Tek-Tips is the largest IT community on the Internet today!

Members share and learn making Tek-Tips Forums the best source of peer-reviewed technical information on the Internet!

  • Congratulations Wanet Telecoms Ltd on being selected by the Tek-Tips community for having the most helpful posts in the forums last week. Way to Go!

Server ActiveSync gives HTTP_403 error

Status
Not open for further replies.
Dec 20, 2001
45
US
We are running Exchange 2003 Enterprise sp1 on Windows Server 2003 Enterprise. We have been successfully using server-side activesync for several different devices: a few PocketPC PDAs, a SmartPhone, and a few newer PocketPC/PDA phones. Until yesterday.

What happened yesterday was that the IP address of the Exchange server was changed. Long story short, it was given a private address with a static NAT to the outside world. Everything seems to be just fine: OWA works correctly (even with SSL), RPC over HTTPS functions correctly, Exchange is getting proper name resolution for incoming and outgoing emails, Outlook clients can connect without any problems, the SMTP service is sending and recieving emails from all sources just as it did before the change.

However, Activesync is broken somehow. All the devices get the same error message:

Your account does not have permission to sync with your current settings. Contact your Microsoft Exchange administrator. An error occurred, and scheduled sychronization had to be disabled. To start synchronization on a schedule again, use the Mobile Schedule tab in ActiveSync options. Error code: HTTP_403

As you can guess, MS has no record of this error in any docs online. No permissions have changed at all on the Exchange server. The only thing that changed was the IP address.

The Security log on Exchange clearly shows me logging in. How do I suddenly not have permission to sync? Especially considering that I am an Exchange admin? And that it worked previous to the IP change?

Any ideas?
 
I just solved this issue, after some backtracking.

Setting up ActiveSync typically involves the creation of a virtual directory in IIS in accordance with article KB817379. Within the settings, you must grant access to only specific IP addresses to the virtual directory ExchangeOMA (or whatever you called it during setup) for security reasons. The only address that should be there is the address of the Exchange server itself, and if the server address changes... well you get the picture.

Another suggestion from another board: make certain that this virtual directory is NOT set to use SSL by default.

:)
 
Status
Not open for further replies.

Part and Inventory Search

Sponsor

Back
Top