This solution works for Exchange 2010 and Exchange 2007, but probably also works for Exchange 2013 and 2016. One caveat: This was done with an Exchange server that had a valid authoritative certificate from a commercial provider. I am not sure how a self-signed or expired certificate may affect this process.
The problem is that your user opens Outlook, and goes to the file tab, and clicks on the "Automatic Replies (Out of Office)" button, and he gets this error: "Your automatic reply settings cannot be displayed because the server is currently unavailable. Try again later."
You probably have this error for every user you try, and if not, you probably have a different permissions issue related to a specific user or group, but the information below will still point you in the right direction (see comments in the last step).
- First, we need some information: On one of the Outlook clients in question, go to the System Tray, and hold the CTRL button down while right clicking on the Outlook icon to get the "Test Email Autoconfiguration...." button. You may need to do this twice before it comes up if you don't click it quite right. Run the test with the user's email you are trying to fix. Once it returns the results, you are looking for the URL that is listed for "OOF" under both RPC and HTTP (If you are reading this for some Exchange 2013 installations and all Exchange 2016 installations, you may not see RPC as that has been phased out as of Exchange 2016). They should be the same, and read something like this:https://mail.yourdomain/ews/exchange.asmx
- Take that URL and paste it into a browser. If it comes back with "This page cannot be displayed", continue with the next step. It is comes back with "403 Forbidden - The website declined to show this webpage", proceed to the last step.
- If the page cannot be displayed, it is often because it is your external .com-type URL, and you are inside your .local-type network. Go to your DNS server, and add the mail. (or whatever sub-domain it was from your test) part of that URL to your internal DNS pointing to the internal IP address. Now, when you try to go tohttps://mail.yourdomain/ews/exchange.asmx, you may already be working and get an authentication pop-up box so go test your Outlook Out of Office again, or at worst, you now get the "403 Forbidden - The website declined to show this webpage" error, but you are making progress.
- This assumes IIS 7.0, but if not, you can figure out your equivalent: Lastly, go into IIS, and expand the site with the EWS directory, and click on the EWS directory. Double-click on the Authentications icon, and make sure that ONLY "Windows Authentication" is enabled. Now try your https://mail.yourdomain/ews/exchange.asmx URL once more, and it should pop up an authentication box. If it does, you can now try your Outlook client again, and it should work provided you do not also have directory security issues too. This probably won't be the case, but if your Out-of-Office still does not work for some reason, make sure the user has permissions to the actual directory on the server.