Release Notes for Office 365 for enterprises (English)

• Top Issues
• Administration
• Exchange Online
• Lync Online
• Mac Release Notes
• Microsoft Online Services Directory Synchronization Tool
• SharePoint Online
• Office 365 Desktop Setup
• Other

Learn about Office 365 software requirements

Top Issues

It may take an hour to receive your first email
March 7, 2011

Immediately after you provision your company with Office 365, it may take up to an hour to receive your first e-mail in your newly created Inbox.

This is because there is a delay between when a newly created hosted organization is created and when that organization can receive mail from the Internet. This delay may last up to an hour due to replication of DNS changes. Mail received by Office 365 during this time will be returned to the sender with a non-delivery receipt (NDR). Once DNS replication is complete mail flow will be resumed automatically and no administrative actions are necessary.

Users created after this first hour will not experience this delay.

Some links may not be active immediately after you sign up for Office 365
March 7, 2011

After you sign up for Office 365, you may notice inactive links on the Home and Admin pages. This is because the service is still provisioning your account and some resources are not ready to use. When provisioning is complete, the color of these links will change to blue, and they will be able to be used. If these links are still inactive after 12 hours, contact Support.

Back to Table of Contents

Administration

Microsoft Online Services Module for Windows PowerShell available
May 13, 2011

The Microsoft Online Services Module for Windows PowerShell installs a set of Office 365 cmdlets to Windows PowerShell that you can use to accomplish many administrative tasks. This MSI download file includes cmdlets that replace the existing Microsoft Online Services Identity Federation Management tool. The previous version of the Identity Federation Management tool will no longer be supported.

Download the Microsoft Online Services Module for Windows PowerShell from one of the following two links:

• 32-bit
• 64-bit

The Office 365 sign-in page does not appear on servers if enhanced security is enabled in Internet Explorer
March 7, 2011

All servers running Windows Server 2003 or Windows Server 2008 have Internet Explorer enhanced security enabled by default. When a server has enhanced security enabled, the Office 365 sign-in page appears blank.

To disable enhanced security:

• For Windows Server 2003: In Control Panel, click Add/Remove Windows Components, and then double-click Internet Explorer Enhanced Security Configuration. In the Internet Explorer Enhanced Security Configuration dialog box, ensure that the For administrator groups check box is cleared, and that the For all other user groups check box is selected.
• For Windows Server 2008: Start Server Manager, and in the Security Information section, click Configure IE ESC. In the Internet Explorer Enhanced Security Configuration dialog box, ensure that Off is selected under Administrators and On (Recommended) is selected underUsers.

Back to Table of Contents

Exchange Online

Running Get-ActiveSyncVirtualDirectory from a server that doesn't host the Exchange ActiveSync virtual directory may cause unexpected errors
June 11, 2011

When you are using Active Directory synchronization for a hybrid deployment (also called rich coexistence), and you want to see the Exchange ActiveSync virtual directory, you will need to run Get-ActiveSyncVirtualDirectory from the server that hosts the Exchange ActiveSync virtual directory instead of from any server in your organization.

A hybrid deployment scenario is where you have Exchange 2007 deployed on premises and an Exchange 2010 coexistence server in the cloud.

For an on-premises Exchange ActiveSync virtual directory, you can run Get-ActiveSyncVirtualDirectory from the on-premises Exchange 2007 server.

BlackBerry® service will not be available in Office 365
May 13, 2011

Microsoft is no longer providing a Hosted BlackBerry® service for Exchange Online. Research In Motion will be providing a cloud-enabled BlackBerry® service by the end of 2011 to enable those capabilities. Further information will be available later in the year.

There is no workaround at this time.

User profiles upgraded to Outlook 2010 won't work if reverted to Outlook 2007
March 7, 2011

Because of the changes in Outlook 2010 that allow for multiple Exchange email accounts, user profiles that were upgraded to Outlook 2010 will not work if the user removes Outlook 2010, reinstalls Office Outlook 2007, and then attempts to start Office Outlook 2007 by using the same user profile. In this scenario, the user profile will have to be removed and recreated in Windows through the Control Panel and Mail options.

For more information and for other changes related to Outlook 2010, see this TechNet article.

You must change your temporary password before accessing your Office 365 email using Outlook
March 7, 2011

Because your first connection to Office 365 must be done with your temporary password, which you are required to change, you will need to first sign in to either the Office 365 Portal or to Microsoft Outlook Web App before connecting with the desktop version of Outlook. Once you change your password, you can then connect using the desktop version of Outlook. Likewise, if your password is reset by your administrator to a new temporary password, you must also sign in to the portal or to Outlook Web App before connecting to Office 365 using your desktop version of Outlook.

Exchange Management Console 2010 SP1 customers need the Microsoft Online Services Sign-In Assistant to connect to Office 365
March 7, 2011

When adding an Exchange forest in the Exchange Management Console, the wizard alerts you that you need the Windows Live ID Sign-In Assistant to connect to Exchange Online. This is incorrect; you need the Microsoft Online Services Sign-In Assistant instead. If you have already installed updates using the Microsoft Online Services Connector, you already installed the Microsoft Online Services Sign-In Assistant. You do not need to install the Windows Live ID Sign-In Assistant.

If you haven't already installed updates using the Microsoft Online Services Connector, go to the Office 365 home page, and, under Resources, clickDownloads. Follow the instructions to install the Microsoft Online Services Sign-In Assistant.

Support for Microsoft Forefront Online Protection for Exchange
March 7, 2011

24x7 technical support is available for Forefront Online Protection for Exchange. Contact support by phone:

• 866-291-7726 - United States
• 800-0000-0060 - Universal International Freephone Number (UIFN)

Support is also available in the Forefront Online Protection for Exchange Administration Center.

Back to Table of Contents

Lync Online

Change a SIP URI in Office 365 for Lync Online
May 9, 2011

When a Lync Online user is licensed, they are assigned a SIP URI; for example, bob@contoso.com. The initial change between the domain provided by Office 365 (SIP URI:bob@contoso.msonline.com) and your company’s custom domain (for example, Contoso.com), will automatically change the user’s SIP URI. However, administrators may additionally want to change a user’s SIP URI for a variety of reasons:

• The company wants to release their current domain name
• The company wants to change their domain name or add a second domain name
• The user moves from one division to another and their domain name changes
• The user changes their user alias

Administrators can manually change user’s SIP URI in two ways:

• If the company is a federated tenant with on-premises Lync 2010, the SIP URI must be changed on-premises. Please refer to the on-premises Lync Deployment documentation.
• If the company is a managed tenant, the administrator must call Support to change the user’s SIP URI.

Note: When an administrator manually changes a user’s SIP URI, the user’s existing meeting links and contacts will no longer work. Other than the automatic SIP URI change from provided to custom domain, a change in SIP URI will break existing meeting links and these will have to be manually created. Furthermore, users will have to notify existing contacts to update their contact list.

Deleting a Domain in Office 365 for Lync Online
May 9, 2011

If a company wants to release a domain, there cannot be any users with a SIP URI with that domain; for example, you cannot remove contoso.com if there is a user with SIP URI bob@contoso.com. The company may want to release a domain for the following reasons:

• The company registered a custom domain, for example, contoso.com, and then decides that it no longer wants to continue the Office 365 subscription.
• The company registered a custom domain, for example, contoso.com, and then changes the company domain or acquires another domain. It wants to move all users to the new domain and then release the existing domain.

The Office 365 provisioning workflow will check to ensure that there are no SIP URIs for the domain that is to be removed.

• To no longer continue the Office 365 subscription, the administrator can delete all users via the Microsoft Office 365 Portal, and then remove the domain. This will not require a Support call. Note that Support will not delete a user’s SIP URI or delete a user.
• To move users to another domain and release the existing domain, this will require all SIP URIs with the existing domain to be changed. This can be accomplished in one of two ways:
  • Change the user’s SIP URI by following the instructions in the Release Notes: “Changing the user’s SIP URI”. This requires a Support call. Note the limitations of changing the user’s SIP URI.
  • Delete all users with the SIP URI with the existing domain, and reprovision them with the new domain as completely new users using the Microsoft Office 365 Portal. This does not require a Support call.

Notes:

• Before an administrator can delete a domain via the Microsoft Office 365 Portal, all SIP URIs with this domain need to be changed.
• After all SIP URIs for a domain have been changed to another domain, the administrator can go back to the Microsoft Office 365 Portal and delete the existing domain.

Lync 2010 cannot sign in to Lync Online
May 9, 2011

If the Lync 2010 desktop client does not automatically discover the Lync Online service based on the sign-in address the user provides, you can try the following:

• Verify you have an active connection to the Internet.
• Wait a bit and try again. The network or the Lync Online service may be temporarily inactive.
• Contact your administrator. It may be that your company network needs configuration changes to allow connection to the Lync Online service.

Administrator Details

The Lync 2010 desktop client executes a DNS SRV query and a DNS CNAME query to find the Lync Online service. When Lync Online is purchased, the Lync Online service does create a global DNS SRV record, but does not create a global DNS CNAME record in the initial release of the service. Therefore, if your Internet proxy/firewall is configured to block external SRV queries, the Lync 2010 desktop client will not be able to discover the Lync Online service and sign in.

Administrator Workaround/Solution

The administrator should configure a global DNS CNAME record that points to the Office 365 Lync Online service. As an alternative, if the administrator cannot do the above, an internal DNS SRV record will also work. This record will be behind the proxy firewall and clients will be able to query it.

The DNS record should be of the form:

Global CNAME record (preferred, and visible on the Internet):

CNAME sip.<tenantdomain> to sipdir.online.lync.com

Or the alternative internal SRV record:

SRV _sip._tls.<tenantdomain> to sipdir.online.lync.com:443

 where <tenantdomain> is the domain assigned for Lync Online use at time of purchase.

Moving a user from one vanity domain to another is not supported
March 7, 2011

Moving an Office 365 user from one vanity domain to another vanity domain will cause data loss, and cause meetings to not work correctly. This is a known issue and is not supported by Office 365.

Back to Table of Contents

Mac Release Notes

Entourage for Mac users cannot set Out of Office messages
May 13, 2011

If a user of Microsoft Entourage 2008 for Mac is using Office 365 and tries to create an Out of Office message, they will get an error message and fail to create their Out of Office message.

There is no workaround for this issue at this time.

Mac 2011 SP1 is required for Office for Mac 2011 users to connect to SharePoint Online in Office 365
May 13, 2011

In order to connect to SharePoint Online in Office 365, users of Office for Mac 2011 will need to download and install Office for Mac 2011 SP1.

Some Outlook for Mac and Entourage for Mac users will fail to authenticate with Exchange after migration to Office 365
May 13, 2011

After users of Microsoft Outlook for Mac 2011 and Microsoft Entourage 2008 for Mac, Web Services Edition migrate to Office 365, their userID for Exchange will change from "domain\username" to their Office 365 email address. Therefore, some users may experience authentication failure.

To work around this, the administrator can enter the user’s email address as the user name for their on-premises Exchange server account.

Contact card information and some other functionality unavailable in Mac Outlook and Mac Entourage
April 8, 2011

When connecting to Office 365, the following information and features are not available for Mac Outlook and Mac Entourage.

Unavailable contact card information:

• Manager/report information in the Global Address List
• Contact picture
• “Member of” information

Other unavailable features:

• Searching the Office 365 directory (via LDAP)
• Encoding messages using certificates

There is no workaround for these issues at this time.

Password expiration prompt doesn’t show up in Mac Outlook and Mac Entourage
April 8, 2011

When you are connecting to Office 365 using Mac Outlook and Mac Entourage, the password expiration prompt will not show up.

To work around this issue, administrators can send out a password expiration reminder in email, and users can change their passwords in Outlook Web App.

Back to Table of Contents

Microsoft Online Services Directory Synchronization Tool

You cannot modify an existing installation of the Directory Synchronization tool to sync to a different Office 365 tenant
August 5, 2011

When a customer signs up for Office 365, they are provisioned a tenant. This tenant is a container that holds all the information for that customer. When you configure the Directory Synchronization tool and specify the global administrator account (via the Configuration Wizard, or Windows PowerShell cmdlets), the Directory Synchronization tool is configured to connect to that tenant. Subsequently, the tool synchronizes on-premises information into the customer’s respective tenant in Office 365. Customers that have signed up for other tenants within the Office 365 service cannot run the Configuration Wizard again and specify the global administrator account for a different Office 365 tenant. Instead, the customer must deploy a new instance of the Directory Synchronization tool, specifying the global administrator account for the second tenant.

Active Directory objects with more than 1,000 values in a multi-valued attribute will not sync
March 7, 2011

When using Active Directory synchronization with Office 365, any object that has more than 1,000 attributes in a multi-valued attribute will fail to sync, and the customer will see an error indicating the object has exceeded the allowed attributes in a multi-valued attribute. Typically this issue arises with the proxyAddresses attribute, though the same would apply for any other multi-valued attribute; for example, otherTelephone.

To fix this error, remove some of the values of the object in your on-premises Active Directory. You cannot remove these extra values in the Office 365 directory.

Administrators cannot turn off Active Directory synchronization once it has been activated
March 7, 2011

Once administrators have activated Active Directory synchronization for their Office 365 organization, via the Office 365 Portal, they will not be able to deactivate it again. This is to prevent potential data loss or corruption as a result of deactivating and reactivating the synchronization process. There is no known workaround for this issue at this time.

Configuration Wizard F1 key doesn't work at first on Windows Server 2008
March 7, 2011

When you run the Microsoft Online Services Directory Synchronization Tool Configuration Wizard for the first time on a Windows Server 2008 machine, you will get an error ("Run As - not supported") if you click the F1 shortcut key on any wizard page. To use the F1 keys to access Help, log off of the machine and then log back on, at which point the F1 shortcut key for Help should work properly.

To access the Configuration Wizard Help topics directly, see Active Directory synchronization: Roadmap, Microsoft Online Services Credentials, or Active Directory Credentials.

Modifying a user’s Active Directory group membership may impact rich coexistence functionality
April 6, 2011

If your company has enabled rich coexistence as part of the Active Directory synchronization configuration, users that are added to some Active Directory security groups before their rich coexistence configuration is successfully written back to their on-premises Active Directory will not have access to those features until the procedure documented below is executed.

The affected security groups are:

• Schema Admins
• Enterprise Admins
• Cert Publishers
• Domain Admins
• Account Operators
• Print Operators
• Administrators (domain local)
• Server Operators
• Backup Operators

To resolve this issue, customers should use the dsacls tool to reprovision the MSOL_AD_Sync_RichCoexistence account permissions to the AdminSDHolder object in their local Active Directory forest.

To modify the AdminSDHolder container, do the following.

1. Download and install the Windows Server 2003 Service Pack 1 (SP1) Support Tools.
   Dsacls.exe is available as part of the Windows Support Tools. For more information, see article 89277 in the Microsoft Knowledge Base.
2. Run the following commands:
   • dsacls CN=AdminSDHolder,CN=System,DC=<mydomain>,DC=com /G MSOL_AD_SYNC_RICHCOEXISTENCE:WP;"MSExchArchiveStatus"
   • dsacls CN=AdminSDHolder,CN=System,DC=<mydomain>,DC=com /G MSOL_AD_SYNC_RICHCOEXISTENCE:WP;" MSExchBlockedSendersHash"
   • dsacls CN=AdminSDHolder,CN=System,DC=<mydomain>,DC=com /G MSOL_AD_SYNC_RICHCOEXISTENCE:WP;" MSExchSafeRecipientsHash"
   • dsacls CN=AdminSDHolder,CN=System,DC=<mydomain>,DC=com /G MSOL_AD_SYNC_RICHCOEXISTENCE:WP;" MSExchSafeSendersHash"
   • dsacls CN=AdminSDHolder,CN=System,DC=<mydomain>,DC=com /G MSOL_AD_SYNC_RICHCOEXISTENCE:WP;" MSExchUCVoiceMailSettings"
   • dsacls CN=AdminSDHolder,CN=System,DC=<mydomain>,DC=com /G MSOL_AD_SYNC_RICHCOEXISTENCE:WP;" ProxyAddresses"

Objects deleted after initial full synchronization may count towards customer's directory synchronization object limit
March 7, 2011

Objects that were once present in the customer's on-premise Active Directory and synchronized to Office 365 via Active Directory synchronization, and then deleted, may still contribute towards the customer's Office 365 object limit for a period of up to 30 days. If the sum of these deleted objects and the remaining active objects is greater than the customer's object limit, the customer may continue to receive notifications informing them they have exceeded their object limit even though the object no longer appears in the on-premise Active Directory or in the Office 365 directory.

For help with this issue, contact Office 365 Support.

You cannot synchronize directories if you use simple Exchange migration
March 7, 2011

If you use simple Exchange migration to migrate data to Office 365, you will not be able to synchronize users through directory synchronization. If you have already migrated users with simple Exchange migration, you would need to off-board the mail data you wish to retain and delete the cloud users created by simple Exchange migration. After completing this you, can run Active Directory synchronization. For more information, see Active Directory synchronization: Roadmap.

You must contact Support to synchronize more than 10,000 Active Directory objects
March 7, 2011

If you plan to use Active Directory synchronization to synchronize your local Active Directory with Office 365, you can synchronize up to 10,000 objects (users, mail-enabled contacts, and groups). If you need to synchronize more than 10,000 objects, contact Office 365 Support to request additional synchronization capacity.

Back to Table of Contents

SharePoint Online

Displayed local time and time zones may not be not correct in SharePoint Online
October 25, 2011

As noted in the Microsoft KB article, August 2011 Cumulative Time Zone Update for Windows, several countries have changed the way they implement Daylight Saving Time (DST), and therefore the displayed local time and time zone might be incorrect for those countries in SharePoint Online.

Updates to support these DST changes will be applied to Microsoft SharePoint Online servers over the next several months. Notices of these updates will be provided in these release notes and referenced on http://www.microsoft.com/time. Any SharePoint Online tasks, timer jobs, appointments, or other data impacted by these updates will be adjusted to use the updated time zone definitions.

Workaround: In the meantime, if the changes for your time zone are not yet available on SharePoint Online, users should temporarily change their time zone to ensure that their data displays correctly. For example, Russian users should identify their current time zone from the following table and select the associated workaround time zone.

See Change your regional settings for information about how to change your SharePoint Online site time zone. If you changed your time zone as a workaround, you can change back to your preferred time zone after the DST updates have been applied.

Deleting and recreating your Office 365 administrator can affect permissions to SharePoint Online
August 5, 2011

If administrators or technical support resources delete and recreate any Microsoft Office 365 administrator account, they should also verify the recreated account's administrator access to SharePoint Online. If there are issues accessing SharePoint Online, or performing administrative functions, please contact Microsoft Office 365 Support.

Single sign-on for SharePoint Online may not work from some mobile devices 
August 5, 2011

In Office 365, to access your SharePoint Online sites from a mobile device, you must first sign in on the Microsoft Online Services Sign in page using your Microsoft Online Services ID or federated corporate credentials, and your password. You will reach this page on your mobile device by browsing to the SharePoint Online website, which will redirect you to the Microsoft Online Services Sign in page.

If your phone falls into one of the following categories, the sign-in page may not work for you.

• BlackBerry operating systems that are older than 5.0
• Android 1.5
• Nokia E71, N95, N8
• iPhone

There is no workaround at this time.

The RSS Viewer Web Part and the XML Viewer Web Part are not supported in Office 365 
March 7, 2011

When adding either the RSS Viewer Web Part or the XML Viewer Web Part to a webpage, you will see the following error message: “A Web Part or Web Form Control on this Page cannot be displayed or imported. The type is not registered as safe.”

If you had already added an RSS Viewer Web Part or an XML Viewer Web Part to a page, you will see the following behavior:

• On Wiki pages, the Web Part will no longer be visible.
• On Web Part Pages, the following error message will appear: “Web Part Error: A Web Part or Web Form Control on this Page cannot be displayed or imported. The type Microsoft.SharePoint.Portal.WebControls.RSSAggregatorWebPart, Microsoft.SharePoint.Portal, Version=14.0.0.0, Culture=neutral, PublicKeyToken=71e9bce111e9429c could not be found or it is not registered as safe.”

No workaround is available.

Users may see additional authentication prompts in SharePoint Online in some scenarios
May 9, 2011

Note:  This issue may not affect all users.

Scenario 1: Users who are signed in to Microsoft SharePoint Online sites using federated Microsoft Online Services IDs will experience additional credential prompts when working between a browser window and a Microsoft Office desktop application. In addition, these users will be required to authenticate after closing and reopening the browser. There is no workaround for this issue.

Scenario 2: When using Distributed Authoring and Versioning (DAV) with some client application features, such as “Open with Explorer” in a SharePoint Online document library, users may experience additional credentials prompts. To avoid this, users must select the Keep me signed in check box during sign-in.

Users who are signed in to SharePoint Online sites using federated Microsoft Online Services IDs do not have the Keep me signed in check box, so they will need to also authenticate with an Office desktop application such as Microsoft Word. Once these users have authenticated in both an Office desktop application and the browser, features and applications that use DAV to communicate with SharePoint Online will be successful.

Office Web Apps do not support Google Chrome
May 9, 2011

Users who use Google Chrome with the Microsoft Office Web Apps for Word, Excel, PowerPoint, and OneNote may experience unexpected errors and behaviors while viewing and editing documents. These may cause you to lose unsaved changes.

Support for Google Chrome in the Office Web Apps will come as part of a future update to Office 365.

To work around these issues, use a supported browser such as Mozilla Firefox or Internet Explorer.

Some methods of accepting external sharing invitations to SharePoint sites not supported on Office 365
May 9, 2011

Note:  This issue may not affect all users.

Users can accept invitations to collaborate on a Microsoft SharePoint Online site by using either a Microsoft Online Services ID or a Windows Live Hotmail ID.

However, the following methods of accepting collaboration invitations are not supported:

• Accepting an invitation using a Windows Live ID that was created using a personal email address.
• Accepting email invitations to SharePoint site collections by clicking on the link in the invitation email from a mobile device.

There is currently no workaround for these issues.

Activation of additional SharePoint Online features on the public-facing website is not supported
March 11, 2011

The public-facing website is a specifically tailored SharePoint site that allows users to create and manage their website in a user-friendly way through the Site Designer feature. A set of SharePoint Online features have been selectively activated on the website to make this experience possible. Users should not activate any additional SharePoint Online features on their public-facing websites, whether through the user interface, through code, or any other methods. Manual activation of additional features may lead to errors and potential complications with the site renaming process when changing the website domain.

• Users seeking functionality available through additional SharePoint Online features that have not been activated in the public-facing sites should create a non-public-facing site and use the desired features there.
• Users that have somehow turned on an additional feature can simply follow the same steps to turn it off. It is possible to activate and deactivate features both through the UI and through the object model. However, once a feature has been activated, it may have caused unavoidable and irreparable consequences in the site renaming process.

Social and My Site experience may miss group information
March 11, 2011

My Sites in SharePoint Online allow you to manage and share personal documents and insights with colleagues. In Office 365, the feature allowing you to import groups into the SharePoint Online user profile database is temporarily disabled. Because of this, some My Site features have limited functionality:

• Memberships tab is empty
• Cannot create audiences based on group memberships

In addition, My Site profiles may take 1-2 days to appear as the user profile import process is run on a daily schedule.

Back to Table of Contents

Office 365 Desktop Setup

To connect to Office 365, some users may be required to configure Outlook manually
March 7, 2011

If you are having trouble connecting to your Office 365 mailbox from Outlook, see the Help topic for your version of Outlook:

• If you're using Outlook 2007, see Set Up E-Mail in Outlook 2007.
• If you're using Outlook 2010, see Set Up E-Mail in Outlook 2010.
• If you're using Outlook 2011 for Mac, see Set Up Outlook for Mac 2011 for Your E-Mail Account.

Users cannot update Office 2010 SP1 Beta to connect to Office 365
March 7, 2011

Office 365 desktop setup requires a patch to Outlook that cannot be installed with Office 2010 SP1 Beta. If you have Office 2010 SP1 Beta installed, in order to connect to Office 365 you must first uninstall the beta service pack. After you have uninstalled the service pack, you can then run Office 365 desktop setup and connect your Office 2010 applications to Office 365.

In addition, if you are using Office 365 you cannot install the beta service pack for Office 2010; installing the beta service pack will interrupt connectivity with Office 365.

Users unable to connect Office 365 to pre-release versions of Office
March 7, 2011

If you are unable update your version of Microsoft Office so that it works with Office 365, check that you don't have a pre-release version of Office, such as a beta version. Office 365 does not support pre-release versions of Office; please uninstall the pre-release version of Office and install a released version, such as Office Professional Plus, instead.

Back to Table of Contents

Other

Federated users of Mozilla Firefox need to apply registry setting for successful sign in to Office 365
June 6, 2011

When a user tries to sign in to the Office 365 portal on the Mozilla Firefox web browser using their federated credentials, they may be prompted repeatedly for their credentials without successfully being signed in, even when they enter the correct user name and password.

To make sign-in successful, apply the following registry setting to the user’s computer:

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa]
"SuppressExtendedProtection"=dword:00000001
"LmCompatibilityLevel"=dword:00000003

Back to Table of Contents

• Share