question

JosephLarrew-0337 avatar image
0 Votes"
JosephLarrew-0337 asked KaelYao-MSFT commented

MS Exchange RBAC Events 17, 23, and 258 - Server Account not assigned any management roles

So I'm seeing events mentioned above hitting my event logs every two hours with regularity. I do not know how long it has been going on, as the log rolls over, but it is at least 10 days old. My question is, how do I track what is causing this issue? I've checked Scheduled tasks and I don't see anything there. Here are some snippets of the errors: ![86367-event17.jpg][1] ![86402-event23.jpg][2] ![86375-event258.jpg][3] NOTE: The events say "user <canonical name of object" but it is indeed referring to my Exchange server object in AD. This is only happening on one server in a 5 member DAG. Kind of at a loss. EDIT: I'm adding the events as a txt file, but it is really a CSV file. You can download it as such. [88300-errors.txt][4] EDIT2: Adding IIS log with entries correlated to event log entries [88616-iislogforevents17-23-258.txt][5] [1]: /answers/storage/attachments/86367-event17.jpg [2]: /answers/storage/attachments/86402-event23.jpg [3]: /answers/storage/attachments/86375-event258.jpg [4]: /answers/storage/attachments/88300-errors.txt [5]: /answers/storage/attachments/88616-iislogforevents17-23-258.txt

office-exchange-server-administrationoffice-exchange-server-itpro
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

KaelYao-MSFT avatar image
0 Votes"
KaelYao-MSFT answered AndyDavid converted comment to answer

Hi, anonymous user

Do you have some third party software installed on this Exchange server? For example, some antivirus, backup or monitor software.
Since the error events are logged regularly on this server, please check if there are specific software running at that time.
You may also disable or uninstall them to check if the problem persists.

Besides, do you have other problems with the Exchange server?


If the response is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

· 12
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

I am certain it has to be some sort of 3rd party software, I just don't know how to determine which one. Also, any 3rd party software installed on this one server SHOULD be installed on the other servers in the DAG. None of the other servers are logging these events. What I need help with is how to track down what's running every 2 hours. And generally, no, there are performance issues at the moment.

0 Votes 0 ·

nothing in Task Scheduler?

0 Votes 0 ·

Can you find some logs generated in Event Viewer >Applications and Services Logs > Microsoft > Windows > TaskScheduler >Optional?

0 Votes 0 ·

In the Task Scheduler > Operational log, there do not appear to be any entries for the times around those failures. Certainly not consistently, anyways. There was one task that fired off in one iteration of my two-hour time span that I thought might have been related, but it does not repeat every two hours in the Task Scheduler > Operational log at all.

0 Votes 0 ·

I just added the events 17,28,253 from the Application log as an attachment to the OP.

0 Votes 0 ·
Show more comments
AndyDavid avatar image
1 Vote"
AndyDavid answered KaelYao-MSFT commented

I would simply delete all the monitoring mailboxes and recreate them and see if that fixes it. This can be done anytime

https://techcommunity.microsoft.com/t5/exchange-team-blog/exchange-2013-2016-monitoring-mailboxes/ba-p/611004

"Troubleshooting tips"










· 2
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Oddly enough, the error has stopped showing up for the server account. Or at least it is getting lost in a sea of similar errors but for a different account that I can actually track down as the back up agent. I think re-creating the health mailboxes could indeed be another step in the troubleshooting at least. Thanks everyone!

1 Vote 1 ·

Thanks for the update!

Glad to hear the issue get resolved.

0 Votes 0 ·