Error 0x80040115: Connection to Exchange Server Failed - Complete Fix Guide

# Check which DNS servers are being used
Get-DnsClientServerAddress -AddressFamily IPv4 | Format-Table InterfaceAlias, ServerAddresses

# Test resolution with specific DNS servers
$dnsServers = @("DC01.domain.local", "DC02.domain.local", "8.8.8.8"8.8.8")
$hostnames = @("mail.domain.com", "autodiscover.domain.com")

foreach ($dns in $dnsServers) {
    Write-Host "`nDNS Server: $dns" -ForegroundColor Cyan
    foreach ($host in $hostnames) {
        try {
            $result = Resolve-DnsName $host -Server $dns -ErrorAction Stop
            Write-Host "  $host -> $($result.IPAddress)"$result.IPAddress)" -ForegroundColor Green
        } catch {
            Write-Host "  $host -> FAILED" -ForegroundColor Red
        }
    }
}

# Check for DNS record issues
Resolve-DnsName mail.domain.com -Type A
Resolve-DnsName mail.domain.com -Type CNAME
Resolve-DnsName autodiscover.domain.com -Type A

# Set correct DNS servers
Set-DnsClientServerAddress -InterfaceAlias "Ethernet" -ServerAddresses ("192.168.1.10"168.1.10", "192.168.1.11"168.1.11")

# For split DNS issues - ensure internal DNS has correct records
# On your DNS server, verify these records exist:
# - mail.domain.com -> A record -> Exchange server IP
# - autodiscover.domain.com -> A record -> Exchange server IP

# Add Windows Firewall rule for Outlook (run as admin)
# Check common Office installation paths
$outlookPath = "C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE"
$outlookPathx86 = "C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE"
$outlookPaths = @($outlookPath, $outlookPathx86)

foreach ($path in $outlookPaths) {
    if (Test-Path $path) {
        New-NetFirewallRule -DisplayName "Microsoft Outlook (Allow)" -Direction Outbound -Program $path -Action Allow -Profile Any
        Write-Host "Firewall rule added for: $path" -ForegroundColor Green
    }
}

# Allow outbound HTTPS
New-NetFirewallRule -DisplayName "HTTPS Outbound (Exchange)" -Direction Outbound -LocalPort 443 -Protocol TCP -Action Allow

# Allow outbound to specific Exchange server
New-NetFirewallRule -DisplayName "Exchange Server" -Direction Outbound -RemoteAddress "192.168.1.100"168.1.100" -Action Allow

# Check existing rules
Get-NetFirewallRule | Where-Object {$_.DisplayName -match "Outlook|Exchange"} |
    Select-Object DisplayName, Direction, Action, Enabled | Format-Table

# For corporate firewalls (network team configuration):
# Ensure these URLs are allowed through the firewall:
# - mail.domain.com:443 (HTTPS)
# - autodiscover.domain.com:443 (HTTPS)
# - Specific EWS/ActiveSync/OWA URLs as needed

# Check current proxy settings
$regPath = "HKCU:\Software\Microsoft\Windows\CurrentVersion\Internet Settings"
$settings = Get-ItemProperty -Path $regPath
Write-Host "Proxy Enabled: $($settings.ProxyEnable)"
Write-Host "Proxy Server: $($settings.ProxyServer)"
Write-Host "Proxy Bypass: $($settings.ProxyOverride)"

# Add Exchange URLs to proxy bypass list
$currentBypass = (Get-ItemProperty -Path $regPath).ProxyOverride
$exchangeUrls = "mail.domain.com;autodiscover.domain.com"

if ($currentBypass) {
    $newBypass = "$currentBypass;$exchangeUrls"$exchangeUrls"
} else {
    $newBypass = $exchangeUrls
}

Set-ItemProperty -Path $regPath -Name "ProxyOverride" -Value $newBypass
Write-Host "Added Exchange URLs to proxy bypass list"

# For PAC file environments - ensure the PAC file returns DIRECT for Exchange
# Example PAC file entry:
# if (shExpMatch(host, "*.domain.com")) { return "DIRECT"; }"DIRECT"; }

# Clear proxy for testing
# Set-ItemProperty -Path $regPath -Name "ProxyEnable" -Value 0-Path $regPath -Name "ProxyEnable" -Value 0

# Configure Outlook-specific proxy settings (if needed)
# Registry: HKCU\Software\Microsoft\Office\16.0\Outlook\HTTP0\Outlook\HTTP
New-Item -Path "HKCU:\Software\Microsoft\Office\16.0\Outlook\HTTP"0\Outlook\HTTP" -Force
Set-ItemProperty -Path "HKCU:\Software\Microsoft\Office\16.0\Outlook\HTTP"0\Outlook\HTTP" -Name "UseHttpsProxy" -Value 0 -Type DWord

# Download and inspect the certificate
$url = "https://mail.domain.com"
$request = [System.Net.HttpWebRequest]::Create($url)
try {
    $request.GetResponse() | Out-Null
} catch { }
$cert = $request.ServicePoint.Certificate
$certBytes = $cert.Export([System.Security.Cryptography.X509Certificates.X509ContentType]::Cert)

# Save certificate for inspection
$certPath = "$env:TEMP\exchange_cert.cer"
[System.IO.File]::WriteAllBytes($certPath, $certBytes)
Write-Host "Certificate saved to: $certPath"

# Check if certificate is trusted
$cert2 = New-Object System.Security.Cryptography.X509Certificates.X509Certificate2($certPath)
$chain = New-Object System.Security.Cryptography.X509Certificates.X509Chain
$chain.ChainPolicy.RevocationMode = [System.Security.Cryptography.X509Certificates.X509RevocationMode]::NoCheck
$result = $chain.Build($cert2)

if ($result) {
    Write-Host "Certificate chain is VALID" -ForegroundColor Green
} else {
    Write-Host "Certificate chain INVALID" -ForegroundColor Red
    $chain.ChainStatus | ForEach-Object {
        Write-Host "  Status: $($_.Status) - $($_.StatusInformation)"$_.StatusInformation)" -ForegroundColor Yellow
    }
}

# Import root CA certificate if needed (run as admin)
# Import-Certificate -FilePath "C:\Certs\RootCA.cer" -CertStoreLocation Cert:LocalMachineRoot-FilePath "C:\Certs\RootCA.cer" -CertStoreLocation Cert:LocalMachineRoot

# Update certificate trust list
certutil -syncWithWU

# Check if VPN is connected
Get-VpnConnection | Format-Table Name, ConnectionStatus, ServerAddress

# Check routing when VPN is connected
Get-NetRoute -DestinationPrefix "192.168.1.0/24"168.1.0/24"  # Replace with your Exchange subnet

# Test connectivity through VPN
$exchangeIP = (Resolve-DnsName mail.domain.com).IPAddress
Test-NetConnection -ComputerName $exchangeIP -Port 443

# Check if split tunneling is causing issues
# If Exchange IP isn't routed through VPN, you need to add a route
# Route add for VPN (requires admin and VPN connected):
# route add 192.168.1.100 mask 255.255.255.255 <VPN_Gateway_IP>168.1.100 mask 255.255.255.255 <VPN_Gateway_IP>

# For always-on VPN or DirectAccess, check these:
Get-DAClientExperienceConfiguration
Get-DAConnectionStatus

# If VPN disconnects Outlook, check MTU settings
# Sometimes VPN has smaller MTU causing fragmentation issues
netsh interface ipv4 show interfaces
# If needed: netsh interface ipv4 set subinterface "VPN Interface" mtu=14001400

# Check VPN DNS settings
Get-DnsClient | Format-Table InterfaceAlias, ConnectionSpecificSuffix