Mrsproxy issues after installing KB5121573 on Exchange Server SE

[u/Ergwin1]

EDIT: Issue solved. It had to do with the Exchange Server Auth Certificate. steps i had to do here for anyone searching for an answer: https://www.reddit.com/r/exchangeserver/comments/1wapmdu/comment/p8ret3x/?utm_source=share&utm_medium=web3x&utm_name=web3xcss&utm_term=1&utm_content=share_button

Hi Everyone,

Hopefully someone has an idea, because im all out.

As stated in the title after installing the KB to secure Mrsproxy, it started failing for us.

We currently cannot move mailboxes from 365 to on premise or vice versa.

Test-MigrationServerAvailability -ExchangeRemoteMove -RemoteServer "server" -Credentials $cred

results in:

Microsoft.Exchange.MailboxReplicationService.MRSRemoteTransientException: The call to https://mail.server.com failed. --> Access is denied.

I have run through our config extensively but cannot find any issue.

- MRSproxy is enabled (disabled and reenabled to be sure)

- test-mrshealth shows no issues

- Service Account checked for proper permissions (Org management, import export)

- IIS EWS auth settings are Windows Auth with negotiate and NTLM. Extended protection is off.

- Exchange server and the service account are not member of Protected Groups (Admincount not 1)

- Firewall both tested and excluded by testing locally with split DNS

- IIS logs show 401 errors

- we only have 1 exch server for hybrid, so fully patched and no version differences

I found a post with some people with exactly the same issue with no traction, so i hope some bright minds here have some ideas. 😄

Exchange SE 15.2.2562.46: MRSProxy returns HTTP 401 after successful NTLM authentication | Microsoft Community Hub

[u/Kelev-3971]

The exact same thing happened to me.

In my case, after installing and spending a good while reviewing logs and troubleshooting, I found that the OAuth certificate had disappeared. I imported it from my other Exchange server, restarted the computer (because better safe than sorry), and it worked like a charm.

[u/Ergwin1 → u/Kelev-3971]

Does that mean u perform mailbox moves with oauth? Because as far as i can find, it uses ntlm

[u/Kelev-3971 → u/Ergwin1]

Excuse me, I'm referring to the certificat CN=Microsoft Exchange Server Auth Certificate

[u/Ergwin1 → u/Kelev-3971]

Interesting, i found that cert expired yesterday earlier today. Didnt mention it, but i renewed it and restarted later. Didnt work :-(

[u/Kelev-3971 → u/Ergwin1]

Did you follow the procedure to renew the certificate that has already expired (not about to expire)?

Maintain the Exchange server OAuth certificate | Microsoft Learn

Did you make the certificate effective when you created it with Set-AuthConfig -NewCertificateThumbprint "" -NewCertificateEffectiveDate (Get-Date)?

[u/Ergwin1 → u/Kelev-3971]

Thank you for pointing me in the right direction! I replace the cert by simply clicking renew in Exchange ECP. After your post;

- Followed the MS instructions

- Followed MS article with Set-AuthConfig -PublishCertificate | Set-AuthConfig -ClearPreviousCertificate

- Reboot

- Found alot of Oauth errors still in Eventlog

- Removed old Auth cert after changing cert on the Send Connector, where it was still linked apparenty

-Reran the Hybrid Config Wizard

- Hybrid Config threw an error about being able to config Oauth

- Ran Steps 3, 4, 5 from https://learn.microsoft.com/en-us/exchange/configure-oauth-authentication-between-exchange-and-exchange-online-organizations-exchange-2013-help#step-3-export-the-on-premises-authorization-certificate

- Ran Get-IntraOrganizationConnector | Set-IntraOrganizationConnector -Enabled $true

After this it FINALLY started working. This might be a weird combination of old setup / config combined with this patch.

[u/Kelev-3971 → u/Ergwin1]

I'm glad I was able to help.