Exchange 2013 OWA Something Went Wrong

While I know Exchange 2016 has been released, some of you may have just succeeded in your year long badgering campaign to convince the higher ups to move to Exchange 2013 and get off of Exchange 2007, 2010, or God forbid Exchange 2003.  If it's the latter, then you have my heart felt sympathies - both because you were stuck on that for all this time and for the amount of work your gonna need to do to get to Exchange 2013

Well, assuming you were persuasive enough and they did in fact agree to let you go to 2013, this post might be of help.  As all good little admins should, I built a dev environment and ran through the upgrade process.  I fine tuned the steps as I went and got my list down.  Confidence was brimming. Servers were created, storage provisioned, and change controls logged.  With a quiet anticipation I started the install.  Everything went by the book.  My list hadn't failed me......until I logged into OWA.  I was met with a sad face staring back at me from my browser with the oh so helpful wording something went wrong.  I tried the ECP site and that also gave me the finger.



Much Google searching ensued, eventually ending up with a call to Microsoft support, which then had to get escalated before we got it resolved.

Turns out this is one of those pay me bitches error messages.  By which, I mean it's a generic error message meaning any number of issues that inevitably involve a call to the vendors support line and possibly a charge if you didn't buy support.  It also allows the vendor to send you a yearly bill for the support renewal.  From the posts I read through, it generally seems to be caused by a failure of Exchange 2013 to proxy through to Exchange 2010 to get mailbox data.

The below steps are based on moving from Exchange 2010 to Exchange 2013.  They may work for 2007 as well but it's not something I did.

First thing to try is modifying the url you're using to get to the site.  If you're using https://myserver/ecp try changing this to https://myserver/ecp/?ExchClientVer=15.

Next, take a look at the user account you're trying to log in with Log into AD users and computers, find the user.  Look at the properties of their account and make sure inheritable permissions in on.

Third on the list is make sure you run through the Exchange Server Deployment Assisstant.  This little fella will take you through all the steps needed to migrate from an older version to a new version.  It will give you all the PowerShell commands needed to make proxying work.

The final thing to check - and this is what I had to do to get it working - is the Internal Authentication Methods on the 2010 CAS servers.  To check this, do the following from an Exchange PowerShell console:


  1. Get-OwaVirtualDirectory "myserver\owa (Default Web Site)" | select *authentication*
  2. Check the InternalAuthenticationMethods.  It should contain WindowsIntegrated
  3. If it doesn't check WindowsAuthentication is set to True.
  4. If it's set to True disable and enable again.
    1. Set-OwaVirtualDirectory "myserver\owa (Default Web Site)" -WindowsAuthentication:$False
    2. Set-OwaVirtualDirectory "myserver\owa (Defailt Web Site)" -WindowsAuthentication:$True
  5. If it's set to False enable it.
  6. Run the first command again and check the InternalAuthenicationMethods.  WindowsIntegrated should be listed now.
Here is a pretty picture of my settings which now work.  Before the above steps WindowsAuthentication was True but WindowsIntegrated was missing.



As always, try the above at your own risk.  It worked for me, but won't necessarily work for you.

Comments

Post a Comment

Popular posts from this blog

Local Administrator Password Solution(LAPS)

Image
We have all come across it.  It's a problem as old as the computer itself.  Ever since those first few engineers sat around the PC and said, "Hey Frank, I can'y log in.  What's the password?"  I am of course talking about local admin passwords.  For what ever reason your local admin password will eventually leak out and when it does, it spreads quicker than rumors of free donuts in the break room. You may have combated this with a script that you run once a year that changes the local admin password.  The problem with this solution is that if a machine is turned off or remote then it won't get the script run against it.  You could put the script into a logon script but then your sticking a clear text version of the script onto your network somewhere. "Well, I just use GPO to deploy my passwords using Group Policy Preferences." I hear you say.  This I will agree was an excellent solution until https://technet.microsoft.com/en-us/library/se...
Read more

Error Connecting to Hyper-V Host

Image
Got yourself a Hyper-V host on a nice HP server and can't connect to it remotely from the Hyper-V manager?  You are not alone.  Assuming your error is something like the error below then I may be able to help. The WS-Management service cannot process the request.  The class Msvm_RegisteredProfile does not exist in the root/interop namespace. This has something to do with the HP tools messing with the registration of the MOF's.  All we need to do to fix it is register the MOF files.  To do this, open an administrative command prompt on the server and run the following command. MOFCOMP %SYSTEMROOT%\System32\WindowsVirtualization.V2.mof That will parse through the MOF file and register it on the system leaving you with the nice screenshot below. You should now be able to use your local Hyper-V console to connect to the server and manage away. As with anything you find on the Internet use this at your own risk.  Just because it...
Read more

MBAM Not BitLocking

Image
MBAM is installed,  group policies are set.  You install the MBAM client and nothing happens. First place to start is the Eventlog.  Open eventvwr.msc and browse through to ' Applications and Services Logs\Microsoft\Windows\MBAM' .  In my case I had 'TPM hardware is missing error' This was an easy one to sort out.  Just reboot, enter the BIOS and enable the TPM module.  Some manufacturers do offer tools to do this remotely so might be worth checking with your vendors on this one if you have a bunch of machines to do. Once the machine came back up it still wasn't encrypting the disk so back to the eventlog we go. This time I was presented with 'Unable to connect to the MBAM Recovery and Hardware service.  Access was denied by the remote endpoint.' For this one I started with checking access to the endpoint.  To do this open up regedit and browse to 'HKLM\Software\Policies\Microsoft\FVE\MDOPBitLockerManagement' .  Copy...
Read more