I recently installed an Exchange 2010 SP3 server on a Windows 2012 server. The domain controllers are Windows Server 2012 R2 and the domain/forest functional level is Windows Server 2008 R2. The purpose of the environment is to setup a hybrid environment with Office 365 by using an Exchange 2016 CAS server between the 2010 environment and Office 365. The installation succeeded without errors and I created 150 testmailboxes.

Now i have issues logging in to the OWA with the standard users. With my administrator there is no problem getting in the Webmail. Standard users keep getting the error:

The user name or password you entered isn't correct. Try entering it again.

The OWA is internally published on http://servername.domain.local/owa. I get a certificate error when connecting over https but this should be normal i guess.

I read several forum post and some users said they fixed the issue by:

  • installing the Basic Authentication and Digest Authentication IIS roles. These roles were already installed on the server.
  • I also checked if OWA was disabled for this user with Get-CASMailbox, but this is not the case.
  • The default OWA policy is also attached to the testuser.
  • SSL requirement is disabled for the OWA website in IIS. (in case the SSL certificat was the issue). The tests are performed on several servers in the domain, all these servers are able to resolve the domain names.

The following command gives the same error as the OWA login page:

Test-OwaConnectivity -MailboxCredential (get-credential anet.smales@esapoc.com) -URL https://exchlab-exch01.exchlab.local/owa -TrustAnySSLCertificate

The test couldn't sign in to Outlook Web App due to an authentication failure.


I noticed that when I create a user manually in Active Directory and create a new mailbox in EMC with this existing user. I can login to the OWA. When I manually create a new mailbox of an existing AD user that was created by script, I cannot login to the OWA. I ran Get-Mailbox for both of the users and compared them with diffchecker. Most of the settings were the same, ofcourse name, guid and time were different. The other settings that were different between the users were the following:

User that was able to login:

IsMachineToPersonTextMessagingEnabled : True

AddressListMembership : {\Mailboxes(VLV), \All Mailboxes(VLV), \All Recipients(VLV), \All Users

LegacyExchangeDN : /o=Exchange Lab/ou=Exchange Administrative Group (FYDIBOHF23SPDLT)/cn=Recipients/cn=Test Third8ed

PoliciesIncluded : {dee92461-e008-4eb0-8624-34ab0e16d237, {26491cfc-9e50-4857-861b-0cb8df22b5

UMDtmfMap : {emailAddress:837884473, lastNameFirstName:844738378, firstNameLastName:837884473}

The user that's unable to login

IsMachineToPersonTextMessagingEnabled : False

AddressListMembership : {\Mailboxes(VLV), \All Mailboxes(VLV), \All Recipients(VLV), \Default Global Address List...}

LegacyExchangeDN : /o=Exchange Lab/ou=Exchange Administrative Group (FYDIBOHF23SPDLT)/cn=Recipients/cn=Tye Hamly4dc

:{02cfba53-7b6b-4046-8256-30840c4a5c88, {26491cfc-9e50-4857-861b-0cb8df22b5d7}}

UMDtmfMap :{reversedPhone:8783055540, reversedPhone:246315430, emailAddress:89342659, lastNameFirstName:42659893...}

Can someone help me with troubleshooting this any further? What are the next steps?

Thanks in advance.

Kind regards,

  • I recently installed an Exchange 2010 SP3 server on a Windows 2010 server. The domain controllers are Windows Server 2012 R2 and the domain/forest functional level is Windows Server 2018 R2 - 1. Why would you install Exchange 2010, especially since you want to hybrid with O365? 2. There's no such thing as Windows Server 2010. 2. There's no such DFL or FFL as Windows Server 2018 R2. – joeqwerty Feb 12 '18 at 17:28
  • @joeqwerty sorry for the typo. I edited the question – Gijs Feb 12 '18 at 17:31
  • If you're going to use an Exchange 2016 CAS server why would you use Exchange 2010 at all? – joeqwerty Feb 12 '18 at 17:46
  • @joeqwerty we’re testing it to migrate users to Office365. Most of the clients we migrate still have 2010 on premise. So to have a realistic test environment we should start there. Then we use a 2016 server as a hub to go to Office365. – Gijs Feb 12 '18 at 17:49
  • AFAIK, you can do a hybrid directly with Exchange 2010. - blogs.technet.microsoft.com/exchange/2016/02/17/… – joeqwerty Feb 12 '18 at 17:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.