This error is observed in the ENS logs when using both a Saas and an On Premise instance of AirWatch.
The exact error is displayed below
2016/04/05 19:59:52.696 ENS-AIRWATCH 690ed586-382b-429a-9aae-faaa7acdc35c [0000000-0000000] (6) Error AW.Mail.Notification.Service.BusinessImpl.ExchangeSubscriber Unable to open Exchange Connection Microsoft.Exchange.WebServices.Data.ServiceRequestException: The request failed. The remote server returned an error: (401) Unauthorized. ---> System.Net.WebException: The remote server returned an error: (401) Unauthorized.
This could be caused because of variety of reasons.
- The ENS Server cannot reach the exchange EWS endpoint over port 443.
- There could be trust issues between ENS and the EWS endpoint on exchange.
- The service account used by ENS does not have the right permissions.
- The password associated with the service account used during the installation of ENS was wrong.
- There is a typo in the name of the service account within the ENS configuration that must have happened during the ENS install.
- There is a typo with the domain name of the service account.
- Address the network and SSL issues between the ENS and the EWS endpoint on exchange.
- Check if the service account associated has the correct permissions.
- Check the registries and verify the service account, domain name, DNS used for Exchange during the ENS install.
The image below shows the location within the registries to check the various values associated.
4. To change a value double click on the registry and change the value associated. The image below displays the way to change the domain name.
5. Verify if the password associated with the service account is right by using the tool called the ServiceAccountConfig. The image below displays the tool location and its executable that can help us verify the password associated with the service account.
When you execute the highlighted tool you can check the password associated with the service account and also do a test connection that verifies the connectivity from ENS to Exchange.
The image below displays the fields that are available when we launch the tool.
If the Test Connection results a success, that means the corresponding DNS of the Exchange, the domain, the service account and the password are all correct.
These steps should get the subscription added successfully.
Once the subscription is added you can find the same in the ENS logs are listed below.
2015/12/23 17:20:37.021 AW-ENS 0f0903b9-eb29-47f5-b1ef-b303c5065427 [0000000-0000000] (6) Info AW.Mail.Notification.Service.BusinessImpl.SubscriberPool Added subscription for user [email@example.com]
2015/12/23 17:20:37.021 AW-ENS 0f0903b9-eb29-47f5-b1ef-b303c5065427 [0000000-0000000] (6) Trace .AW.Mail.Notification.Service.BusinessImpl.SubscriberPool._AddSubscription Exit --AW.Mail.Notification.Service.BusinessImpl.SubscriberPool._AddSubscription 00:00:00.0053781