Exchange 2016 account will not perform activesync. Setup but no connectivity

Question

The issue is that on some accounts that I create in Exchange 2016, they cannot get email on an iphone.

I'm using exchange version 15.1 (build 225.42) running on Windows Server 2012, on premises.

I have created a number of accounts via exchange's web EMC. They also exist of course in active directory.

Some (most?) accounts that I create have no problem with this.

However I've got one account that I created some time ago, it works in outlook, works in OWA, receives email just fine, but cannot get email on ANY iOS device. I have not tested on android.

On any iOS device that I set this account up on, I can set the account up, autodiscover works fine and appears that everything is good, but I can tell that it won't work because "Automatic Reply" in the account screen just says Loading.

I can set other exchange accounts up on this phone. If I set this account up though on other phones it does not work. Thus I believe I've eliminated it being a phone specific problem. Some test accounts that I've created (with the same methodology!) work. I'd like to figure out why this particular account won't. When I go into mail for this account on the phone, after a moment I get "Cannot get mail/The connection to the server failed." And the phone does not show up in EMC under Mailbox Features> Mobile Devices.

I've done get-mailbox with | fl for the account, and compared it line by line to other working accounts, and cannot see anything different.

So:

Has anyone run into this sort of thing? Is there a bug or misconfiguration of some sort that people have seen before?

Or does anyone have any pointers on trying to get in deeper on this? Are there activesync logs that I should take a look at?

Thanks!

edit: activesync is enabled, according to EMC and powershell.

MS testconnectivity site gives passes except for: The test of the FolderSync command failed. Exchange ActiveSync returned an HTTP 500 response (Internal Server Error).

It linked me to this article: https://technet.microsoft.com/en-us/library/620c5ce8-3595-4658-9a7a-ec76c10e4a69.aspx which solved it!

Thanks!!

Solution 1

As suggested, I ran: https://testconnectivity.microsoft.com/

Which returned lots of successes, and this failure:

The test of the FolderSync command failed. Exchange ActiveSync returned an HTTP 500 response (Internal Server Error).

This lead me to: https://technet.microsoft.com/en-us/library/620c5ce8-3595-4658-9a7a-ec76c10e4a69.aspx

Changed permissions to inherit, and voilà! Working!

Solution 2

You should do a test by using https://testconnectivity.microsoft.com/ on broken accounts. It should give you an idea.

However what I encountered in my setup is:

Start Active Directory Users and Computers.
Click View, and then click to enable Advanced Features.
Right-click the object where you want to change the Exchange Server permissions and then click Properties.

Note You can change permissions against a user, an organizational unit, or a domain.

On the Security tab, click Advanced. Click Add, type Exchange Servers, and then click OK. In the Apply to box, click Descendant msExchActiveSyncDevices objects. Under Permissions, click to enable Modify Permissions. Click OK three times.

On another note make sure you correctly change msExchActiveSyncDevices not msExchActiveSyncDevice (those are next to each other and I found the hard way that only one works).

Comments

[blaughw]

Does the account in question have elevated (domain) permissions? This would be against best practices.

[jeremy]

You're right, the account is an admin. Thanks for that heads up!