Event ID 2007: ActiveSync Failure - Complete Fix Guide

# Check current ActiveSync virtual directory settings
Get-ActiveSyncVirtualDirectory | Format-List Server, Name, InternalUrl, ExternalUrl,
    BasicAuthEnabled, WindowsAuthEnabled, InternalAuthenticationMethods,
    ExternalAuthenticationMethods

# Set correct URLs
Get-ActiveSyncVirtualDirectory | Set-ActiveSyncVirtualDirectory -InternalUrl "https://mail.domain.com/Microsoft-Server-ActiveSync"-ActiveSync" -ExternalUrl "https://mail.domain.com/Microsoft-Server-ActiveSync"-ActiveSync"

# Enable appropriate authentication
Get-ActiveSyncVirtualDirectory | Set-ActiveSyncVirtualDirectory -BasicAuthEnabled $true -WindowsAuthEnabled $false -InternalAuthenticationMethods Basic -ExternalAuthenticationMethods Basic

# If using certificate-based auth
# Set-ActiveSyncVirtualDirectory -ClientCertAuth Accepted-ClientCertAuth Accepted

# Restart IIS
iisreset /noforce

# Verify settings
Get-ActiveSyncVirtualDirectory | Format-List InternalUrl, ExternalUrl, *Auth*

# View current default policy
Get-MobileDeviceMailboxPolicy -Identity "Default" | Format-List

# Create a permissive policy for testing
New-MobileDeviceMailboxPolicy -Name "Testing-AllowAll" -AllowNonProvisionableDevices $true -DevicePasswordEnabled $false -AlphanumericDevicePasswordRequired $false

# Apply policy to specific user for testing
Set-CASMailbox -Identity user@domain.com -ActiveSyncMailboxPolicy "Testing-AllowAll"

# Check organization-wide default access level
Get-ActiveSyncOrganizationSettings | Format-List DefaultAccessLevel

# Set default to allow (for troubleshooting)
Set-ActiveSyncOrganizationSettings -DefaultAccessLevel Allow

# Create device access rule to allow specific device types
New-ActiveSyncDeviceAccessRule -QueryString "iOS" -Characteristic DeviceOS -AccessLevel Allow
New-ActiveSyncDeviceAccessRule -QueryString "Android" -Characteristic DeviceOS -AccessLevel Allow

# Remove quarantine for all devices
Get-MobileDevice -ResultSize Unlimited | Where-Object {$_.DeviceAccessState -eq "Quarantined"} |
    ForEach-Object {
        $user = $_.UserDisplayName
        Set-CASMailbox -Identity $user -ActiveSyncAllowedDeviceIDs @{Add=$_.DeviceId}
        Write-Host "Allowed device for: $user"
    }

# Check if account is locked out
Get-ADUser -Identity "username" -Properties LockedOut, BadLogonCount, LastBadPasswordAttempt |
    Format-List Name, LockedOut, BadLogonCount, LastBadPasswordAttempt

# Unlock account if locked
Unlock-ADAccount -Identity "username"
Write-Host "Account unlocked"

# Reset bad password count
Set-ADUser -Identity "username" -Replace @{badPwdCount=0}

# Check password expiry
$user = Get-ADUser -Identity "username" -Properties PasswordLastSet, PasswordExpired
$maxAge = (Get-ADDefaultDomainPasswordPolicy).MaxPasswordAge
$expires = $user.PasswordLastSet + $maxAge
Write-Host "Password expires: $expires"
Write-Host "Password expired: $($user.PasswordExpired)"

# Force password change if needed
Set-ADUser -Identity "username" -ChangePasswordAtLogon $true

# Check for modern auth support (Exchange 2019)
Get-AuthConfig | Format-List ServiceName, CurrentCertificateThumbprint
Get-OrganizationConfig | Format-List OAuth2ClientProfileEnabled

# Enable OAuth for ActiveSync (Exchange 2019 CU1+)
Set-ActiveSyncVirtualDirectory -Identity "YOURSERVER\Microsoft-Server-ActiveSync (Default Web Site)"-ActiveSync (Default Web Site)" -InternalAuthenticationMethods OAuth,Basic -ExternalAuthenticationMethods OAuth,Basic

# Check ActiveSync app pool status
Import-Module WebAdministration
Get-WebAppPoolState -Name "MSExchangeSyncAppPool"

# Start pool if stopped
Start-WebAppPool -Name "MSExchangeSyncAppPool"

# Recycle the app pool
Restart-WebAppPool -Name "MSExchangeSyncAppPool"

# Check IIS ActiveSync configuration
Get-WebApplication -Site "Default Web Site" -Name "Microsoft-Server-ActiveSync"-ActiveSync"

# Verify handler mappings
$easPath = "IIS:\Sites\Default Web Site\Microsoft-Server-ActiveSync"-ActiveSync"
Get-WebHandler -PSPath $easPath | Format-Table Name, Path, Verb

# Check authentication settings in IIS
Get-WebConfigurationProperty -PSPath $easPath -Filter "system.webServer/security/authentication/basicAuthentication" -Name enabled
Get-WebConfigurationProperty -PSPath $easPath -Filter "system.webServer/security/authentication/windowsAuthentication" -Name enabled
Get-WebConfigurationProperty -PSPath $easPath -Filter "system.webServer/security/authentication/anonymousAuthentication" -Name enabled

# Enable Basic auth if needed
Set-WebConfigurationProperty -PSPath $easPath -Filter "system.webServer/security/authentication/basicAuthentication" -Name enabled -Value $true

# Reset IIS
iisreset /noforce