Event ID 1035: Autodiscover Failed - Complete Fix Guide

# View current SCP configuration
Get-ClientAccessService | Format-List Name, AutoDiscoverServiceInternalUri, AutoDiscoverSiteScope

# Set the correct Autodiscover SCP URI
Set-ClientAccessService -Identity "YOURSERVER" -AutoDiscoverServiceInternalUri "https://mail.domain.com/autodiscover/autodiscover.xml"

# Configure site scope (for multi-site environments)
Set-ClientAccessService -Identity "YOURSERVER" -AutoDiscoverSiteScope "Default-First-Site-Name"-Site-Name", "Branch-Site"

# Force AD replication
Invoke-Command -ComputerName DC01 -ScriptBlock {
    repadmin /syncall /APed
}

# Verify SCP is accessible
$filter = "(&(objectClass=serviceConnectionPoint)(keywords=67661d7F-8FC4-4fa7-BFAC-E1D7794C1F68))"-4fa7-BFAC-E1D7794C1F68))"
Get-ADObject -LDAPFilter $filter -SearchBase "CN=Configuration,DC=domain,DC=com" -Properties serviceBindingInformation |
    Select-Object Name, @{N='URL';E={$_.serviceBindingInformation}}

# Option 1: CNAME record (recommended)
# In your DNS zone, create:
# autodiscover.domain.com -> CNAME -> mail.domain.com

# Verify CNAME works
Resolve-DnsName autodiscover.domain.com -Type CNAME

# Option 2: SRV record (for redirect scenarios)
# Create SRV record in DNS:
# _autodiscover._tcp.domain.com -> SRV -> 0 0 443 mail.domain.com0 443 mail.domain.com

# Verify SRV record
Resolve-DnsName _autodiscover._tcp.domain.com -Type SRV

# Option 3: A record (if using dedicated IP)
# autodiscover.domain.com -> A -> 192.168.1.100168.1.100

# Test external resolution
$externalDNS = "8.8.8.8"8.8.8"
Resolve-DnsName -Name autodiscover.domain.com -Server $externalDNS

# Create redirect for HTTP to HTTPS (IIS)
# This handles clients that try HTTP first
New-WebBinding -Name "Default Web Site" -Protocol "http" -Port 80 -HostHeader "autodiscover.domain.com"

# Add URL Rewrite rule to redirect to HTTPS
$site = "IIS:\Sites\Default Web Site"
Set-WebConfigurationProperty -PSPath $site -Filter "system.webServer/httpRedirect" -Name "enabled" -Value "false"  # Use URL Rewrite instead for autodiscover

# Generate a certificate request with Autodiscover name
$certRequest = New-ExchangeCertificate -GenerateRequest -SubjectName "CN=mail.domain.com" -DomainName mail.domain.com, autodiscover.domain.com, owa.domain.com, domain.com -PrivateKeyExportable $true

# Save request to file for CA submission
Set-Content -Path "C:\CertRequest.txt" -Value $certRequest

# After receiving certificate from CA, import it
Import-ExchangeCertificate -FileData ([System.IO.File]::ReadAllBytes("C:\NewCert.cer"))

# Get the thumbprint of new certificate
$newCert = Get-ExchangeCertificate | Where-Object {$_.Subject -eq "CN=mail.domain.com"} |
    Sort-Object NotAfter -Descending | Select-Object -First 1

# Enable the certificate for Exchange services
Enable-ExchangeCertificate -Thumbprint $newCert.Thumbprint -Services IIS, SMTP, POP, IMAP

# Verify services are assigned
Get-ExchangeCertificate -Thumbprint $newCert.Thumbprint | Format-List Services, CertificateDomains

# Restart IIS to apply
iisreset /noforce

# Remove existing Autodiscover virtual directory
Get-AutodiscoverVirtualDirectory -Server YOURSERVER | Remove-AutodiscoverVirtualDirectory -Confirm:$false

# Create new Autodiscover virtual directory
New-AutodiscoverVirtualDirectory -WebSiteName "Default Web Site" -Server YOURSERVER

# Configure the URLs
Get-AutodiscoverVirtualDirectory -Server YOURSERVER | Set-AutodiscoverVirtualDirectory -InternalUrl "https://mail.domain.com/autodiscover/autodiscover.xml" -ExternalUrl "https://mail.domain.com/autodiscover/autodiscover.xml"

# Set authentication methods
Get-AutodiscoverVirtualDirectory -Server YOURSERVER | Set-AutodiscoverVirtualDirectory -InternalAuthenticationMethods Ntlm, Basic, Negotiate -ExternalAuthenticationMethods Ntlm, Basic, Negotiate -WindowsAuthentication $true -BasicAuthentication $true

# Restart IIS
Restart-Service W3SVC, WAS -Force

# Verify virtual directory is functional
$uri = "https://mail.domain.com/autodiscover/autodiscover.xml"
$response = Invoke-WebRequest -Uri $uri -Method GET -UseDefaultCredentials
$response.StatusCode

# Configure different internal/external URLs
Set-AutodiscoverVirtualDirectory -Identity "YOURSERVER\autodiscover (Default Web Site)" -InternalUrl "https://mail.domain.local/autodiscover/autodiscover.xml" -ExternalUrl "https://mail.domain.com/autodiscover/autodiscover.xml"

# Create internal DNS zone for domain.com (split DNS)
# On internal DNS server:
Add-DnsServerPrimaryZone -Name "domain.com" -ZoneFile "domain.com.dns"

# Add internal A record for mail
Add-DnsServerResourceRecordA -ZoneName "domain.com" -Name "mail" -IPv4Address "192.168.1.100"168.1.100"
Add-DnsServerResourceRecordA -ZoneName "domain.com" -Name "autodiscover" -IPv4Address "192.168.1.100"168.1.100"

# Or use CNAME
Add-DnsServerResourceRecordCName -ZoneName "domain.com" -Name "autodiscover" -HostNameAlias "mail.domain.com"

# Test internal resolution
Resolve-DnsName autodiscover.domain.com -Server DC01.domain.local

# Test external resolution
Resolve-DnsName autodiscover.domain.com -Server 8.8.8.8