Event ID 1053: MAPI over HTTP Failed - Complete Fix Guide

# Remove existing MAPI virtual directory
Get-MapiVirtualDirectory -Server YOURSERVER | Remove-MapiVirtualDirectory -Confirm:$false

# Create new MAPI virtual directory
New-MapiVirtualDirectory -Server YOURSERVER -WebSiteName "Default Web Site" -InternalUrl "https://mail.domain.com/mapi" -ExternalUrl "https://mail.domain.com/mapi"

# Configure authentication
Get-MapiVirtualDirectory -Server YOURSERVER | Set-MapiVirtualDirectory -IISAuthenticationMethods Ntlm, OAuth, Negotiate -InternalAuthenticationMethods Ntlm, OAuth, Negotiate -ExternalAuthenticationMethods Ntlm, OAuth, Negotiate

# Restart IIS
iisreset /noforce

# Verify in IIS
Import-Module WebAdministration
Get-WebApplication -Site "Default Web Site" -Name "mapi"

# Test the new virtual directory
Test-MAPIConnectivity -Identity user@domain.com | Format-List

# Check MAPI/HTTP status for a specific user
Get-CASMailbox -Identity user@domain.com | Format-List *Mapi*

# Enable MAPI/HTTP for a single user
Set-CASMailbox -Identity user@domain.com -MapiHttpEnabled $true

# Enable MAPI/HTTP for all users in an OU
Get-Mailbox -OrganizationalUnit "OU=Users,DC=domain,DC=com" | ForEach-Object {
    Set-CASMailbox -Identity $_.Identity -MapiHttpEnabled $true
    Write-Host "Enabled MAPI/HTTP for: $($_.DisplayName)"
}

# Enable MAPI/HTTP for all mailboxes (organization-wide)
Get-CASMailbox -ResultSize Unlimited | Where-Object {$_.MapiHttpEnabled -eq $false} |
    ForEach-Object {
        Set-CASMailbox -Identity $_.Identity -MapiHttpEnabled $true
        Write-Host "Enabled: $($_.DisplayName)"
    }

# Verify the setting
Get-CASMailbox -Identity user@domain.com | Format-List MapiHttpEnabled

# Check which mailboxes have MAPI/HTTP disabled
Get-CASMailbox -ResultSize Unlimited | Where-Object {$_.MapiHttpEnabled -eq $false} |
    Select-Object DisplayName, MapiHttpEnabled | Format-Table

# Check current authentication methods
Get-MapiVirtualDirectory | Format-List IISAuthenticationMethods

# Ensure Windows Authentication is enabled in IIS
Import-Module WebAdministration
Set-WebConfigurationProperty -PSPath "IIS:\Sites\Default Web Site\mapi" -Filter "system.webServer/security/authentication/windowsAuthentication" -Name enabled -Value $true

# Disable Anonymous Authentication
Set-WebConfigurationProperty -PSPath "IIS:\Sites\Default Web Site\mapi" -Filter "system.webServer/security/authentication/anonymousAuthentication" -Name enabled -Value $false

# Register HTTP SPN if missing
$hostname = (Get-ExchangeServer).Fqdn
$serviceAccount = "YOURSERVER$"  # Or the service account running Exchange
setspn -S HTTP/$hostname $serviceAccount

# Verify SPNs
setspn -L $serviceAccount | Select-String "HTTP"

# For OAuth (Modern Auth) issues
# Check OAuth certificate
Get-AuthConfig | Format-List CurrentCertificateThumbprint
$cert = Get-ExchangeCertificate -Thumbprint (Get-AuthConfig).CurrentCertificateThumbprint
$cert | Format-List Subject, NotAfter, Services

# If OAuth cert expired, create new one
New-ExchangeCertificate -KeySize 2048 -SubjectName "CN=Microsoft Exchange Server Auth Certificate" -FriendlyName "Microsoft Exchange Server Auth Certificate" -Services SMTP

# Set new OAuth certificate
Set-AuthConfig -NewCertificateThumbprint (Get-ExchangeCertificate | Where-Object {$_.FriendlyName -eq "Microsoft Exchange Server Auth Certificate"}).Thumbprint
Set-AuthConfig -PublishCertificate

# Check MAPI app pool status
Import-Module WebAdministration
$mapiPools = @("MSExchangeMapiMailboxAppPool", "MSExchangeMapiFrontEndAppPool")
foreach ($pool in $mapiPools) {
    $state = Get-WebAppPoolState -Name $pool -ErrorAction SilentlyContinue
    if ($state) {
        Write-Host "$pool : $($state.Value)"$state.Value)"
    } else {
        Write-Host "$pool : NOT FOUND" -ForegroundColor Red
    }
}

# Start stopped pools
$mapiPools | ForEach-Object {
    $state = Get-WebAppPoolState -Name $_ -ErrorAction SilentlyContinue
    if ($state.Value -ne "Started") {
        Start-WebAppPool -Name $_
        Write-Host "Started: $_" -ForegroundColor Green
    }
}

# Reset app pool settings to defaults
$mapiPools | ForEach-Object {
    Set-ItemProperty "IIS:\AppPools\$_" -Name processModel.identityType -Value "ApplicationPoolIdentity"
    Set-ItemProperty "IIS:\AppPools\$_" -Name failure.rapidFailProtection -Value $true
    Set-ItemProperty "IIS:\AppPools\$_" -Name recycling.periodicRestart.time -Value "00:00:00"00:00"
}

# Check for recent crashes
Get-WinEvent -FilterHashtable @{
    LogName = 'System'
    ID = 5011
    StartTime = (Get-Date).AddDays(-7)
} | Where-Object {$_.Message -like "*Mapi*"} | Select-Object TimeCreated, Message | Format-List

# If pool keeps crashing, check .NET issues
& "$env:SystemRoot\Microsoft.NET\Framework64\v4.0.30319\aspnet_regiis.exe"0.30319\aspnet_regiis.exe" -i

# Restart all MAPI pools
$mapiPools | ForEach-Object { Restart-WebAppPool -Name $_ }

# Check if MAPI/HTTP is disabled on client (run on client PC)
$regPath = "HKCU:\Software\Microsoft\Exchange"
$mapiDisabled = Get-ItemProperty -Path $regPath -Name "MapiHttpDisabled" -ErrorAction SilentlyContinue
if ($mapiDisabled.MapiHttpDisabled -eq 1) {
    Write-Host "MAPI/HTTP is DISABLED on this client!" -ForegroundColor Red
    # Enable it
    Set-ItemProperty -Path $regPath -Name "MapiHttpDisabled" -Value 0
    Write-Host "MAPI/HTTP enabled. Restart Outlook."
} else {
    Write-Host "MAPI/HTTP is enabled on client" -ForegroundColor Green
}

# Clear Outlook's cached protocol preference
$outlookPath = "$env:LOCALAPPDATA\Microsoft\Outlook"
Get-ChildItem $outlookPath -Filter "*.xml" | Remove-Item -Force

# Check Outlook version (needs 2013 SP1+ for MAPI/HTTP)
$outlook = Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Office\ClickToRun\Configuration" -ErrorAction SilentlyContinue
if ($outlook) {
    Write-Host "Outlook version: $($outlook.VersionToReport)"
}

# Force Outlook to use MAPI/HTTP
# Create/update registry key
if (-not (Test-Path $regPath)) { New-Item -Path $regPath -Force }
Set-ItemProperty -Path $regPath -Name "MapiHttpDisabled" -Value 0 -Type DWord

# Clear credential manager entries that might cause auth issues
cmdkey /list | ForEach-Object {
    if ($_ -match "Target:\s+(.+)") {
        $target = $Matches[1].Trim()
        if ($target -match "MicrosoftOffice|exchange") {
            cmdkey /delete:$target
        }
    }
}

Write-Host "Restart Outlook to apply changes"