This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(51.2, 48%, 14%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ENH%3C/text%3E%3C/svg%3E)
In Exchange server Hybrid Environment, we are getting 401 status with Null User for MAPI, EWS and Active Sync.
D:\RPIISLog\Exmbx-dc-2\u_ex210523.log 831406 2021-05-23 06:44:09 10.96.64.101 NULL NULL EXMBX-DC-2 10.96.36.101 443 POST /EWS/Exchange.asmx &CorrelationID=<empty>;&cafeReqId=36f2e160-e8db-4b7e-a8ff-0255b433d25f; 401 0 0 NULL NULL 19 NULL NULL Microsoft+Office/16.0+(Windows+NT+6.2;+Microsoft+Outlook+16.0.4417;+Pro) OutlookSession="{6F1FF216-ADBC-449A-BF0D-DFBF373ECE29}" NULL NULL NULL NULL NULL NULL NULL NULL NULL
D:\RPIISLog\Exmbx-dc-2\u_ex210523.log 831646 2021-05-23 06:44:13 10.96.64.100 NULL NULL EXMBX-DC-2 10.96.36.101 443 POST /EWS/Exchange.asmx &CorrelationID=<empty>;&cafeReqId=c6a4fd6f-1502-4195-9a6a-4a4cf7b9658d; 401 0 0 NULL NULL 30 NULL NULL Microsoft+Office/16.0+(Windows+NT+6.2;+Microsoft+Outlook+16.0.4266;+Pro) OutlookSession="{83BE22C9-1E53-46A8-993F-50B3F01C9795}" NULL NULL NULL NULL NULL NULL NULL NULL NULL
D:\RPIISLog\Exmbx-dc-2\u_ex210523.log 831533 2021-05-23 06:44:12 10.21.26.51 NULL NULL EXMBX-DC-2 10.96.36.101 443 POST /mapi/emsmdb/ MailboxId=******@mydomain.com&CorrelationID=<empty>;&cafeReqId=39a29516-633d-48ff-b93f-9de29984dfec; 401 0 0 NULL NULL 9 NULL NULL Microsoft+Office/16.0+(Windows+NT+10.0;+Microsoft+Outlook+16.0.4549;+Pro) MapiContext=MAPIAAAAAOC49bfvwobF6Nn6yPjK+9bm0/7M/Nzt1e/c7dfj0oirmaCQpJKnl6KW9zIAAAAAAAA=;MapiRouting=UlVNOjVhOWFjMWU1LTM4ZTktNGY0Yy04OTFmLWYyNDFjODNhMzI5MzpiAs7xtR3ZCA==;MapiSequence=493-9Bw/Aw==;X-BackEndCookie=3142a0b8-351f-49e4-9067-08c5ddcc2bbc=u56Lnp2ejJqBxsfLmZuZz8vSzpnNzdLLy5uc0p7IxpzSm8aazs2ayZ3Lx5ucgYHNz83O0s/J0s3Nq8/JxcvLxc7O NULL NULL NULL NULL NULL NULL NULL NULL NULL
D:\RPIISLog\Exmbx-dc-2\u_ex210523.log 831606 2021-05-23 06:44:13 10.21.92.109 NULL NULL EXMBX-DC-2 10.96.36.101 443 POST /autodiscover/autodiscover.xml &CorrelationID=<empty>;&cafeReqId=7dad860b-73c7-4d17-9ae0-417d6fdeb98a; 401 0 0 NULL NULL 53 NULL NULL Microsoft+Office/16.0+(Windows+NT+10.0;+Microsoft+Outlook+16.0.4954;+Pro) OutlookSession="{CD7A4BC8-E0AA-4B82-BBC6-AE4C48F55FB6}" NULL NULL NULL NULL NULL NULL NULL NULL NULL
D:\RPIISLog\Exmbx-dc-2\u_ex210523.log 831646 2021-05-23 06:44:13 10.96.64.100 NULL NULL EXMBX-DC-2 10.96.36.101 443 POST /EWS/Exchange.asmx &CorrelationID=<empty>;&cafeReqId=c6a4fd6f-1502-4195-9a6a-4a4cf7b9658d; 401 0 0 NULL NULL 30 NULL NULL Microsoft+Office/16.0+(Windows+NT+6.2;+Microsoft+Outlook+16.0.4266;+Pro) OutlookSession="{83BE22C9-1E53-46A8-993F-50B3F01C9795}" NULL NULL NULL NULL NULL NULL NULL NULL NULL
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(252.8, 22%, 34%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ELL%3C/text%3E%3C/svg%3E)
Hi @Nur Hossain ,
Since the screenshot you provided contains your personal information (domain name), in order to prevent your information from leaking, I will overwrite it and upload it again.
Hi @Nur Hossain ,
I am writing here to confirm with you how thing going now?
----------
If the response is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.
Hi @Nur Hossain
Try enabling advanced logging in IIS and see if the usernames are logged. Also, could you please let us know the below,
1.What authentication is enabled on the virtual directories
2.Are there any impact for the users like disconnection/not working/functionality not working, etc
3.If you open the IIS log in notepad, does it show the cs-username or is it still NULL. This is just to isolate if there could be issues with loading the IIS log to the log parser studio
Hi @Nur Hossain ,
In addition to the above, the following points need to be confirmed:
What's the version of Exchange server?
Have any changes been made to the Exchange organization before the problem occurred?
Please check the Authentication of MAPI,EWS and ActiveSync in IIS.
----------
If the response is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.
Below are the details:
Authentication is enabled on the virtual directories
For Autodiscover: Integrated Windows Authentication and Basic Authentication.
For Active Sync: Basic Authentication
For MAPI: Windows Authentication (NTLM, Negotiate) and server to server authentication (OAuth).
Exchange Server Version: Exchange Server 2016 CU20 (latest SU Installed). Exchange hybrid Environment.
Enable advanced logging: Options is not available.
Impact: No, users are not facing any issue but getting reports from the Monitoring tool.
Note: In notepad also showing the same.
Thank You
Nur
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(284.8, 17%, 37%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EYS%3C/text%3E%3C/svg%3E)
Hi @Nur Hossain ，
As per the log parser screenshot shared in your initial post, I'm wondering do you mean all the cs-username entries are showing as "NULL", which means no cs-username is recorded, or you have alreay filtered out the other usernames when querying the logs?
Is this a recently occurred issue after any changes were implemented in the environment?
No, Some cs-username showing NULL,
Actually, only for Status code 401 cs-username showing NULL.
Is it normal? or Is it an Issue?
I am confused when cs-username showing null and what mean by staus code 401.
Hi @Nur Hossain ,
I tried searching around regarding "cs-username showing NULL" but hardly find anything useful. Then I checked the IIS logs in my test Exchange server and found no values for cs-username are showing "NULL", but I noticed that there are quite a few lines with cs-username showing hyphen(-), which means Anonymous users according to this official document:
However, when the logs are viewed in Log Parser Studio, the hypens are showing as empty, still different from what you encountered:
Could you check if there are cs-username showing hyphen or empty on your end? As I am thinking if the Anonymous users are indicated by "NULL" for any unknown reason in your situation.
As regards to your concern about the Status code 401, it refers to "Access Denied" according to this link.