Exchange 2007 Autodiscover Service

Introduction;

Microsoft Exchange Server 2007 includes a new Microsoft Exchange service named the Autodiscover
service. The Autodiscover service configures and maintains server settings for client computers that are
running Microsoft Office Outlook 2007. The Autodiscover service can also configure supported mobile
devices. An important function of the Autodiscover service is to provide access to Microsoft Exchange
features for Outlook 2007 clients that are connected to your Microsoft Exchange messaging environment.
These features include the Web-based offline address book (OAB), the Availability service, and Unified
Messaging (UM). The Autodiscover service must be deployed and configured correctly for Outlook 2007
clients to automatically connect to Microsoft Exchange features. For more information about how to
configure Exchange features, see How to Configure Exchange Services for the Autodiscover Service later
in this white paper.

How the Autodiscover Service Works with Clients ?

     When you install the Client Access server role on a computer that is running Exchange 2007, a new virtual
directory named Autodiscover is created under the Default Web Site in Internet Information Services
(IIS). This virtual directory handles Autodiscover service requests from Outlook 2007 clients in the
following circumstances:
When a new Outlook profile is configured or updated
When a client periodically checks for changes to the Exchange Web Services URLs
When underlying network connection changes occur in your Exchange messaging
environment
Additionally, a new service connection point (SCP) Active Directory object is created for each server
where the Client Access server role is installed. The SCP object is used by domain-connected clients to
locate the Autodiscover service. The SCP object contains two pieces of information, the
serviceBindingInformation attribute and the keywords attribute. The serviceBindingInformation
attribute has the Fully Qualified Domain Name (FQDN) of the Client Access server in the form of
https://cas01.contoso.com/autodiscover/autodiscover.xml, where cas01.contoso.com is the fully qualified
domain name (FQDN) for the Client Access server. The keywords attribute specifies the Active Directory
sites to which this SCP record is associated. By default, this attribute specifies the Active Directory site to
which the Client Access server belongs.
When a domain-connected client connects to the Active Directory directory service, the Exchange 2007
client authenticates to Active Directory and tries to locate the Autodiscover SCP objects that were created
during Setup by using the user's credentials. In deployments that include multiple Client Access servers,
an Autodiscover SCP record is created for each Client Access server. By using the user credentials, the
Outlook 2007 client authenticates to Active Directory and searches for the Autodiscover SCP objects. After
the client obtains and enumerates the instances of the Autodiscover service, the client connects to the
first Client Access server in the enumerated and sorted list and obtains the profile information in the form
of XML data that is needed to connect to the user's mailbox and available Microsoft Exchange features.
An Outlook 2007 client connects to the Autodiscover service as follows:
Outlook 2007 sends a Lightweight Directory Access Protocol (LDAP) query to Active Directory
looking for all available SCP objects. Specifically, Outlook initializes the LDAP connection using the
ldap_init() function and passes a NULL value for the hostname. When a particular global catalog
server name (or domain name) is not specified, the operation searches for a global catalog server
in the domain, based on the membership of the computer that is initializing the operation.

1.Outlook 2007 sorts and enumerates the returned results based on the client's Active Directory site
by using the keyword attribute of the SCP record. One of two lists is created, an in-site list or an
out-of-site list. The in-site list provides the SCP records that have AutodiscoverSiteScope
information. AutodiscoverSiteScope is a parameter that is set on the Client Access server by using
the Set-ClientAccessServer cmdlet. The parameter specifies the site for which the Autodiscover

2.  Exchange 2007 Autodiscover Service Page 2 of 41
http://technet.microsoft.com/en-us/library/bb332063(EXCHG.80,printer).aspx 3/2/2010
service is authoritative. The AutodiscoverSiteScope information contained in the SCP records for
the in-site list matches the Active Directory site for the Outlook client. If there are no in-site
records, an out-of-site SCP record list will be generated. The list is not sorted in any particular
order. Therefore, the list is approximately in the order of oldest SCP records (based on creation
date) first.
Note:
In environments where Outlook 2007 is deployed in remote sites that do not have
Exchange 2007 Mailbox and Client Access servers, you can use site affinity to configure the
SCP objects for Outlook 2007 clients to use SCP objects that are physically closer. For more
information, see How to Configure the Autodiscover Service to Use Site Affinity later in this
white paper.
Outlook first tries to connect to each Autodiscover URL that it had previously generated from either
an in-site list or an out-of-site list. If that doesn't work, Outlook will try to connect to the
predefined URLs (for example, https://autodiscover.contoso.com/autodiscover/autodiscover.xml)
by using DNS. If that fails also, Outlook will try the HTTP redirect method and, failing that, Outlook
will try to use the SRV record lookup method. If all lookup methods fail, Outlook will be unable to
obtain Outlook Anywhere configuration and URL settings.
3. The Autodiscover service queries Active Directory to obtain the connection settings and URLs for
the Exchange services that have been configured.
4. The Autodiscover service returns an HTTPS response with an XML file that includes the connection
settings and URLs for the available Exchange services.
5. Outlook uses the appropriate configuration information and connection settings to connect to your
Exchange messaging environment.

Welcome to The Tips and Tricks Guide to Active Directory Troubleshooting!

Q.1: What do the FSMO roles do?

A: In general, all domain controllers in an Active Directory domain are created equal. That is,

they all have the ability to both read from and write to the Active Directory database and are

essentially interchangeable. However, certain operations within a domain and forest must be

centrally coordinated from a single authoritative source. These operations are handled by only

one domain controller within the domain and are divided into five distinct operational categories.

These categories are referred to as Flexible Single Master Operations (FSMOs).

The term flexible refers to the fact that no particular domain controller must handle these

operations. Instead, the five FSMO roles can be held by any one domain controller; in fact, all

five roles can be held by a single domain controller if you desire. When you install the first

Active Directory domain in a new forest, the first domain controller you create automatically

holds all five roles, and will continue to do so unless you manually move one or more of the

roles to another domain controller.

The FSMO Roles

The five FSMO roles are as follows:

• Schema master. This role is held by only one domain controller per forest. This role

coordinates all changes to the Active Directory schema, and is required in order to

process any schema updates. Only the schema master is permitted to replicate schema

changes to other domain controllers in a forest.

• Domain naming master. This role is held by only one domain controller per forest. This

role handles all changes to the forest-wide domain namespace, and is the only role that

can process the addition or removal of a domain to or from the forest.

• RID master. This role is held by only one domain controller per domain. This role

manages the relative identifier (RID) pool for the domain (for more information about

RIDs, see the sidebar “Relative Identifiers in a Domain”). This role is also responsible for

moving objects from one domain to another within a forest.

• PDC emulator. This role is held by only one domain controller per domain. This role is

the central authority for time synchronization within a domain, and emulates the

functionality of a Windows NT 4.0 Primary Domain Controller (PDC). Any NT Backup

Domain Controllers (BDCs) in a domain replicate from the PDC emulator. Pre-Windows

2000 (Win2K) clients without the Microsoft Directory Services Client (DSClient) contact

the PDC emulator to change user and computer passwords. The PDC emulator is also

responsible for processing account lockouts. Finally, any failed logon attempts are first

forwarded to the PDC emulator before returning a bad logon message to the client.

􀀄 The PDC emulator is the one FSMO role that your domain cannot live without for very long. This role

should be placed on a robust server computer, and you should monitor that computer closely to

ensure that the PDC emulator is functioning correctly. Because the PDC emulator processes account

lockout, it is a key piece of Active Directory’s security infrastructure.

The Tips and Tricks Guide to Active Directory Troubleshooting

2

• Infrastructure master. This role is held by only one domain controller per domain. This

role updates object security identifiers (SIDs) and distinguished names (DNs) in crossdomain

object references.

Relative Identifiers in a Domain

All security principals, such as users and computers, in a domain have a unique SID that identifies the

principal on access control lists (ACLs) in the domain. SIDs consist of two major portions: the domain

SID, which is the same for all SIDs within a domain, and a RID, which is unique for each security principal

within a domain. The combination of the domain SID and the RID make the resulting SID completely

unique across domains, even though different domains can issue the same RIDs.

The RID master allocates small pools of unique RIDs to each domain controller in a domain. Domain

controllers use this pool to assign RIDs when creating new security principals. When a domain controller

runs out of available RIDs, the domain controller contacts the RID master to obtain a new pool. Because

all RIDs originate from a single source, the RIDS are guaranteed to be unique within the domain.

􀀄 You might sometimes see references to a sixth FSMO role, the Global Catalog (GC). Although the

GC is an extra function that can be assigned to a domain controller, it is not a FSMO. Domains and

forests can contain multiple domain controllers acting as a GC server, whereas FSMOs are be

definition held by one, and only one, domain controller at a time.

􀀉 For more information about the FSMO roles, refer to the Microsoft article “Windows 2000 Active

Directory FSMO Roles.”

The following list provides some best practices for placing FSMOs:

• In a multiple-domain forest, never place the infrastructure master role on a domain

controller that is also a GC server. The infrastructure master’s job is to update crossdomain

references, and it does so by looking for references it does not itself possess.

Because a GC contains a reference to every object in the entire forest, the infrastructure

master will never be without a reference, and will therefore fail to perform its job

properly.

• Because the PDC emulator holds such a crucial, central role in Active Directory, you

should place the PCD emulator on a domain controller that has the best possible

connectivity to other domain controllers in the domain. The PDC emulator in the forest

root domain synchronizes time for all other PDC emulators in the forest, and should have

a reliable network connection to the domain controllers holding the role in each domain.

• You should place the schema master on a domain controller that is physically collocated

with the administrators responsible for maintaining the forest’s schema. This placement

will ensure that the administrators have a reliable connection when performing schema

updates.

The Tips and Tricks Guide to Active Directory Troubleshooting

3

FSMO Failover

Active Directory does not provide automatic failover for the FSMO roles. Some of the roles,

such as the schema master, aren’t required for Active Directory’s day-to-day operations, so

automatic failover isn’t strictly necessary. However, some roles, such as the PDC emulator,

control critical domain operations, and you’ll notice pretty quickly if the domain controller

containing the role fails. In those cases, you’ll have to manually relocate the FSMO role to

another domain controller.