When you test access in the Microsoft Dynamics CRM E-mail Router, you receive a "(401) Unauthorized" error

Article translations Article translations
Article ID: 2003033 - View products that this article applies to.
Expand all | Collapse all

Symptoms

When you click Test Access in the E-mail Router Configuration Tool for Microsoft Dynamics CRM, you receive the following error for incoming email messages:

“Incoming Status: Failure - The remote Microsoft Exchange e-mail server returned the error "(401) Unauthorized". Verify that you have permission to connect to the mailbox. The remote server returned an error: (401) Unauthorized.”

Cause

One or more of the following conditions may cause this issue:

  • The account that is specified on the Incoming Profile does not have Full access to users' mailboxes.
  • There are missing Service Principal Names (SPNs) when an alias is used for Microsoft Office Outlook Web Access.
  • The latest update rollup for Microsoft Dynamics CRM is not applied.
  • Authentication on the Exadmin and Exchange virtual directories is incorrect.
  • The Outlook Web Access URL is missing from the Local Intranet Zone in Windows Internet Explorer on the server where the E-mail Router is installed.

Resolution

Resolution 1


Verify that the account that is specified on the Incoming Profile has Full access to users' mailboxes. Also verify that the Local System account is starting the Microsoft CRM Email Router Service.

To verify the account that is starting the Microsoft CRM Email Router, follow these steps on the server where the E-mail Router is installed:

  1. Click Start, click Run, type Services.msc, and then click OK.

  2. Locate the Microsoft CRM Email Router service, note the account that is listed in the Log on As column, and then verify that it is set to LocalSystem.

To verify the account that is specified for the Incoming Profile access, follow these steps on the computer that has the Microsoft CRM Email Router installed:

  1. Click Start, click All programs, click Microsoft Dynamics CRM E-mail Router, and then click Microsoft CRM Email Router Configuration Manager.
  2. Click the Configuration Profiles tab, double-click Incoming Profile, and then note the account that is specified in the Access Credentials field.  Verify that this account has full access to the user's mailbox.

a. If you are using the Forward Mailbox option for all your users and queues, we recommend that you use the forward mailbox credentials in this field.

b. If you are using the Router option for your users and queues, you must make sure that the account that is specified in the Access Credentials field has full access to all those users' inboxes.

For more information about adding additional permissions on users' inboxes, see the following articles:

http://technet.microsoft.com/en-us/library/aa996343.aspx 
http://technet.microsoft.com/en-us/library/aa998707(EXCHG.65).aspx 

Resolution 2

 
If you use http://mail.domain.com to access Outlook Web Access, but your Microsoft Exchange Server name is Exchange01, you must add more SPNs on the account that is running the Application Pool for your Exchange website.


To determine the account that is starting the Exchange Application Pool, follow these steps:

  1. Log on to the Microsoft Exchange Server.

  2. Click Start, click Run, type Inetmgr, and then click OK.

  3. Expand your server in IIS, and then click Application Pools.

  4. The account that is running the Exchange Application Pool is listed in the preview pane.

To the account that you identified in step 4, add the following SPNs:

HTTP/Mail
HTTP/Mail.yourdomainname.com

Note You must change these SPNs to match the alias URL that your users use to access Outlook Web Access.


For more information about adding SPNs, visit the following Microsoft websites:


http://technet.microsoft.com/en-us/library/ms191153.aspx

http://blogs.msdn.com/crm/archive/2009/08/06/configuring-service-principal-names.aspx

 Resolution 3

Note This resolution only applies to Microsoft Dynamics CRM 4.0.

Verify that you have a minimum of Update Rollup 3 for Microsoft Dynamics CRM 4.0 installed for the Microsoft Dynamics CRM Server and for the Microsoft Dynamics CRM E-mail Router. The latest update rollup is highly recommended. 

For more information and to download the latest update rollup for Microsoft Dynamics CRM, click the following article number to view the article in the Microsoft Knowledge Base:

949256 Microsoft Dynamics CRM 4.0 updates and hotfixes 

Resolution 4

Check the following authentication on the /Exchange and /Exadmin virtual directories:

  • Verify that Basic Authentication and Windows Authentication are enabled on the /Exadmin virtual directory.
  • Verify that Basic Authentication is enabled on the /Exchange virtual directory.

To check authentication on the virtual directories, follow these steps on the Microsoft Exchange Server as appropriate for the operating system that you are running:

On Windows Server 2008:

  1. Click Start, click Run, type Inetmgr, and then click OK.
  2. Expand the Server name, expand Sites, and then expand the Exchange Website.
  3. Click the /Exadmin virtual directory, open Authentication in the Preview pane and verify that Basic Authentication and Windows Authentication are enabled.
  4. Click the /Exchange virtual directory, open Authentication in the Preview pane, and verify that Basic Authentication is enabled.


On Windows Server 2003:

  1. Click Start, click Run, type Inetmgr, and then click OK.

  2. Expand the Server name, expand Sites, and then expand the Exchange Website.

  3. Right-click the /Exadmin virtual directory, and then click Properties.

  4. Click the Directory Security tab, click Edit under the Authentication and access control, and then verify that Basic Authentication and Windows Authentication are enabled.

  5. Right-click the /Exchange virtual directory, and then click Properties.

  6. Click the Directory Security tab, click Edit under the Authentication and access control, and then verify that Basic Authentication and Windows Authentication are enabled.

Resolution 5

Add the URL for Outlook Web Access to the Local Intranet Zone, and verify that Automatic Logon is enabled on the server on which the Microsoft Dynamics CRM E-mail Router is installed. To do this, follow these steps:

  1. Log on to the computer on which the CRM E-mail Router is installed using the account specified in the Incoming Profile.
  2. Open Internet Explorer.
  3. Click Tools, and then click Internet Options.
  4. Click the Security tab, click Local Intranet, and then click Sites.
  5. Click Advanced, add the URL you use to access Outlook Web Access, and then add the URL for the Exchange Server.
  6. Click Close, and then click OK.
  7. Make sure that Local Intranet is selected, click Custom Level, and then click Automatically logon only in Intranet zone.
  8. Click OK two times, and then click Apply.
  9. Close all Internet Explorer sessions.

Note: Internet Explorer can be ran under the context of a specific user account while logged onto Windows as a different user account. This can be accomplished by pressing shift and then right-clicking on the Internet Explorer executable, which will display the option to run Internet Explorer as a different user. If Internet Explorer is ran under the context of the incoming profile account on the computer where the e-mail router is installed, this can be used to bypass steps 1 and 2 above.

Note This is a "FAST PUBLISH" article created directly from within the Microsoft support organization. The information contained herein is provided as-is in response to emerging issues. As a result of the speed in making it available, the materials may include typographical errors and may be revised at any time without notice. See Terms of Use for other considerations.

Properties

Article ID: 2003033 - Last Review: June 21, 2014 - Revision: 6.0
Applies to
  • Microsoft Dynamics CRM 2011
  • Microsoft Dynamics CRM 4.0
  • Microsoft Dynamics CRM Online Professional Edition
  • Microsoft Dynamics CRM Online Professional Plus
  • Microsoft Dynamics CRM E-mail Router
Keywords: 
kbmbsmigrate KB2003033

Give Feedback

 

Contact us for more help

Contact us for more help
Connect with Answer Desk for expert help.
Get more support from smallbusiness.support.microsoft.com