Error message when you create a profile in Outlook 2007 after you install the cumulative update that is described in Microsoft Knowledge Base article 961752: "Outlook cannot log on"

View products that this article applies to.

Symptoms

After you install either the February 24, 2009 cumulative update that is described in Microsoft Knowledge Base article 961752 or the 2007 Microsoft Office suite Service Pack 2, you may experience the following symptoms.

When you create a profile in Microsoft Office Outlook 2007, you may receive the following error message:
Outlook cannot log on. Verify you are connected to the network and are using the proper server and mailbox name. The connection to Microsoft Exchange is unavailable. Outlook must be online or connected to complete this action.
This problem occurs when any one of the following conditions is true:
- The Microsoft Exchange Server mailbox server has the No RFR Service registry value set to 1.
  
  For more information about the registry path, click the following article number to view the article in the Microsoft Knowledge Base:
  302914 How Outlook 2000 accesses Active Directory
- You specify the name of a global catalog (GC) for the server name in your Outlook profile settings, and the GC is not an Exchange server.
- The fully qualified domain name (FQDN) of your Exchange server cannot be accessed from your Outlook client. For example, the FQDN of the server may be server.Domain.local.
You may also receive the following error when you click the
Delegates tab in the Options dialog box in Outlook:
The Delegates page is not available. Cannot access Outlook folder. The connection to Microsoft Exchange is unavailable. Outlook must be online or connected to complete this action.
In Outlook, when you view the properties of a user in your Exchange organization, you experience the following problems:
- There is no information on either the Organization or the Member of tabs
- The Organization and Member Of tabs display the following error text next to an information icon:
  Unable to connect to retrieve additional data

↑ Back to the top

Cause

This problem occurs because of a code change in Outlook 2007 that is included in the update from KB article 961752. After you install the update, Outlook always assumes that you are connecting to an Exchange 2000 Server mailbox, or later versions, and always uses the Referral service when you create a new profile.

If you have the "No RFR Service" registry value set to 1 on the Exchange server the server is effectively configured to always use DSProxy. However, Outlook does not support DSProxy after the installation of the update, and it cannot reach your global catalog server.

A global catalog server does not support the Referral service. Therefore, if you specify the global catalog as the Exchange server name and you do not have Exchange installed on the global catalog server, there is no way for the global catalog server to give you the Exchange server information.

In some topologies, a referral from the Exchange server for a GC returns an FQDN that is not routable from the client computer. For example, after you connect to an Exchange server by using a wireless router, the router cannot route traffic from the client to an FQDN such as “server.Domain.local." This is a typical FQDN that is returned by a Microsoft Small Business Server.

This can also occur on non-SBS servers in which the Outlook client and the Exchange server are in different domains. Such an Exchange server is typically a single Exchange server that is also a GC. If your DNS configuration cannot resolve the FQDN of the server in the other domain, you can use the nslookup command on the Outlook client to see whether it returns the correct IP address for the server. The following example shows a failed nslookup from a client for such a topology:

C:\Users\User1>nslookup exchange01.contoso.com
Server: dc01.fourthcoffee.com
Address: IP address of dc01.fourthcoffee.com

*** dc01.fourthcoffee.com can't find exchange01.contoso.com:

Non-existent domain

In this example, exchange01.contoso.com is the FQDN of the Exchange server in the contoso domain and dc01.fourthcoffee.com is the DNS server in the Outlook client domain (fourthcoffee).

↑ Back to the top

Resolution

To resolve this problem, install the update from the following article:
For more information, click the following article number to view the article in the Microsoft Knowledge Base:

968858 Description of the Outlook 2007 hotfix package (Outlook.msp): April 30, 2009

If you cannot install the update at this point, please use one of the following methods as a workaround until you can install the update.

Method 1

Do not specify a global catalog server when you create your Outlook profile.

If you specify a global catalog server when you manually create your Outlook profile, and you do not have Exchange installed on the global catalog server, specify the name of an Exchange server in your organization.

If you use a .prf file to create your Outlook profile and the .prf file specifies a global catalog server for the Exchange mailbox server name, change the .prf file so that it uses the name of an Exchange server in your organization instead of a global catalog server.

Method 2

Stop using the "No RFR Service" registry value on the Exchange server.

If you use the "No RFR Service" registry value on an Exchange Server 2003 server or on an Exchange 2007 server, you can solve this problem by following these steps:

Click Start, click Run, type regedit in the Open box, and then click OK.
Locate and then click the following registry subkey:
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\MSExchangeSA\Parameters
Right-click No RFR Service, and then click
Modify.
In the Value data box, type
0, and then click OK.
On the Edit menu, point to
New, and then click DWORD Value.
Type Refer TCPIP to DsProxy, and then press ENTER.
Right-click Refer TCPIP to DsProxy, and then click Modify.
In the Value data box, type
1, and then click OK.
Exit Registry Editor.
Restart the Exchange System Attendant service and other dependent services.

Method 3

If you use an SBS server that returns a FQDN that is not routable from the client computer, you can resolve this problem by following these steps:

Click Start, click Run, type regedit in the Open box, and then click OK.
Locate and then click the following registry subkey:
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\MSExchangeSA\Parameters
On the Edit menu, point to
New, and then click String Value.
Type NSPI Target Server, and then press ENTER.
Right-click NSPI Target Server, and then click Modify.
In the Value data box, type the Netbios name or the FQDN of your SBS server, and then click
OK.
Exit Registry Editor.
Restart the Exchange System Attendant service and other dependent services.

Method 4

Use a Hosts file entry for the FQDN of the global catalog server. If the nslookup command returns a "Non-existent domain" result for the FQDN of the GC, change the Hosts file on your Outlook client to include an entry that resolves the FQDN to the IP address of the server. To do this, follow these steps:

Click Start, click Run, type %windir%\system32\drivers\etc\hosts in the
Open box, and then click OK.
If you need to, select Notepad to open the Hosts file.
Enter the IP address and the FQDN of your GC. For example, you may enter:102.54.94.97 exchange01.contoso.com
Save and then close the Hosts file.

↑ Back to the top

More Information

Before you install the update from Microsoft Knowledge Base article 961752, Outlook uses the following global catalog server connection logic when you create a new profile. When you create a new Outlook profile, the client has to know the name of your global catalog server. During the initial profile creation process, Outlook is not aware of the Exchange version that hosts your mailbox. Because of this, Outlook assumes that the Exchange server supports the DSProxy service and uses the Exchange server name as the global catalog server name. Therefore, Outlook prompts Exchange to proxy Name Service Provider Interface (NSPI) calls on to the actual global catalog server.

Note Exchange is fully aware of the global catalog servers to which it can connect.

After this initial connection is made, and Outlook successfully finishes its first start, Outlook caches the version of Exchange that hosts your mailbox. Because Outlook 2007 only supports connections with Exchange 2000 Server and later versions, Outlook knows that these versions of Exchange provide support for the Referral service (DSRefer). Therefore, Outlook uses the referral service on Exchange instead of using DSProxy to obtain the name of a global catalog server. As soon as Outlook has the name of the global catalog server, NSPI calls are made directly with the global catalog server.

For more information, click the following article number to view the article in the Microsoft Knowledge Base:

961752 Description of the Outlook 2007 hotfix package (Outlook.msp): February 24, 2009

↑ Back to the top