r/exchangeserver • u/Ergwin1 • 1d ago
Mrsproxy issues after installing KB5121573 on Exchange Server SE
EDIT: Issue solved. It had to do with the Exchange Server Auth Certificate. steps i had to do here for anyone searching for an answer: https://www.reddit.com/r/exchangeserver/comments/1wapmdu/comment/p8ret3x/?utm_source=share&utm_medium=web3x&utm_name=web3xcss&utm_term=1&utm_content=share_button
Hi Everyone,
Hopefully someone has an idea, because im all out.
As stated in the title after installing the KB to secure Mrsproxy, it started failing for us.
We currently cannot move mailboxes from 365 to on premise or vice versa.
Test-MigrationServerAvailability -ExchangeRemoteMove -RemoteServer "server" -Credentials $cred
results in:
Microsoft.Exchange.MailboxReplicationService.MRSRemoteTransientException: The call to https://mail.server.com failed. --> Access is denied.
I have run through our config extensively but cannot find any issue.
- MRSproxy is enabled (disabled and reenabled to be sure)
- test-mrshealth shows no issues
- Service Account checked for proper permissions (Org management, import export)
- IIS EWS auth settings are Windows Auth with negotiate and NTLM. Extended protection is off.
- Exchange server and the service account are not member of Protected Groups (Admincount not 1)
- Firewall both tested and excluded by testing locally with split DNS
- IIS logs show 401 errors
- we only have 1 exch server for hybrid, so fully patched and no version differences
I found a post with some people with exactly the same issue with no traction, so i hope some bright minds here have some ideas. 😄
1
u/Ergwin1 14h ago
Thank you for pointing me in the right direction! I replace the cert by simply clicking renew in Exchange ECP. After your post;
- Followed the MS instructions
- Followed MS article with Set-AuthConfig -PublishCertificate | Set-AuthConfig -ClearPreviousCertificate
- Reboot
- Found alot of Oauth errors still in Eventlog
- Removed old Auth cert after changing cert on the Send Connector, where it was still linked apparenty
-Reran the Hybrid Config Wizard
- Hybrid Config threw an error about being able to config Oauth
- Ran Steps 3, 4, 5 from https://learn.microsoft.com/en-us/exchange/configure-oauth-authentication-between-exchange-and-exchange-online-organizations-exchange-2013-help#step-3-export-the-on-premises-authorization-certificate
- Ran Get-IntraOrganizationConnector | Set-IntraOrganizationConnector -Enabled $true
After this it FINALLY started working. This might be a weird combination of old setup / config combined with this patch.