Office 365 users don't receive mail that's sent through Windows Server 2003

Office 365 users do not receive any mail that's sent through a Windows Server 2003-based server. Specifically, when Transport Layer Security (TLS) is used with the Windows Server 2003 Simple Mail Transfer Protocol (SMTP) service, messages are not sent from the mail queue in Windows Server 2003. The SMTP service is frequently used as an SMTP relay to send mail from devices such as printers and scanners to Office 365.

This problem may occur if issues with the Triple Data Encryption Standard (TripleDES or 3DES) cipher in legacy versions of Windows prevent proper TLS negotiation with secure hosts, including Office 365.�

To resolve this issue, use one of the following methods.

Method 1: Install support for Advanced Encryption Standard (AES) cipher suites, and change the cipher order in the registry

Important Follow the steps in this section carefully. Serious problems might occur if you modify the registry incorrectly. Before you modify it, back up the registry for restoration in case problems occur.

Step 1: Install support for AES cipher suites

Install the update that's documented in the following Microsoft Knowledge Base article:

Step 2: Change the cipher order in the registry to prefer AES

1. Stop the SMTP service.
2. Back up the Mailroot folder. By default, this folder is located at C:\Inetpub\Mailroot.
3. Remove all files that are contained in subfolders of the Mailroot folder. Make sure that you remove only the files and not the folders.
4. Open a text editor such as Notepad, copy and paste the following text, and then save the file as�Schannel_SMTP_O365.reg:

   Windows Registry Editor Version 5.00
   [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL]
   "EventLogging"=dword:00000001
   [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers]
   [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\AES 128/128]
   "Enabled"=dword:ffffffff
   [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\DES 56/56]
   "Enabled"=dword:00000000
   [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\NULL]
   "Enabled"=dword:ffffffff
   [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\RC2 128/128]
   "Enabled"=dword:00000000
   [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\RC2 40/128]
   "Enabled"=dword:00000000
   [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\RC2 56/128]
   "Enabled"=dword:00000000
   [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\RC4 128/128]
   "Enabled"=dword:ffffffff
   [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\RC4 40/128]
   "Enabled"=dword:00000000
   [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\RC4 56/128]
   "Enabled"=dword:00000000
   [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\RC4 64/128]
   "Enabled"=dword:00000000
   [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\Triple DES 168/168]
   "Enabled"=dword:00000000
   [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Hashes]
   [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Hashes\MD5]
   "Enabled"=dword:ffffffff
   [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Hashes\SHA]
   "Enabled"=dword:ffffffff
   [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\KeyExchangeAlgorithms]
   [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\KeyExchangeAlgorithms\Diffie-Hellman]
   "Enabled"=dword:ffffffff
   [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\KeyExchangeAlgorithms\PKCS]
   "Enabled"=dword:ffffffff
   [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols]
   [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\Multi-Protocol Unified Hello]
   [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\Multi-Protocol Unified Hello\Server]
   [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\PCT 1.0]
   [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\PCT 1.0\Client]
   "Enabled"=dword:00000000
   [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\PCT 1.0\Server]
   [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0]
   [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0\Client]
   "Enabled"=dword:00000000
   [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0\Server]
   [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0]
   [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0\Client]
   "Enabled"=dword:ffffffff
   [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0\Server]
   [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0]
   [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Client]
   "Enabled"=dword:00000000
   [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Server]

5. Open Registry Editor, and then follow these steps:
   1. Back up the following registry key:
      HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL
   2. Delete all keys and values that are under the registry key.
   3. Import the�Schannel_SMTP_O365.reg file that you created in step 4.
6. Restart the computer.
7. Test the SMTP service to make sure that it's working.
8. Create and send a test message, and then watch the Mailroot\Queue folder. The test message should disappear from the folder after it's transmitted. This can typically take from 5�15 seconds.
9. After you confirm that the SMTP service is working as expected, copy the files from the Mailroot\Queue backup that you created in step 2 to the active Mailroot\Pickup folder.�
   
   Doing�this lets the SMTP service reprocess the messages in the Pickup folder.�

Method 2: Install an update for 3DES negotiation�

Install the update that's documented in the following Microsoft Knowledge Base article:�

For more info, see How to allow a multi-function device or application to send email through Office 365 using SMTP.

Still need help? Go to the Office 365 Community website.