Just can't get enough of IT

Problem

You are not able to list public folders in a co-existence scenario with Exchange Server 2007 and Exchange Server 2010/2013 using the Exchange 2007 EMS or EMC.

When you try to execute Get-PublicFolder you receive the following error:

Get-PublicFolder " There is no existing PublicFolder that matches the following Identity: '\'. Please make sure that you specified the correct PublicFolder Identity and that you have the necessary permissions to view PublicFolder.

This might happen after you have removed the first Exchange 2007 mailbox server, but not the last Exchange 2007 mailbox server.

Exchange Server 2007 uses the Exchange System Attendant to access the public folder store and fails, if the System Attendant discovery in Active Directory does not provide a proper configuration.

KB 2621350 describes the discovery process:

1. Exchange Server 2007 selects a mailbox database.
2. Exchange Server 2007 obtains the LegacyExchangeDN attribute of the selected mailbox database. For example, Exchange Server 2007 obtains the following LegacyExchangeDN attribute value:
   /o=First Organization/ou=Exchange Administrative Group (group_name)/cn=Configuration/cn=Servers/cn=E14HUBCAS/cn=Microsoft Private MDB
3. Exchange Server 2007 removes the "CN=Mailbox Database" part of the address. The address then resembles the following:
   /o=First Organization/ou=Exchange Administrative Group (group_name)/cn=Configuration/cn=Servers/cn=E14HUBCAS
4. Exchange Server 2007 adds "CN=Microsoft System Attendant" to the LegacyExchangeDN value. After the value is appended, the LegacyExchangeDN attribute value resembles the following:
   /o=First Organization/ou=Exchange Administrative Group (group_name)/cn=Configuration/cn=Servers/cn=E14HUBCAS/CN=Microsoft System Attendant
5. Exchange Server 2007 tries to log on to the public store by using the value in step 4.
6. The store then tries to locate the System Attendant object.

There two annoying things about these steps

1. Step 1:  Exchange Server 2007 selects a mailbox database
   
   There is no description available on how the database is being selected. But the co-existence scenario results in a mailbox database being selected that might be located on Exchange Server 2010 or Exchange Server 2013. Even thought that there still are Exchange Server 2007 mailbox database available. You still require to have a mailbox database hosted on an Exchange 2007 public folder server, due to the legacy public folder requirements with Exchange Server 2013.
    
2. Steps 2-4: The LegacyExchangeDN example shows a E14HUBCAS name as a placeholder. In a situation where you have deployed dedicated mailbox servers this should read E14MBX.
    

Solution

The magic System Attendant mailbox has been removed from Exchange 2010. But the System Attendent configuration node does still exist in the Active Directory Configuration Partition for compatibility reasons. The configured attributes of the System Attendent entry vary depending on the version of the installed Exchange Server.

In regards of public folder issue, we need to focus on the following:

• Exchange Server 2010 System Attendant
  • homeMDB: <not set>
  • homeMTA: <not set>
• Exchange Server 2013 System Attendant
  • homeMDB: <not set>
  • homeMTA: CN=Microsoft MTA,CN=E15MBX,CN=Servers,CN=Exchange Administrative Group (FYDIBOHF23SPDLT),CN=Administrative Groups,CN=[ORG],CN=Microsoft Exchange,CN=Services,CN=Configuration,DC=[DOMAIN],DC=[TLD]

To fix the public folder access issue for Exchange Server 2007, set the homeMDB and homeMTA attributes. Set the Exchange System Attendant attributes to appropriate values for your Exchange servers.

Exchange Server 2013

1. Open ADSIEdit and connect to the Configuration context
2. Open Databases node
   CN=Databases,CN=Exchange Administrative Group (FYDIBOHF23SPDLT),CN=Administrative Groups,CN=[ORG],CN=Microsoft Exchange,CN=Services,CN=Configuration,DC=[DOMAIN],DC=[TLD]
3. Open the Properties of an Exchange 2013 database
4. View the distinguishedName property and copy the value to clipboard
   Example: CN=E15MBXDB01,CN=Databases,CN=Exchange Administrative Group (FYDIBOHF23SPDLT),CN=Administrative Groups,CN=[ORG],CN=Microsoft Exchange,CN=Services,CN=Configuration,DC=[DOMAIN],DC=[TLD]
5. Close the Properties window and open the Servers node
   CN=Servers,CN=Exchange Administrative Group (FYDIBOHF23SPDLT),CN=Administrative Groups,CN=[ORG],CN=Microsoft Exchange,CN=Services,CN=Configuration,DC=[DOMAIN],DC=[TLD]
6. Expand the first Exchange 2013 server and open the Properties of the Microsoft System Attendant node
   Ensure that the view is not filtered to Show only attributes that have values
7. Edit the homeMDB attribute and paste the distinguished name of the mailbox database copied in step 4
8. Apply the changes and close the properties window

Repeat steps 4 to 8 for each Exchange 2013 server in your environment.

Exchange Server 2010

1. Open ADSIEdit and connect to the Configuration context
2. Open Databases node
   CN=Databases,CN=Exchange Administrative Group (FYDIBOHF23SPDLT),CN=Administrative Groups,CN=[ORG],CN=Microsoft Exchange,CN=Services,CN=Configuration,DC=[DOMAIN],DC=[TLD]
3. Open the Properties of an Exchange 2010 database
4. View the distinguishedName property and copy the value to clipboard
   Example: CN=E14MBXDB01,CN=Databases,CN=Exchange Administrative Group (FYDIBOHF23SPDLT),CN=Administrative Groups,CN=[ORG],CN=Microsoft Exchange,CN=Services,CN=Configuration,DC=[DOMAIN],DC=[TLD]
5. Close the Properties window and open the Servers node
   CN=Servers,CN=Exchange Administrative Group (FYDIBOHF23SPDLT),CN=Administrative Groups,CN=[ORG],CN=Microsoft Exchange,CN=Services,CN=Configuration,DC=[DOMAIN],DC=[TLD]
6. Expand the first Exchange 2010 server and open the Properties of the Microsoft System Attendant node
   Ensure that the view is not filtered to Show only attributes that have values
7. Edit the homeMDB attribute and paste the distinguished name of the mailbox database copied in step 4
8. Apply the changes and close the properties window
9. Open the Properties windows of the Microsoft MTA of the same Exchange
10. View the distinguishedName property and copy the value to clipboard
    Example: CN=Microsoft MTA,CN=E14MBXSRV01,CN=Servers,CN=Exchange Administrative Group (FYDIBOHF23SPDLT),CN=Administrative Groups,CN=[ORG],CN=Microsoft Exchange,CN=Services,CN=Configuration,DC=[DOMAIN],DC=[TLD]
11. Open the properties of the Microsoft System Attendant node for a second modification
    Ensure that the view is not filtered to Show only attributes that have values
12. Edit the homeMTA attribute and paste the distinguished name of the mailbox database copied in step 10
13. Apply the changes and close the properties window

Repeat steps 4 to 13 for each Exchange 2010 server in your environment.

Wait for Active Directory replication and retry to access the public folders using Get-PublicFolder in an Exchange Server 2007 Management Shell.

It might be required to restart the Exchange 2007 Information Store and System Attendant service of the Exchange 2007 server in question

Use an administrative PowerShell

Restart-Service MSExchangeIS 
Restart-Service MSExchangeSA 

I haven’t noticed any issues in production environments so far. If you encounter any issues in your environment, feel free to leave a comment.

Links

• You cannot view a list of public folders in an Exchange organization that has Exchange Server 2007 and Exchange Server 2010 mailbox databases,
• On-Premises Legacy Public Folder Coexistence for Exchange 2013 Cumulative Update 7 and Beyond,
• Breaking Change : The System Attendant mailbox has been removed from Exchange 2010
• Exchange 2007 and 2013 environment – Public Folders on 2007 “Get-PublicFolder” cmdlet fails

You need assistance with your Exchange Server setup? You have questions about your Exchange Server infrastructure and going hybrid? You are interested in what Exchange Server 2016 has to offer for your environment?

Contact me at thomas@mcsmemail.de
Follow at https://twitter.com/stensitzki

The JET Blue Story

The Exchange Server product used the Extensible Storage Engine (ESE, aka JET Blue) to store data for decades. The story of the JET Blue (in contrast to JET Red which is used for Access database) can be read here (https://en.wikipedia.org/wiki/Microsoft_Jet_Database_Engine). In the acient days of data storage the ESE database was the best choice for storing mostly unstructured data with many dynamic properties.

The Messaging API (MAPI) had been developed in the 1990s to provide programmers with a set of unified interface for easier message exchange. The MAPI documentation at TechNet has been replaced by the current Outlook 2013 MAPI Reference. In todays world it is not easy to find reliable ressource about the original MAPI implementation. The only printed resource is Inside Mapi (Microsoft Programming Series) , ISBN 978-1572313125 , which has been published in 1996.

At Ignite 2015 Ross Smith VI joked about moving the Exchange storage engine to SQL. Back in the day with Exchange 2013 in production and Exchange 2016 coming, this was true. But Ross laid the tracks for the evolution of Exchange.

But it seems that the Exchange Product Team realized that in today's world with heavily standardized communication and less dynamic requirements than in the 1990s the days of JET blue are over. At the same time SQL Server evolved to mature database solution, capable of handling big data. The question was, if it can store SharePoint data, why not Exchange data. After twenty years of Exchange Server using the good ole ESE engine it was time to move on.

The SQL scripts that are used by Exchange to configure SQL are loacted in $exbin\SQL

Example

CREATE TABLE [dbo].[MAPI_PROPERTIES](
	[MAPI_PROPERTTY_ID] [int] IDENTITY(1,1) NOT NULL,
	[MAPI_PROPERTY_NAME] [nchar](127) NOT NULL,
	[IsWellKnownProperty] [bit] NOT NULL,
	[MAPI_TYPE_ID] [int] NOT NULL,
 CONSTRAINT [PK_MAPI_PROPERTIES] PRIMARY KEY CLUSTERED 
(
	[MAPI_PROPERTTY_ID] ASC
)WITH (PAD_INDEX = OFF, STATISTICS_NORECOMPUTE = OFF, IGNORE_DUP_KEY = OFF, ALLOW_ROW_LOCKS = ON, ALLOW_PAGE_LOCKS = ON) ON [PRIMARY]
) ON [PRIMARY]

GO

ALTER TABLE [dbo].[MAPI_PROPERTIES]  WITH CHECK ADD  CONSTRAINT [FK_MAPI_PROPERTIES_MAPI_TYPES] FOREIGN KEY([MAPI_TYPE_ID])
REFERENCES [dbo].[MAPI_TYPES] ([MAPI_TYPE_ID])
GO

ALTER TABLE [dbo].[MAPI_PROPERTIES] CHECK CONSTRAINT [FK_MAPI_PROPERTIES_MAPI_TYPES]
GO

Exchange Server goes SQL

The current Exchange 2016 CU2 Preview supports an undocumented registry key to activate SQL Server support for Exchange. Personally I do not know, if this was supposed to be officially included in a public realease. So maybe the SQL support was made available by error and is already removed from the most current build again.

The famous SqueakyLobster registry key in has been used in Exchange 5.5 to troubleshoot performance issues. The new "Lobster" key is used to activate hidden code in Exchange Server product. The name of the key is LobsterMapiDB.

This key activates support for Exchange modern storage. Without this key you won't be able to move mailboxes from ESE legacy storage to SQL modern storage.

It is assumed that a SQL Server 2014 instance is available. A SQL Server 2014 Express edition is sufficient for testing purposes.

Note:
Any changes to configurations or the registry should be validated in a test environment first. Never try this in production right away.

The high level steps required to activate SQL support for Exchange 2016 are:

• Create a configuration file to provide the SQL connection string
• Create a SQL server login for the Exchange Trusted Subsystem security group
• Add a registry key to the local Exchange Server registry
• Restart Information Store Service (MSExchangeIS)
• Execute PowerShell script to migrate mailboxes to SQL

The detailed steps are:

• Create a new config file named Microsoft.Exchange.Data.SQL.exe.config in $exinstall/bin

		<?xml version="1.0" encoding="utf-8" ?>
		<!-- Exchange SQL Configuration - preliminary support -->
		<!-- %MAILBOXDATABASENAME% will be replaced by Exchange -->
		<!-- More information https://goo.gl/QiTtDo -->
		<configuration>
			<sectionGroup name="SqlMapiProviderGroup" type="Microsoft.Exchange.Data.SQL.SqlMapiProviderGroup, Microsoft.Exchange.Data.Common, Version=15.2.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a">
				<section name="SqlMapiProviderSection" type="Microsoft.Exchange.Data.SQL.SqlMapiProviderGroup, Microsoft.Exchange.Data.Common, Version=15.2.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" />
		    </sectionGroup>
			<runtime>
				<gcServer enabled="True" />
				<generatePublisherEvidence="False" />
			</runtime>
			<appSettings>
				<add key="MigrateMailboxesAutomatically" value="false" /> <!-- Not yet supported -->
				<add key="AllowJETBlueCoexistence" value="true" /> <!-- Allows for SQL/ESE Coexistence in DAG -->
				<add key="PerDatabaseMaxSize" value="1GB" />
				<add key="VerboseLoggingEnabled" value="False" />
		
			</appSettings>
			<SqlMapiProviderSection>
				<SqlMapiProvider>
					<add name="LobsterMapiDB"
					providerName="System.Data.SqlClient"
					connectionString="Data Source=SERVERNAME\INSTANCE;Initial Catalog=%MAILBOXDATABASENAME%;Integrated Security=True;MultipleActiveResultSets=True" />
				</SqlMapiProvider>
			</SqlMapiProviderSection>
		</configuration>

• Create a SQL login for Exchange Trusted Subsystem

CREATE LOGIN [DOMAIN\Exchange Trusted Subsystem] FROM WINDOWS

• Create a new DWORD named LobsterMapiDB in
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ExchangeServer\v15
  and set the data value to 1
  
  
• Restart Exchange Information Store
  
  Restart-Service MSExchangeIS
   
• Use Move-MailboxToModernStorage.ps1 script to move selected mailboxes to modern storage

More can be found here:

• Migration scripts and config files are available at Github, https://github.com/Apoc70/LobsterMapiDB

Links

• From crush to product documentation: The story of Squeaky Lobster, http://blogs.technet.com/b/exchange/archive/2006/06/15/3394229.aspx
• Setting "Squeaky Lobster" performance counter settings, https://support.microsoft.com/en-us/kb/556030
• Extensible Storage Engine, https://en.wikipedia.org/wiki/Extensible_Storage_Engine
• Outlook 2013 MAPI Reference, https://msdn.microsoft.com/en-us/library/cc765775.aspx
• SQL Server 2014, https://www.microsoft.com/en/server-cloud/products/sql-server/
• Final information: https://goo.gl/QiTtDo

Enjoy Exchange for the next 20 years...

Problem

You might encounter EventId 106 errors on Exchange 2013/2016 servers.

There are some article available on how to fix this issue on servers having a full installationof Exchange Server 2013/2016.

But you might encounter this error on servers having the Exchange 2013/2016 Management Tools installed only as well. In this case the solutions described will not work as expected.

Running the New-PerfCounters cmdlet requires the Microsoft.Exchange.Management.PowerShell.Setup PowerShell snapin. This PowerShell snapin cannot be loaded on servers having the Exchange Management Tools installed.

Add-PsSnapin : The Windows PowerShell snap-in 'Microsoft.Exchange.Management.PowerShell.Setup' is not installed on
this computer.
At line:1 char:1
+ Add-PsSnapin Microsoft.Exchange.Management.PowerShell.Setup
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : InvalidArgument: (Microsoft.Excha...owerShell.Setup:String) [Add-PSSnapin], PSArgumentEx
   ception
    + FullyQualifiedErrorId : AddPSSnapInRead,Microsoft.PowerShell.Commands.AddPSSnapinCommand

Solution

The required code library is available on servers having the Exchange Management Tools installed. But the library is not added to the registry by default.

Registry of a server running Exchange Management Tools only:

Registry of a fully installed Exchange Server:

Just export the registry key Microsoft.Exchange.Management.PowerShell.Setup from an Exchange Server, fix Exchange file paths (if required) and import the regiytry file on the server having the Exchange Management Tools installed.

Example registry file:

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\1\PowerShellSnapIns\Microsoft.Exchange.Management.PowerShell.Setup]
"CustomPSSnapInType"="Microsoft.Exchange.Management.PowerShell.SetupPSSnapIn"
"ApplicationBase"="D:\\Program Files\\Microsoft\\Exchange Server\\V15\\bin"
"AssemblyName"="Microsoft.Exchange.PowerShell.Configuration, Version=15.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35"
"Description"="Setup Tasks for the Exchange Server"
"ModuleName"="D:\\Program Files\\Microsoft\\Exchange Server\\V15\\bin\\Microsoft.Exchange.PowerShell.configuration.dll"
"PowerShellVersion"="1.0"
"Vendor"="Microsoft"
"Version"="15.0.0.0"

After adding the registry key, you can successfully fix the performance counter issue.

Add-PsSnapin Microsoft.Exchange.Management.PowerShell.Setup 

New-PerfCounters -DefinitionFileName "$exinstall\setup\perf\WorkerTaskFrameworkPerfCounters.xml”

Links

• Jetze Mellema Post: Fix those silly "106" Performance Counter events on Exchange 2013 servers

When you've enabled the Exchange scripting agent extension agents, it is required to copy the configuration file to each Exchange server. Paul Cunningham's script helps you to achive this goal pretty easily.

But if you have installed the Exchange 2013 Management Tools on additonal servers, these servers are not fetched using the Get-ExchangeServer cmdlet. But when you install a Cumulative Update the existence of the extension agent config file is checked. And this even on a server having only the Exchange Management Tools installed.

Therefore the following PowerShell code provides an easy and simple way to add additonal server having the Exchange 2013+ Management Tools installed (aka Admin Servers, Monitoring Servers, Job Servers, etc.). The script uses a filter to select Exchange 2013 servers only, as the script has been extended in an environment having still active Exchange 2007 servers.

The following PowerShell snippet displays only the changes, which need to be added to Paul's original script starting row 68.

# Original PowerShell code
# $exchangeservers = Get-ExchangeServer

# Select all Exchange 2013 servers only, restrict properties to Name and AdminDisplayName
$exchangeservers = Get-ExchangeServer | ?{$_.AdminDisplayVersion -like "Version 15.0*"} | Select Name, AdminDisplayVersion

# Add additional servers as needed

$manualServers = @()
# Copy and modify as needed
$manualServers += (New-Object PSObject -Property @{Name="EXSRV2010";AdminDisplayVersion="Version 14"})
$manualServers += (New-Object PSObject -Property @{Name="EXSRV2013-01";AdminDisplayVersion="Version 15"})
$manualServers += (New-Object PSObject -Property @{Name="EXSRV2013-02";AdminDisplayVersion="Version 15"})

# Combine arrays
$exchangeservers = $exchangeservers + $manualServers

# End Modification

$report = @()

[string]$date = Get-Date -F yyyyMMdd-HHmmss

Enjoy extending the Exchange PowerShell cmdlets.

Links

• TechNet: Cmdlet extension agents
• TechNet: Manage cmdlet extension agents
• Paul Cunningham's blog post: PowerShell Script to Distribute Scripting Agent Configuration File to Exchange Servers

Questions? Just leave a comment.

Problem

You have an Exchange Server 2016 organization and plan to upgrade to Cumulative Update 10. You log on to an  Exchange Server, activate DAG maintenance and prepare the Server Component States for installing the new Cumulative Update. 

You open an elevated PowerShell Session and start the Setup using

./Setup.exe /Mode:Upgrade /IAcceptExchangeServerLicenseTerms

Out of a sudden the Exchange Server CU Setup fails while executing setup step Stopping Services with an error:

Microsoft Exchange Server 2016 Cumulative Update 10 Unattended Setup

Copying Files...
File copy complete. Setup will now collect additional information needed for installation.

Languages
Management tools
Mailbox role: Transport service
Mailbox role: Client Access service
Mailbox role: Unified Messaging service
Mailbox role: Mailbox service
Mailbox role: Front End Transport service
Mailbox role: Client Access Front End service

Performing Microsoft Exchange Server Prerequisite Check

    Configuring Prerequisites                                                                         COMPLETED
    Prerequisite Analysis                                                                             COMPLETED

Configuring Microsoft Exchange Server

    Preparing Setup                                                                                   COMPLETED
    Stopping Services                                                                                 FAILED

The following error was generated when "$error.Clear();
 & $RoleBinPath\ServiceControl.ps1 -Operation:DisableServices
-Roles:($RoleRoles.Replace('Role','').Split(',')) -SetupScriptsDirectory:$RoleBinPath; &
$RoleBinPath\ServiceControl.ps1 -Operation:Stop -Roles:($RoleRoles.Replace('Role','').Split(','))
-IsDatacenter:([bool]$RoleIsDatacenter)
 " was run: "Microsoft.PowerShell.Commands.ProcessCommandException: Cannot stop
process "fms (2496)" because of the following error: Access is denied ---> System.ComponentModel.Win32Exception: Access
is denied
 at System.Diagnostics.ProcessManager.OpenProcess(Int32 processId, Int32 access, Boolean throwIfExited)
 at System.Diagnostics.Process.GetProcessHandle(Int32 access, Boolean throwIfExited)
 at System.Diagnostics.Process.get_HasExited()
 at Microsoft.PowerShell.Commands.StopProcessCommand.ProcessRecord()
 ---
End of inner exception stack trace ---".

The Exchange Server setup operation didn't complete. More details can be found in ExchangeSetup.log located in the
<SystemDrive>:\ExchangeSetupLogs folder.

Why would an error like Access Denied happen while executing the Setup.exe as a member of the local Administrators security group from within an elevated PowerShell session?

Issue

The PowerShell code executed as part of the CU Setup sets the startup type of Exchange and some Windows services to Disabled. This ensures that in the case of a server reboot an automatic start of the service will not interfere partially executed the setup. After setting the startup type to Disabled the services are stopped. 

The services are controlled by the ServiceControl.ps1 script which is located on the Exchange Server installation media in \Setup\ServerRoles\Common\.

The function StopServices stops services using the Stop-Service cmdlet. Due to some timing issues some services are stopped by killing the running processes using Stop-Process -Force.

The services stopped by stopping the running process are:

• FMS
• MSExchangeServiceHost
• MSExchangeTransport
• MSExchangeInferenceService
• MSExchangeDagMgmt

Executing the Stop-Process cmdlet results in the Access Denied error.

Solution

The issue is related to fact that the user account logged on the server and executing the Exchange Server Cumulatice Update does not have the local User Rights Assignment to Debug Programs.

By default the right to debug programs is assigned to the local Adminstrators security group. In secured Active Directory infrastructures the user rights assignments and local security groups are often managed using Group Policy Objects (GPO). The GPOs manage the names of local security groups, group memberships and even user rights assignments.

• To avoid the error described above you must ensure that the group of Exchange Administrators that install Exchange Server Cumulative Updates has the user rights assignment to debug programs.

The client encountering the issue described above hasn't had any issues installing Cumulative Updates for Exchange Server 2013 in the past. So this is solution is related to the setup of Exchange Server 2016 Cumulative Updates on Windows Server 2016 only. If you have any information regarding Exchange Server 2013, let me know using the comments section below.

Enjoy Exchange Server!

There are quite a lot of good step-by-step manuals available describing how to enable Kerberos authentication for Exchange Server 2013/2016.

The following issue has been seen in an Exchange 2013 infrastructure (8 server DAG) where Outlook clients use OutlookAnyhwere to connect to Exchange Server. MAPI over Http is disabled on an organizational level due to a compatibility issue with another client software.

Problem

Even if you follow the detailed descriptions you might end up in a situation where your Outlook clients still won't connect to Exchange Server using Kerberos. The Outlook connection status overview (Ctrl + Right Click on the Outlook icon in System Tray) still shows Ntlm as the used authentication provider:

Reason

You are supposed to use the following PowerShell cmdlets to configure OutlookAnywhere to use Kerberos:

Get-OutlookAnywhere -Server CASSERVER | Set-OutlookAnywhere -InternalClientAuthenticationMethod  Negotiate

All eight Exchange 2013 servers where still not offering Nego as an authentication provider even after some period of time. Verifying the OutlookAnywhere configurations using PowerShell showed the correct configuration values. So what to do?

A quick check at the IIS authentication settings of the \Rpc virtual directory of the Front End web site (Default Web Site) showed that this virtual directory was still configured to use Ntlm only.

Solution

Use the IIS management consolte to add the Negotiate authentication provider to the list of available providers and reorder the list to use Nego first.

Now Outlook clients will pick up the configuration change an will connect to OutlookAnywhere using Kerberos.

Note

You should not use the IIS management console to change any settings of the Exchange Server virtual directories during normal operations. Using the IIS management console should only be used for troubleshooting fancy situations that you encounter in your Exchange Server infrastructure. 

The preferred method to change Exchange Server vDir settings is PowerShell.

Links

• Configuring Kerberos authentication for load-balanced Client Access services (Exchange 2016), https://technet.microsoft.com/en-us/library/ff808312(v=exchg.160).aspx
• Configuring Kerberos authentication for load-balanced Client Access servers (Exchange 2013), https://technet.microsoft.com/en-us/library/ff808312(v=exchg.150).aspx

Enjoy Exchange Server