OWA and ECP doesnt work after KB5003435 on Exchange 2016

Priya Jayaraman 301 Reputation points
2021-09-08T08:03:37.627+00:00

Hi,
Environment: Exchange 2016 CU 19
We are getting issues ECP and OWA after logging to admin credentials without mailboxes. This is happening for few admin accounts post installation of KB5003435 (May security update).

2021-09-08T06:38:53.000Z,******-6ee7-4a9a-*-c6a********0,15,1,2176,14,,Owa,Exchservernam,/owa/auth.owa,,FBA,true,Domain\UserAlias,,Sid~**Mozilla/4.0 .NET4.0C),,exchserver,500,,OrganizationMailboxNotFound,POST,,,,,WindowsIdentity-NoDatabase,,,,,ClientId=*********************************5;BeginRequest=2021-09-08T06:38:52.906Z;CorrelationID=<empty>;ProxyState-Run=None;AccountForestGuard_1;ProxyState-Complete=CalculateBackEnd;SharedCacheGuard=0;EndRequest=2021-09-08T06:38:53.000Z;I32:ATE.HttpProxyException=Microsoft.Exchange.HttpProxy.HttpProxyException: **Unable to find organization mailbox for organization at Microsoft.Exchange.HttpProxy.UserBasedAnchorMailbox.RefreshCacheEntry() at Microsoft.Exchange.HttpProxy.AnchorMailbox.GetCacheEntry() at Microsoft.Exchange.HttpProxy.DatabaseBasedAnchorMailbox.GetDatabase() at Microsoft.Exchange.HttpProxy.ProxyRequestHandler.InternalBeginCalculateTargetBackEnd(AnchorMailbox& anchorMailbox)

Issue is fixed after enabling mailbox and user is able to access ECP fine. Even after disabling mailbox, ECP still works without any issues.

Any ideas would be really helpful!

cheers
Priya

Exchange Server Management
Exchange Server Management
Exchange Server: A family of Microsoft client/server messaging and collaboration software.Management: The act or process of organizing, handling, directing or controlling something.
7,357 questions

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Yuki Sun-MSFT 40,866 Reputation points
    2021-09-09T06:41:45.61+00:00

    Hi @Priya Jayaraman ,

    Issue is fixed after enabling mailbox and user is able to access ECP fine. Even after disabling mailbox, ECP still works without any issues.

    Glad to know that the issue has already been fixed and it's now working fine.

    As per your concern that the issue started post installation of the May security update, I tried searching around but so far haven't see similar reports of this. After checking it further about the error message you shared above, especially the bold part, it seems to me that the issue is probably related to the SystemMailbox{bb558c35-97f1-4cb9-8ff7-d53741dc928c} which is also know as "organization mailbox". See this article:
    130605-1.png

    Then combining with the clue that the admin accounts with issue don't have mailboxes, I found the blog which could be helpful:
    HTTP 500 Internal Server Error when logging into Exchange 2013 Exchange Control Panel (ECP)
    (Although the blog talks about Exchange 2013, the basic concepts could be applied to Exchange 2016 as well.)

    According to the explanation in the blog, Exchange depends on the ExchangeGuid of a mailbox to proxy the ECP/OWA access request, if the account has no mailbox, thus no ExchangeGuid associated with it, Exchange uses the ExchangeGuid of system mailboxes to determine where to proxy the requests. "In this specific scenario, Exchange uses the system mailbox SystemMailbox{bb558c35-97f1-4cb9-8ff7-d53741dc928c}", this is the orgnization mailbox as mentioned earlier.

    Taken in the round, I am assuming that when the issue occurred, there might have been some temorary issues with the organization mailbox involved, such as the database with the organization mailbox was unavailable, so Exchange failed to find the ExchangeGuid of the system mailbox to proxy the request for the admin account without mailbox. When you enabled mailbox for the user, the account got its own ExchangeGuid for proxy the request and the user can be able to access ECP without issue. Then by the time you disabled the mailbox again, it's likely the unknown temporary issue with the system mailbox has disappeared, so ECP can still be accessed properly, using the ExchangeGuid of the system mailbox.

    Considering that currently everything is now working fine, you can just don't worry and rest assured. In case similar issue reoccurs, I'd suggest checking the status of the organization mailbox as the first troubleshooting step:

    1.Run the command below to find the database which hosts the organization mailbox, also check if there's any error or warning message returned: 

    Get-mailbox "SystemMailbox{bb558c35-97f1-4cb9-8ff7-d53741dc928c}" -Arbitration |ft Name, DisplayName, Database -AutoSize

    2.Based on the database returned in step2, use the following command to verify the status of the mailbox database: 

    Get-MailboxDatabase <DatabaseName> -status | fl name,sever,mounted

    If an Answer is helpful, please click "Accept Answer" and upvote it.
    Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

    0 comments