An iis directory entry couldn't be created. The error message is access denied, Exchange server 2013 CU13

Benard Mwanza 996

We have four exchange server 2013 cu23 in our deployment. Two are mailbox role servers and two CAS role servers. Users are currently unable to access or sync their mailbox using mobile device outlook clients. Outlook sync, send and receive in desktop or laptop is working properly both in internal and external.

We intend to sync user mailboxes in mobile device outlook clients. When i sync mailbox in mobile device outlook client i get a bank screen for all users

As i was troubleshooting, In one of the CAS server(CAS01), when i open virtual directory then click authentication tab or other tab for VD with more than one tab i get an error in the snip below All virtual directories in that CAS server(CAS01) is affected. The other CAS server(CAS02) is not affected. What is wrong or what needs to be done to restore the CAS virtual directories and mailbox sync. I suspect the mailbox sync in mobile devices is being impacted by that problematic CAS server.

I checked my exchange servers certificates in IIS and confirmed its assigned properly.
I checked if exchange trusted subsystem group is member of local admin group, all exchange servers are members of exchange trusted subsystem group in AD, and confirmed this is correct.

Aholic Liang-MSFT 13,741 Reputation points Microsoft Vendor

2022-09-12T05:49:27.68+00:00
Hi @Benard Mwanza ,
In order to better solve your issue, I would like to confirm the following points at first:
1.Whether the 4 servers are configured as a DAG?
2.Did you install an older version of Exchange in your environment? Such as Exchange 2007.
3.Did you change the default self-signed certificate? Please refer to the following command to check which certificates are bound to the server?

Get-ExchangeCertificate -Server <servername>

If possible, please provide the screenshot about it for our better research. (In order to avoid the disclosure of your privacy, please remember to hide your personal information).

4.Please have a check that the IP address in DNS points to the correct address .

In addition , please try recreating virtual directory using the method in the following link to see if the issue persists.
https://www.stellarinfo.com/article/fix-iis-virtual-directory-error.php

(Notes:Microsoft provides third-party contact information to help you find additional information about this topic. This contact information may change without notice. Microsoft does not guarantee the accuracy of third-party contact information.)
Aholic Liang-MSFT 13,741 Reputation points Microsoft Vendor

2022-09-14T09:17:13.953+00:00

Hi,
It has been a few days and I am checking in to see how things are going on with this issue. Does this issue have any updates?
Benard Mwanza 996 Reputation points

2022-09-14T11:16:34.713+00:00

Hello @Aholic Liang-MSFT fin below response to questions asked.

1.Whether the 4 servers are configured as a DAG? Yes
2.Did you install an older version of Exchange in your environment? Such as Exchange 2007. NO
3.Did you change the default self-signed certificate? Please refer to the following command to check which certificates are bound to the server? NO

Get-ExchangeCertificate -Server <servername> I will provide the snip tomorrow.
If possible, please provide the screenshot about it for our better research. (In order to avoid the disclosure of your privacy, please remember to hide your personal information).

4.Please have a check that the IP address in DNS points to the correct address . This is correctly configured in DNS.
Aholic Liang-MSFT 13,741 Reputation points Microsoft Vendor

2022-09-19T07:03:40.177+00:00

Hi,

Get-ExchangeCertificate -Server <servername> I will provide the snip tomorrow.

It has been a few days and I am checking in to see how things are going on with this issue.
Did you run the above command? Please provide the related screenshot for our research .Thanks for your understanding!
Aholic Liang-MSFT 13,741 Reputation points Microsoft Vendor

2022-09-19T08:48:55.18+00:00

Hi,

In addition , please have a check whether the Exchange Trusted Subsystem group belongs to Administrators group of the affected CAS server.
If not, please add it and restart the server to see if the issue persists.
Aholic Liang-MSFT 13,741 Reputation points Microsoft Vendor

2022-09-22T05:11:43.72+00:00

Hi @Benard Mwanza ,

Just checking in to see how things are going on with this thread.
Does this issue have any updates?
If you have any questions or need further assistance, please feel free to post back. Thanks!
Benard Mwanza 996 Reputation points

2022-10-03T08:41:59.76+00:00

Hi @Aholic Liang-MSFT I'm still experiencing the same issue. Exchange Trusted Subsystem group is already member of Administrator in the affected CAS server
Aholic Liang-MSFT 13,741 Reputation points Microsoft Vendor

2022-10-07T10:02:52.9+00:00

Hi,
Here is a similar thread about the error Access is denied:
An IIS directory entry couldn't be created. The error message is Access is denied. (microsoft.com)
Please refer to the article above to check setting and see if it works.
Note: Microsoft provides third-party contact information to help you find additional information about this topic. This contact information may change without notice. Microsoft does not guarantee the accuracy of third-party contact information.