In Exchange Server and Reverse Proxy Server, Getting 401 status with Null User Information

Question

In Exchange Server and Reverse Proxy Server, Getting 401 status with Null User Information

Nur Hossain 282

In Exchange server Hybrid Environment, we are getting 401 status with Null User for MAPI, EWS and Active Sync.
D:\RPIISLog\Exmbx-dc-2\u_ex210523.log 831406 2021-05-23 06:44:09 10.96.64.101 NULL NULL EXMBX-DC-2 10.96.36.101 443 POST /EWS/Exchange.asmx &CorrelationID=<empty>;&cafeReqId=36f2e160-e8db-4b7e-a8ff-0255b433d25f; 401 0 0 NULL NULL 19 NULL NULL Microsoft+Office/16.0+(Windows+NT+6.2;+Microsoft+Outlook+16.0.4417;+Pro) OutlookSession="{6F1FF216-ADBC-449A-BF0D-DFBF373ECE29}" NULL NULL NULL NULL NULL NULL NULL NULL NULL

D:\RPIISLog\Exmbx-dc-2\u_ex210523.log 831646 2021-05-23 06:44:13 10.96.64.100 NULL NULL EXMBX-DC-2 10.96.36.101 443 POST /EWS/Exchange.asmx &CorrelationID=<empty>;&cafeReqId=c6a4fd6f-1502-4195-9a6a-4a4cf7b9658d; 401 0 0 NULL NULL 30 NULL NULL Microsoft+Office/16.0+(Windows+NT+6.2;+Microsoft+Outlook+16.0.4266;+Pro) OutlookSession="{83BE22C9-1E53-46A8-993F-50B3F01C9795}" NULL NULL NULL NULL NULL NULL NULL NULL NULL

D:\RPIISLog\Exmbx-dc-2\u_ex210523.log 831533 2021-05-23 06:44:12 10.21.26.51 NULL NULL EXMBX-DC-2 10.96.36.101 443 POST /mapi/emsmdb/ MailboxId=******@mydomain.com&CorrelationID=<empty>;&cafeReqId=39a29516-633d-48ff-b93f-9de29984dfec; 401 0 0 NULL NULL 9 NULL NULL Microsoft+Office/16.0+(Windows+NT+10.0;+Microsoft+Outlook+16.0.4549;+Pro) MapiContext=MAPIAAAAAOC49bfvwobF6Nn6yPjK+9bm0/7M/Nzt1e/c7dfj0oirmaCQpJKnl6KW9zIAAAAAAAA=;MapiRouting=UlVNOjVhOWFjMWU1LTM4ZTktNGY0Yy04OTFmLWYyNDFjODNhMzI5MzpiAs7xtR3ZCA==;MapiSequence=493-9Bw/Aw==;X-BackEndCookie=3142a0b8-351f-49e4-9067-08c5ddcc2bbc=u56Lnp2ejJqBxsfLmZuZz8vSzpnNzdLLy5uc0p7IxpzSm8aazs2ayZ3Lx5ucgYHNz83O0s/J0s3Nq8/JxcvLxc7O NULL NULL NULL NULL NULL NULL NULL NULL NULL

D:\RPIISLog\Exmbx-dc-2\u_ex210523.log 831606 2021-05-23 06:44:13 10.21.92.109 NULL NULL EXMBX-DC-2 10.96.36.101 443 POST /autodiscover/autodiscover.xml &CorrelationID=<empty>;&cafeReqId=7dad860b-73c7-4d17-9ae0-417d6fdeb98a; 401 0 0 NULL NULL 53 NULL NULL Microsoft+Office/16.0+(Windows+NT+10.0;+Microsoft+Outlook+16.0.4954;+Pro) OutlookSession="{CD7A4BC8-E0AA-4B82-BBC6-AE4C48F55FB6}" NULL NULL NULL NULL NULL NULL NULL NULL NULL

D:\RPIISLog\Exmbx-dc-2\u_ex210523.log 831646 2021-05-23 06:44:13 10.96.64.100 NULL NULL EXMBX-DC-2 10.96.36.101 443 POST /EWS/Exchange.asmx &CorrelationID=<empty>;&cafeReqId=c6a4fd6f-1502-4195-9a6a-4a4cf7b9658d; 401 0 0 NULL NULL 30 NULL NULL Microsoft+Office/16.0+(Windows+NT+6.2;+Microsoft+Outlook+16.0.4266;+Pro) OutlookSession="{83BE22C9-1E53-46A8-993F-50B3F01C9795}" NULL NULL NULL NULL NULL NULL NULL NULL NULL

Lucas Liu-MSFT 6,196 Reputation points

2021-05-26T01:29:46.813+00:00

Hi @Nur Hossain ,
Since the screenshot you provided contains your personal information (domain name), in order to prevent your information from leaking, I will overwrite it and upload it again.
Lucas Liu-MSFT 6,196 Reputation points

2021-05-31T02:53:27.01+00:00

Hi @Nur Hossain ,
I am writing here to confirm with you how thing going now?

----------

If the response is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

1 answer

Your answer

Lucas Liu-MSFT 6,196 Reputation points

2021-05-26T01:29:46.813+00:00

Hi @Nur Hossain ,
Since the screenshot you provided contains your personal information (domain name), in order to prevent your information from leaking, I will overwrite it and upload it again.
Lucas Liu-MSFT 6,196 Reputation points

2021-05-31T02:53:27.01+00:00

Hi @Nur Hossain ,
I am writing here to confirm with you how thing going now?

----------

If the response is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 1

Ashok M 6,876

Hi @Nur Hossain

Try enabling advanced logging in IIS and see if the usernames are logged. Also, could you please let us know the below,

1.What authentication is enabled on the virtual directories
2.Are there any impact for the users like disconnection/not working/functionality not working, etc
3.If you open the IIS log in notepad, does it show the cs-username or is it still NULL. This is just to isolate if there could be issues with loading the IIS log to the log parser studio

https://learn.microsoft.com/en-us/iis/extensions/advanced-logging-module/advanced-logging-for-iis-custom-logging#server_logging

Lucas Liu-MSFT 6,196 Reputation points

2021-05-26T01:54:25.543+00:00

Hi @Nur Hossain ,
In addition to the above, the following points need to be confirmed:
What's the version of Exchange server?
Have any changes been made to the Exchange organization before the problem occurred?
Please check the Authentication of MAPI,EWS and ActiveSync in IIS.

----------

If the response is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.
Nur Hossain 282 Reputation points

2021-05-31T08:29:19.48+00:00

Below are the details:

Authentication is enabled on the virtual directories
For Autodiscover: Integrated Windows Authentication and Basic Authentication.
For Active Sync: Basic Authentication
For MAPI: Windows Authentication (NTLM, Negotiate) and server to server authentication (OAuth).
Exchange Server Version: Exchange Server 2016 CU20 (latest SU Installed). Exchange hybrid Environment.
Enable advanced logging: Options is not available.
Impact: No, users are not facing any issue but getting reports from the Monitoring tool.

Note: In notepad also showing the same.

Thank You
Nur
Yuki Sun-MSFT 41,456 Reputation points Moderator

2021-06-01T09:51:59.633+00:00

Hi @Nur Hossain ，

As per the log parser screenshot shared in your initial post, I'm wondering do you mean all the cs-username entries are showing as "NULL", which means no cs-username is recorded, or you have alreay filtered out the other usernames when querying the logs?
Is this a recently occurred issue after any changes were implemented in the environment?
Nur Hossain 282 Reputation points

2021-06-02T04:57:18.027+00:00

No, Some cs-username showing NULL,
Actually, only for Status code 401 cs-username showing NULL.
Is it normal? or Is it an Issue?

I am confused when cs-username showing null and what mean by staus code 401.
Yuki Sun-MSFT 41,456 Reputation points Moderator

2021-06-07T06:53:58.547+00:00

Hi @Nur Hossain ,

I tried searching around regarding "cs-username showing NULL" but hardly find anything useful. Then I checked the IIS logs in my test Exchange server and found no values for cs-username are showing "NULL", but I noticed that there are quite a few lines with cs-username showing hyphen(-), which means Anonymous users according to this official document:

However, when the logs are viewed in Log Parser Studio, the hypens are showing as empty, still different from what you encountered:

Could you check if there are cs-username showing hyphen or empty on your end? As I am thinking if the Anonymous users are indicated by "NULL" for any unknown reason in your situation.
Yuki Sun-MSFT 41,456 Reputation points Moderator

2021-06-07T06:56:04.72+00:00

As regards to your concern about the Status code 401, it refers to "Access Denied" according to this link.

Share via

In Exchange Server and Reverse Proxy Server, Getting 401 status with Null User Information

1 answer

Your answer