On Prem Exchange 2019 authentication box pops up sporadically 20 minutes to the hour.

Question

On Prem Exchange 2019 authentication box pops up sporadically 20 minutes to the hour.

N&C 0

We have recently upgraded from Exchange 2013 to Exchagne 2019 on Prem and we use the M365 client to access our On-Prem Exchange. sporadically 20 minutes to the hour we keep getting a authentication log in box to log in. How to I stop this as we're on Prem. I do have a M365 environment standalone none integrated that we use for apps, OneDrive and Teams only. We do not have AD connect in place nor are we a hybrid environment I receive 1097 and 1098 event ID's errors and need help to resolve this issue. I've tried several reg fixed and solutions but nothing has helped ID the real issue or fix it. We can't be the only people wiht his issues.

Anonymous

2023-11-02T06:55:45.7233333+00:00

Hello, I am just checking in to see if you have received my previous reply. Would you please kindly reply to me and let me know if you need further assistance?

2 answers

Your answer

Anonymous

2023-11-02T06:55:45.7233333+00:00

Hello, I am just checking in to see if you have received my previous reply. Would you please kindly reply to me and let me know if you need further assistance?

Answer 1

Andy David - MVP 157.9K MVP Volunteer Moderator

Typically this is load balancer issue. Are you using one? If so, what is set for session timeouts?

What reg fixes did you try?

N&C 0 Reputation points

2023-10-26T13:08:22.9866667+00:00
No load balancers users just a single Exchange 2019 on prem server. The followng reg fixes have been tried to no avail : 1) reg add HKEY_CURRENT_USER\Software\Microsoft\Office\x.0\Outlook\AutoDiscover /t REG_DWORD /v ExcludeExplicitO365Endpoint /d 1 (HKEY_CURRENT_USER\SOFTWARE\Microsoft\office\16.0\outlook\autodiscover DWORD: ExcludeExplicitO365Endpoint Value = 1 AND HKEY_CURRENT_USER\SOFTWARE\Policies\Microsoft\office\16.0\outlook\autodiscover DWORD: ExcludeExplicitO365Endpoint Value = 1 )

HKEY_CURRENT_USER\Software\Policies\Microsoft\Office\16.0\Outlook\Security. If any of the keys on this path do not exist, create them by right-clicking on the parent key > New > Key > copy and paste the exact name (eg. create the key Office under Microsoft, then 16.0 under Office, etc.) until the path is built

Change or create a new DWORD with the name PromptForCredentials. Set its value to 0.

HKEY_CURRENT_USER\Software\Microsoft\Exchange , On the Edit menu, point to New, and then click DWORD Value. Type AlwaysUseMSOAuthForAutoDiscover, and then press Enter. Right-click AlwaysUseMSOAuthForAutoDiscover, and then click Modify. In the Value data box, type 1, and then click OK.

HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\ Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\PSR

HKEY_USERS\S-1-5-21-299502267-1950408961-849522115-1818\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion \AppModel\SystemAppData\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\PSR

Match the SID reported for the user in event ID 1098 to the path under HKEY_USERS. In this case, it is- S-1-5-21-299502267-1950408961-849522115-1818. To resolve this issue, do the following: Take ownership of the key if necessary (Owner = SYSTEM).

Dsable Modern Authentication by regedit to HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\Identity, create a DWORD item named EnableADAL and set it to zero.

Under the same registry key, create a DWORD item named DisableADALatopWAMOverride and set it to 1.

Renamed the AAD.BrokerPlugin folder in %appdata%\local\packages

HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\AutoDiscover 2.add a DWORD value named ExcludeHttpsRootDomain and set its value data to 1

Answer 2

Anonymous

Hello,

According to your description, we need to gather more information about your case so that we can identify the problem and provide a resolution more effectively:

1.Please screenshot the authentication box, being cautious not to include any of your personal information.

2.Could you please clarify if the 1097 and 1098 event ID's errors you described only shows up when the authentication box pops up and what is the specific situation of the error?

3.When the authentication box pops up, please check the connect status to see what the situation is, as shown in the figure below. The method to view is press and hold the Ctrl key, right-click the Outlook icon in the notification area, and then click connect status.

User's image

4.As Andy said, I'd like to know which specific reg fixes you've attempted.

5.If at all feasible, it is recommended that you try to test a different version of Outlook and observe the results.

I would appreciate it if you could collect the above information and give feedback at your earliest convenience.

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Note: Please follow the steps in [our documentation] to enable e-mail notifications if you want to receive the related email notification for this thread.

N&C 0 Reputation points

2023-10-26T13:26:17.71+00:00
This is the pop up box. The reg hacks applied are : 1) reg add HKEY_CURRENT_USER\Software\Microsoft\Office\x.0\Outlook\AutoDiscover /t REG_DWORD /v ExcludeExplicitO365Endpoint /d 1 (HKEY_CURRENT_USER\SOFTWARE\Microsoft\office\16.0\outlook\autodiscover DWORD: ExcludeExplicitO365Endpoint Value = 1 AND HKEY_CURRENT_USER\SOFTWARE\Policies\Microsoft\office\16.0\outlook\autodiscover DWORD: ExcludeExplicitO365Endpoint Value = 1 )

HKEY_CURRENT_USER\Software\Policies\Microsoft\Office\16.0\Outlook\Security. If any of the keys on this path do not exist, create them by right-clicking on the parent key > New > Key > copy and paste the exact name (eg. create the key Office under Microsoft, then 16.0 under Office, etc.) until the path is built

Change or create a new DWORD with the name PromptForCredentials. Set its value to 0.

HKEY_CURRENT_USER\Software\Microsoft\Exchange , On the Edit menu, point to New, and then click DWORD Value. Type AlwaysUseMSOAuthForAutoDiscover, and then press Enter. Right-click AlwaysUseMSOAuthForAutoDiscover, and then click Modify. In the Value data box, type 1, and then click OK.

HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\ Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\PSR

HKEY_USERS\S-1-5-21-299502267-1950408961-849522115-1818\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion \AppModel\SystemAppData\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\PSR

Match the SID reported for the user in event ID 1098 to the path under HKEY_USERS. In this case, it is- S-1-5-21-299502267-1950408961-849522115-1818. To resolve this issue, do the following: Take ownership of the key if necessary (Owner = SYSTEM).

Dsable Modern Authentication by regedit to HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\Identity, create a DWORD item named EnableADAL and set it to zero.

Under the same registry key, create a DWORD item named DisableADALatopWAMOverride and set it to 1.

Renamed the AAD.BrokerPlugin folder in %appdata%\local\packages

HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\AutoDiscover 2.add a DWORD value named ExcludeHttpsRootDomain and set its value data to 1

Outlook connection status is disconnected when the pop up box appears, if you wait 2 minutes then reconnect it works again without entering in any credentials..

The 1097 and 1098 errors appear in event log - applications and services - Windows - AAD -operational. These appear as the pop up box appears. The 1098 say the following : Error: 0x80070002 The system cannot find the file specified.

The specified account can't be found

Exception of type 'class WinRTException' at webaccountprocessor.cpp, line: 279, method: AAD::Core::WebAccountProcessor::ProcessBrokerBackgroundRequest::<lambda_10eb35b2257b68612b69a6908d94afc2>::operator ().

Log: 0xcaa5001c Token broker operation failed.

Operation name: GetTokenSilently

Logged at webaccountprocessor.cpp, line: 528, method: AAD::Core::WebAccountProcessor::ReportException.

AND

Error: 0xCAA5001C Token broker operation failed.

Operation name: GetTokenSilently, Error: -895155996 (0xcaa500e4), Description: Fatal error when decripting OAuth response.

Logged at webaccountprocessor.cpp, line: 540, method: AAD::Core::WebAccountProcessor::ReportOperationError.

The 1097 say : Error: 0xCAA90056 Renew token by the primary refresh token failed.

Logged at refreshtokenrequest.cpp, line: 100, method: RefreshTokenRequest::AcquireToken.

Request: authority: https://login.microsoftonline.com/b4a1c14c-1eb6-40e5-abce-00db1be87e1f, client: {6F7E0F60-9401-4F5b-98E2-CF15BD5Fd5E3}, redirect URI: ms-appx-web://Microsoft.AAD.BrokerPlugin/{6F7E0F60-9401-4F5b-98E2-CF15BD5Fd5E3}, resource: https://activity.microsoft.com, correlation ID (request): 3ec502c8-fb27-46bc-96f0-fbff7ecb098e.

The pattern is 20 minutes to the hour GMT time. It happens for all users connected via Outlook client.

We've tried different Outlook client version and this makes no difference.

We have enen tired running the : SetupProd_OfficeSignIn.exe from MS but again it makes no difference.

It's only since we upgraded to Exchange 2019 that this started happening prior to that on Exchange 2013 everything was fine using exactly the same clients.
Anonymous

2023-10-27T09:21:51.7933333+00:00

Thank you for providing detailed information. Based on your information, first of all, I would like to ask you to confirm whether there is any M365 account bound to the client. And does this happen within the domain or outside the domain? If it is convenient, please screenshot the authentication box.

Additionally, please ensure that the time between the Exchange server and the M365 client is synchronized, if there is a time difference between the two, it may cause this issue.

Share via

On Prem Exchange 2019 authentication box pops up sporadically 20 minutes to the hour.

2 answers

Your answer