Autodiscover Errors 0x800C820F & 0x80070057 - Fix Guide 2025

<Error>
  <Time>2025-01-15T10:23:45.123Z</Time>
  <ErrorCode>0x800C820F</ErrorCode>
  <ErrorMessage>The Autodiscover service could not be contacted.</ErrorMessage>
  <AttemptedUrl>https://autodiscover.company.com/autodiscover/autodiscover.xml</AttemptedUrl>
</Error>

# Set correct internal Autodiscover URL
Set-ClientAccessService -Identity "EXCH01" -AutoDiscoverServiceInternalUri "https://mail.company.com/autodiscover/autodiscover.xml"

# Verify the change
Get-ClientAccessService | Format-List Name,AutoDiscoverServiceInternalUri

# Force Active Directory replication
repadmin /syncall /AdeP

# Option 1: CNAME Record (Recommended)
# In DNS Manager, create CNAME:
# autodiscover.company.com -> mail.company.com

# Option 2: A Record
# autodiscover.company.com -> 192.168.1.10 (Exchange IP)168.1.10 (Exchange IP)

# Option 3: SRV Record (for multiple domains)
# _autodiscover._tcp.company.com
# Priority: 0, Weight: 0, Port: 4430, Port: 443
# Target: mail.company.com

# Verify DNS propagation
nslookup autodiscover.company.com
Resolve-DnsName autodiscover.company.com

# Create certificate request including autodiscover
$domains = @(
    "mail.company.com",
    "autodiscover.company.com",
    "owa.company.com"
)

$request = New-ExchangeCertificate -GenerateRequest -SubjectName "CN=mail.company.com" `
  -DomainName $domains -PrivateKeyExportable $true

# Save request to file
$request | Out-File "C:\CertRequests\exchange_cert_request.txt"

# After receiving certificate from CA:
Import-ExchangeCertificate -FileName "C:\Certs\new_certificate.pfx" -Password (ConvertTo-SecureString -String "password" -AsPlainText -Force)

# Enable certificate for IIS
Enable-ExchangeCertificate -Thumbprint "THUMBPRINT" -Services IIS

# Remove existing virtual directory
Remove-AutodiscoverVirtualDirectory -Identity "EXCH01\Autodiscover (Default Web Site)"

# Recreate with correct settings
New-AutodiscoverVirtualDirectory -WebSiteName "Default Web Site" -InternalUrl "https://mail.company.com/autodiscover/autodiscover.xml" -ExternalUrl "https://mail.company.com/autodiscover/autodiscover.xml"

# Reset IIS
iisreset

# Verify configuration
Get-AutodiscoverVirtualDirectory | Format-List

# Check current authentication settings
Get-AutodiscoverVirtualDirectory | Format-List *Auth*

# Enable correct authentication methods
Set-AutodiscoverVirtualDirectory -Identity "EXCH01\Autodiscover (Default Web Site)" `
  -InternalAuthenticationMethods Ntlm,Negotiate `
  -ExternalAuthenticationMethods Ntlm,Negotiate,Basic

# If using modern auth (OAuth)
Set-AutodiscoverVirtualDirectory -Identity "EXCH01\Autodiscover (Default Web Site)" `
  -OAuthAuthentication $true

# Restart IIS
iisreset /restart

# Close Outlook completely
taskkill /IM outlook.exe /F

# Clear Autodiscover cache (run as user)
Remove-Item "$env:LOCALAPPDATA\Microsoft\Outlook\*.xml" -Force

# Clear credential cache
cmdkey /list | ForEach-Object {
    if ($_ -like "*target=MicrosoftOffice*") {
        $target = $_.Split(":")[1].Trim()
        cmdkey /delete:$target
    }
}

# Create new Outlook profile
# Control Panel -> Mail -> Show Profiles -> Add

# 1. Test Autodiscover from Exchange server
Test-OutlookWebServices -Identity "testuser@company.com" -MailboxCredential (Get-Credential)

# 2. Test Autodiscover XML response
$cred = Get-Credential
$uri = "https://autodiscover.company.com/autodiscover/autodiscover.xml"
Invoke-WebRequest -Uri $uri -Credential $cred -Method POST -ContentType "text/xml" `
  -Body '<?xml version="1.0" encoding="utf-8"?><Autodiscover xmlns="http://schemas.microsoft.com/exchange/autodiscover/outlook/requestschema/2006"><Request><EMailAddress>user@company.com</EMailAddress><AcceptableResponseSchema>http://schemas.microsoft.com/exchange/autodiscover/outlook/responseschema/2006a</AcceptableResponseSchema></Request></Autodiscover>'0" encoding="utf-8"?><Autodiscover xmlns="http://schemas.microsoft.com/exchange/autodiscover/outlook/requestschema/2006"><Request><EMailAddress>user@company.com</EMailAddress><AcceptableResponseSchema>http://schemas.microsoft.com/exchange/autodiscover/outlook/responseschema/2006a</AcceptableResponseSchema></Request></Autodiscover>'

# 3. Verify DNS resolution from client
Resolve-DnsName autodiscover.company.com

# 4. Test certificate validity
Test-NetConnection -ComputerName autodiscover.company.com -Port 443

# Check certificate expiry
Get-ExchangeCertificate | Where-Object {$_.NotAfter -lt (Get-Date).AddDays(60)} |
  Format-List Subject,NotAfter,CertificateDomains

# Set up email alert for expiring certificates
$expiringCerts = Get-ExchangeCertificate | Where-Object {$_.NotAfter -lt (Get-Date).AddDays(30)}
if ($expiringCerts) {
    Send-MailMessage -To "admin@company.com" -From "monitoring@company.com" `
      -Subject "Exchange Certificate Expiring Soon" -SmtpServer "mail.company.com" `
      -Body "Certificates expiring: $($expiringCerts.Subject -join ', ')"-join ', ')"
}

# Create scheduled task to test Autodiscover daily
$testScript = {
    $result = Test-OutlookWebServices -Identity "monitoring@company.com" -WarningAction SilentlyContinue
    if ($result.Result -ne "Success") {
        Send-MailMessage -To "admin@company.com" -Subject "Autodiscover Test Failed" `
          -Body ($result | Out-String) -SmtpServer "mail.company.com"
    }
}

# Or use Microsoft Remote Connectivity Analyzer API for external testing