https://mail.hoffent.com/ecp/</EcpUrl> <EcpUrl-um>?p=customize/voicemail.aspx&exsvurl=1</EcpUrl-um> <EcpUrl-aggr>?p=personalsettings/EmailSubscriptions.slab&exsvurl=1</EcpUrl-aggr> <EcpUrl-mt>PersonalSettings/DeliveryReport.aspx?exsvurl=1&IsOWA=<IsOWA>&MsgID=<MsgID>&Mbx=<Mbx></EcpUrl-mt> <EcpUrl-ret>?p=organize/retentionpolicytags.slab&exsvurl=1</EcpUrl-ret> <EcpUrl-sms>?p=sms/textmessaging.slab&exsvurl=1</EcpUrl-sms> <OOFUrl>https://mail.hoffent.com/EWS/Exchange.asmx</OOFUrl> <UMUrl>https://mail.hoffent.com/EWS/UM2007Legacy.asmx</UMUrl> <OABUrl>https://mail.hoffent.com/OAB/2ebb91eb-6e4e-4334-a9c6-5c215c1352c5/</OABUrl> </Protocol> <Protocol> <Type>WEB</Type> <Internal> <OWAUrl AuthenticationMethod="Basic, Fba">https://mail.hoffent.com/owa/</OWAUrl> <Protocol> <Type>EXCH</Type> <ASUrl>https://mail.hoffent.com/EWS/Exchange.asmx</ASUrl> </Protocol> </Internal> <External> <OWAUrl AuthenticationMethod="Fba">https://mail.hoffent.com/owa/</OWAUrl> <Protocol> <Type>EXPR</Type> <ASUrl>https://mail.hoffent.com/EWS/Exchange.asmx</ASUrl> </Protocol> </External> </Protocol> <AlternativeMailbox> <Type>Delegate</Type> <DisplayName>Doug Wess</DisplayName> <LegacyDN>/o=First Organization/ou=Exchange Administrative Group (FYDIBOHF23SPDLT)/cn=Recipients/cn=Doug Wess</LegacyDN> <Server>SBS.hoffent.local</Server> </AlternativeMailbox> </Account> </Response> </Autodiscover>
- Editado Zettoz quinta-feira, 14 de junho de 2012 13:23
-
sexta-feira, 15 de junho de 2012 06:23
-
sexta-feira, 15 de junho de 2012 13:16
Here is a screenshot of the log: http://i.imgur.com/VS3xQ.png
Also the issue occurs to everyone, I tried disabling the outlook anywhere and it still happens.
- Editado Zettoz sexta-feira, 15 de junho de 2012 13:17
-
segunda-feira, 18 de junho de 2012 05:30
Hi,
By the way, do you have any thrid party add-in installed to outlook? Please try to disable all the third party add-ins and then try to create a new Exchange profile and then test the issue.
Besides, please follow the steps in article below to modify the internalurl for EWS, OAB UM.
Security warning when you start Outlook 2007 and then connect to a mailbox that is hosted on a server that is running Exchange Server 2007 or Exchange Server 2010: "The name of the security certificate is invalid or does not match the name of the site"
http://support.microsoft.com/kb/940726
Xiu Zhang
TechNet Community Support
- Sugerido como Resposta Xiu Zhang - MSFT terça-feira, 26 de junho de 2012 06:16
- Marcado como Resposta Xiu Zhang - MSFT terça-feira, 10 de julho de 2012 06:25

