Autodiscover SCP Issues in Exchange - Fix Guide 2025

CN=<ServerName>,CN=Autodiscover,CN=Protocols,CN=<ServerName>,
   CN=Servers,CN=Exchange Administrative Group (FYDIBOHF23SPDLT),
   CN=Administrative Groups,CN=<Organization>,CN=Microsoft Exchange,
   CN=Services,CN=Configuration,DC=company,DC=com

# Set correct Autodiscover URL (replace with your values)
$serverName = "EXCH01"
$correctUrl = "https://mail.company.com/autodiscover/autodiscover.xml"

# Update the SCP
Set-ClientAccessService -Identity $serverName -AutoDiscoverServiceInternalUri $correctUrl

# Verify the change
Get-ClientAccessService -Identity $serverName | Format-List Name, AutoDiscoverServiceInternalUri

# Force AD replication
repadmin /syncall /AdeP

# Wait 2-3 minutes for replication, then test-3 minutes for replication, then test
Start-Sleep -Seconds 180
Test-OutlookWebServices -Identity "testuser@company.com" -MailboxCredential (Get-Credential)

# Step 1: List all Exchange Autodiscover SCPs
$RootDSE = [ADSI]"LDAP://RootDSE"
$ConfigNC = $RootDSE.configurationNamingContext

Get-ADObject -SearchBase "CN=Microsoft Exchange,CN=Services,CN=Configuration,$ConfigNC" `
    -LDAPFilter "(objectClass=serviceConnectionPoint)" `
    -Properties serviceBindingInformation, whenCreated |
    Select-Object Name, serviceBindingInformation, whenCreated |
    Format-Table -AutoSize

# Step 2: Test each URL to identify dead ones
# Note: Manually verify each URL before deletion

# Step 3: Remove orphaned SCP (replace DN with actual distinguished name)
# BACKUP FIRST: Export-ADObject to CSV
$orphanedSCP = "CN=OLDSERVER,CN=Autodiscover,CN=Protocols,CN=OLDSERVER,CN=Servers,..."
Remove-ADObject -Identity $orphanedSCP -Confirm:$true

# Step 4: Force replication
repadmin /syncall /AdeP

# View current site configuration
Get-ClientAccessService | Format-List Name, AutoDiscoverServiceInternalUri, AutoDiscoverSiteScope

# Scope SCP to specific AD site
Set-ClientAccessService -Identity "EXCH01" `
    -AutoDiscoverSiteScope "HeadquartersSite","DataCenterSite"

# For multi-site with site-specific URLs:-specific URLs:
# Site A server
Set-ClientAccessService -Identity "EXCH-SITEA" `
    -AutoDiscoverServiceInternalUri "https://mail-sitea.company.com/autodiscover/autodiscover.xml" `
    -AutoDiscoverSiteScope "SiteA"

# Site B server
Set-ClientAccessService -Identity "EXCH-SITEB" `
    -AutoDiscoverServiceInternalUri "https://mail-siteb.company.com/autodiscover/autodiscover.xml" `
    -AutoDiscoverSiteScope "SiteB"

# Open ADSI Edit
adsiedit.msc

# Navigate to:
# Configuration > CN=Services > CN=Microsoft Exchange > CN=<Organization> >
# CN=Administrative Groups > CN=Exchange Administrative Group > CN=Servers >
# CN=<ServerName> > CN=Protocols > CN=Autodiscover > CN=<ServerName>

# Modify the 'serviceBindingInformation' attribute:
# Set to: https://mail.company.com/autodiscover/autodiscover.xml

# Alternative: PowerShell direct AD modification
$DN = "CN=EXCH01,CN=Autodiscover,CN=Protocols,CN=EXCH01,CN=Servers,CN=Exchange Administrative Group (FYDIBOHF23SPDLT),CN=Administrative Groups,CN=Company,CN=Microsoft Exchange,CN=Services,CN=Configuration,DC=company,DC=com"

Set-ADObject -Identity $DN -Replace @{serviceBindingInformation="https://mail.company.com/autodiscover/autodiscover.xml"}

# Disable SCP lookup for Outlook (per-user)
# Path varies by Outlook version:
# Outlook 2016/2019/365: HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\AutoDiscover2019/365: HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\AutoDiscover

$regPath = "HKCU:\Software\Microsoft\Office\16.0\Outlook\AutoDiscover"0\Outlook\AutoDiscover"

# Create key if it doesn't exist
if (!(Test-Path $regPath)) {
    New-Item -Path $regPath -Force
}

# Disable SCP lookup (1 = exclude)
Set-ItemProperty -Path $regPath -Name "ExcludeScpLookup" -Value 1 -Type DWord

# Alternative: Enable only specific Autodiscover methods
# ExcludeHttpRedirect = 1 (disable HTTP redirect)
# ExcludeSrvRecord = 1 (disable SRV record lookup)
# ExcludeHttpsAutoDiscoverDomain = 1 (disable https://domain.com/autodiscover)

# Deploy via Group Policy for multiple machines

# 1. Verify SCP configuration
Get-ClientAccessService | Format-List Name, AutoDiscoverServiceInternalUri

# 2. Test Autodiscover from Exchange server
Test-OutlookWebServices -Identity "testuser@company.com" -MailboxCredential (Get-Credential)

# 3. Test from a domain-joined client (run as regular user)-joined client (run as regular user)
# Hold CTRL and right-click Outlook system tray icon
# Select "Test E-mail AutoConfiguration"
# Check "Use AutoDiscover" and enter email/password
# Look for "SCP" in the results

# 4. Check AD replication completed
repadmin /showrepl

# 5. Query SCP from client perspective
$searcher = New-Object DirectoryServices.DirectorySearcher
$searcher.Filter = "(&(objectClass=serviceConnectionPoint)(keywords=*Autodiscover*))"
$searcher.SearchRoot = "LDAP://CN=Configuration,DC=company,DC=com"
$searcher.FindAll() | ForEach-Object { $_.Properties["servicebindinginformation"] }

# Before uninstalling Exchange:
# 1. Move all mailboxes off the server
Get-Mailbox -Server OLDSERVER | New-MoveRequest -TargetDatabase "NewDB"

# 2. Remove server from DAG (if applicable)
Remove-MailboxDatabaseCopy -Identity "DB\OLDSERVER"
Remove-DatabaseAvailabilityGroupServer -Identity DAG01 -MailboxServer OLDSERVER

# 3. Run Exchange uninstall (removes SCP automatically)
# Control Panel > Programs > Microsoft Exchange Server > Uninstall

# 4. Verify SCP removed
Get-ClientAccessService | Where-Object {$_.Name -eq "OLDSERVER"}

# Scheduled task to verify SCP health weekly
$servers = Get-ClientAccessService

foreach ($server in $servers) {
    $url = $server.AutoDiscoverServiceInternalUri

    if ([string]::IsNullOrEmpty($url)) {
        Write-Warning "Server $($server.Name) has no Autodiscover URL configured"
        continue
    }

    try {
        $response = Invoke-WebRequest -Uri $url -Method HEAD -TimeoutSec 10 -UseDefaultCredentials
        if ($response.StatusCode -ne 200) {
            Write-Warning "Server $($server.Name): Autodiscover URL returned $($response.StatusCode)"$response.StatusCode)"
        }
    } catch {
        Write-Error "Server $($server.Name): Cannot reach Autodiscover URL - $($_.Exception.Message)"$_.Exception.Message)"
    }
}