This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(163.2, 98%, 25%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EGD%3C/text%3E%3C/svg%3E)
I need to remove an Exchange 2013 server from our setup.
We had a single Exchange 2013 CU23 server in a hybrid config, all mailboxes are Exchange online, the server was simply a transport server used to allow our scan to email service and a few systems to email alerts/reports etc.
I recently added an Exchange 2016 CU18 server to this with the intention of removing the Exchange 2013 server.
However, despite following the setup instructions it looks like if I remove the 2013 server we lose access to autodiscover and the Exchange ECP console because they default to the 2013 box.
When I say lose access, I mean the ECP page loads but it then refuses to allow anyone to log on, says user ID or password are wrong despite the same person being able to log on when the 2013 machine is still online.
Looking at the ECP console both servers have their own entry for each of the virtual directory urls but as soon as the 2013 box is taken offline we lose access though the email flow from the scan to email and the alerts/reports still works, if a little slowly.
What am I missing here?
Again, there are no mailboxes on the on premises Exchange servers though each of them has a database. The database on the 2013 machine was originally used to store mailboxes while the one on the 2016 was set up by default when I installed Exchange on the server, the database on the 2013 box is dismounted.
The servers are not in a DAG
Both servers are multi role (mailbox and CAS)
The 2016 server has been set as the hybrid server by rerunning the hybrid setup wizard.
Both machines are Hyper-V guests, the 2013 server is on Server 2012 R2, the 2016 one is running on Server 2016
Update:
After checking the certificate settings I now get a slightly different error when trying to log into the ECP console. If I just use my samaccountname I get the ID/password error, if I use domain\samaccountname and password it does the same. If I use my UPN it gives me a 500 error saying the page cannot handle the request.
As soon as the old server is brought back online it lets me log in.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(246.4, 22%, 33%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EKY%3C/text%3E%3C/svg%3E)
Hi,
I am writing here to confirm with you how thing going now?
Did the problem get resolved?
If the response is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.
Did you move the arbitration mailboxes on the 2013 server to the 2016 server?
Set-ADServerSettings -ViewEntireForest:$true
get-mailbox -arbitration | new-moverequest -targetdatabase <2016DB>
You will need to mount the 2013 DB to move these of course.
I had not done that, and I was about to post saying it did not work then realized I needed to mount the database in order to open the mailboxes it needed to move.
However, now this is done I still have the same issue, I cannot log in to the ECP console, same errors are seen
I would bounce both servers now and ensure all the Exch Services are started cleanly ( including IIS) and databases mounted and try again.
So, it looks like both servers had suddenly identified they needed Exchange updates, the 2013 box stalled for a while but eventually came back just fine. The 2016 box is a different matter. Multiple IIS helpers run hogging the CPU, the result is multiple Exchange services now do not start.
This was not the case before the update installed.
Not sure where to go now, the new server built to replace the 2013 box is the one with a new set of issues not seen before I made the mistake of letting it install an update and the original problem is still seen even after I manually start the services.
Multiple reboots later, and seeing very slow login with the old standard user profile service pause, I am still in the original position but now with added problems just for fun.
I rebooted again, same result, multiple Exchange services not starting. This time it started the services without any issue when I manually started. I tried to log into ECP and initially got the same response, however I decided to wait and tried again a few minutes later, this time it worked when I used my UPN.
So, is UPN the default entry to log into ECP in Exchange 2016?
This does not resolve the issue of the services not starting but at least I have something. Not sure I feel comfortable removing the 2013 server at this point though
What is set for the ECP/OWA virtual dirs as far as auth?
ECP was set to use forms authentication on both servers, OWA was set to use just ID with the domain preset.
I changed this on the new server, restarted IIS then changed it back and restarted IIS again, it now allows me to use just my user ID.
Thanks for the help on this, I now have what I was asked for originally though I'm still not comfortable trusting this 2016 server, it's an Exchange server that will not start Exchange without intervention...
What updates did you apply?
the 2016 server installed KB4588741 - Security update for Exchange server 2016 CU18 plus the new patches released by MS for Windows (2020-11 CU for server 2016, 2020-11 CU for .NET 4.8 and the regular malware/malicious software removal tool.
Ok, that can be a known issue if you didnt install as admin
https://support.microsoft.com/en-us/help/4588741/description-of-the-security-update-for-microsoft-exchange-server
Exchange services may remain in a disabled state after you install this security update. This condition does not indicate that the update is not installed correctly. This condition may occur if the service control scripts experience a problem when they try to return Exchange services to their usual state.
To fix this issue, use Services Manager to restore the startup type to Automatic, and then start the affected Exchange services manually. To avoid this issue, run the security update at an elevated command prompt.
I would also check:
Get-ServerComponentState <ServerName> | ft Component,State –Autosize
and set to active if any were disabled during the update
https://www.codetwo.com/admins-blog/exchange-2013-components-inactive/
that only applies if it is manually installed, I used Microsoft Update, the server automatically found, downloaded and installed the update. See description-of-the-security-update-for-microsoft-exchange-server
None of the services have been set to manual start, they are all automatic as they should be but they do not start unless I manually start them
Did you check the component state?
On the plus side, you can start the services and there are no user mailboxes so the impact is pretty low even though its annoying.
I assume this is not a Domain Controller and nothing in the event logs when they dont start automatically that may point to the issue otherwise.