Nach Neuinstallation: kein Zugriff möglich (web und outlook)

markush · 2024-02-16T07:21:21+00:00

Guten Morgen in die Runde, ich habe eine Neuinstallation meiner Testumgebung von grom vorgenommen. Das ganze läuft als virtualisierte Maschine auf einem Pro...

Mister2

markush I agree, but MS seems to think everyone is using Office 365 (especially with newer Office versions and apps) and try to send you to their mail servers instead of your one-premise one(s).

More recent version of Outlook use the 'Simplified Account Creation', to setup new accounts, by default. As MS want everyone to use Microsft365, they check their servers first and when that does work, it can all go a bit 'pear shaped'.

The following article may offer some assistance in disabling the default behaviour:-

https://support.microsoft.com/en-us/topic/how-to-disable-simplified-account-creation-in-outlook-2016-outlook-2019-and-outlook-for-office-365-662bf4f8-c357-dbc8-53b3-ff8f445e8247

This should help to allow the users to select 'Exchange' as a mail profile type as per a mobile device. Of course it means you may have to apply a reg setting to all users machines and the mail profile creation process is not quite as 'slick' as it should be, but might be an option for you.

markush

Yes MS is trying to get access to all user data. I have found this article yesterday:

https://www.deskmodder.de/blog/2020/08/26/microsoft-outlook-probleme-mit-autodiscover-und-microsoft-365-postfach-workaround/

It describes the same, setting a manual registry or group policy and deactivate the behaviour of outlook. I'll continue testing the grommunio installation for now.

WalterH

markush DNS SRV entry "autodiscover.tcp.meinedomain.de" is missing!

Is your DNS server working? Do you use a splitt DNS?

markush

WalterH Yes the server is working and i'm using split dns.

markush

markush Okay, there was indeed an issue with the SRV Record on my dns. But i was able to solve the problem:

`* Request body:
<?xml version="1.0" encoding="UTF-8"?>
<Autodiscover xmlns="http://schemas.microsoft.com/exchange/autodiscover/outlook/requestschema/2006">
<Request>
<EMailAddress>markus@meinedomain.de</EMailAddress>
<AcceptableResponseSchema>http://schemas.microsoft.com/exchange/autodiscover/outlook/responseschema/2006a</AcceptableResponseSchema>
</Request>
</Autodiscover>

Trying 10.10.1.232:443...
Connected to autodiscover.meinedomain.de (10.10.1.232) port 443 (#0)
ALPN: offers h2,http/1.1
SSL connection using TLSv1.3 / TLS_AES_256_GCM_SHA384
ALPN: server accepted h2
Server certificate:
subject: CN=*.meinedomain.de
start date: Feb 18 10:16:18 2024 GMT
expire date: May 18 10:16:17 2024 GMT
issuer: C=US; O=Let's Encrypt; CN=R3
SSL certificate verify result: unable to get local issuer certificate (20), continuing anyway.
using HTTP/2
Server auth using Basic with user 'markus@meinedomain.de'
h2h3 [:method: POST]
h2h3 [:path: /Autodiscover/Autodiscover.xml]
h2h3 [:scheme: https]
h2h3 [:authority: autodiscover.meinedomain.de]
h2h3 [authorization: Basic bWFya3VzQGhpbGxlci1yZWdlbi5kZTpLNTgwbG9ld2Ut]
h2h3 [user-agent: Microsoft Office/16]
h2h3 [accept: /]
h2h3 [content-type: text/xml]
h2h3 [content-length: 386]
Using Stream ID: 1 (easy handle 0x55c8abdb8f70)

POST /Autodiscover/Autodiscover.xml HTTP/2
Host: autodiscover.meinedomain.de
authorization: Basic bWFya3VzQGhpbGxlci1yZWdlbi5kZTpLNTgwbG9ld2Ut
user-agent: Microsoft Office/16
accept: /
content-type: text/xml
content-length: 386

old SSL session ID is stale, removing
We are completely uploaded and fine
< HTTP/2 200
< content-type: text/xml
< content-length: 3418
< content-security-policy: default-src 'self' data:; frame-src * blob:; connect-src * data: blob:; font-src * data:; img-src * data: blob:; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; object-src 'self'; base-uri 'self'; frame-ancestors 'self';
< permissions-policy: accelerometer=(), autoplay=(self), camera=(self), display-capture=(self), encrypted-media=(self), fullscreen=(self), geolocation=(self), gyroscope=(), keyboard-map=(self), magnetometer=(), microphone=(self), midi=(), payment=(), picture-in-picture=(self), publickey-credentials-get=(self), screen-wake-lock=(self), sync-xhr=(), usb=(), web-share=(self), xr-spatial-tracking=(self)
< strict-transport-security: max-age=15552000; includeSubDomains; preload
< x-content-type-options: nosniff
< x-frame-options: SAMEORIGIN
< x-permitted-cross-domain-policies: none
< x-robots-tag: none
< x-xss-protection: 1; mode=block
< referrer-policy: no-referrer
<
Connection #0 to host autodiscover.meinedomain.de left intact
Response body:
<?xml version="1.0" encoding="UTF-8"?><Autodiscover xmlns="http://schemas.microsoft.com/exchange/autodiscover/responseschema/2006"><Response xmlns="http://schemas.microsoft.com/exchange/autodiscover/outlook/responseschema/2006a"><User><AutoDiscoverSMTPAddress>markus@meinedomain.de</AutoDiscoverSMTPAddress><DisplayName>Markus Name</DisplayName><LegacyDN>/o=i65d1e7e4/ou=Exchange Administrative Group (FYDIBOHF23SPDLT)/cn=Recipients/cn=0100000002000000-markus</LegacyDN><DeploymentId>6d61726b-7573-4068-696c-6c6502000000</DeploymentId></User><Account><AccountType>email</AccountType><Action>settings</Action><MicrosoftOnline>False</MicrosoftOnline><ConsumerMailbox>False</ConsumerMailbox><Protocol><OOFUrl>https://srv.meinedomain.de/EWS/Exchange.asmx</OOFUrl><OABUrl>https://srv.meinedomain.de/OAB/</OABUrl><Type>EXHTTP</Type><Server>srv.meinedomain.de</Server><SSL>On</SSL><CertPrincipalName>None</CertPrincipalName><AuthPackage>basic</AuthPackage><ServerExclusiveConnect>on</ServerExclusiveConnect><ASUrl>https://srv.meinedomain.de/EWS/Exchange.asmx</ASUrl><EwsUrl>https://srv.meinedomain.de/EWS/Exchange.asmx</EwsUrl><EmwsUrl>https://srv.meinedomain.de/EWS/Exchange.asmx</EmwsUrl><EcpUrl>https://srv.meinedomain.de/EWS/</EcpUrl><EcpUrl-photo>thumbnail.php</EcpUrl-photo></Protocol><Protocol Type="mapiHttp" Version="1"><MailStore><InternalUrl>https://srv.meinedomain.de/mapi/emsmdb/?MailboxId=6d61726b-7573-4068-696c-6c6502000000@meinedomain.de</InternalUrl><ExternalUrl>https://srv.meinedomain.de/mapi/emsmdb/?MailboxId=6d61726b-7573-4068-696c-6c6502000000@meinedomain.de</ExternalUrl></MailStore><AddressBook><InternalUrl>https://srv.meinedomain.de/mapi/nspi/?MailboxId=6d61726b-7573-4068-696c-6c6502000000@meinedomain.de</InternalUrl><ExternalUrl>https://srv.meinedomain.de/mapi/nspi/?MailboxId=6d61726b-7573-4068-696c-6c6502000000@meinedomain.de</ExternalUrl></AddressBook></Protocol><Protocol><Type>EXCH</Type><Server>6d61726b-7573-4068-696c-6c6502000000@meinedomain.de</Server><ServerVersion>73C0834F</ServerVersion><ServerDN>/o=i65d1e7e4/ou=Exchange Administrative Group (FYDIBOHF23SPDLT)/cn=Configuration/cn=Servers/cn=6d61726b-7573-4068-696c-6c6502000000@meinedomain.de</ServerDN><MdbDN>/o=i65d1e7e4/ou=Exchange Administrative Group (FYDIBOHF23SPDLT)/cn=Configuration/cn=Servers/cn=6d61726b-7573-4068-696c-6c6502000000@meinedomain.de/cn=Microsoft Private MDB</MdbDN><AuthPackage>anonymous</AuthPackage><ServerExclusiveConnect>off</ServerExclusiveConnect><OOFUrl>https://srv.meinedomain.de/EWS/Exchange.asmx</OOFUrl><OABUrl>https://srv.meinedomain.de/OAB/</OABUrl><PublicFolderServer>srv.meinedomain.de</PublicFolderServer><ASUrl>https://srv.meinedomain.de/EWS/Exchange.asmx</ASUrl><EwsUrl>https://srv.meinedomain.de/EWS/Exchange.asmx</EwsUrl><EmwsUrl>https://srv.meinedomain.de/EWS/Exchange.asmx</EmwsUrl><EcpUrl>https://srv.meinedomain.de/EWS/</EcpUrl><EcpUrl-photo>thumbnail.php</EcpUrl-photo></Protocol><Protocol><Type>EXPR</Type><Server>srv.meinedomain.de</Server><SSL>On</SSL><CertPrincipalName>None</CertPrincipalName><AuthPackage>basic</AuthPackage><ServerExclusiveConnect>on</ServerExclusiveConnect><OOFUrl>https://srv.meinedomain.de/EWS/Exchange.asmx</OOFUrl><OABUrl>https://srv.meinedomain.de/OAB/</OABUrl></Protocol><PublicFolderInformation><SmtpAddress>public.folder.root@meinedomain.de</SmtpAddress></PublicFolderInformation></Account></Response></Autodiscover>
Response has validated
`
This message disappeared:

DNS SRV entry "autodiscover.tcp.meinedomain.de" is missing!

markush

Hallo zusammen,

ich wollte nur nochmal kurz Rückmeldung zum aktuellen Stand geben: nach erneuter kompletter Neuinstallation funktioniert jetzt soweit alles. Was ich geändert habe:

Die Zertifikatserstellung via certbot etwas angepasst und die Standardoptionen verwendet (z.B. kein 4096 bit Verschlüsselung mehr)
neuen Proxy Manager aufgesetzt und Domains bzw. Subdomains konfiguriert

Ansonsten penibel darauf geachtet, dass überall der richtige Hostname und die Maildomain verwendet werden beim Setup. Outlook, Webmail und die Android Zugriffe funktionieren schon mal, Apple fehlt mir noch ein Testgerät.
Das einzige was nicht funktioniert: Outlook erkennt beim verwenden des Assistenten nicht, dass es mit einem Exchange Server verbunden werden soll. Das muss ich über die Erweiterten Optionen manuell machen (kommt aber noch in eine GPO rein wie oben verlinkt).

Ansonsten vielen Dank 🙏 nochmal an die Hilfeleister hier, hätte fast schon kapituliert 😉👍

Beste Grüße 🙋‍♂️

« Previous Page