Exchange 2016 ECP error 403 after login

Mariusz Gora 41 Reputation points
2021-12-02T12:38:43.383+00:00

Hi,

We using Exchange 2016 on premise from few years.
For these years we had only one Exchange server but few days ago we decided to install another one and create DAG.
I added second Exchange server to our infrastructure (but not yet form DAG). When I tried logon to ECP i receive 403 error (Forbidden: Access is denied) after type my credentials.

I tried:

  • logon locally from server
  • recreate ECP and OWA virtual directories and run iisreset
  • Double check Get-CASMailbox for my user return ECPEnabled: True
  • reboot server
  • HealthChecker not show any serious errors

I can logon to OWA without problems. I can logon to our firs server with the same credentials.
First server build is 15.1.2242.4 (CU20), new one build is 15.1.2375.7 (CU22).

Event log not show any errors after I receive 403 error.

Where to next?

Exchange Server Management
Exchange Server Management
Exchange Server: A family of Microsoft client/server messaging and collaboration software.Management: The act or process of organizing, handling, directing or controlling something.
7,357 questions
Accepted answer
  1. Andy David - MVP 142.2K Reputation points MVP
    2021-12-04T13:05:13.837+00:00

    After moving my mailbox to new server I can logon to ECP but when I move the mailbox back issue occurs again.
    I don't understand why I must have mailbox on server to access ECP. Could anyone explain this correlation?
    It is not difficult to imagine situation when server with my mailbox fail. In this case will I lose access to ECP on another server    ?

    Does the problem continue after you upgrade the older server to CU22 as well and apply the latest Nov 2021 Security Patch?

    0 comments

3 additional answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Amit Singh 4,846 Reputation points
    2021-12-03T06:04:11.623+00:00

    These issues occur if the "deny" permission is effective on the ms-Exch-EPI-Token-Serialization user right on a computer object that has an Exchange Server 2013 or Exchange Server 2016 role assigned.

    To resolve this issue, remove the computer object from the restricted group.

    You can check out the detailed article from here - https://learn.microsoft.com/en-us/exchange/troubleshoot/client-connectivity/error-occur-ems-eac-owa

    -------------------

    Please mark as "Accept the answer" if the above steps helps you. Your suggestion will help others also !

    1 person found this answer helpful.
  2. Andy David - MVP 142.2K Reputation points MVP
    2021-12-03T16:26:10.973+00:00

    Make sure the auth set for the ECP directory matches the OWA one.
    In other words:

    If OWA is set for Forms BAsed, ensure ECP is as well. etc...

    Compare the ECP vir dir settings with the working server and see if there is something different.

    0 comments
  3. Mariusz Gora 41 Reputation points
    2022-02-03T10:45:09.9+00:00

    After upgrading oldest server to CU22 and Nov 2021 SP the problem stopped occur.

    Thanks for help.

    0 comments