Error message when you create a profile in Outlook 2007 after you install the cumulative update that is described in Microsoft Knowledge Base article 961752: "Outlook cannot log on"

After you install either the February 24, 2009 cumulative update that is described in Microsoft Knowledge Base article 961752 or the 2007 Microsoft Office suite Service Pack 2, you may experience the following symptoms.

1. When you create a profile in Microsoft Office Outlook 2007, you may receive the following error message:
   Outlook cannot log on. Verify you are connected to the network and are using the proper server and mailbox name. The connection to Microsoft Exchange is unavailable. Outlook must be online or connected to complete this action.
   This problem occurs when any one of the following conditions is true:
   • The Microsoft Exchange Server mailbox server has the No RFR Service registry value set to 1.
     
     For more information about the registry path, click the following article number to view the article in the Microsoft Knowledge Base:
     302914  (http://support.microsoft.com/kb/302914/ ) How Outlook 2000 accesses Active Directory
   • You specify the name of a global catalog (GC) for the server name in your Outlook profile settings, and the GC is not an Exchange server.
   • The fully qualified domain name (FQDN) of your Exchange server cannot be accessed from your Outlook client. For example, the FQDN of the server may be server.Domain.local.
2. You may also receive the following error when you click the Delegates tab in the Options dialog box in Outlook:
   The Delegates page is not available. Cannot access Outlook folder. The connection to Microsoft Exchange is unavailable. Outlook must be online or connected to complete this action.
3. In Outlook, when you view the properties of a user in your Exchange organization, you experience the following problems:
   • There is no information on either the Organization or the Member of tabs
   • The Organization and Member Of tabs display the following error text next to an information icon:
     Unable to connect to retrieve additional data

This problem occurs because of a code change in Outlook 2007 that is included in the update from KB article 961752. After you install the update, Outlook always assumes that you are connecting to an Exchange 2000 Server mailbox, or later versions, and always uses the Referral service when you create a new profile.

If you have the "No RFR Service" registry value set to 1 on the Exchange server the server is effectively configured to always use DSProxy. However, Outlook does not support DSProxy after the installation of the update, and it cannot reach your global catalog server.

A global catalog server does not support the Referral service. Therefore, if you specify the global catalog as the Exchange server name and you do not have Exchange installed on the global catalog server, there is no way for the global catalog server to give you the Exchange server information.

In some topologies, a referral from the Exchange server for a GC returns an FQDN that is not routable from the client computer. For example, after you connect to an Exchange server by using a wireless router, the router cannot route traffic from the client to an FQDN such as “server.Domain.local." This is a typical FQDN that is returned by a Microsoft Small Business Server.

This can also occur on non-SBS servers in which the Outlook client and the Exchange server are in different domains. Such an Exchange server is typically a single Exchange server that is also a GC. If your DNS configuration cannot resolve the FQDN of the server in the other domain, you can use the nslookup command on the Outlook client to see whether it returns the correct IP address for the server. The following example shows a failed nslookup from a client for such a topology:


In this example, exchange01.contoso.com is the FQDN of the Exchange server in the contoso domain and dc01.fourthcoffee.com is the DNS server in the Outlook client domain (fourthcoffee).

To resolve this problem, install the update from the following article: For more information, click the following article number to view the article in the Microsoft Knowledge Base: If you cannot install the update at this point, please use one of the following methods as a workaround until you can install the update.

Method 1

Do not specify a global catalog server when you create your Outlook profile.

If you specify a global catalog server when you manually create your Outlook profile, and you do not have Exchange installed on the global catalog server, specify the name of an Exchange server in your organization.

If you use a .prf file to create your Outlook profile and the .prf file specifies a global catalog server for the Exchange mailbox server name, change the .prf file so that it uses the name of an Exchange server in your organization instead of a global catalog server.

Method 2

Stop using the "No RFR Service" registry value on the Exchange server.

If you use the "No RFR Service" registry value on an Exchange Server 2003 server or on an Exchange 2007 server, you can solve this problem by following these steps:

1. Click Start, click Run, type regedit in the Open box, and then click OK.
2. Locate and then click the following registry subkey:
   HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\MSExchangeSA\Parameters
3. Right-click No RFR Service, and then click Modify.
4. In the Value data box, type 0, and then click OK.
5. On the Edit menu, point to New, and then click DWORD Value.
6. Type Refer TCPIP to DsProxy, and then press ENTER.
7. Right-click Refer TCPIP to DsProxy, and then click Modify.
8. In the Value data box, type 1, and then click OK.
9. Exit Registry Editor.
10. Restart the Exchange System Attendant service and other dependent services.

Method 3

If you use an SBS server that returns a FQDN that is not routable from the client computer, you can resolve this problem by following these steps:

1. Click Start, click Run, type regedit in the Open box, and then click OK.
2. Locate and then click the following registry subkey: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\MSExchangeSA\Parameters
3. On the Edit menu, point to New, and then click String Value.
4. Type NSPI Target Server, and then press ENTER.
5. Right-click NSPI Target Server, and then click Modify.
6. In the Value data box, type the Netbios name or the FQDN of your SBS server, and then click OK.
7. Exit Registry Editor.
8. Restart the Exchange System Attendant service and other dependent services.

Method 4

Use a Hosts file entry for the FQDN of the global catalog server. If the nslookup command returns a "Non-existent domain" result for the FQDN of the GC, change the Hosts file on your Outlook client to include an entry that resolves the FQDN to the IP address of the server. To do this, follow these steps:

1. Click Start, click Run, type %windir%\system32\drivers\etc\hosts in the Open box, and then click OK.
2. If you need to, select Notepad to open the Hosts file.
3. Enter the IP address and the FQDN of your GC. For example, you may enter:102.54.94.97 exchange01.contoso.com
4. Save and then close the Hosts file.

Before you install the update from Microsoft Knowledge Base article 961752, Outlook uses the following global catalog server connection logic when you create a new profile. When you create a new Outlook profile, the client has to know the name of your global catalog server. During the initial profile creation process, Outlook is not aware of the Exchange version that hosts your mailbox. Because of this, Outlook assumes that the Exchange server supports the DSProxy service and uses the Exchange server name as the global catalog server name. Therefore, Outlook prompts Exchange to proxy Name Service Provider Interface (NSPI) calls on to the actual global catalog server.

Note Exchange is fully aware of the global catalog servers to which it can connect.

After this initial connection is made, and Outlook successfully finishes its first start, Outlook caches the version of Exchange that hosts your mailbox. Because Outlook 2007 only supports connections with Exchange 2000 Server and later versions, Outlook knows that these versions of Exchange provide support for the Referral service (DSRefer). Therefore, Outlook uses the referral service on Exchange instead of using DSProxy to obtain the name of a global catalog server. As soon as Outlook has the name of the global catalog server, NSPI calls are made directly with the global catalog server.

For more information, click the following article number to view the article in the Microsoft Knowledge Base: