Page 47 – Azure365Pro.com

The HTTP request was forbidden with client authentication scheme ‎’Negotiate‎’

Satheshwaran Manoharan

-

January 7, 2018

Exchange Server 2016 Hybrid Server , Hybrid remote move Migration Error.

Error: MigrationTransientException: The call to ?’https://mail.careexchange.in/EWS/mrsproxy.svc?’ failed. Error details: The HTTP request was forbidden with client authentication scheme ?’Negotiate?’. –> The remote server returned an error: ?(403)? Forbidden.. –> The call to ?’https://mail.careexchange.in/EWS/mrsproxy.svc?’ failed. Error details: The HTTP request was forbidden with client authentication scheme ?’Negotiate?’. –> The remote server returned an error: ?(403)? Forbidden.. –> The HTTP request was forbidden with client authentication scheme ?’Negotiate?’. –> The remote server returned an error: ?(403)? Forbidden.
Report: anon@careexchange.in

Make sure MRS Proxy is Enabled.

Get-WebServicesVirtualDirectory –identity SERVERNAME\EWS (Default Web Site) | FL MrsProxy*

To Enable

Set-WebServicesVirtualDirectory –identity SERVERNAME\EWS (Default Web Site)  -MRSProxyEnabled $true

To Disable

Set-WebServicesVirtualDirectory –identity SERVERNAME\EWS (Default Web Site)  -MRSProxyEnabled $false

In my case MRS Proxy is already Enabled. Enabling Basic Authentication on Web Services Virtual Directory resolved the issue.

Set-WebServicesVirtualDirectory –identity SERVERNAME\EWS (Default Web Site) -BasicAuthentication $TRUE

Outlook Web App X-OWA-Error ExAssertException

Satheshwaran Manoharan

-

December 31, 2017

9

Once installing Exchange 2016 Cu8 on Windows Server 2012 R2 gave error on OWA.

ECP will work if administrator doesn’t have a mailbox. else even ecp will throw the same error.

An unexpected error occurred and your request couldn’t be handled.
X-ClientId: F554643C29C44C22B59A1DF6E706EB91
request-id bd391bdf-5057-4d0e-8a4d-c5a4f42f22d2
X-OWA-Error Microsoft.Exchange.Diagnostics.ExAssertException
X-OWA-Version 15.1.1415.2
X-FEServer EXCH2016
X-BEServer EXCH2016

Search for Event 2004 to make sure you are having issues with the auth certificate-

Log Name:      Application
Source:        MSExchange OAuth
Event ID:      2004
Task Category: Configuration
Level:         Warning
Computer:      EXCH2016.careexchange.in
Description:
Unable to find the certificate with thumbprint A9BBA1727F285CD86EB5785DF47C0A19DA997280 in the current computer or the certificate is missing private key. The certificate is needed to sign the outgoing token.

Solution –

Creating a new Exch Auth Certificate. Resolved the issue.

Ran below , Saw Auth certificate missing.

Get-ExchangeCertificate (Get-AuthConfig).CurrentCertificateThumbprint

Created a new certificate . Change to your default domain on the end of the command.

New-ExchangeCertificate -KeySize 2048 -PrivateKeyExportable $true -SubjectName "cn=Microsoft Exchange Server Auth Certificate" -FriendlyName "Microsoft Exchange Server Auth Certificate" -DomainName "careexchange.in"

Say no to Replace SMTP Certificate.

Run

Set-AuthConfig –PublishCertificate

Set-AuthConfig –ClearPreviousCertificate

Then run

Get-ExchangeCertificate (Get-AuthConfig).CurrentCertificateThumbprint

verified auth certificate created successfully. Do iis reset. wait for few hours if its a large environment. it should resolve the same.

Run below if still issue persists.

Locate bin folder and run updatecas.ps1 and updateConfigfile.ps1 resolved for few others.

Other things i have tried –

Took Backup – Tried Removing msExchCanaryData0/1/2. No luck

Uninstall and re install the server. No Luck

Outlook rules is Inbox Rules in Outlook Web App

Satheshwaran Manoharan

-

December 20, 2017

0

How to find your Outlook Rules in the Outlook web app.

Login to https://outlook.office.com/

Settings – Search for Inbox Rules

Export and Import Transport Rules in Exchange Online

Satheshwaran Manoharan

-

December 20, 2017

1

Export and Import Transport Rules in Exchange Online

Lets see in a hybrid in Environment. We got to move the transport Rules from On-Premises Server to Office 365. So that transport rules will still work when mail flow hits the cloud for Mail processing.

Export XML file from On premises Server –

$file = Export-TransportRuleCollection

Set-Content -Path "C:\Scripts\Rules.xml" -Value $file.FileData -Encoding Byte

Connect to Exchange Online PowerShell –

$UserCredential = Get-Credential

$Session = New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri https://outlook.office365.com/powershell-liveid/ -Credential $UserCredential -Authentication Basic -AllowRedirection

Import-PSSession $Session

Import XML file to Office 365 –

[Byte[]]$Data = Get-Content -Path "C:\Scripts\Rules.xml" -Encoding Byte -ReadCount 0

Import-TransportRuleCollection -FileData $Data

Note : Import from Exchange 2010 Server is not Supported. Error : It cannot be used with a engine-based XML File is Datacenter Environment.

Dump All Proxy Address from Exchange Server

Satheshwaran Manoharan

-

December 11, 2017

2

Dump All Proxy Address from Exchange Server

Dump All Proxy Address/Email Addresses from Exchange Server using PowerShell.

Mailboxes –

Get-Mailbox -ResultSize Unlimited | Select-Object DisplayName,Servername,EmailAddressPolicyEnabled,PrimarysmtpAddress, @{Name=&quot;EmailAddresses&quot;;Expression={$_.EmailAddresses | Where-object {$_.PrefixString -ceq &quot;smtp&quot;} |Foreach-object {$_.SmtpAddress}}} | Export-Csv EmailAddresses_MBX_Dump.csv

Distribution Groups –

Get-DistributionGroup -ResultSize Unlimited | Select-Object DisplayName,Servername,EmailAddressPolicyEnabled,PrimarysmtpAddress, @{Name=&quot;EmailAddresses&quot;;Expression={$_.EmailAddresses | Where-object {$_.PrefixString -ceq &quot;smtp&quot;} |Foreach-object {$_.SmtpAddress}}} | Export-Csv EmailAddresses_DG_Dump.csv

Mail Contacts –

Get-MailContact -ResultSize Unlimited | Select-Object DisplayName,Servername,EmailAddressPolicyEnabled,PrimarysmtpAddress, @{Name=&quot;EmailAddresses&quot;;Expression={$_.EmailAddresses | Where-object {$_.PrefixString -ceq &quot;smtp&quot;} |Foreach-object {$_.SmtpAddress}}} | Export-Csv EmailAddresses_Contact_Dump.csv

you can create a CSV as below,

Enable Password Write back on existing Azure AD Connect

Satheshwaran Manoharan

-

December 10, 2017

0

Enable Password Write back on existing Azure AD Connect

By Default Azure AD Connect synchronizes password one way only , From On-Premises to Cloud and it won’t allow the user to reset the password on cloud.

To Enable the user to reset the password on Cloud , Password Write back as to be enabled.

It needs additional licenses – License Required for Password Write back –

See below – if you don’t know where the Azure AD Connect server is deployed in the forest.

https://www.azure365pro.com/finding-the-azure-ad-connect-server-in-the-forest/

Run the Azure AD Connect setup. you can see password write back on optional features.

Check box on Password write back.

Wait for the Event 31005 to Appear. Which notifies the completion of the process.

Now Check on Outlook web Access –

Without password Write back –

https://mail.office365.com –> My Account

After password Write back Enabled –

The HTTP request was forbidden with client authentication scheme ‎’Negotiate‎’

Outlook Web App X-OWA-Error ExAssertException

Outlook rules is Inbox Rules in Outlook Web App

Export and Import Transport Rules in Exchange Online

Dump All Proxy Address from Exchange Server

Enable Password Write back on existing Azure AD Connect

EDITOR PICKS

Deploying a React + Vite Application to Azure App Service with Azure DevOps Pipelines

How to Configure VNet Peering in Azure

How to Create a SharePoint Site

POPULAR POSTS

Find Licensed & Unlicensed Users in Microsoft 365 Using PowerShell

Troubleshoot “Invalid Latest Package Version” Error in Microsoft Endpoint Admin Center

How to Set Google as the Default Search Engine in Microsoft Edge Using Intune: A Step-by-Step Guide

POPULAR CATEGORY

ABOUT ME

FOLLOW US