MS Exchange RBAC Events 17, 23, and 258 - Server Account not assigned any management roles

Question

MS Exchange RBAC Events 17, 23, and 258 - Server Account not assigned any management roles

Joseph Larrew 341 Microsoft Employee

So I'm seeing events mentioned above hitting my event logs every two hours with regularity. I do not know how long it has been going on, as the log rolls over, but it is at least 10 days old. My question is, how do I track what is causing this issue? I've checked Scheduled tasks and I don't see anything there. Here are some snippets of the errors: ![86367-event17.jpg][1] ![86402-event23.jpg][2] ![86375-event258.jpg][3] NOTE: The events say "user <canonical name of object" but it is indeed referring to my Exchange server object in AD. This is only happening on one server in a 5 member DAG. Kind of at a loss. EDIT: I'm adding the events as a txt file, but it is really a CSV file. You can download it as such. [88300-errors.txt][4] EDIT2: Adding IIS log with entries correlated to event log entries [88616-iislogforevents17-23-258.txt][5] [1]: /api/attachments/86367-event17.jpg?platform=QnA [2]: /api/attachments/86402-event23.jpg?platform=QnA [3]: /api/attachments/86375-event258.jpg?platform=QnA [4]: /api/attachments/88300-errors.txt?platform=QnA [5]: /api/attachments/88616-iislogforevents17-23-258.txt?platform=QnA

2 answers

Your answer

Answer 1

Andy David - MVP 158K MVP Volunteer Moderator

I would simply delete all the monitoring mailboxes and recreate them and see if that fixes it. This can be done anytime

https://techcommunity.microsoft.com/t5/exchange-team-blog/exchange-2013-2016-monitoring-mailboxes/ba-p/611004

"Troubleshooting tips"

Joseph Larrew 341 Reputation points Microsoft Employee

2021-04-26T11:58:26.433+00:00

Oddly enough, the error has stopped showing up for the server account. Or at least it is getting lost in a sea of similar errors but for a different account that I can actually track down as the back up agent. I think re-creating the health mailboxes could indeed be another step in the troubleshooting at least. Thanks everyone!
Kael Yao 37,751 Reputation points Moderator

2021-04-29T08:15:56.757+00:00

Thanks for the update!

Glad to hear the issue get resolved.

Answer 2

Kael Yao 37,751 Moderator

Hi, anonymous user

Do you have some third party software installed on this Exchange server? For example, some antivirus, backup or monitor software.
Since the error events are logged regularly on this server, please check if there are specific software running at that time.
You may also disable or uninstall them to check if the problem persists.

Besides, do you have other problems with the Exchange server?

If the response is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Joseph Larrew 341 Reputation points Microsoft Employee

2021-04-12T13:03:45.82+00:00

I am certain it has to be some sort of 3rd party software, I just don't know how to determine which one. Also, any 3rd party software installed on this one server SHOULD be installed on the other servers in the DAG. None of the other servers are logging these events. What I need help with is how to track down what's running every 2 hours. And generally, no, there are performance issues at the moment.
Andy David - MVP 158K Reputation points MVP Volunteer Moderator

2021-04-12T13:32:40.953+00:00

nothing in Task Scheduler?
Kael Yao 37,751 Reputation points Moderator

2021-04-15T08:57:05.973+00:00

Can you find some logs generated in Event Viewer >Applications and Services Logs > Microsoft > Windows > TaskScheduler >Optional?
Joseph Larrew 341 Reputation points Microsoft Employee

2021-04-15T19:17:47.373+00:00

In the Task Scheduler > Operational log, there do not appear to be any entries for the times around those failures. Certainly not consistently, anyways. There was one task that fired off in one iteration of my two-hour time span that I thought might have been related, but it does not repeat every two hours in the Task Scheduler > Operational log at all.
Joseph Larrew 341 Reputation points Microsoft Employee

2021-04-15T19:40:59.88+00:00

I just added the events 17,28,253 from the Application log as an attachment to the OP.
Andy David - MVP 158K Reputation points MVP Volunteer Moderator

2021-04-15T19:43:40.897+00:00

Nothing matching up during those events in the IIS logs?
Joseph Larrew 341 Reputation points Microsoft Employee

2021-04-16T14:28:37.04+00:00

Well, interestingly enough, I was able to do some correlation. Still don't know what it means, but the times do correlate. It makes sense because the events talk about not being authorized to run PowerShell cmdlets. The attached log is filtered as there are some other entries, but I don't think they're related. I've added the log to the OP.
Andy David - MVP 158K Reputation points MVP Volunteer Moderator

2021-04-16T14:34:53.23+00:00

Whats the IP of that connecting client? Another Exch Server or ...
Joseph Larrew 341 Reputation points Microsoft Employee

2021-04-16T14:56:25.637+00:00

It's all the server acting on itself it seems. "<server ip>" is indeed the same IP in both spots in the log.
Kael Yao 37,751 Reputation points Moderator

2021-04-21T08:34:39.683+00:00

Thanks for the update.

Please check via ADUC(Active Directory Users and Computers) to see if the server is added to the correct groups:
Joseph Larrew 341 Reputation points Microsoft Employee

2021-04-22T14:49:46.033+00:00

It sure is, lol.
Joseph Larrew 341 Reputation points Microsoft Employee

2021-04-22T17:19:09.77+00:00

Maybe it has something to do with Managed Availability? Any idea on how to check that?

Share via

MS Exchange RBAC Events 17, 23, and 258 - Server Account not assigned any management roles

2 answers

Your answer