Combining Web Farm publishing with Software or Hardware Based Load Balanced CAS arrays

re: Combining Web Farm publishing with Software or Hardware Based Load Balanced CAS arrays

hawaiiisit2 — Mon, 18 Oct 2010 08:11:03 GMT

re: Combining Web Farm publishing with Software or Hardware Based Load Balanced CAS arrays

kylet_7 — Fri, 13 Aug 2010 06:26:50 GMT

Thanks! So, on my 2010 Exchange server I changed the -AutoDiscoverServiceInternalUri to servername.externaldomain.edu/autodiscover/autodiscover.xml and now the OOF works for my Outlook client and the "Test Email Autoconfiguration" works! It hasn't worked with Outlook 2010 and Exchange 2010 until now.

With Outlook 2010 or 2007 and Exchange 2007, I've had those -AutoDiscoverServiceInternalUri's set to look at that second site, autodiscover.externaldomain.edu/autodiscover/autodiscover.xml and the OOF and "Test Email Autoconfiguration" always worked.

That change made the difference in getting Outlook 2010 to work! Your thoughts?

re: Combining Web Farm publishing with Software or Hardware Based Load Balanced CAS arrays

Greg Taylor — Thu, 12 Aug 2010 20:24:36 GMT

Kylet, so I added a new web site and VDir for AutoDiscover and it works just fine for me. A few thoughts - are you removing the Vdir in the Default Site? You don't need to. Also, the SCP for internal users can point at the AutoDiscover Vdir in the default site, that's fine - only external users need to use the DNS name/cert on the second site - and when I tested that, mine worked fine. Feel free to drop me a line directly if you want and let's see if we can figure this out. grtaylor @.

re: Combining Web Farm publishing with Software or Hardware Based Load Balanced CAS arrays

kylet_7 — Wed, 11 Aug 2010 04:43:28 GMT

Any updates Greg?

re: Combining Web Farm publishing with Software or Hardware Based Load Balanced CAS arrays

kylet_7 — Thu, 29 Jul 2010 00:31:35 GMT

Thanks Greg...I appreciate it. Let me know what you find out!

re: Combining Web Farm publishing with Software or Hardware Based Load Balanced CAS arrays

Greg Taylor — Thu, 29 Jul 2010 00:28:22 GMT

@kylet - I'm going to try and set this up myself and have a look when I have a moment, as frankly, it shouldn't be this hard to get this to work.

@Luke - drop me a line directly, grtaylor @ and I'll see if I can help. And no, it's not Direct Access.

re: Combining Web Farm publishing with Software or Hardware Based Load Balanced CAS arrays

Luke — Wed, 28 Jul 2010 15:04:54 GMT

Thanks Greg. Any clues about the not-two-factor method that could let us control which machines are able to access Exchange remotely? We're in the middle of trying to solve it. Are we just talking Win7 Direct Access?

re: Combining Web Farm publishing with Software or Hardware Based Load Balanced CAS arrays

kylet_7 — Wed, 28 Jul 2010 00:23:28 GMT

Well, I've tried that, but I don't think it really matters. Since the user's mailbox is on the Exch2010 server and that server has the SPN registered, it never passes the credentials onto the Autodiscover site/server. Since it has the ExchangeAB SPN, I'm thinking the Exch2010 server thinks it needs to respond to the authentication request and since the Autodiscover site isn't on the Exch2010 server...the authentication loop password prompt keeps happening over and over.

Is there any way to validate that the SPN WILL get re-registered everytime at reboot, even if removed?

re: Combining Web Farm publishing with Software or Hardware Based Load Balanced CAS arrays

Greg Taylor — Tue, 27 Jul 2010 20:10:17 GMT

Interesting problem, and the reason why you can't get to OOF adn AS when you configure the profile manually of course is because you can't get to AutoDiscover.

I do have one suggestion though, in IIS, on the site where you have added the new AutoDiscover VDir, go into IIS, on the AutoDiscover virtual directory, then go to Authentication. Select Windows Integrated, and click on the Providers link in the Actions pane. Remove Negotiate, add NTLM only. Then Outlook can only do NTLM against the service, and SPN's become a non-issue.

re: Combining Web Farm publishing with Software or Hardware Based Load Balanced CAS arrays

kylet_7 — Mon, 26 Jul 2010 18:01:41 GMT

Yes, with Exch2007, I couldn't setup a new mail profile using Outlook and Autodiscover. I worked with a Microsoft Tech rep and once we unregistered the SPN on my Exch2007 server, the Autodiscover piece of setting up a new mail profile completed successfully. The KB article I used I listed above as basically, when I setup a new Outlook profile, I couldn't use "negotiate authentication" and had to use "NTLM authentication."

This is the same scenario I am seeing now with Exch2010. With a mailbox that's on Exch2010 server, I can't setup a new Outlook profile and have Autodiscover successfully finish. I am continually prompted for a username/password. I also can't contact the OOF and AS service if I manually create a new Outlook profile. This was exactly the same with Exch2007 and once I unregistered the SPN, these issues went away with Microsoft Tech rep.

With a mailbox that's still on Exch2007, the new Outlook profile and mailbox setup completes successfully using Autodiscover. This is has been tested with Outlook 2007 and 2010 with the same results so I know it's an Exchange 2010 config issue.