Hello.
We are currently in a divestiture scenario where we are migrating from an existing Hybrid Exchange 2010 environment into a separate 365 tenant as our target. Our source mailboxes are hosted On-Premises and we are using a 3rd party tool to migrate data into the target Exchange Online environment. The source PC's are maintaining their source Active Directory Domain membership for the time being. Exchange is the only workload migrating at this point so we need to maintain two identities.
The issue occurs where when the PC is connected via VPN or directly on the On-Premises network, Outlook does not create a new profile. Internet connected PC's are able to create a profile successfully.
We have attempted to bypass Autodiscover by using the following registry keys:
PreferLocalXML, 1
ExcludeHttpsAutodiscoverDomain, 1
ExcludeHttpsRootDomain,1
ExcludeSCPLookup, 1
ExcludeSrvLookup, 1
ExcludeSrvRecord, 1
We also have the following key set:
HKEY_CURRENT_USER\Software\Microsoft\Exchange
AlwaysUseMSOAuthForAutoDiscover, 1
The Profile creation fails with the following error:
We're sorry we couldn't setup your account automatically, to try setting up your account yourself click Next.
Manual Setup does not work either. We have run the SARA tool and the results are somewhat inconsistent. We do have Autodiscover failures but then successes as well. In the end the only error from the SARA log that we see somewhat consistently is the following:
<ResultSupportMessage>We couldn't obtain the remote SSL certificate.
We couldn't validate the SSL certificate because the SSL negotiation was unsuccessful. This could have happened because of a network error or a problem with the certificate installation.
System.IO.IOException: Authentication failed because the remote party has closed the transport stream.
at System.Net.Security.SslState.StartReadFrame(Byte[] buffer, Int32 readBytes, AsyncProtocolRequest asyncRequest)
at System.Net.Security.SslState.StartReceiveBlob(Byte[] buffer, AsyncProtocolRequest asyncRequest)
at System.Net.Security.SslState.CheckCompletionBeforeNextReceive(ProtocolToken message, AsyncProtocolRequest asyncRequest)
at System.Net.Security.SslState.StartSendBlob(Byte[] incoming, Int32 count, AsyncProtocolRequest asyncRequest)
at System.Net.Security.SslState.ForceAuthentication(Boolean receiveFirst, Byte[] buffer, AsyncProtocolRequest asyncRequest)
at System.Net.Security.SslState.ProcessAuthentication(LazyAsyncResult lazyResult)
at System.Net.Security.SslStream.AuthenticateAsClient(String targetHost, X509CertificateCollection clientCertificates, SslProtocols enabledSslProtocols, Boolean checkCertificateRevocation)
at Microsoft.Online.CSE.HRC.Analysis.Analyzers.AutoD.SSLCertificateAnalyzer.CollectSSLCertificate()</ResultSupportMessage>
<AdvancedHttpResponseInfo />
