Yet Another Exchange Activesync Issue

A user received a new Android tablet and they wanted to sync their email with the Exchange 2010 server. After configuring everything phone side the phone never displayed the security setting warning and displayed a loading sign that never ended.

On the server side, the exchange server was spewing event id 1008 into the event log.

Other users had no problem, but this was the first time this user had attempted to sync with exchange.

To make a long story short and after some googling I found,  Cannot sync iPhone with Exchange ActiveSync.
This article talks about a permissions problem on the server. The solution was to verify that the user has the "Include inheritable permissions from this object's parent" checked on the Active Directory user's permissions.

1. Open "Active Directory Users and Computers" (dsa.msc).
2. Go to "View" and make sure "Advanced Features" is checked, if it isn't - check it.
3. Find the problematic user and open its "Properties" (right click --> Properties).
4. Go to the "Security" tab and click on the "Advanced" button.
5. Verify that the "Include inheritable permissions from this object's parent" checkbox is checked. If it is, you may try to reset the user's permissions by clicking on the "Restore defaults" button.

After fixing the permissions and then newly adding the email account on the tablet, everything worked but the initial sync did seem to take a little while. It is interesting that this is the same root cause of a similar problem I had before.The interesting thing is that I checked this on all of the users last time and I also checked all of the users again this time. Probably I missed this one user the last time around though....

Exchange 2010 Activesync Issue

I upgraded my Exchange server from Exchange 2007 to Exchange 2010 as part of the migration to SBS 2011. After the upgrade I was making good progress ironing out issues until I tried to sync my android phone.

The native android email in Android 2.2 was failing with an unspecified error. I then tried Touchdown by Nitrodesk. It was also failing but they have nice logging built into their software and I was able to see the following:


Checking Certificate...
Checking ActiveSync with SSL...
Server is Microsoft-IIS/7.5
ActiveSync was found
ActiveSync Version :Versions:Microsoft-IIS/7.5,2.0,2.1,2.5,12.0,12.1,14.0,14.1
Trying activesync protocol -116...
ActiveSync provisioning returns HTTP:200
Error provisioning ActiveSync: Policy status is 0
Trying activesync protocol 2.5...
ActiveSync provisioning returns HTTP:200
ActiveSync provisioning success
The following policies have been requested :

Refreshing AS folders
Error refreshing folders

Checking 2007 with SSL...

 The error refreshing folders was the key and NitroDesk support pointed me to the Nick MacKechnie blog. The main idea is that there is an issue with upgrading to Exchange 2010 and some of the permissions are not set correctly.

Another good Exchange troubleshooting tool I found is the Microsoft Exchange Remote Connectivity Analyzer . This tool pointed right to the HTTP 500 error I was getting which pointed me to a Technet Article that described essentially the same issue.

I followed the steps but in my case I had about 10 Exchange server entries so I selected the first one and chose "include inheritable permissions from parent". After the obligatory  OK clicks I ran the Exchange checker again and it passed. Then I tried my Droid in both Touchdown and the Native app and everything worked.