Exchange 2010 Autodiscocer for non-domain computers.

Hello. I have problems with autodiscover for non -domain computers. Somebody can explain me in turn what i must do for configuration.

Hi,
For your Non-domain joined clients, the Outlook would connect to Exchange mailbox from the Internet. We need to enable Outlook Anywhere for your external users:
Enable-OutlookAnywhere -Server:Exch10 -ExternalHostname:mail.contoso.com
-ClientAuthenticationMethod:Ntlm -SSLOffloading:$true
For autodiscover service, when Outlook is started on a client that is not domain-connected, it first tries to locate the Autodiscover service by looking up the SCP object in Active Directory. Because the client is unable to contact Active
Directory, it tries to locate the Autodiscover service by using Domain Name System (DNS). In this scenario, the client will determine the right side of the user’s email address, that is, contoso.com, and check DNS by using two predefined URLs. For example,
if your email address is [email protected], Outlook will try the following two URLs to try to connect to the Autodiscover service:
https://contoso.com/autodiscover/autodiscover.xml
https://autodiscover.contoso.com/autodiscover/autodiscover.xml
For more information about autodiscover service in Exchange 2010, please refer to:
http://technet.microsoft.com/en-us/library/jj591328(v=exchg.141).aspx
Therefore, you don’t need to change any configuration for Autodiscover. Just make sure your Exchange certificate which is assigned with IIS service has included aotodiscover.contoso.com name and the certificate is valid and trusted for external
user using. If not, please create a new SRV record for your autodiscover service and pointed to
mail.contoso.com. For more information about SRV record of autodiscover, please click:
http://support.microsoft.com/kb/940881
Regards,
Winnie Liang
TechNet Community Support

Similar Messages

RemoteApp file associations for non-domain computers

I have a customer with a simple AD domain, and some joined and some workgroup computers, all windows 8.1 pro. I want to connect them to my remote app service. We want to create a "default connection" for this remote app service, specifically for
the file type associations. We tried using the default connection group policy, but credentials are a problem. The remote app service has its own domain. So the "default connection" created by the group policy is trying to use the local logon credentials.
Is there a way to specify what default credentials are to be used for the remoteapp "default connection" using credential manager? Or is there a better way to accomplish remote app file type associations all together using non-domain joined Windows
8.1 and 2012R2 remote app on a different domain?

Hi,
For your case, you can try the following way. You can create the RDP file as what you want and then publish that RDP file as RemoteApp with default user credentials. When non-domain joined system will get access to RD Web they will launch the RemoteApp as they
are using the other apps, the RDP file App will first get connect to the RDS Farm server name which is displayed and try to resolve that name through gateway or any other method which is configured. Once got resolve it will use the default user credentials
to connect to that user and then the user can use that RDP file to connect to the respective Server.
Apart for file type association you can go through the detailed article for more information.
Windows Server 2012 RemoteApp and Desktop Connections: Default Connections and File Type Associations
http://blogs.msdn.com/b/rds/archive/2013/05/21/windows-server-2012-remoteapp-and-desktop-connections-default-connections-and-file-type-associations.aspx
Hope it helps!
Thanks.
Dharmesh Solanki
Please remember to mark the replies as answers if they help and unmark them if they provide no help. If you have feedback for TechNet Support, contact [email protected]

Report for non Domain computers

Is there a way to run a report for all computers not on a specified domain?

Also there is a standard report called Computers in a specific workgroup or domain
in the category Hardware - General that provides exactly that information.
My Blog: http://www.petervanderwoude.nl/
Follow me on twitter: pvanderwoude

Windows Domain Controller certificate for non domain clients

Hi,
Is it possible that we can export windows domain certificate and use it for non domain computers without joining domain, so that they can communicate each others without joining domain controller?
Regards

Hi,
Is it possible that we can export windows domain certificate and use it for non domain computers without joining domain, so that they can communicate each others without joining domain controller?
Not sure that what you want to achieve here.
However, yes, it is possible to export certificates (with private keys) from domain machines then import them to non-domain machines, and some certificates can even function well based on key usages. Please note that Domain Controller certificates are only
meaningful to Domain Controllers. Possession of domain certificates doesn’t indicate machines are part of domain.
Without joining a machine to a domain (or without a trust), the machine is always treated as untrusted by the domain members no matter what kind of certificates it holds.
Best Regards,
Amy
Please remember to mark the replies as answers if they help and un-mark them if they provide no help. If you have feedback for TechNet Subscriber Support, contact [email protected]

SCSM 2012 Portal change from http to https to get silverlight to work on non domain computers?

Hi
Wanting to change our Self Service Portal from http to https and make it accessible from non domain computers.
Non domain computers - the sharpoint parts load (the silverlight does not load). Domain computers can access the portal with no problem.
Does this mean I need to reinstall the portal or can it be changed while in operation now?
Would something like the below link be enough to get https going?
http://blogs.technet.com/b/babulalghule/archive/2013/01/10/how-to-create-alternate-url-for-service-manager-self-service-portal.aspx
Thanks!

the silverlight part not loading due to SSL certification. import the certification into non domain computer will fix this issue.

Configure DHCP to add non domain computers to DNS

Hi
We would like to add non domain computers automaticallly to DNS through our DHCP server.
The reason is that we actally use Linux and our Linux admins would like the machines automatically to DNS when receiving a IP.
I assumed that it was just a matter of selecting "Always dynamically update DNS A and PTR records" on the IPv4 scope option, but it doesn't seem to work?
Lasse
/Lasse

I started out changing that setting to "Dynamically update DNS records for DHCP clients that do not request updates" but it didn't seem to work.
I then changed "Always dynamically update DNS A and PTR records" and it didn't work. Then I tried having both settings set and then it worked. I then removed "Always dynamically update DNS A and PTR records" since it shouldn't be necessary
and then it still worked..... :-)
Lasse
/Lasse

MBAM on Workgroup (non-domain) Computers

Hi,
is it possible to manage non-domain computers with MBAM to deploy bitlocker?
assuming policy is set by local policy or registry settings.
thanks ahead,

I was thinking the same as it was pointed in this thread - you will not be able to store keys on SQL database, because it´s relied on AD:
http://social.technet.microsoft.com/Forums/en-US/8eea1337-9cc7-47d4-87ca-83428abdce83/mbam-for-work-group-computers?forum=mdopmbam

Scom monitoring non domain computers

hello experts
i have scom 2012 and want to monitor non domain computers (servers in dmz)
i have created new template in ca server then create new certificates for dmz server and scom rms server.
now i have connection between two servers but there is an authentication error.
hear are logs.
please help
log from dmz computer
Log Name: Operations Manager
Source: OpsMgr Connector
Date: 29/09/2014 10:54:51
Event ID: 20071
Task Category: None
Level: Error
Keywords: Classic
User: N/A
Computer: SRV-AB-WWW1.somebank.am
Description:
The OpsMgr Connector connected to scom.somebank.am
, but the connection was closed immediately without authentication taking place. The most likely cause of this error is a failure to authenticate either this agent or the server . Check the event log on the server and on the agent for events which
indicate a failure to authenticate.
Event Xml:
<Event xmlns="">
<System>
<Provider Name="OpsMgr Connector" />
<EventID Qualifiers="49152">20071</
EventID>
<Level>2</Level>
<Task>0</Task>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2014-09-29T06:54:51.000000000Z" />
<EventRecordID>2163</EventRecordID>
<Channel>Operations Manager</Channel>
<Computer>SRV-AB-WWW1.somebank.am</Computer>
<Security />
</System>
<EventData>
<Data>scom.somebank.am</Data>
</EventData>
</Event>
scom rms computer
Log Name: Operations Manager
Source: OpsMgr Connector
Date: 29/09/2014 11:18:57
Event ID: 21010
Task Category: None
Level: Error
Keywords: Classic
User: N/A
Computer: SRV-SCOM1.somebank.local
Description:
The OpsMgr Connector negotiated the use of mutual authentication with 192.168.169.40:53552, but Active Directory is not available and no certificate is installed. A connection cannot be established.
Event Xml:
<Event xmlns="">
<System>
<Provider Name="OpsMgr Connector" />
<EventID Qualifiers="49152">21010</EventID>
<Level>2</Level>
<Task>0</Task>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2014-09-29T07:18:57.000000000Z" />
<EventRecordID>1269145</EventRecordID>
<Channel>Operations Manager</Channel>
<Computer>SRV-SCOM1.somebank.local</Computer>
<Security />
</System>
<EventData>
<Data>192.168.169.40:53552</Data>
</EventData>
</Event>
telnet to 5723 port from dmz server to scom rms server is ok

PS C:\Users\administrator.AMERIABANK> C:\Users\administrator.AMERIABANK\Desktop\1.ps1
This script will inspect Local Machine certificate
store and registry settings. This will take several seconds...
Script will check certificates to match the following requirements:
        Subject equals computer FQDN
        Certificate is time valid
        Certificate has private key and it supposed for computer certificate
        KeySpec is set to 1
        Certificate Application Policies (in former EKU) contains both Server and Client Authentication
WARNING: OpsMgr Agent is already configured to work with certificate, but this certificate don't exist in
WARNING: LocalComputer store or not match all certificate requirements.
To resolve this issue, obtain new certificate from trusted Certification Authority
using the following instructions: http://en-us.sysadmins.lv/Lists/Posts/Post.aspx?ID=5
and install it by running the following command: MOMCertImport /Subject SRV-SCOM1.ameriabank.local

Restrict non-domain computers

Does anyone know if it is possible to restrict access based on domain membership or an AD Group?
The purpose is to restrict non-domain computers even if the client has a legitimate domain credential to use for authentication.

That is correct. The only way to restrict these computers would be to make a rule (above your auth group policies), that states the specific IPs / subnets are granted certain / no access.
As long as the rule is above all your auth rules, it will trigger first and take precedence. Be sure to disable WBRS for this rule as well, since there is a potential for +6 sites to be allowed.

Non Domain Computers Becoming Master Browser

Hello,
I am troubleshooting an issue with the master browser service when an external user connects his workgroup laptop to our domain network and wins the election.
The network consists of a domain controller which has the following registry settings
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Browser\Parameters\IsDomainMaster = True
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Browser\Parameters\MaintainServerList = Yes
All the client computers that are connected to the domain have IsDomainMaster = False and MaintainServerList = No.
When an external user connects to the network with a laptop that isn't part of the domain it causes a master browser election and wins. All the servers and client computers list only media devices instead of all the computers and servers on the network.
Is there a way to prevent non domain computers from becoming the master browser without changing registry settings on that computer?
Thanks
Jon

Hello,
The TechNet Wiki Forum is a place for the TechNet Wiki Community to engage, question, organize, debate, help, influence and foster the TechNet Wiki content, platform and Community.
Please note that this forum exists to discuss TechNet Wiki as a technology/application.
As it's off-topic here, I am moving the question to the
Where is the forum for... forum.
Karl
When you see answers and helpful posts, please click Vote As Helpful, Propose As Answer, and/or Mark As Answer.
My Blog: Unlock PowerShell
My Book:
Windows PowerShell 2.0 Bible
My E-mail: -join ('6F6C646B61726C406F75746C6F6F6B2E636F6D'-split'(?<=\G.{2})'|%{if($_){[char][int]"0x$_"}})

Non-Domain computers via VPN

I am not sure if this a right forum for this. I have some non-domain devices that are coming in to my network via VPN (VPN client). can someone tell me on how to deny these non-devices coming in to my network. Is their a configuration in the VPN concentrator to deny non-domain computers? please advise

Did u deploy IPSEC in ur VPN network?.If snot, u just deploy IP SEC on all the peers and the VPN server.
IPSEC is a 2 phase VPN security provider.This IPsec along with IKE provides double level security.
With this ipsec, we configure some security parameters like hostname or remote ip address , pre-shared key etc on both ends(server and peer).When a non-domain client tries to access ur VPN, the vpn server may authenticate the in coming client using either ip address or host name and it wil contact with a aaa server or its own database for validating the user.
If u r using an external server for validating the incoming users, u must go for aaa server externally.
For a complete detail of deploying vpn with ipsec,
http://www.cisco.com/en/US/products/sw/secursw/ps2120/products_configuration_guide_chapter09186a008017278c.html#wp1045493

RDP using Smartcard fails with NLA for non-domain members

We have to administer Windows 2008 R2 servers which are in domains we are not members of - typically domains that support a particular application. We have DoD smartcards (CAC) and we admin from our Windows 7 desktops. If we disable NLA, we can CAC-authenticate
over RDP just fine. With NLA enabled, though, we get "The remote computer you are trying to connect to requires NLA but your Windows domain controller cannot be contacted to perform NLA".
My assumption would be that the Win7 desktops would never know where the particular ADCs are, since we're not domain members, but that they actually need to verify the DoD root cert that signed our CAC. Said root cert has been installed on our desktops and
on the servers in the domains.
What is necessary to get NLA with smart cards working for non-domain members?
Edit: With NLA enabled I *can* connect over RDP from one of the domain members to another, so this really seems specific to the non-member desktop settings and how it performs NLA

Hi,
Thank you for posting in Windows Server Forum.
If you use the credential SSP on Windows Vista or Windows 7 to log on with a smart card from a computer that is not joined to a domain, the smart card must contain the root certification of the domain controller. A public key infrastructure (PKI) secure channel
cannot be established without the root certification of the domain controller.
You can use following command for adding certificate.
certutil –addstore –enterprise NTAUTH <CertFile>
Where <CertFile> is the root certificate of the KDC certificate issuer.
More information.
Smart Card and Remote Desktop Services
http://technet.microsoft.com/en-us/library/ff404286(WS.10).aspx
Apart there is one Hotfix might resolve your case, go through beneath link once.
RDS client computer cannot connect to the RDS server by using a remote desktop connection in Windows
http://support.microsoft.com/kb/2752618
Hope it helps!
Thanks.
Dharmesh Solanki
TechNet Community Support
Please remember to mark the replies as answers if they help and unmark them if they provide no help. If you have feedback for TechNet Support, contact [email protected]

Clone an exchange 2010 environment for testing

Hi,
I would like to clone our existing Exchange 2010 environment for testing purposes. We have 2 mbx servers and two cas servers. (mbx - 2 physical, cas - 1 physical 1 vm).
Anyone knows of a good guide to start with ?
thanks
Olivia

Hi,
I would like to clone our existing Exchange 2010 environment for testing purposes. We have 2 mbx servers and two cas servers. (mbx - 2 physical, cas - 1 physical 1 vm).
Anyone knows of a good guide to start with ?
thanks
Olivia
What are you trying to test exactly?
Twitter!: Please Note: My Posts are provided “AS IS” without warranty of any kind, either expressed or implied.

PEAP authentication for domain & non-domain computers

Hello Everyone,
Some of our users have laptops that are not in the domain and are unable to connect to the wireless network. Although their computers aren't in the domain, the users do have an AD account and are currently a part of the security group attached to the Wireless NPS policy. The only remedy I have for this problem is to manually add the SSID to their computer which defeats the purpose of this wireless network. The ultimate goal is to allow the user to connect to the wireless network by entering their domain credentials and moving on.
We have a WLC 2504 running 7.4.110.0 with 15 1602i APs. The SSID is configured to pass 802.1x EAP authentication to NPS running on windows 2008 R2. With mobile phones and tablets, the authentication is successful without a hitch so I don't understand why a non-domain computer is unable to connect without manually entering the SSID. In the WLC log, I will see entries such as:
"AAA Authentication Failure for UserName:host/LastNameFirstInitial-LT.mydomain.Local User Type: WLAN USER".
By examining this log entry, to me it says the domain profile on the computer is being sent to the NPS for authentication instead of the username and password. We have a 3rd party SSL certificate installed on the NPS server.
Taking it one step further - We have a second SSID for guest users that is configured with the same setup except that the NPS is configured to accept authentication attempts from a single AD user called "mydomain\guest". We decided on this approach for the guest wireless network so that we can rotate the password automatically every week with a vbscript that manipulates the password via LDAP. Users with laptops in different domains are unable to connect to the guest wireless network and I'm starting to think the machine authentication is a problem.
Any suggestions would be greatly appreciated.
Thanks,
Ali.

Hi Ali,
That’s all part of the wonderful world of wireless on Windows.
When a connection to a WLAN is made on a windows machine, by selecting it from available Wireless Networks list (Passive RF Scan), and Windows as parsed the 802.11 AP Beacon to contain the WPA2, 802.1X element, by default it will attempt to connect with known or active session credentials.
Typically it will be Machine account (they all have them whether on a Domain or not) and then /Or User. This order and preference may change depending on version of Windows (Vista to Windows 8) and service pack level.
Regardless the only thing you can count of for sure is that the first authentication attempt from a windows client will not involve the user entering information. Once the first attempt fails the Windows supplicant will prompt the user for login information via a notification in the system tray, which may or may be noticed by the user. May or may not stay for more than 5 seconds.
Windows XP and Vista were the worst for this. Windows 7 and Windows 8 this process and recovery and user prompt mechanism is greatly improved but not infallible.
The only way to avoid this would be to manually configure the WLAN profile on the windows machine as you are currently doing.
Mobile phones and tablets don’t have this issue as they don’t have issue because software coding in their supplicants. Besides the only “system” credentials on iOS or Android phone are typically your Play Store and App Store accounts, and both vendors know those won’t be accepted for network access by default anywhere.
There isn’t an easy way to support non-domain windows systems on a domain integrated one.
You might want to try adding another SSID.
You could have a corporate SSID, Guest Portal and a third that is PSK + Guest Portal. ON NPS you could filter for RADIUS attribute called-station-id (includes SSID) to allow all domain ID’s access instead of the just that WLAN.
Or you could look at swapping out NPS for a Cisco ISE VM/appliance with the new Plus licenses add lower cost for onboarding devices and Windows XP and up are supported for supplicant configuration via ISE.

Exchange 2003 migrate to Exchange 2010 - single forest multiple domain. Active Sync problem

Hi All,
I have AD single forest and multiple domain. for example, the forest domain is jakarta.co.id, and the other domain is bali.co.id.
Exchange 2003 deployed in jakarta.co.id, User mail enabled in domain jakarta.co.id and bali.co.id.
Then, I upgrade to Exchange 2010 (deploy in jakarta.co.id) and move mailbox from Exchange 2003 to Exchange 2010.
All users in bali.co.id are able to access email from Owa, BlackBerry (BIS), Outlook, but cannot access from Android, Windows Phone. (Active-Sync).
I got error information generated from https://testconnectivity.microsoft.com, as following:
Attempting the FolderSync command on the Exchange ActiveSync session.
The test of the FolderSync command failed.
Tell me more about this issue and how to resolve it
Additional Details
Exchange ActiveSync returned an HTTP 500 response (Internal Server Error).
Active-Sync still not work even I check option "Include inheritable permissions from this object" in security tab.
any idea to fix this issue?
Thanks.
Endrik
Endrik | blog: itendrik.wordpress.com Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading
the thread.

Hi Sathish,
We are planning to migrate Exchange 2003 to Exchange 2013, all user already in Exchange 2010 and Exchange 2003 was decommissioned
Event Viewer log as following:
Log Name: Application
Source: MSExchange ActiveSync
Date: 1/17/2014 10:00:48 PM
Event ID: 1008
Task Category: Requests
Level: Warning
Keywords: Classic
User: N/A
Computer: EXC2010.jakarta.co.id
Description:
An exception occurred and was handled by Exchange ActiveSync. This may have been caused by an outdated or corrupted Exchange ActiveSync device partnership. This can occur if a user tries to modify the same item from multiple computers. If this is the case,
Exchange ActiveSync will re-create the partnership with the device. Items will be updated at the next synchronization.
URL=/Microsoft-Server-ActiveSync/default.eas?Cmd=Sync&User=bali%5Csteveng&DeviceId=SAMSUNG123456789&DeviceType=SAMSUNGGTN7000
--- Exception start ---
Exception type: Microsoft.Exchange.AirSync.AirSyncPermanentException
Exception message: A null value was received for the NTSD security descriptor of container CN=ExchangeActiveSyncDevices,CN=Steven Gerrard,OU=IT,DC=bali,DC=co,DC=id.
Exception level: 0
HttpStatusCode: 500
AirSyncStatusCode: 110
XmlResponse:
This request does not contain a WBXML response.
Exception stack trace: at Microsoft.Exchange.AirSync.ADDeviceManager.SetActiveSyncDeviceContainerPermissions(ActiveSyncDevices container)
at Microsoft.Exchange.AirSync.ADDeviceManager.CreateActiveSyncDeviceContainer(Boolean retryIfFailed)
at Microsoft.Exchange.AirSync.ADDeviceManager.CreateActiveSyncDevice(GlobalInfo globalInfo, ExDateTime syncStorageCreationTime, Boolean retryIfFailed)
at Microsoft.Exchange.AirSync.ADDeviceManager.CreateActiveSyncDevice(GlobalInfo globalInfo, ExDateTime syncStorageCreationTime)
at Microsoft.Exchange.AirSync.Command.UpdateADDevice(GlobalInfo globalInfo)
at Microsoft.Exchange.AirSync.Command.CompleteDeviceAccessProcessing()
at Microsoft.Exchange.AirSync.Command.WorkerThread()
--- Exception end ---.
I think KB817379 is not related because Exchange 2003 was decommissioned.
Regards,
Endrik
Endrik | blog: itendrik.wordpress.com Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading
the thread.

Exchange 2010 Autodiscocer for non-domain computers.

Similar Messages

Maybe you are looking for