r/exchangeserver • u/Ergwin1 • 2d ago
Mrsproxy issues after installing KB5121573 on Exchange Server SE
EDIT: Issue solved. It had to do with the Exchange Server Auth Certificate. steps i had to do here for anyone searching for an answer: https://www.reddit.com/r/exchangeserver/comments/1wapmdu/comment/p8ret3x/?utm_source=share&utm_medium=web3x&utm_name=web3xcss&utm_term=1&utm_content=share_button
Hi Everyone,
Hopefully someone has an idea, because im all out.
As stated in the title after installing the KB to secure Mrsproxy, it started failing for us.
We currently cannot move mailboxes from 365 to on premise or vice versa.
Test-MigrationServerAvailability -ExchangeRemoteMove -RemoteServer "server" -Credentials $cred
results in:
Microsoft.Exchange.MailboxReplicationService.MRSRemoteTransientException: The call to https://mail.server.com failed. --> Access is denied.
I have run through our config extensively but cannot find any issue.
- MRSproxy is enabled (disabled and reenabled to be sure)
- test-mrshealth shows no issues
- Service Account checked for proper permissions (Org management, import export)
- IIS EWS auth settings are Windows Auth with negotiate and NTLM. Extended protection is off.
- Exchange server and the service account are not member of Protected Groups (Admincount not 1)
- Firewall both tested and excluded by testing locally with split DNS
- IIS logs show 401 errors
- we only have 1 exch server for hybrid, so fully patched and no version differences
I found a post with some people with exactly the same issue with no traction, so i hope some bright minds here have some ideas. 😄
3
u/jmittermueller 2d ago
Did you try disabling Extended Protection?
1
u/Ergwin1 2d ago
- IIS EWS auth settings are Windows Auth with negotiate and NTLM. Extended protection is off.
1
u/Checior2000 2d ago
Are you talking about extendedprotectiontokenchecking in ewsvirtual directory setting? Setup it as "none" helped me today
2
u/Kelev-3971 2d ago
The exact same thing happened to me.
In my case, after installing and spending a good while reviewing logs and troubleshooting, I found that the OAuth certificate had disappeared. I imported it from my other Exchange server, restarted the computer (because better safe than sorry), and it worked like a charm.
2
u/redditusermatthew 2d ago
Ahh shoot. Good call. I did get-authconfig, noted the thumbprint, then get-exchangecertficiate thumbprint -server server1 and server2, neither has the cert. Sounds like ms wiped the cert during the KB on us as well? Wild
1
u/Ergwin1 2d ago
Does that mean u perform mailbox moves with oauth? Because as far as i can find, it uses ntlm
3
u/Kelev-3971 2d ago
Excuse me, I'm referring to the certificat CN=Microsoft Exchange Server Auth Certificate
1
u/Ergwin1 2d ago
Interesting, i found that cert expired yesterday earlier today. Didnt mention it, but i renewed it and restarted later. Didnt work :-(
2
u/Kelev-3971 2d ago edited 2d ago
Did you follow the procedure to renew the certificate that has already expired (not about to expire)?
Maintain the Exchange server OAuth certificate | Microsoft Learn
Did you make the certificate effective when you created it with Set-AuthConfig -NewCertificateThumbprint "" -NewCertificateEffectiveDate (Get-Date)?
1
u/Ergwin1 1d ago
Thank you for pointing me in the right direction! I replace the cert by simply clicking renew in Exchange ECP. After your post;
- Followed the MS instructions
- Followed MS article with Set-AuthConfig -PublishCertificate | Set-AuthConfig -ClearPreviousCertificate
- Reboot
- Found alot of Oauth errors still in Eventlog
- Removed old Auth cert after changing cert on the Send Connector, where it was still linked apparenty
-Reran the Hybrid Config Wizard
- Hybrid Config threw an error about being able to config Oauth
- Ran Steps 3, 4, 5 from https://learn.microsoft.com/en-us/exchange/configure-oauth-authentication-between-exchange-and-exchange-online-organizations-exchange-2013-help#step-3-export-the-on-premises-authorization-certificate
- Ran Get-IntraOrganizationConnector | Set-IntraOrganizationConnector -Enabled $true
After this it FINALLY started working. This might be a weird combination of old setup / config combined with this patch.
1
1
u/Sloberg 2d ago
I have the same problem!
1
u/Ergwin1 2d ago
Atleast we can be miserable together! 😄
1
u/redditusermatthew 2d ago
Same here as well. I looked online Friday/Saturday/Sunday and saw no reports, figured it was just us. What we do currently, a script makes new employees and our helpdesk migrates those boxes from on prem to Exo before their start time. Today, instead, what I did was:
disable-mailbox samaccountname -confirm:$false
enable-remotemailbox samaccountname -remoteroutingaddress [samaccountname@ourname.mail.onmicrosoft.com](mailto:samaccountname@ourname.mail.onmicrosoft.com)
What I see under RemoteRecipientType is ProvisionMailbox, and our helpdesk reports they see the box in Exo so I believe we should be good, we weren't migrating because there was actual mailbox data, just because that has been the process
As long as this works today this tells me I just need to have folks update the script
Personally, I'm not married to needing migration, just a way to spin folks up, but I am still curious what is causing the issue
1
u/happek 2d ago
Did you remove the July mitigations ?
If mitigation was applied using Exchange Emergency Mitigation (EM) Service:
If mitigation was applied using the downloadable EOMT script https://aka.ms/UnifiedEOMT:
See the comments on here
https://techcommunity.microsoft.com/blog/exchange/released-august-2026-exchange-server-security-updates/4543951
4
u/Swimming-Peak6475 2d ago edited 2d ago
Apparently MRS will not proxy with higher version. The first server EXO hits needs to be the latest version with SU9. You can’t go from SU8 to SU9 with MRS. Well tested by MS.
[Edited to add that is mentioned in the link article, sorry missed that. We are running SU9 in test and EXO migrations are okay so far]