Credit to Alan Hardisty
http://www.it-eye.co.uk/faqs/readQuestion.php?qid=1
The below covers all steps to get activesync working with exchange.
- You need to make sure that you have Exchange Server 2003 Service Pack 2 Installed. To check if you have it installed, open up Exchange System Manager – Start, Programs, Microsoft Exchange, System Manager. Then expand Servers, Right-Click your server and choose Properties. This will display whether you have SP2 installed or not.
- You also need to ensure that TCP Port 443 is open and forwarded on the firewall to your Exchange server. You don’t need to open up any other ports to get Activesync working, just TCP port 443.
- Please check the LAN Adapter Binding order to make sure the NIC that Exchange is bound to is at the top of the list (Start> Run> ncpa.cpl > Advanced> Advanced Settings> Connections).
IIS Settings
Please check and mirror the settings below (Open up IIS, expand the default website then expand the relevant Virtual Directory, right-click on the Virtual Directory and choose properties, then click on the Directory Security Tab):
Exchange 2003 (Not part of Small Business Server):
Exchange Virtual Directory
- Authentication = Integrated & Basic
- Default Domain = NetBIOS domain name
- Realm = domain.com
- IP Address Restrictions = Granted Access
- Secure Communications = Require SSL NOT ticked (very important)
Microsoft-Server-Activesync Virtual Directory
- Authentication = Basic
- Default Domain = NETBIOS domain name
- Realm = NETBIOS name
- IP Address Restrictions = Granted Access
- Secure Communications = Require SSL and Require 128-Bit Encryption IS ticked
Exchange 2003 (Part of Small Business Server):
Exchange Virtual Directory
- Authentication = Integrated & Basic
- Default Domain = NetBIOS domain name
- Realm = domain.com
- IP Address Restrictions = Granted Access
- Secure Communications = Require SSL IS ticked (very important)
Microsoft-Server-Activesync Virtual Directory
- Authentication = Basic
- Default Domain = NETBIOS domain name
- Realm = NETBIOS name
- IP Address Restrictions = Granted Access
- Secure Communications = Require SSL and Require 128-Bit Encryption NOT ticked
Exchange-oma Virtual Directory
- Authentication = Integrated & Basic
- Default Domain = NETBIOS domain name
- Realm = NETBIOS name
- IP Address Restrictions = Restricted to IP Address of Server
- Secure Communications = Require SSL and Require 128-Bit Encryption NOT ticked
OMA Virtual Directory
- Authentication = Basic
- Default Domain = NETBIOS domain name
- Realm = NETBIOS name
- IP Address Restrictions = Granted Access
- Secure Communications = Require SSL and Require 128-Bit Encryption NOT ticked
- ASP.NET should be set to version 1.1 for all virtual directories listed above. If you cannot see the ASP.NET tab, you only have v 1.1 installed so do not worry. If any version other than 1.1 is selected, please change it to v 1.1.4322.
- No other virtual directories are involved when using Activesync
- Also, make sure that you have HTTP Keep-Alives enabled
http://www.microsoft.com/technet/prodtechnol/WindowsServer2003/Library/IIS/d7e13ea5-4350-497e-ba34-b25c0e9efd68.mspx?mfr=true
- Please also check that Ignore Client Certificates is selected under the IISADMPWD virtual directory / Directory Security Tab / Edit Secure Communications Button. This Virtual Directory may not exist if you have not setup the ability to reset passwords via Outlook Web Access (OWA)
For Small Business Server 2003 Users – please check this MS article – http://support.microsoft.com/kb/937635
Make sure that the name on the SSL certificate you have installed matches the Fully Qualified Domain Name (FQDN) that you are connecting to for ActiveSync
Ensure that the IP for the Default Website is set to All Unassigned and using port 80 (open up IIS, Right-Click the Default Website). If your default website is using any port other than port 80, it simply will not work, so if you have changed this to make something else work, either change it back to port 80 or stop trying to use Activesync! THIS ONE IS IMPORTANT, LOOSEMORES HAD AN INTRANET SETUP ON PORT 80 USING THE IP ADDRESS OF THE STARSKY AND THE DEFAULT WEB SITE WAS SET TO ALL UNASSIGNED IP’S. ABSOLUTELY NOTHING CAN USE PORT 80 EXCEPT ACTIVESYNC
If you make any changes to IIS, you will need to reset IIS settings (IISRESET)
Testing:
If you have got SP2 installed, check on https://testexchangeconnectivity.com to see if everything is working properly by running the Exchange Activesync check. The site is an official Microsoft site specifically for testing Exchange installations and connectivity.
Please select ‘Specify Manual Server Settings’ (Exchange 2003 does not have native Autodiscover enabled so using the Autodiscover settings will fail).
3rd Party SSL Certificate: Do not check the “Ignore Trust for SSL” check box Self-Certified SSL Certificate: Check the “Ignore Trust for SSL” checkbox.
If you are trying to make an iPhone work, then you can also download the free iPhone App ‘Activesync Tester’ and this should identify any problems with your configuration, or download the version for your PC from https://store.accessmylan.com/main/diagnostic-tools
Various Activesync Errors / Solutions:
If you make any changes to IIS settings, please run IISRESET and re-visit https://testexchangeconnectivity.com
Activesync Error 0×86000108: Activesync is unsuccessful and you see the error 0×86000108 on your Windows Mobile Device: Please read the following MS Article which checks that Authenticated Users has write permissions to the %TEMP% directory (usually c:\windows\temp) – http://support.microsoft.com/kb/950796/en-us
Application Event Log 3005 Errors: A lot of 3005 errors can be resolved by changing the Default Website Timeout value from 120 (default) to something greater, such as 480 using IIS Manager.
Inconsistent Sync: If you are getting inconsistent Synchronisation from your device to your Exchange 2003 server, please add the following registry key to the server: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MSExchangeIS\VirusScan ProactiveScanning REG_DWORD 1
HTTP 401 Error: If you are getting an HTTP 401 error when testing on https://testexchangeconnectivity.com then you are probably entering an incorrect username or password, or you may have IP Address restrictions setup on your virtual directories (see IIS Settings above).
HTTP 403 Error: Ensure that Forms Based Authentication is NOT turned on under Exchange Virtual Server under Exchange Protocols (Exchange System Manager, Servers, Protocols, HTTP, Exchange Virtual Server properties, Settings Tab). If it is — read http://support.microsoft.com/kb/817379
I have had Activesync work despite seeing “An HTTP 403 forbidden response was received. The response appears to have come from Unknown. Body is: HTTP/1.1 403 Forbidden” at the end of the test above. To resolve this, please open up Exchange System Manager, Global Settings, Mobile Services Properties, Device Security Button, Exceptions Button, then add your account to the exceptions list.
HTTP 500 Error: If you still cannot get Activesync to work or keep getting an HTTP 500 error, please follow Method 2 in Microsoft Knowledgebase Article KB883380 (http://support.microsoft.com/kb/883380) and this should resolve the issues. This essentially deletes the Exchange Virtual Directories from the IIS Metabase (which can be corrupted) and rebuilds them. Rebuilding those virtual directories often clears up problems that all the other steps above do not resolve.
If, after following KB 883380, Activesync still does not work and it keeps coming up with HTTP 500 errors, please do the following:
• Disable Forms Based Authentication – Exchange HTTP Protocol (if enabled) • Remove SSL settings from the Exchange IIS virtual directory • Run iisreset • Test Activesync without SSL selected – hopefully this should work or give the OK result • If okay – right-click on the Exchange Virtual Directory and select all Tasks> Save Configuration to a file. Name the file Exchange and save to the desktop • Run Regedit (and be extremely careful here as you can kill your server very easily) then right-click on My Computer and select Export. Name the file as ‘EntireRegistry’ and save the backup of the registry to the desktop • In regedit – locate HKLM \ System \ CurrentControlSet \ Services \ MasSync \ Parameters and delete the ExchangeVDir key from the right-hand pane. • Close Regedit • Right-click on the default-website and select New> Virtual Directory fom File. Browse to the desktop and click on the Exchange.xml that you created above, then click on Read file, select Exchange from the ‘Select a configuration to import’ section and click on OK. Select ‘Create a new virtual Directory’ and name the directory ‘exchange-oma’ and click OK. • Right-click on Exchange-OMA virtual directory you just created and click Browse – you should see OWA open up happily • Open Regedit and add the ExchangeVDir key back that you recently deleted as a String Value and then change the value to read /exchange-oma • Close regedit • Enable SSL and require 128-Bit Encryption on the Exchange Virtual Directory to ensure it is secure once again • Enable Forms Based Authentication (if you want to use it) on Exchange > Protocols> HTTP • Make sure that Integrated Authentication is enabled on the Exchange Virtual Directory • Check that the Exchweb virtual directory does not have SSL enabled • Run iisreset • Test Activesync – should hopefully be working now
