ECP
5 Topicsupgrading from exchange 2013 to 2019, new install of 2019..cannot login to ecp or owa
hi, thanks in advance for your help. i have an existing small environment. it consists of a pair of 2022 domain controllers, the domain/forest level is set to 2016. I have an existing 2012 (not r2) server running exchange 2013 and a brand new 2022 server with newly installed exchange 2019. everything is patched fully. the install of 2019 proceeded without error. however, i cannot login to either owa or ecp on the 2019 server. when i try, i just get sent back to the login screen. in the event log, i see this warning: Event code: 3005 Event message: An unhandled exception has occurred. Event time: 8/7/2023 1:09:12 PM Event time (UTC): 8/7/2023 5:09:12 PM Event ID: 31c12d2579ac4779bfec01933febc091 Event sequence: 2 Event occurrence: 1 Event detail code: 0 Application information: Application domain: /LM/W3SVC/2/ROOT/owa-1-133359017471842518 Trust level: Full Application Virtual Path: /owa Application Path: D:\Program Files\Microsoft\Exchange Server\V15\ClientAccess\owa\ Machine name: HOME-EXCH1 Process information: Process ID: 472 Process name: w3wp.exe Account name: NT AUTHORITY\SYSTEM Exception information: Exception type: TargetInvocationException Exception message: Exception has been thrown by the target of an invocation. at System.RuntimeMethodHandle.InvokeMethod(Object target, Object[] arguments, Signature sig, Boolean constructor) at System.Reflection.RuntimeMethodInfo.UnsafeInvokeInternal(Object obj, Object[] parameters, Object[] arguments) at System.Reflection.RuntimeMethodInfo.Invoke(Object obj, BindingFlags invokeAttr, Binder binder, Object[] parameters, CultureInfo culture) at Owin.Loader.DefaultLoader.<>c__DisplayClass12.<MakeDelegate>b__b(IAppBuilder builder) at Owin.Loader.DefaultLoader.<>c__DisplayClass1.<LoadImplementation>b__0(IAppBuilder builder) at Microsoft.Owin.Host.SystemWeb.OwinAppContext.Initialize(Action`1 startup) at Microsoft.Owin.Host.SystemWeb.OwinBuilder.Build(Action`1 startup) at Microsoft.Owin.Host.SystemWeb.OwinHttpModule.InitializeBlueprint() at System.Threading.LazyInitializer.EnsureInitializedCore[T](T& target, Boolean& initialized, Object& syncLock, Func`1 valueFactory) at Microsoft.Owin.Host.SystemWeb.OwinHttpModule.Init(HttpApplication context) at System.Web.HttpApplication.RegisterEventSubscriptionsWithIIS(IntPtr appContext, HttpContext context, MethodInfo[] handlers) at System.Web.HttpApplication.InitSpecial(HttpApplicationState state, MethodInfo[] handlers, IntPtr appContext, HttpContext context) at System.Web.HttpApplicationFactory.GetSpecialApplicationInstance(IntPtr appContext, HttpContext context) at System.Web.Hosting.PipelineRuntime.InitializeApplication(IntPtr appContext) ID1039: The certificate's private key could not be accessed. Ensure the access control list (ACL) on the certificate's private key grants access to the application pool user. Thumbprint: '9F650D5586F179E05BA85AE833DFB66044CA2F08' at System.IdentityModel.X509Util.EnsureAndGetPrivateRSAKey(X509Certificate2 certificate) at System.IdentityModel.RsaEncryptionCookieTransform..ctor(X509Certificate2 certificate) at Microsoft.Exchange.Security.Authentication.OAuthExtension.DataHandler.RsaGenericDataProtector..ctor(X509Certificate2[] certificates) at Microsoft.Exchange.Clients.Owa2.Server.Core.notifications.SignalR.SignalRStartup.Configuration(IAppBuilder app) Invalid provider type specified. at System.Security.Cryptography.Utils.CreateProvHandle(CspParameters parameters, Boolean randomKeyContainer) at System.Security.Cryptography.Utils.GetKeyPairHelper(CspAlgorithmType keyType, CspParameters parameters, Boolean randomKeyContainer, Int32 dwKeySize, SafeProvHandle& safeProvHandle, SafeKeyHandle& safeKeyHandle) at System.Security.Cryptography.RSACryptoServiceProvider.GetKeyPair() at System.Security.Cryptography.RSACryptoServiceProvider..ctor(Int32 dwKeySize, CspParameters parameters, Boolean useDefaultKeySize) at System.Security.Cryptography.X509Certificates.X509Certificate2.get_PrivateKey() at System.IdentityModel.X509Util.EnsureAndGetPrivateRSAKey(X509Certificate2 certificate) Request information: Request URL: https://localhost:444/owa/proxylogon.owa Request path: /owa/proxylogon.owa User host address: 127.0.0.1 User: Is authenticated: False Authentication Type: Thread account name: NT AUTHORITY\SYSTEM Thread information: Thread ID: 13 Thread account name: NT AUTHORITY\SYSTEM Is impersonating: False Stack trace: at System.RuntimeMethodHandle.InvokeMethod(Object target, Object[] arguments, Signature sig, Boolean constructor) at System.Reflection.RuntimeMethodInfo.UnsafeInvokeInternal(Object obj, Object[] parameters, Object[] arguments) at System.Reflection.RuntimeMethodInfo.Invoke(Object obj, BindingFlags invokeAttr, Binder binder, Object[] parameters, CultureInfo culture) at Owin.Loader.DefaultLoader.<>c__DisplayClass12.<MakeDelegate>b__b(IAppBuilder builder) at Owin.Loader.DefaultLoader.<>c__DisplayClass1.<LoadImplementation>b__0(IAppBuilder builder) at Microsoft.Owin.Host.SystemWeb.OwinAppContext.Initialize(Action`1 startup) at Microsoft.Owin.Host.SystemWeb.OwinBuilder.Build(Action`1 startup) at Microsoft.Owin.Host.SystemWeb.OwinHttpModule.InitializeBlueprint() at System.Threading.LazyInitializer.EnsureInitializedCore[T](T& target, Boolean& initialized, Object& syncLock, Func`1 valueFactory) at Microsoft.Owin.Host.SystemWeb.OwinHttpModule.Init(HttpApplication context) at System.Web.HttpApplication.RegisterEventSubscriptionsWithIIS(IntPtr appContext, HttpContext context, MethodInfo[] handlers) at System.Web.HttpApplication.InitSpecial(HttpApplicationState state, MethodInfo[] handlers, IntPtr appContext, HttpContext context) at System.Web.HttpApplicationFactory.GetSpecialApplicationInstance(IntPtr appContext, HttpContext context) at System.Web.Hosting.PipelineRuntime.InitializeApplication(IntPtr appContext) Custom event details: i see a lot of info on the web about permissions to private keys but i have checked and the app pool user is localsystem, and system has full access to the keys. i also see some information about the provider type but this cert was generated by the install.....so would it generate a cert it could not use?? i have working on this for days and am going around in circles. i really appreciate anyone's help on this! thanksSolved2.9KViews0likes11CommentsIntermittently ECP access denied on local computer
when trying to access ecp from user local machine intermittently we will get the http error 403, access was denied. however if we refresh the page couple time it will eventually let us through. this behavior only observed in local computer, if we try to access ecp from exchange server the issue cannot be reproduced. if anyone encounter such issue before and any resolution so far. Thank you in advanced.1.1KViews0likes2CommentsExchange 2019 CU 12 update - One DC object not found in ECP
Hello, The environment consists of one domain, one EX2019 server and DC1 and DC2 which are replicated. After upgrading Exchange 2019 to the latest CU 12 release, when selecting on objects in the virtual directories list within ecp, the following message appears on the right side where the virtual directory: 'The operation couldn't be performed because object '' couldn't be found on 'dc1.domain.local'. - Screenshot attached. Unselecting and selecting it again, resolves this and the information is now displayed properly. This happens with all virtual dirictory items upon initial selection in the panel. The error message in the Command Logging tool is: \"+e)}}return!0}return Logger.info(\"performSourceBufferOperation(): Raw source buffer not instantiated yet.\"+e),!1}catch(g){return Logger.error(\"performSourceBufferOperation: Exception:\"+g.message+e),!1}},this.processAddSourceBufferMessage=function(a){var b=this,c=null;if(!a||typeof a.id!=\"number\"||typeof a.mimeType!=\"string\")return Logger.error(\"processAddSourceBufferMessage(): Invalid parameter.\"),!1;if(this._mediaSource==null)return Logger.error(\"processAddSourceBufferMessage(): Media Source is NULL.\"),!1;if(!MediaSource.isTypeSupported(a.mimeType))return Logger.error(\"processAddSourceBufferMessage(): MimeType is not supported. MimeType = \"+a.mimeType),!1;var d=function(e){try{c=b._mediaSource.addSourceBuffer(a.mimeType),b.updatePlayerSourceBufferFromId(a.id,c,\"sourceOpen\"),c.id=a.id,Logger.info(\"sourceOpen(): Source buffer added, Id = \"+a.id+\", mimeType = \"+a.mimeType),c.addEventListener(\"updatestart\",function(c){b.performSourceBufferOperation(this.id,\"updatestart\")}),c.addEventListener(\"update\",function(c){b.performSourceBufferOperation(this.id,\"update\")}),c.addEventListener(\"updateend\",function(c){b.performSourceBufferOperation(this.id,\"updateend\")}),b.performSourceBufferOperation(a.id,\"sourceOpen\"),b._mediaSource.removeEventListener(\"sourceopen\",d,!1)}catch(e){Logger.error(\"sourceOpen(): Exception thrown:\"+e.message+\"Id = \"+a.id)}};return this._mediaSource.readyState==\"open\"?d():this._mediaSource.addEventListener(\"sourceopen\",d,!1),!0},this.processAddTimestampOffsetMessage=function(a){if(!a||typeof a.id!=\"number\")return Logger.error(\"processAddTimestampOffsetMessage(): Invalid paramter.\"),!1;var b=this.updatePlayerSourceBufferFromId(a.id,null,\"processAddTimestampOffsetMessage\");if(b instanceof PlayerSourceBuffer)b.timestampOffset=a.timestampOffset;else return Logger.error(\"processAddTimestampOffsetMessage(): Cannot instantiate PlayerSourceBuffer from Id = \"+a.id),!1},this.processAbortSourceBuffer=function(a){if(!a||typeof a.id!=\"number\")return Logger.error(\"processAbortSourceBuffer(): Invalid paramter.\"),!1;var b=this.updatePlayerSourceBufferFromId(a.id,null,\"processAbortSourceBuffer\");return b instanceof PlayerSourceBuffer?(b.pendingBuffers.push({type:SourceBufferOperationType.ABORT}),this.performSourceBufferOperation(a.id,\"processAbortSourceBuffer\"),!0):(Logger.error(\"processAbortSourceBuffer(): Cannot instantiate PlayerSourceBuffer from Id = \"+a.id),!1)},this.processBlobMessage=function(a,b){if(typeof a==\"number\"&&b instanceof Uint8Array){var c=this.updatePlayerSourceBufferFromId(a,null,\"processBlobMessage\");return c instanceof PlayerSourceBuffer?(c.pendingBuffers.push({type:SourceBufferOperationType.APPEND,buffer:b}),this.performSourceBufferOperation(a,\"processBlobMessage\"),!0):(Logger.error(\"processBlobMessage(): Cannot instantiate PlayerSourceBuffer from Id = \"+a),!1)}return Logger.error(\"processBlobMessage(): Invalid parameters.\"),!1}},gPlayer=new Html5MMRPlayer;gPlayer.initialize();"},"responseKey":null,"group":"html5mmr-postmessage"}' Exception: The operation couldn't be performed because object '' couldn't be found on 'dc1.domain.local'.877Views0likes0CommentsError "There are more results available than are currently displayed" after May 2022 installation
I recently installed May 2022 security update on my Exchange 2016 CU22 DAG. I restored the customization on web.config of ECP to display all OU from ECP (https://docs.microsoft.com/en-us/exchange/troubleshoot/administration/exchange-server-not-display-all-ou) , but it does not work at all neither after a recycle bin nor an IISreset on the server. When I check the PoSh command executed it is still "Get-OrganizationalUnit -IncludeContainers:$true -ResultSize 500" whereas it should be with 1500 according to the change I made in the web.config file. Did someone have the same issue? Thanks for your help5.1KViews0likes1CommentAADconnect with Exchange server but without Hybrid Config - Managing users
Hi, We have all of our mailboxes in Exchange Online. MX records point to Exchange Online. Autodiscover points to Exchange Online (autodiscover.outlook.com). These were migrated to O365 from a previous project (previous supplier). I have a new on-premises Active Directory forest. I have configured AADConnect server and will be syncing my new AD users to Azure. I will also be hard matching the Exchange Online mailboxes to my on-premises AD users (using immutableID command. Not an issue). As I have installed a new Exchange 2016 environment, I want to see the Exchange Online mailboxes visible in my on-premise Exchange ECP. I want to do this without having to set up a Hybrid Configuration. The reason is, There is no need for Free/Busy, no need for mail to route across on-prem and EXO - because, Autodiscover points to Outlook.com, MX records point direct to Exchange Online. I just want to be able to see the Exchange Online mailboxes displayed as "Office 365" mailboxes in my on-premise Exchange 2016 so IT admin team can do BAU activities such as changing Exchange related attributes (e.g. hide from address list) etc from on-prem. Or even be able to create a new remote mailbox from Exchange on-prem. Thanks Ron2.3KViews0likes4Comments