401 Error when attempting Test-OutlookWebServices
Some users have been recieving 401 Error when attempting to run Test-OutlookWebServices from the CAS server. The below articles talks about why IIS returns this error.
http://support.microsoft.com/?id=896861
You can test this by attemtping to access the server in the following way:
https://netbiosname/Autodiscover/Autodiscover.xml :
It will prompt for credentials. After prompting a couple of times we get the following error:Error: Access is Denied.-
Use https://localhost/Autodiscover/Autodiscover.xml :
It will work fine and give an output.
DisableLoopbackCheck can be disabled but then the system is left open to an attack and I would not recommend disabling this function unless you will enable once testing is completed.
: Disable the loopback check
Follow these steps:
1.Click Start, click Run, type regedit, and then click OK.
2.In Registry Editor, locate and then click the following registry key:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa
3.Right-click Lsa, point to New, and then click DWORD Value.
4.Type DisableLoopbackCheck, and then press ENTER.
5.Right-click DisableLoopbackCheck, and then click Modify.
6.In the Value data box, type 1, and then click OK.
7.Quit Registry Editor, and then restart your computer.
![[Google]]( http://www.exchange-genie.com/wp-content/plugins/easy-adsenser/google-light.gif)
July 25th, 2007 at 3:04 pm
Thanks Genie for this post. I searched all over the net yesterday for why my EX2K7 server was having these errors, and I was about to pay for per-incedent support at MS to get it resolved. Turns out this was my problem – and it’s not really a problem at all… so thanks again!
July 26th, 2007 at 7:32 pm
Dave,
I am glad I was able to save you some $$$
Brian
August 2nd, 2007 at 9:09 am
Brian, this was one of the many issues that you helped with me over the past few days.. I really appreciate your expertise and knowledge..
I love this blog and am delighted that people like you are so generous in sharing their knowledge and experiences..
Thank you once again,
Liam
August 2nd, 2007 at 3:59 pm
Liam,
It was my pleasure to help!I am glad that I can provide assistance. I know how fustrating it can be to try and find solution!
August 13th, 2007 at 7:45 am
Hi,
I am having a similar problem when I run test-outlookwebservices | fl.
I have set my autodiscover on a seperate website with its own cert. I have removed the default autodiscover virtual directory. When I run the test, I get: Error 1013 “When Contacting https://autodiscover.domain.com/autodiscover/autodiscover.xml received the error The remote server returned an error: (401) Unauthorized.”
If I open IE and try going to https://localhost/autodiscover/autodiscover.xml, I just get a “Page cannot be displayed”. I have been searching for days and was happy to come across your blog but unfortunately, this doesn’t seem to cure my problem. Any ideas which you would like to share?
August 13th, 2007 at 1:23 pm
Do you only have 1 server in your envrionment?
Can you attempt to run the test from an alternate Exchange server?
Take a look at exchange-experts I answer a lot questions there…
November 9th, 2007 at 2:23 am
should internal clients be using the external url for the AS? I don’t see a config to specify an internal and external url for the AS?
November 11th, 2007 at 7:38 am
I have this exact issue! Thanks for the post, quick question though, I am a little hesitant to disable this security feature. Is there any other work around? When I run the test-outlookwebservices it shows that the AS is contacting the External URL. This is also confirmed from the Test Outlook Auto Configuration from an internal domain client, should it be using the external url for internal clients?
— I reposted this so I did not have your email address listed
November 11th, 2007 at 7:43 am
Gmatteson……
If you dont want to disable this feature full time, you can do it run your test then enable it back. I would not recommned leaving it unsecure…..
The 2nd part of your question.
A domain joined internal client should hit the internal url, now depending on how you have thing configured the url could be the same.
We a domain join client start autodiscover – it contacts AD and get the SCP for the autodiscover service and now knows which url to connect if the client is not domain joined it will query dns for the autodiscover.domain.com or domain.com/autodiscover info… and xml file is pulled from this which states the url to use.
December 21st, 2007 at 3:11 am
Hi Genie, thanks for charing your knowledge. I’m really greatful!
I have a similar problem with my Exchange 2007 environment.
Environment
2 servers; edge transport server and the other server with cas, hub, store etc. Domain controller role is separated on a dedicated server for DC, DNS and DHCP.
Test-error
When i run the test-OutlookWebServices I get the same problem as described. When I changed the DisableloopbackCheck some of the errors disappear, but one is still there:
1005 Error; When accessing https://”netbios CAS-server”/Autodiscover/Autodiscover.xml the error “RemoteCertificateNameMismatch:CN=”external DNS name” …
Autodiscover.xml
The autodiscover.xml file has the following code:
===================
xml version=”1.0″ encoding=”utf-8″
- Autodiscover xmlns=”http://schemas.microsoft.com/exchange/autodiscover/responseschema/2006″
- Response
- Error Time=”01:34:49.9053248″ Id=”331888869″
ErrorCode 600 /ErrorCode
Message Invalid Request /Message
DebugData /
/Error
/Response
/Autodiscover
===================
I’m not sure what steps to take from this point. Any ideas?
Best Regards
isak
December 21st, 2007 at 2:26 pm
Have you read through my autodiscover blog, the error states that you have a mismatch of the cert name?
Domain joined client typicall get the autodiscover info from the SCP in AD this can be check with the get-clientaccessserver command
take a look over this
http://exchange-genie.blogspot.com/2007/07/autodiscover-ad-attribute.html
April 14th, 2008 at 10:18 am
Hi Genie,
I have disabled the security check as you discribed, however I am still getting the 401 error with Rest-OutlookWebServices |fl, is there anything else that may cause this issue?
OWA works and Internal Autodiscover, but my Outlook Anywhere Clients simply keep asking for login credentials
Thanks
May 20th, 2008 at 7:52 am
please reference the autodiscover blog that I have http://exchange-genie.blogspot.com/2007/07/autodiscover-ad-attribute.html internal clients pull autodiscover from the scp and will then use web services to pull free busy info…
May 20th, 2008 at 1:06 pm
I actually used your autodiscover blog to setup my autodiscover. I’ve gone through that blog at least 3 times and triple checked all of my settings. The Test-OutlookWebServices is successful and the Test Email Auto Configuration in Outlook works fine. It’s looking more and more like I need to call Microsoft on this one.
July 21st, 2008 at 10:24 am
You are the best!
Excellent solution.
Thank you so much!
July 31st, 2008 at 7:08 pm
Thank you!!! Our spam filter was not working properly and we needed to resolve this problem asap. I am not certain why it just decided to fail, because the initial tests worked without issue…Regardless, thanks again for your help.
April 29th, 2009 at 8:50 pm
This worked for me! Thanks!
So, how do we fix it permanently ?
April 30th, 2009 at 8:07 am
the fix would be to leave the changes you have made, else only make the mods when you need to use the test command
June 29th, 2009 at 7:09 am
Hi I am also getting the same Id : 1013
Type : Error
Message : When contacting https://webmail.virginmobile.in/Autodiscover/Autodisc
over.xml received the error The remote server returned an error: (401
) Unauthorized.
Id : 1006
Type : Error
Message : The Autodiscover service could not be contacted.
From internal everything is working fine but when i connect my mail from outside as in RPC over http i am not able to put out of office and not able to download OAB also.
Can you please help me out. I purchased public cert which includes the my autodiscover.
September 9th, 2009 at 9:31 pm
Would this error stop new users (that have mailboxes on the same server that the 2nd Autodiscover web site is hosted) from being able to setup new Outlook profiles?
My current users can run the Test Email Autoconfiguration and get success but if they delete their Outlook profile, when Autodiscover tries to setup a new Outlook profile, they are continually prompted for their username/password and are never able to get back into Outlook.
Hopefully you have some suggestions for me!!
September 12th, 2009 at 2:31 pm
no that should not… I would look at your autodiscover setup that you have configured
September 17th, 2009 at 6:34 am
Kyle, have you run the SCW? if so have a look at the security logs on the exchange box. I had very similar issues and had to create allow rule in the windows firewall, granting client access to mad.exe on the exchange box.
March 22nd, 2010 at 1:27 pm
Wow – can’t thank you enough for this fix. Worked like a CHARM
April 20th, 2010 at 6:31 am
great post – you can also get this working without disabling the loopback security check by following METHOD 1 of this article:
http://support.microsoft.com/kb/926642
May 4th, 2010 at 5:16 am
i have updated the rollpack 2 exchange 2007 sp2. I started getting the error.
1st option doesn’t work.
It work for me with second option on production environment.
Disable the loopback check (less-recommended method)
The second method is to disable the loopback check by setting the DisableLoopbackCheck registry key.
To set the DisableLoopbackCheck registry key, follow these steps:
Set the DisableStrictNameChecking registry entry to 1. For more information about how to do this, click the following article number to view the article in the Microsoft Knowledge Base:
281308 (http://support.microsoft.com/kb/281308/ ) Connecting to SMB share on a Windows 2000-based computer or a Windows Server 2003-based computer may not work with an alias name
Click Start, click Run, type regedit, and then click OK.
In Registry Editor, locate and then click the following registry key:
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlLsa
Right-click Lsa, point to New, and then click DWORD Value.
Type DisableLoopbackCheck, and then press ENTER.
Right-click DisableLoopbackCheck, and then click Modify.
In the Value data box, type 1, and then click OK.
Quit Registry Editor, and then restart your computer.
plz let meknow what exact jhappen when we update the roll pack /service pack.
Regards,
Pravin Desai.