Importing SMTP or Custom Recipients into Exchange

We're Here to Help

Exchange has such great features, but maintaining it can be overwhelming. CGNET can help you with:

  • Consulting
  • Monitoring
  • Hosting
  • Dynamic Backup
Read More...

Troubleshooting Guide for Outlook Web Access

About this Guide and More Resources

CGNET is happy to provide this concise guide, which is based on its 20 years' experience providing managed email and managed network services. You may also be interested in our fairly extensive list of more resources for Installing and Administering Exchange 5.5 on Windows NT 4. CGNET provides many services, including consulting, network installation, managed email, network monitoring and management, Web hosting and global roaming Internet access. We have particular experience working with non-profits and NGOs, and our network currently serves users in 94 countries. Check out our home page for more information about how we can help you.

New! If Outlook Web Access opens the Office Installer, click here for a workaround.

Contents

  1. Overview
  2. Server Configuration Checklist
  3. Password Authentication Methods
  4. Required Components
  5. The IUSR_<servername> Account
  6. Setting up Anonymous Access
  7. Troubleshooting Error Messages
  8. Microsoft's OWA Troubleshooting page
  9. Appendix:

 

Overview

This document provides a comprehensive guide to troubleshooting the Microsoft Outlook Web Access (OWA) components that are included with Microsoft Exchange Server 5.0 and 5.5. The Server Configuration Checklist provides a list of common configuration settings that should be set prior to using the OWA components. The remainder of the document covers the most common error messages that you may encounter when configuring the server and when connecting to and using your Exchange mailbox from a Web browser. The Appendix includes additional information on configuration options for the OWA components.

Server Configuration Checklist

This sections covers basic settings to ensure proper configuration of the OWA components on the Exchange or IIS server. Before troubleshooting a specific error message, you may wish to check this information for items that may be missing from your installation.

The 'Log on Locally' right - Each Windows NT account that will be accessing the Exchange Server via the OWA client must have the Log on Locally right assigned on the IIS Server and/or the Exchange Server if it is located on another server. The administrator can assign this right to the Everyone group or to specific groups if access restriction is needed. To assign this right to an account, follow these steps:

Start User Manager for Domains.

Select the User Rights menu option from the Policies menu.

In the Right dropdown listbox, select Log on Locally.

Select the Add... button.

In the Add Users and Groups dialog box, select the Show Users button and choose one or more user or group accounts from the Names list.

Select the Add button and press OK when you are finished.

Press OK again and exit User Manager for Domains.

Password Authentication Methods

The WWW service on the IIS server must be configured for the appropriate password authentication method. This is dependent upon how you intend to setup your Exchange and IIS servers. If both Exchange and IIS are installed on the same computer, you can use any of the three-supported authentication methods. If Exchange and IIS are on separate computers, only Basic (Clear Text) and Anonymous can be used. Windows NT Challenge/Response (also called NTLM) authentication cannot be used if a browser other than Internet Explorer will be used for Web Access.

 

 

Required Components

The following components are required for a successful installation of Outlook Web Access:

ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/NT40/hotfixes-postSP3/roll-up/

Exchange 5.0 is only supported with IIS 3.0 (regardless of the Service Pack)

Exchange 5.5 is supported with IIS 3.0 or IIS 4.0

ASP can be setup from the Windows NT 4.0 SP3 CD or you can download SP3 and the ASP components from http://www.microsoft.com)

The Active Server Components are included with Exchange 5.0. It is recommended that you install Exchange 5.0 SP1 or Exchange 5.5, since they include the enhanced OWA components.

Internet Explorer 3.02 with RFC1867.EXE installed to allow attachments (available from http://ww.microsoft.com)

Internet Explorer 4.0 or later

Latest version of any other 3rd-party Internet Browser software

 

NOTE: If Innoculan Anti-Virus Software is installed on the same machine running the OWA components, it is recommended that Innoculan be uninstalled before installing Exchange. Innoculan may be reinstalled after the installation of Exchange.

 

The IUSR_<ServerName> Account

Make sure that the IUSR_<ServerName> account has been assigned the Log on Locally right on the IIS server. Also, make sure the password for this account is the same in both User Manager and the Internet Service Manager. These passwords can be changed independently and differences will cause access problems.

 

Setting Up Anonymous Access to Public Folders

  1. From the Windows NT Start menu, choose Programs.
  2. Choose Microsoft Exchange, and then choose Microsoft Exchange Administrator.
  3. Choose the server you are configuring and then open the Configuration container.
  4. Choose Protocols, and then double-click HTTP (Web) Site Settings.
  5. Select the Allow anonymous users to access the anonymous public folders check box.
  6. Select the Folder Shortcuts tab.
  7. Choose New to add folders for anonymous viewing, and select an existing folder in the Public Folders dialog box.
  8. Choose OK.

Published folders must have at least Read permission granted to the Anonymous account. This is set in the Permissions tab for the specified folder. Folder permissions can be accessed from either the Microsoft Exchange Server Administrator program or from the client.

  1. In the Microsoft Exchange Server Administrator program, browse to the public folder for which you created a shortcut.
  2. From the File menu, choose Properties.
  3. Choose Client Permissions.
  4. In the box at the top of the Client Permissions dialog box, select Anonymous, and change its role from None to the desired level of access.
  5. If you want to publish all subfolders of this folder for anonymous access, select the Propagate these properties to all subfolders check box.
  6. Choose OK.

Troubleshooting Error Messages

"Failed to Get Inbox" Error Occurs During Logon

One of the most common errors you may receive when attempting to logon to a Microsoft Exchange mailbox via the OWA client is the Failed to Get Inbox error. The following steps can be used to troubleshoot this error:

  1. You may have typed the mailbox incorrectly. Try entering the alias again.
  2. Check the password authentication method being used by the WWW service on the IIS server.

 

 

NOTE: Windows NT Challenge/Response can be enabled if the Web Server is on the same machine as the Exchange Server. Basic (Clear Text) can be left unchecked if you will only be using Internet Explorer and your Web Server is on the same machine as the Exchange Server.
  1. If using NTLM authentication on the IIS server, verify that the Do not use Proxy server for local addresses option has been enabled on the client's Web browser.

 

  1. Confirm that the mailbox alias name does not contain any spaces. If it does, rename the mailbox alias by removing the spaces.
  2. Verify the Home Server of the mailbox. If you are trying to log onto an Exchange Server computer other than your home server, be sure to allow adequate time for your mailbox to replicate to the server that you are trying to log on to.
  3. Verify that you can logon to Exchange via a Web browser located on the IIS server. If you are unable to logon from the IIS computer, check for a problem in that user's Windows NT account or password.
  4. If using NTLM authentication, verify that you are logged in to the domain with the Windows NT account that has permissions on the Exchange mailbox. If the user can logon from the IIS computer but not from a client workstation, then verify that the user has the Log on locally right assigned on the IIS server.
  5. If you are prompted with a dialog box requesting the user name and password when logging into the mailbox, but you are still getting the error shown above, then enable "Allow Anonymous" and "Basic (Clear Text)" password authentication on the IIS server through IIS Manager.
  6. If the Exchange Server is on an NTFS partition, then share it out with the same name and give Full Control access to the Everyone group.
  7. If prompted for a user name and password, enter the domain and user name in the NT authentication dialog box as <Domain>\<User Name>.
  8. Try to logon from another computer. If this works, then the password file of the user on the original computer may be corrupt if this is a Windows 95 system. Try deleting your *.PWL file, log off, then log back into Windows 95. This will create a new *.PWL file.
  9. If you are replicating directories between two recently connected sites, you must ensure that no two mailboxes contain the same alias name. If so, either rename or remove the duplicate alias.
  10. If you logon to a mailbox with one alias, log off and then try to logon to another mailbox, the Failed to get Inbox error may occur since the browser has cached the previous user's credentials. Close the browser and try again.
  11. If logging in as an Anonymous user to access Public Folders, verify that you have given sufficient permissions for the Anonymous account to access public folders.
  12. Logon to the mailbox from an Exchange or Outlook client to verify that the mailbox is accessible. This may determine whether there is a problem with mailbox corruption or a problem specific to the OWA components.
  13. Access another Web page to ensure that the browser is not the problem. If this works, try connecting to the sample ASP sample pages at http://<server name>/aspsamp
  14. Create a new mailbox and NT account. Try accessing this mailbox to ensure that there is no problem with a specific user's account.

 

"Sorry! The Exchange Server is Down or the HTTP Service has been disabled by an Administrator" Error

This is another common error message you may see when logging on to a mailbox. The following steps can be used to troubleshoot this error message:

  1. The HTTP protocol may be disabled. Open the Microsoft Exchange Administrator program, select the Protocols container, and open the HTTP (Web) Site Settings object. Make sure the Enable Protocol option is checked. Open the properties for the mailbox and select the Protocols tab. Highlight the HTTP protocol, then select Settings. Make sure that Enable HTTP for this recipient (HTTP is enabled on this server) is checked.

  2. Anonymous access may be disabled in LDAP. Open the Exchange Administrator program, select the Protocols object and open the LDAP (Directory) Site Defaults object. Select the Anonymous tab and make sure that the Allow anonymous access option is enabled.

    3.  

  3. This error may also occur if the Anonymous access account defined in the DS Site Configuration object in the Microsoft Exchange Administrator program does not have Search permissions at the Configuration container level. This Search feature is only available in Exchange 5.5 or later.
  4. Verify that the Microsoft Exchange Information Store service on the Exchange Server is started.
  5. Verify that the MSExchangeWeb Registry key shown below contains the correct values for the Organization, Site and Server names of the Exchange server to which you are connecting. Open the Microsoft Exchange Administrator program. Note the Organization, Site and Server names displayed for the server to which you are connecting. Start Registry Editor (REGEDT32.EXE) on the Microsoft Exchange server and select the following Registry key:

Hkey_Local_Machine

\System

\CurrentControlSet

\Services

\MSExchangeWeb

\Parameters

Verify that the following match:

Enterprise (Must match the Organization name)

Site (Must match the Site in which the Server is located)

Server (Must match the Server to which you are connecting)

If any of the above values are incorrect, change them to match the names displayed in the Exchange Administrator. These values are not case sensitive.

"Access is Denied" Error

When logging on and trying to enter authentication credentials, you may be prompted endlessly with NT Authentication dialogs, or you may get the immediate error 'Access is Denied'. Try the steps described below to troubleshoot this error message:

  1. The password may have been typed incorrectly. Retype the password and double check the spelling, being sure to check caps, etc.
  2. The username may have been typed incorrectly. Retype the user name, double checking caps lock, etc and using <Domain>\<Username> format.
  3. You may not have the Log on Locally right on the IIS server. To correct this, perform Step 1 in the Server Configuration Checklist at the beginning of this document.

 

"Failed to Connect to the Microsoft Exchange Server, <servername>" Error

This is another error message you may receive when you attempt to logon to a mailbox via the OWA client. Use the following checklist to troubleshoot this error:

Check the permissions set on the <WINNT> directory and all of its subdirectories. Also, check the permissions on the <Exchsrvr>\Webdata and <Exchsrvr>\Webtemp directories and all of their sub-directories. If using Exchange Server version 5.0, the <WINNT> directory and all of its subdirectories must have CHANGE permissions set on them for the Domain Users group. The <WINNT>\SYSTEM32 directory must have at least READ permissions set for the Domain Users group.

When you use Microsoft Exchange Active Server components to access information on a computer running Microsoft Exchange Server, files with a .mmp extension are created in your <WINNT> directory by default. The .mmp file is a temporary file used by Active Messaging to store certain profile information during the active session. This file should be deleted after the user logs off and the session is closed. Because these files must be created dynamically, the Microsoft Internet Information Server (IIS) Anonymous Logon account (IUSR_Server by default) needs to have CHANGE permissions on the <WINNT> directory.

After you install Microsoft Exchange Server 5.0 Service Pack 1, you can change the directory in which the temporary .mmp files are created.

WARNING: Using Registry Editor incorrectly can cause serious problems that may require you to reinstall Windows 95. Microsoft cannot guarantee that problems resulting from the incorrect use of Registry Editor can be solved. Use Registry Editor at your own risk.

If the following Registry key is present, the .mmp files will be created there instead of in the <WINNT> directory:

HKEY_LOCAL_MACHINE

\Software

\Microsoft

\Windows Messaging Subsystem

To create this Registry entry, perform the following steps:

Start Registry Editor (Regedt32.exe) and go to the following key:

HKEY_LOCAL_MACHINE

\Software

\Microsoft

\Windows Messaging Subsystem

On the Edit menu, click Add Value and type the following values:

Value Name: ProfileDirectory

Data Type: REG_SZ

Value Data: Path to the directory in which the temporary files are created. (Example: C:\WEBTEMP)

If the Registry value is not present, the .mmp files are created in the <WINNT> directory.

 NOTE: The IIS Anonymous Logon account (IUSR_Server by default) must have CHANGE permissions for the directory specified for ProfileDirectory.

If using Exchange Server version 5.0 SP1 or higher, verify that the <WINNT> directory and all of its sub-directories have at least READ permissions set on them for Domain Users group. Verify that the <WINNT>\System32 directory has at least READ permissions set for the Domain User group. If using Exchange Server version 5.5 or higher, no special permissions have to be set on the <WINNT> directory.

You may need to change the permissions on the Exchsrvr\Webdata directory and all of its sub-directories to READ. Verify too that the Exchsrvr\Webtemp directory and all of its sub-directories are set to CHANGE.

 

VBScript Error Accessing Outlook Web Access Server

You may receive the following VBScript error on your Web Browser when you attempt to connect to Outlook Web Access (OWA). The script name and line number may not necessarily be identical, but the error code will remain the same.

Microsoft VBScript runtime error '800a03e3'

Unknown runtime error

/exchange/USA/lib/session.inc, line 300

This error may have more than one cause. Check the following:

Anonymous access is not enabled on the LDAP protocol in the Exchange Administrator program and/or the anonymous account has not been assigned the correct permissions. Trying to connect to a mailbox that either doesn't exist or no longer exists will generate this error. Verify the mailbox alias to which you are trying to connect.

Open the Exchange Administrator program to check the LDAP protocol and anonymous account permissions. View the properties of the LDAP protocol and ensure that Allow Anonymous is checked. View also the properties of the DS Site Configuration container and ensure the account designated for the anonymous access is correct and that the password for this account is correct. (Note: The IUSR_serverame account is normally used for anonymous access, however it is possible to use a different account name.)

View the properties of the Configuration container and select the Permissions tab. Ensure that the IUSR_servername or anonymous account has Search permissions.

If changes are made to any of the above, stop and restart the World Wide Web Publishing service (WWW) via Control Panel Services or through IIS manager.

Another cause of the above error message can be when the server is very busy or when you try to connect to a mailbox that doesn't exist, but are authenticated as a real user. Also, this problem may occur if the incoming message is larger than the input buffer of the Internet Web Browser. (usually around 16k) A hotfix for this problem is available on the Microsoft FTP site.

NOTE: This should only be used in specific cases where installation of the hotfix is warranted. This hotfix is only for use with Exchange Server and IIS version 3.0. The hotfix is available at the following link:

ftp://ftp.microsoft.com/bussys/winnt/winnt-public/IIS/fixes/usa/ASP/asp-memfix/

  

When you login Anonymously, you see no Public Folders or get "Unable to get published folder list":

  1. Verify that the IIS server's WWW service is running and handling ASP requests. This can be done by running some of the sample scripts available with IIS.
  2. No Public Folders are published - From the Microsoft Exchange Administrator program, confirm that the HTTP protocol is enabled and allows for anonymous access to public folders.
    • Open the Exchange Administrator program.
    • Open the Protocols object.
    • Double click HTTP and select the General tab. Select the Folder Shortcuts tab. Verify that the folders for anonymous access are available in the Public Folder shortcuts listbox.
    • Note: Including only the Public Folder tree object will not provide anonymous access to any of the top level Public Folders.

  3. Verify that the folder has access permissions set correctly. Make sure that the default permissions for the anonymous account are set to a minimum of Reviewer.
  4. Verify that the Public Folders you are trying to open are available from the Microsoft Exchange or Outlook client. This should ensure that the public folder is accessible.
  5. Set up a test folder and add it to the list of public folders and assign the appropriate permissions. Remember to exit the browser and restart it before attempting to access the test public folder.
  6. Make sure that the IUSR_Servername account has Log on Locally rights on the IIS server.
  7. Make sure that the IUSR_Servername account's password in User Manager is the same as in the Internet Service Manager.
  8. Check to ensure that the 'Guest' account on the Exchange server has not been disabled.

From the Exchange Server, select User Manager for Domains. Select the Guest account and double click to view the properties. Make sure that "Account Disabled" is not checked.

Unable to Render View:

This error will occur if incorrect security permissions are set on the following registry keys:

To set the correct permissions for the above listed registry keys, do the following:

  1. Run the Registry Editor (Regedt32.exe).
  2. Select the above keys, one at a time.
  3. On the Security menu, select Permissions.
  4. Click Add, and select the Everyone group.
  5. Change the permission to Full and click OK.
  6. Select the Replace Permission on Existing Subkeys check box, and click OK.
  7. Shut down the Exchange Services, and restart the computer.

Be sure to heed the warnings about editing the registry!!!

Other Error Messages:

"424Object required"

This error will occur if some of the Outlook Web Access files located on the Microsoft Exchange Server computer are corrupt or missing.

To correct this behavior, remove and reinstall the OWA components from the Microsoft Exchange server using the following steps:

  1. Backup the \Exchsrvr\Webdata directory on the Microsoft Exchange server.
  2. Run the Microsoft Exchange Server setup program and choose the Add/Remove option.
  3. Deselect the Outlook Web Access component and continue with the setup program to remove the OWA component.
  4. Delete the \Webdata directory.
  5. Run the Setup program again select the OWA component.
  6. Continue with the Setup program to perform a clean installation of the OWA components.

 

"VBScript Runtime Error '800A01A8' Object Required: 'Application (...)' \exchange\USA\logon.asp, Line12"

The above error may be caused by file corruption in the Exchange Active Server components. Also a failed installation followed by a successful installation can cause the errors. The failed installation can cause the reinstallation process not to proceed as expected.

Occasionally when you try to remove the Active Server Components (ASC) from Exchange Server Setup add/remove selection, the checkbox for this option cannot be removed. You may not be able to uninstall just the Active Server Components option by using add/remove.

Removing the related registry key will allow the ASC to be reinstalled. Heed the warnings before editing the registry!

The registry key is as follows:

\HKEY_LOCAL_MACHINE

\SOFTWARE

\MICROSOFT

\EXCHANGE\SETUP

Remove the String Value Web Connector from this key. This will uncheck the ASC Option from the Exchange Server CD Setup program. You should then be able to perform a reinstallation of the ASC option.

"HTTP Error 401 401.1 Unauthorized: Logon Failed"

This error will occur when you try to access your mailbox through the active server logon page if Internet Information Server (IIS) version 4.0 has been installed on an Exchange 5.0 Web Access server. Exchange Server version 5.0 Web Access is not supported with IIS version 4.0. The only alternative in this situation is to remove IIS version 4.0 and reinstall IIS version 3.0

Appendix

Server and Registry Settings

Setting the Session Timeout

  1. Open the Exchsrvr\webdata\<lang>\lib\logon.inc file using a text editor such as Notepad.
  2. Search for the Session.Timeout string. The first occurrence is for authenticated access and the default value is 60 minutes. The second occurrence is for anonymous access and the default value is 20 minutes.

The MSExchangeWeb Registry Key

WARNING: Using Registry Editor incorrectly can cause serious problems that may require you to reinstall your operating system. Microsoft cannot guarantee that problems resulting from the incorrect use of Registry Editor can be solved. Use Registry Editor at your own risk.

For information about how to edit the registry, view the "Changing Keys And Values" Help topic in Registry Editor (Regedit.exe) or the "Add and Delete Information in the Registry" and "Edit Registry Data" Help topics in Regedt32.exe. Note that you should back up the registry before you edit it. If you are running Windows NT, you should also update your Emergency Repair Disk (ERD).

The OWA settings are stored in the following Registry key on the IIS server:

HKEY_LOCAL_MACHINE \SYSTEM \CurrentControlSet \Services \MSExchangeWeb

The following values may be found in this Registry key:

AcceptLanguage - Contains sub-keys for all possible accept languages and a default key. Every key points to USA settings by default unless you are running JPN, FRN, or GER setup, in which case the key for that language is localized. Each key contains the following values:

Note that this key and also HKEY_LOCAL_MACHINE\SYSTEM\currentcontrolset\services\W3SVC should should have permissions set such that everyone has full control. If these permissions are not set correctly, do the following:

  1. Run the Registry Editor (Regedt32.exe).
  2. Select the keys, one at a time.
  3. On the Security menu, select Permissions.
  4. Click Add, and select the Everyone group.
  5. Change the permission to Full and click OK.
  6. Select the Replace Permission on Existing Subkeys check box, and click OK.
  7. Shut down the Exchange Services, and restart the computer.

Additional Information from Exchange 5.5 Release Notes:

Installing the Windows NT Hot Fix for Outlook Web Access

When installing Outlook Web Access, you should install the Windows NT hot fix that addresses problems with Secure Sockets Layer (SSL) and memory leaks. This hotfix is only for use with Exchange Server using IIS version 3.0. For more information, see the Microsoft Knowledge Base at the Microsoft Product Support Services Web site (http://www.microsoft.com/support).

You can download the hot fix from:

ftp://ftp.microsoft.com/bussys/winnt/winnt-public/IIS/fixes/usa/ASP/asp-memfix/

The self-extracting zip file is called ASP-MEMFIX.EXE.

Installing Internet Explorer 4.0 After Installing Microsoft Exchange Server

In many cases, you may wish to install IE 4.0 on your Exchange OWA server for troubleshooting and setup. If you need to run Internet Explorer and Microsoft Exchange Server on the same computer, it is strongly recommended that you install Internet Explorer 4.0 before installing Microsoft Exchange Server. If you install Internet Explorer 4.0 after installing Microsoft Exchange Server, Internet Explorer modifies the MIME registry database resulting in problems for international mail, especially mail with double-byte character content. If you installed Internet Explorer 4.0 after installing Microsoft Exchange Server, complete the following procedure to correct this problem. You can perform this procedure without stopping any Microsoft Exchange Server services.

Note This procedure is not required if you are installing Internet Explorer 4.0 before you install Microsoft Exchange Server.

  1. Copy the Reset.inf file in the Server\Support\Mimedb directory from the Microsoft Exchange Server compact disc to a local hard disk.
  2. Right-click on the file and choose Install.  

Web Browser Exception Errors When Using 128-bit SSL Authentication

When 128-bit SSL authentication is turned on for IIS, some Web browsers, such as Internet Explorer versions earlier than 3.02, build 1310, can quit due to an exception error when users access Web documents using Microsoft Outlook Web Access.

To eliminate these types of Web browser exception errors, you can add the following Registry key to the IIS computer:

HKEY_LOCAL_MACHINE

\SYSTEM

\ControlSet001

\Services

\w3svc

\asp\parameters

\BufferingOn=1

This turns buffering on for the IIS computer. When buffering is turned on, Active Server Pages are parsed completely before any data is sent to Web browsers. Buffering is off for servers by default.

In addition to modifying the Registry, users can also control buffering on a per-page basis by inserting <%Response.Buffer = TRUE %> at the top of a page.

Caution With buffering turned on, more server memory is used to parse Active Server Pages and server performance is slower. Be sure to monitor the server to evaluate the impact of buffering on server performance. You may need to upgrade the server's processor or memory to maintain optimum performance.

For optimum performance of Outlook Web Access when using 128-bit SSL authentication, consider upgrading your users' Web browsers to versions with enhanced ability to handle 128-bit SSL authentication. Internet Explorer 3.02, build 1310 and later versions have enhanced 128-bit SSL authentication capability. For more information on obtaining the latest version of Internet Explorer, use your Web browser to visit http://www.microsoft.com/ie.

Installing Microsoft Outlook Version 8.03 on a Microsoft Exchange Server Version 5.5 Computer

If you install Outlook 8.03 on a Microsoft Exchange Server 5.5 computer, Outlook Web Access does not perform as expected. To solve this problem, run Regsvr32a.exe after installing Outlook. This utility resets the affected Registry settings by re-registering Cdo.dll. You can download Regsvr32a.exe from the Microsoft web site at:

http://premium.microsoft.com/support/downloads/dp2439.asp. Run Regsvr32.exe from the command line using the full path to Cdo.dll as the argument. For example, the following command changes the Registry settings by re-registering Cdo.dll:

Regsvr32.exe systemroot\system32\cdo.dll where system root is your Windows NT directory.

©2009 CGNET Services International.   All Rights Reserved.   Phone: 650.833.6000   E-mail: info@cgnet.com