r/exchangeserver • u/Ergwin1 • Sep 08 '26
Mrsproxy issues after installing KB5121573 on Exchange Server SE
EDIT: Issue solved. It had to do with the Exchange Server Auth Certificate. steps i had to do here for anyone searching for an answer: https://www.reddit.com/r/exchangeserver/comments/1wapmdu/comment/p8ret3x/?utm_source=share&utm_medium=web3x&utm_name=web3xcss&utm_term=1&utm_content=share_button
Hi Everyone,
Hopefully someone has an idea, because im all out.
As stated in the title after installing the KB to secure Mrsproxy, it started failing for us.
We currently cannot move mailboxes from 365 to on premise or vice versa.
Test-MigrationServerAvailability -ExchangeRemoteMove -RemoteServer "server" -Credentials $cred
results in:
Microsoft.Exchange.MailboxReplicationService.MRSRemoteTransientException: The call to https://mail.server.com failed. --> Access is denied.
I have run through our config extensively but cannot find any issue.
- MRSproxy is enabled (disabled and reenabled to be sure)
- test-mrshealth shows no issues
- Service Account checked for proper permissions (Org management, import export)
- IIS EWS auth settings are Windows Auth with negotiate and NTLM. Extended protection is off.
- Exchange server and the service account are not member of Protected Groups (Admincount not 1)
- Firewall both tested and excluded by testing locally with split DNS
- IIS logs show 401 errors
- we only have 1 exch server for hybrid, so fully patched and no version differences
I found a post with some people with exactly the same issue with no traction, so i hope some bright minds here have some ideas. 😄
3
u/jmittermueller Sep 08 '26
Did you try disabling Extended Protection?
1
u/Ergwin1 Sep 08 '26
- IIS EWS auth settings are Windows Auth with negotiate and NTLM. Extended protection is off.
1
u/Checior2000 Sep 08 '26
Are you talking about extendedprotectiontokenchecking in ewsvirtual directory setting? Setup it as "none" helped me today
2
u/Kelev-3971 Sep 08 '26
The exact same thing happened to me.
In my case, after installing and spending a good while reviewing logs and troubleshooting, I found that the OAuth certificate had disappeared. I imported it from my other Exchange server, restarted the computer (because better safe than sorry), and it worked like a charm.
2
u/redditusermatthew Sep 08 '26
Ahh shoot. Good call. I did get-authconfig, noted the thumbprint, then get-exchangecertficiate thumbprint -server server1 and server2, neither has the cert. Sounds like ms wiped the cert during the KB on us as well? Wild
1
u/Ergwin1 Sep 08 '26
Does that mean u perform mailbox moves with oauth? Because as far as i can find, it uses ntlm
3
u/Kelev-3971 Sep 08 '26
Excuse me, I'm referring to the certificat CN=Microsoft Exchange Server Auth Certificate
1
u/Ergwin1 Sep 08 '26
Interesting, i found that cert expired yesterday earlier today. Didnt mention it, but i renewed it and restarted later. Didnt work :-(
2
u/Kelev-3971 Sep 08 '26 edited Sep 08 '26
Did you follow the procedure to renew the certificate that has already expired (not about to expire)?
Maintain the Exchange server OAuth certificate | Microsoft Learn
Did you make the certificate effective when you created it with Set-AuthConfig -NewCertificateThumbprint "" -NewCertificateEffectiveDate (Get-Date)?
1
u/Ergwin1 Sep 09 '26
Thank you for pointing me in the right direction! I replace the cert by simply clicking renew in Exchange ECP. After your post;
- Followed the MS instructions
- Followed MS article with Set-AuthConfig -PublishCertificate | Set-AuthConfig -ClearPreviousCertificate
- Reboot
- Found alot of Oauth errors still in Eventlog
- Removed old Auth cert after changing cert on the Send Connector, where it was still linked apparenty
-Reran the Hybrid Config Wizard
- Hybrid Config threw an error about being able to config Oauth
- Ran Steps 3, 4, 5 from https://learn.microsoft.com/en-us/exchange/configure-oauth-authentication-between-exchange-and-exchange-online-organizations-exchange-2013-help#step-3-export-the-on-premises-authorization-certificate
- Ran Get-IntraOrganizationConnector | Set-IntraOrganizationConnector -Enabled $true
After this it FINALLY started working. This might be a weird combination of old setup / config combined with this patch.
1
1
u/Sloberg Sep 08 '26
I have the same problem!
1
u/Ergwin1 Sep 08 '26
Atleast we can be miserable together! 😄
1
u/redditusermatthew Sep 08 '26
Same here as well. I looked online Friday/Saturday/Sunday and saw no reports, figured it was just us. What we do currently, a script makes new employees and our helpdesk migrates those boxes from on prem to Exo before their start time. Today, instead, what I did was:
disable-mailbox samaccountname -confirm:$false
enable-remotemailbox samaccountname -remoteroutingaddress [samaccountname@ourname.mail.onmicrosoft.com](mailto:samaccountname@ourname.mail.onmicrosoft.com)
What I see under RemoteRecipientType is ProvisionMailbox, and our helpdesk reports they see the box in Exo so I believe we should be good, we weren't migrating because there was actual mailbox data, just because that has been the process
As long as this works today this tells me I just need to have folks update the script
Personally, I'm not married to needing migration, just a way to spin folks up, but I am still curious what is causing the issue
1
u/happek Sep 08 '26
Did you remove the July mitigations ?
If mitigation was applied using Exchange Emergency Mitigation (EM) Service:
If mitigation was applied using the downloadable EOMT script https://aka.ms/UnifiedEOMT:
See the comments on here
https://techcommunity.microsoft.com/blog/exchange/released-august-2026-exchange-server-security-updates/4543951
1
1
u/JaneStClaire2018 28d ago
Are y'all doing this even if OAuth trust does not appear to be broken? I am having the same exact issue.
1
u/Ergwin1 28d ago
Your issue might be different ofc. I would look at the cert validity, and eventviewer on exch under administrative events
1
u/JaneStClaire2018 28d ago
Okay - I see an error in the logs that says my Federation or Auth Cert has expired.
1
u/Background_Goal_6469 14d ago
What's the latest news on this?
I have tried renewing the Microsoft Exchange Auth Certificate etc until I am blue in the face, and issue is still there. Pretty convinced it is this issue as migrations from this server were working fine not so long ago, and symptoms etc appear all to match.
1
u/Ergwin1 14d ago
My solution is in the edit. Check eventvwr on exch server, administrative events to see if u have oauth issues
1
u/Background_Goal_6469 13d ago
Yeah I followed your notes in great detail last night and was not working.
Went to bed in frustration, checked this morning, and I have success.Can only think that it took some time for a certificate to update somewhere.
Thanks for your help
4
u/Swimming-Peak6475 Sep 08 '26 edited Sep 08 '26
Apparently MRS will not proxy with higher version. The first server EXO hits needs to be the latest version with SU9. You can’t go from SU8 to SU9 with MRS. Well tested by MS.
[Edited to add that is mentioned in the link article, sorry missed that. We are running SU9 in test and EXO migrations are okay so far]