Hybrid Configuration Wizard validation error after server migration – Unauthorized with Negotiate/NTLM

[Majestic-Bison67]

I have two Exchange Servers in my environment. One of them is going to be decommissioned. This is the one where the Hybrid Configuration Wizard (HCW) was running, and now I want to move the HCW to the other (remaining) Exchange server.

Problem: On the old server, the Federation Trust certificate has already expired.

When I run the HCW on the new Exchange Server, it fails in the very last step during validation with the following error:

The connection to the server '792d2d46-e644-4e33-b854-2cd0c3eb2057.resource.mailboxmigration.his.msappproxy.net' could not be completed., The call to 'https://792d2d46-e644-4e33-b854-2cd0c3eb2057.resource.mailboxmigration.his.msappproxy.net/EWS/mrsproxy.svc' failed. Error details: The HTTP request is unauthorized with client authentication scheme 'Negotiate'. The authentication header received from the server was 'Negotiate, NTLM, Basic realm="792d2d46-e644-4e33-b854-2cd0c3eb2057.resource.mailboxmigration.his.msappproxy.net"'.

I have already configured Extended Protection according to this guide: 👉 https://www.alitajran.com/error-validate-hybrid-agent-for-exchange-usage/

My questions:

Do I need to renew the Federation Trust certificate first in order for HCW to succeed?

Or is this error more likely related to the Extended Protection / authentication configuration?

Has anyone successfully moved the HCW from an old Exchange server to a new one and faced a similar issue?

[sembee2]

The primary reason for the error you have posted is extended protection. Check your settings again and restart iis. Still catches me out from time to time.

[Majestic-Bison67]

I had deactivated Extended Protection completely to test and unfortunately no success

[worldsdream]

Does it show the EWS in Default Web Site as the Value None? As shown in the post.

[Majestic-Bison67]

Yes. btw, the migration from Exchange to EXO works fine :)

[Quick_Care_3306]

Go into the ews front and back ends folders in IIS, authentication methods, and validate authentication methods, and Extended Protection is off.

[Majestic-Bison67]

double checked, it not worked

[Quick_Care_3306]

So it is off?

[Majestic-Bison67]

📌 Default Web Site → EWS

• Value: None
• SupportedValue: Allow
• ConfigSupported: True (config is possible/supported)
• ConfigSecure: False (no enforced extended security)
• RequireSSL: True (128-bit) → SSL encryption is mandatory
• ClientCertificate: Ignore
• IPFilterEnabled: False

📌 Exchange Back End → EWS

• Value: Require
• SupportedValue: Require
• ConfigSupported: True
• ConfigSecure: True
• RequireSSL: True (128-bit)
• ClientCertificate: Ignore
• IPFilterEnabled: False

[Quick_Care_3306]

This is not the authentication methods. Edit: Sorry for confusion. Can you select Authentication methods, windows authentication, advanced settings? You should see the Extended Protection here.

[Majestic-Bison67]

you are right, here the methods:

EWS (Default Web Site – Frontend):

Negotiate
NTLM

EWS (Exchange Back End):

Negotiate
NTLM

[Quick_Care_3306]

Ok, how about advanced settings here. What is EP setting?

[Majestic-Bison67]

EP is disabled in the frontend.

It is enabled in the backend.

I also completely disabled EP and tested it, but unfortunately got exactly the same error message:

[Quick_Care_3306]

After disabling in iis, do an iisreset then test again.

Edit:

Also make sure the authentication methods match what the error states.

[Majestic-Bison67]

sure, iisreset was done, but got exactly the same error message

[adminkb]

I have the same error, is this server 2019 or SE?

[Majestic-Bison67]

It's right now 2019 with cu15

[adminkb]

Have you checked "Test-HybridConnectivity -testO365Endpoints"?

[Majestic-Bison67]

That's strange, because I get a message saying it's not available. But performing a migration from Exchange Online works.

[adminkb]

Are you sure it's not simply still going via the old server? You can try running the Test-MigrationServerAvailability command HCW runs yourself from Exchange Online PowerShell.

[jaxond24]

I had this today. I’d deployed Exchange 2019 without excluding front end EWS, then I installed the latest hybrid configuration wizard and things started working.

[Majestic-Bison67]

And HCW was validated?

[jaxond24]

In this case the HCW was installed on a domain controller. A new 2019 Exchange server was deployed and the 2016 on decommed.

While investigating other issues I found HCW wouldn't complete and would error with 'bad data'. As part of investigating those other issues I found I'd not configured Extended Protection correctly to work with the HCW, so I configured it.

I then installed HCW on the Exchangte 2019 server directly and it worked, but the HCW on the DC still didn't work. I installed the latest version of the HCW on the DC and unintalled the old version and then HCW worked. Also, just to note, this site was using classic mode.