This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(44.800000000000004, 28.999999999999996%, 14%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EJM%3C/text%3E%3C/svg%3E)
I set up an exchange 2019 server on-prem, and if I try to access it through OWA, it gives the below error. I have disabled SSL in IIS for OWA and ECP and it still does it.
I also seem to not be able to access it through the mail app, but that could be due to a routing issue. The computers can see it, but it keeps saying if can't find the server to configure the settings.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(73.60000000000001, 94%, 17%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ELM%3C/text%3E%3C/svg%3E)
Hi,
I am checking the status of this case. Please let us know if you would like further assistance.
Is there any update on this case?
If you have any update about this issue, please feel free to post back.
Have a nice day!
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(137.6, 98%, 23%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EAS%3C/text%3E%3C/svg%3E)
Please locate "Computer Management> Local Users and Groups>Groups>Administrators" on each of your Exchange servers.
And make sure "Domain\Exchange Trusted Subsystem" is a member of this group.
Check this blog for help - https://www.stellarinfo.com/blog/exchange-server-http-500-error-ecp/
It is there, though guessing that it has the extra stuff on the end, it isn't happy with it.
Hi @Anonymous ，
According to your description, Exchange cannot be accessed through OWA and the mail APP. This may seem like a problem with exchange server configuration. You can first look at Event Viewer to see if there are any related error logs generated and to ensure that the Exchange server is running.
This issue may be caused by not enabling the MyBaseOptions user role in the Default Role Assignment Policy. For specific solutions, please refer to this document.
According to your error message "You do not have the user rights to view this page", it may be that you do not have the user rights to access, it is recommended that you check the permissions first.
Besides, this issue occurs if a computer object is added to a group that's denied the ms-Exch-EPI-Token-Serialization user right.. To resolve this issue, remove the computer object from the restricted group.
Please refer to this link for more information.
Browsers can also cause similar issue. https://appuals.com/fix-you-dont-have-authorization-to-view-this-page/
Besides, not sure if disabling OWA will have a similar issue, you can confirm it again.
If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".
MyBaseOperations in Default Role Assignment policy is checked.
On this command Get-ADPermission -Identity <ExchangeComputerObject> | where {($.ExtendedRights -like "ms-Exch-EPI-Token-Serialization") -and ($.Deny -like "True")} | ft -autosize User,ExtendedRights from https://learn.microsoft.com/en-us/exchange/troubleshoot/client-connectivity/error-occur-ems-eac-owa, is something supposed to be in the <ExchangeComputerObject>? The instructions don't say anything, just run this.
I did find these three in the administrators group on the exchange server. Should I remove them? They are also on the domain controller because they were needed for the install of Exchange.
Domain Admins
Schema Admins
Enterprise Admins
I am using Edge Chromium, and in inprivate mode, it does the same thing.
Hi @ JonMercer-4070,
Get-ADPermission is used to view all the users and groups that are denied permissions on the Exchange computer object.
By default, these three groups are denied the ms-Exch-EPI-Token-Serialization user right.
You just remove the computer object from the restricted group and restart the computer that has the exchange Server Role assigned.
Hi,
It has been a long time since last reply, if the above suggestion helps, please click “Accept as answer” to mark helpful reply as an answer. Your action would be helpful to other users who encounter the same issue and read this thread.
Regards,
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(51.2, 70%, 14%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EDP%3C/text%3E%3C/svg%3E)
Hi,
I most cases problem with accessing OWA when using CBA is a certificate issue. First place that you need to look is IIS logs (C:\inetpub\logs\LogFiles\W3SVC3) and find an error line with 403 error code, then look end of that line with specific details, example: 403 2148204809.
If this is the case, for sure problem is with local certificate root store conflict described in this article:
https://stackoverflow.com/questions/26247462/http-error-403-16-client-certificate-trust-issue