When you test access in the Microsoft Dynamics CRM E-mail Router, you receive a "(401) Unauthorized" error

Resolution 1

Verify that the account that is specified on the Incoming Profile has Full access to users' mailboxes. Also verify that the Local System account is starting the Microsoft CRM Email Router Service.

To verify the account that is starting the Microsoft CRM Email Router, follow these steps on the server where the E-mail Router is installed:

1. Click Start, click Run, type Services.msc, and then clickOK.

2. Locate the Microsoft CRM Email Router service, note the account that is listed in theLog on As column, and then verify that it is set to LocalSystem.

To verify the account that is specified for the Incoming Profile access, follow these steps on the computer that has the Microsoft CRM Email Router installed:

1. Click Start, click All programs, click Microsoft Dynamics CRM E-mail Router, and then click Microsoft CRM Email Router Configuration Manager.
   
2. Click the Configuration Profiles tab, double-click Incoming Profile, and then note the account that is specified in theAccess Credentials field.  Verify that this account has full access to the user's mailbox.

a. If you are using the Forward Mailbox option for all your users and queues, we recommend that you use theforward mailbox credentials in this field.

b. If you are using the Router option for your users and queues, you must make sure that the account that is specified in theAccess Credentials field has full access to all those users' inboxes.

For more information about adding additional permissions on users' inboxes, see the following articles:

http://technet.microsoft.com/en-us/library/aa996343.aspx 
http://technet.microsoft.com/en-us/library/aa998707(EXCHG.65).aspx 

Resolution 2

 
If you use http://mail.domain.com to access Outlook Web Access, but your Microsoft Exchange Server name is Exchange01, you must add more SPNs on the account that is running the Application Pool for your Exchange website.

To determine the account that is starting the Exchange Application Pool, follow these steps:

1. Log on to the Microsoft Exchange Server.

2. Click Start, click Run, type Inetmgr, and then clickOK.

3. Expand your server in IIS, and then click Application Pools.

4. The account that is running the Exchange Application Pool is listed in the preview pane.

To the account that you identified in step 4, add the following SPNs:

HTTP/Mail
HTTP/Mail.yourdomainname.com

Note You must change these SPNs to match the alias URL that your users use to access Outlook Web Access.

For more information about adding SPNs, visit the following Microsoft websites:

http://technet.microsoft.com/en-us/library/ms191153.aspx

http://blogs.msdn.com/crm/archive/2009/08/06/configuring-service-principal-names.aspx

 Resolution 3

Note This resolution only applies to Microsoft Dynamics CRM 4.0.

Verify that you have a minimum of Update Rollup 3 for Microsoft Dynamics CRM 4.0 installed for the Microsoft Dynamics CRM Server and for the Microsoft Dynamics CRM E-mail Router. The latest update rollup is highly recommended. 

For more information and to download the latest update rollup for Microsoft Dynamics CRM, click the following article number to view the article in the Microsoft Knowledge Base:

949256 Microsoft Dynamics CRM 4.0 updates and hotfixes 

Resolution 4

Check the following authentication on the /Exchange and /Exadmin virtual directories:

• Verify that Basic Authentication and Windows Authentication are enabled on the /Exadmin virtual directory.
• Verify that Basic Authentication is enabled on the /Exchange virtual directory.

To check authentication on the virtual directories, follow these steps on the Microsoft Exchange Server as appropriate for the operating system that you are running:

On Windows Server 2008:

1. Click Start, click Run, type Inetmgr, and then clickOK.
2. Expand the Server name, expand Sites, and then expand the Exchange Website.
3. Click the /Exadmin virtual directory, open Authentication in the Preview pane and verify thatBasic Authentication and Windows Authentication are enabled.
4. Click the /Exchange virtual directory, open Authentication in the Preview pane, and verify thatBasic Authentication is enabled.

On Windows Server 2003:

1. Click Start, click Run, type Inetmgr, and then clickOK.

2. Expand the Server name, expand Sites, and then expand the Exchange Website.

3. Right-click the /Exadmin virtual directory, and then click Properties.

4. Click the Directory Security tab, click Edit under the Authentication and access control, and then verify thatBasic Authentication and Windows Authentication are enabled.

5. Right-click the /Exchange virtual directory, and then click Properties.

6. Click the Directory Security tab, click Edit under the Authentication and access control, and then verify thatBasic Authentication and Windows Authentication are enabled.

Resolution 5

Add the URL for Outlook Web Access to the Local Intranet Zone, and verify thatAutomatic Logon is enabled on the server on which the Microsoft Dynamics CRM E-mail Router is installed. To do this, follow these steps:

1. Log on to the computer on which the CRM E-mail Router is installed using the account specified in the Incoming Profile.
   
2. Open Internet Explorer.
   
3. Click Tools, and then click Internet Options.
   
4. Click the Security tab, click Local Intranet, and then clickSites.
   
5. Click Advanced, add the URL you use to access Outlook Web Access, and then add the URL for the Exchange Server.
   
6. Click Close, and then click OK.
   
7. Make sure that Local Intranet is selected, clickCustom Level, and then click Automatically logon only in Intranet zone.
   
8. Click OK two times, and then click Apply.
   
9. Close all Internet Explorer sessions.

Note: Internet Explorer can be ran under the context of a specific user account while logged onto Windows as a different user account. This can be accomplished bypressing shift and then right-clicking on the Internet Explorer executable, which will display the option to run Internet Explorer as a different user. If Internet Explorer is ran under the context of the incoming profile account on the computer where the e-mail router is installed, this can be used to bypass steps 1 and 2 above.