Microsoft KB Archive Search

Notice: This website is an unofficial Microsoft Knowledge Base (hereinafter KB) archive and is intended to provide a reliable access to deleted content from Microsoft KB. All KB articles are owned by Microsoft Corporation. Read full disclaimer for more details.

  1. Home
  2. Autodiscover does not work when FIPS is enabled in Exchange Server 2007

Autodiscover does not work when FIPS is enabled in Exchange Server 2007

View products that this article applies to.

Symptoms

Assume that the Windows policy setting System cryptography: Use FIPS compliant algorithms for encryption, hashing, and signing is enabled in Microsoft Exchange Server 2007. Users cannot connect to the Autodiscover service. When you try open the Autodiscover.xml file (https://hostname/autodiscover/autodiscover.xml�) in a web browser, you receive the following error message:

This implementation is not part of the Windows Platform FIPS validated cryptographic algorithms.

Note Federal Information Processing Standards (FIPS) is required by many federal agencies as an extra security layer, and it is supposed to work with Exchange Server 2007 Service Pack 3.

↑ Back to the top

Cause

This is a known issue in Exchange Server 2007.

By default, the web.config value for the Autodiscover application pool contains the following entry.����

Note The web.config file for Autodiscover is located by default in "C:\Program Files\Microsoft\Exchange Server\Client Access\AutoDicover."

<system.web>
   <compilation defaultLanguage="c#" debug="true">
</system.web>
When this value is set to�true, the Autodiscover service uses the MD5 algorithm, which is not FIPS compliant. This causes Autodiscover requests to fail. �

↑ Back to the top

Workaround

To work around this issue, use one of the following methods.

Note�Any of these changes will require you to recycle the Autodiscover application pool.

Method 1

Remove the "<compilation defaultLanguage="c#" debug="true">" line�from the web.config file for Autodiscover.

Method 2

Set the value of "debug" to false�in the web.config file for Autodiscover:
<compilation defaultLanguage="c#" debug="false">

Method 3

If you must have this value be set to true�for some reason, you can make AutoDiscover work by forcing it to use 3DES instead of MD5. To do this, add the following to the <system.web> section of the web.config file:
<machineKey validationKey="AutoGenerate,IsolateApps" decryptionKey="AutoGenerate,IsolateApps" validation="3DES" decryption="3DES"/>


↑ Back to the top

Keywords: KB2952457, kbexpertiseinter, kbtshoot, kbsurveynew

↑ Back to the top

Article Info
Article ID : 2952457
Revision : 2
Created on : 4/21/2014
Published on : 4/21/2014
Exists online : False
Views : 243