Users cannot log on to Outlook Web Access after you apply Exchange 2007 Service Pack 1 in an Exchange 2007 environment

When upgrading your CAS servers to Exchange 2007 SP2 , if one is in a CAS proxying scenario, after upgrading the Internet-facing CAS servers, as recommended by the Release Notes of Exchange 2007 SP2, users will no longer be able to log into OWA and the following error message will be displayed in the application log of the recently upgraded CAS server:

Event Type: Error
Event Source: MSExchange OWA
Event Category: Proxy
Event ID: 46
Description:
Client Access server "https://mail.domain.com/owa", running Microsoft Exchange version "8.1.240.5", is proxying Outlook Web Access traffic to Client Access server "servername.domain.com", which runs Exchange version "8.0.685.24". To ensure reliable interoperability, the proxying Client Access server needs to be running a newer version of Exchange than the Client Access server it is proxying to. If the proxying Client Access server is running a newer version of Exchange than the Client Access server it is proxying to, the proxying Client Access server needs to have an Outlook Web Access resource folder (for example, "<Exchange Server installation path>)\ClientAccess\owa\8.0.498.0" that contains all the same versioned resource files as the Client Access server it is proxying to. If you will be running Outlook Web Access proxying with mismatched server versions, you can manually copy this resource folder to the proxying Client Access server.

This problem occurs because the updated Internet-facing CAS does not have the same Outlook Web Access control directory as the internal-facing CAS when a user is directed to another CAS through a proxy. We recommend that you always update the Internet-facing CAS first. Then, update all other CASs in the organization.

To resolve this problem, install the same Exchange 2007 updates on the destination CAS that are installed on the Internet-facing CAS.

After you apply Service Pack 1, the control directories from the previous version will be removed. If you are unable to apply the same update to the internal facing CAS, you can work around this issue by manually copying the control directories from the internal-facing CAS to the Internet-facing CAS. To do this, follow these steps:

1. Log on to the Internet-facing CAS.
2. Map a network drive to the following path on the internal-facing CAS:
   <Server installation path>\ClientAccess\OWA folder
3. Open Windows Explorer on the Internet-facing CAS.
4. Browse to the mapped network drive.
5. Open the Outlook Web Access folder that is located on the internal-facing CAS.
6. You will see folders named in the 8.x.xxx.xx format.
7. Right-click the highest 8.x.xxx.xx folder, and then click Copy.
8. In Windows Explorer, browse to the following path on the Internet-facing CAS:
   <Server installation path>\ClientAccess\OWA folder
9. Right-click the Outlook Web Access folder, and then click Paste.

The Internet-facing CAS must have the highest control directory that is present on the destination CAS. If the Internet-facing CAS does not have the highest control directory, the proxy will fail.

If you use the workaround to copy the control directories to the Internet-facing CAS, new features that are introduced with the latest updates will be available only for mailboxes that are in the same Active Directory site. If an Exchange 2007 SP1 CAS has to proxy the Outlook Web Access request to a non-Exchange 2007 SP1 CAS, the new features in Exchange 2007 SP1 will not be available to that user.