-
Title
CPUU continuously prompts for credentials and fails with error MAPI_E_LOGON_FAILED when CPUU is configured to use default RPC over HTTP settings -
Description
If RPC over HTTP settings have been changed from the default settings on the target Exchange server, and CPUU has not been configured to use specific RPC over HTTP settings on the 'Network' tab of the CPUU configuration wizard, then CPUU will continuously prompt for credentials and fail with the following errors logged to the CPUU log file:
8/9/2017 12:46:18 PM 3348 [Trace] Open store 'Private Folders'.
MAPI result: 0x80040111, Description: MAPI_E_LOGON_FAILED, Extended info: Component: MAPI 1.0, Description: The information store could not be opened., Context: 646, Low level: 0
Stack: 0046EDAA 004DCC28 004D7190 004D6F08 005BE0A6 005B173B 005D207B 005CFE2A 0042915D 004289DC 00438200 0063C021 BaseThreadInitThunk RtlInitializeExceptionChain RtlInitializeExceptionChain
8/9/2017 12:46:18 PM 3348 [Error] Cannot log on to the profile. Please verify the logon credentials, connection settings in CPUU.ini and that the Exchange server is available. Also you can use the 'LeaveTemporaryProfile' parameter to check the temporary profile. For more details, see the product documentation.
MAPI result: 0x80040111, Description: MAPI_E_LOGON_FAILED
Stack: 0041B6F5 0041977C 004D73E8 004D6F08 005BE0A6 005B173B 005D207B 005CFE2A 0042915D 004289DC 00438200 0063C021 BaseThreadInitThunk RtlInitializeExceptionChain RtlInitializeExceptionChain
8/9/2017 12:46:18 PM 3348 [Info] Modifying profile 'Outlook' is 'failed'.
8/9/2017 12:46:18 PM 3348 [Info] Rolling back changes made for profile 'Outlook'.
-
Cause
RPC over HTTP settings on the Exchange server have been changed from the default settings which CPUU uses automatically, and correct RPC over HTTP settings have not been manually configured on the 'Network' tab of the CPUU configuration wizard
** It should also be noted that the use of port or URL limiting perimeter appliances and software should always be check for rejections when getting this error. In one customer case the MAPI error was because a O365 Autodiscover URL was being blocked at the perimeter of their network.
-
Resolution
From the CPUU Administrator Guide:
CPUU can configure target Outlook profiles to use RPC over HTTP access to Exchange. You can set the RPC over HTTP settings manually or use automatic detection of RPC over HTTP settings in CPUU. The automatic detection is only available if you work with Microsoft Office 365 or Microsoft Exchange Server 2013 (or higher).
NOTE: If you migrate to Microsoft Exchange Server 2013 or higher, RPC over HTTP settings are set to default automatically. If these settings were changed on your Exchange server, you should specify the RPC over HTTP settings manually in the CPUU configuration file.
To configure RPC over HTTP settings manually:
- In the Client Profile Updating Utility Configuration wizard, go to the Network step.
- Select the Configure profiles to connect to Microsoft Exchange using HTTP as follows check box.
- Specify the proxy server URL and other parameters.
- Then, select Try TCP/IP connection first, and use HTTP only if TCP/IP access fails option if you want CPUU to try using RPC/TCP and set PRC/HTTP only if TCP access fails. If the option is not selected, CPUU will not try RPC/TCP access and will set RPC/HTTP access for the target mailbox in all cases.
- Proceed with other options.
Alternatively you can edit the .INI file directly. The INI file section should have the following format:
[RPCOverHTTP]ConnectUsingHTTP={0,1} [1]ProxyServer=SSLOnly={0,1} [1]MutualAuth={0,1} [0]PrincipalName=[""]HTTPFirstOnFast={0,1} [1]HTTPFirstOnSlow={0,1} [0]AuthType={Basic, NTLM} [NTLM]FirstLogonOverTCP={0,1} [1]
Confirming RPC over HTTP Settings in the Target environment:
In order to confirm the proper RPC over HTTP settings in the target environment which should be entered into the CPUU configuration wizard, you can manually create an Outlook profile on the workstation for a target user, then check the profile's RPC over HTTP settings.
In order to do this, the following registry setting must be added:
[HKEY_CURRENT_USER\Software\Microsoft\Exchange]
"MapiHttpDisabled"=dword:00000001
This registry change will force the manually created profile to use RPC over HTTP instead of MAPI over HTTP. This registry setting will also allow the Connection tab to appear in the Account Settings | More Settings of an Outlook profile per the following MSKB: https://support.microsoft.com/en-ca/help/3000090/microsoft-exchange-dialog-does-not-include-a-connection-tab-in-outlook
Then create a new profile on the workstation:
- Go to Control Panel | Mail (32-bit) | Show Profiles
- Click 'Add' and enter a profile name and click 'OK'
- Complete the New Profile wizard and click 'Finish'
- In the Mail (32-bit) applet, select the newly created profile and click 'Properties' then click 'Email Accounts'
- Select the email account and click the 'Change' button then click 'More Settings'
- On the 'Connection' tab click 'Exchange Proxy Settings'
- The 'Exchange Proxy Settings' configured here are the exact RPC over HTTP settings which need to be entered into the 'Network' step within the CPUU Configuration Wizard for the target environment.
Confirming default RPC over HTTP settings CPUU is using
To confirm which RPC over HTTP settings CPUU is using when no settings have been configured on the Network tab of the configuration wizard, you can edit the CPUU_Update.bat file created by CPUU and add the -LeaveTemporaryProfile parameter to the command lines in order to leave a temporary profile behind after CPUU runs. Then check the Connection tab | Exchange Proxy Settings of the temporary profile to view what settings CPUU is using.
The -LeaveTemporaryProfile parameter should be added at the end of the commands lines in the CPUU_Update.bat file like this:set run_cmd=ClientProfileUpdatingUtility_x64.exe %command_line% - LeaveTemporaryProfile) else (set run_cmd=ClientProfileUpdatingUtility.exe %command_line% -LeaveTemporaryProfile)
More information on the -LeaveTemporaryProfile parameter:
Before updating a profile, CPUU checks that the target mailbox is available and accessible with current CPUU.ini settings by creating the temporary target profile and trying to logon to it. By default, the temporary profile will be deleted after that. If -LeaveTemporaryProfile is specified, temporary profile will remain. Temporary profile name is like the following: CPUU_{}. -LeaveTemporaryProfile is useful if CPUU cannot access the target mailbox with current CPUU.ini settings. In this case, you can leave the temporary target profile, open it in the Mail Control Panel applet and check which of the profile settings are incorrect and determine what should be changed in CPUU.ini to force CPUU
More information on CPUU Parameters can be found here: https://support.quest.com/technical-documents/client-profile-updating-utility/5.7/administrator-guide/6#TOPIC-691713 -
Additional Information
CPUU currently only uses RPCoverHTTP for Exchange 2016 and lower and can use MAPIoverHTTP for O365. R&D is working on changes for CPUU to work with MAPIoverHTTP more as Microsoft is discontinuing support for RPCoverHTTP as of October 31st, 2017: https://support.microsoft.com/en-us/help/3201590/rpc-over-http-deprecated-in-office-365-on-october-31--2017