We are experiencing the same problem, but we installed a new Server 2025 Exchange Server, then installed Exchange Server 2019 CU15, and noticed we couldn't access the Local Exchange Admin Console (PowerShell) on the new server, we veried WinRM, IIS Virtual Directory Permissions and Modules, we can access the EAC from the older 2016 Exchange Server and connect to the newere Exchange 2019 server, and can launch the Toolbox and see that email is flowing via the Queue on the new server, but can't launch locally. We have discovered the following:
Key Findings:
- ✅ WebAdministration module loaded
- ✅ WinRM functional and responding
- ✅ Exchange install path validated
- ✅ Default Web Site bindings for HTTP & HTTPS confirmed
- ✅ PowerShell vDir identified
- ⚠️ Remote PowerShell (HTTP) failed due to missing/invalid content type
We can't run locally the Exchange Health Check script https://github.com/microsoft/CSS-Exchange/blob/main/Diagnostics/HealthChecker/HealthChecker.ps1 on the new server but on the old it can pull the information from the new server, but any attempt to run the EMC or Toolbox is failing. We have validated the SPNs are registered and compared the old with the new server, but the difference is the old server is running on Server OS 2016 and the newer Server is Server 2025 with the latest Windows July 2025 Updates.
We believe the issue is related to Kerberos authentication or local loopback authentication being blocked when the shell is called:
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -noexit -command ". 'E:\Program Files\Microsoft\Exchange Server\V15\bin*RemoteExchange.ps1*'; Connect-ExchangeServer -auto -ClientApplication:ManagementShell "
We have followed all of the steps listed in these two articles and still no luck:
https://learn.microsoft.com/en-us/troubleshoot/exchange/administration/connecting-remote-server-failed
I am very curios if you have resolved it. As a final hope we went ahead and upgraded this Exchange 2019CU15 Hybrid Server to the recently release Exchange SE (Subscription Edition) and licensed it using the Hybrid Wizard. Mail flows from the server as we have tested it, but can't manage it locally on the server, and some remote testing options won't work remotely such as Test-Mailflow -Identity EXCHANGESERVER, but will work locally on the server itself.
Looking for clues on what Kerberos or WinRM or other permissions settings that might block this from working on the new Server 2025 now running Exchange SE RTM. Our goal is to retire the Exchange 2016 Server running on Server 2016 and replace it exclusively with the Exchange SE Server now running on Server OS 2025 with July 2025 updates. We only use this server for Account Management on-premise for Office 365 Users, and SMTP mailrelay.