Ceyhun KIRMIZITAS

10Sep 2026 by Ceyhun Kirmizitas No Comments

Exchange Server SE / 2019 OWA Authentication Deep Dive – Part 5: Managed Availability and OWA Health Probes

Exchange

Summary: Exchange generates its own OWA traffic through Managed Availability, and that traffic can look confusing when it is mixed with real user requests. In this part, we separate health probes from interactive logons and look at exhealth.check, SelfTest, DeepTest, OWADEEPTEST, EACBACKENDLOGON, HealthMailbox traffic, backend 401 challenges, and the 241 response captured during testing. Exchange's own health traffic can look surprisingly similar to failed user authentication. Knowing how to recognize Managed Availability probes prevents normal 401 challenges, HealthMailbox activity, and synthetic tests from becoming false troubleshooting leads. Part 1: How OWA Authentication Really WorksPart 2: Forms-Based and Basic Authentication – What Really Changes?Part 3: Frontend vs Backend Authentication – Controlled A/B TestsPart 4: Troubleshooting OWA Authentication with IIS and HttpProxy LogsPart 5: Managed Availability and OWA Health Probes — you…

08Sep 2026 by Ceyhun Kirmizitas No Comments

Exchange Server SE / 2019 OWA Authentication Deep Dive – Part 4: Troubleshooting OWA Authentication with IIS and HttpProxy Logs

Exchange

Summary: OWA authentication troubleshooting gets much easier when the same request is followed through all three log layers instead of reading one HTTP status in isolation. In this part, we compare successful FBA, a bad password, and a backend authentication failure across frontend IIS, Exchange HttpProxy, and backend IIS. If you troubleshoot Exchange OWA by searching for 401 responses or treating every 302 as a successful sign-in, you can easily chase the wrong layer. This part gives you a repeatable way to correlate W3SVC1, HttpProxy, and W3SVC2 so the same request shows where it actually failed. Part 1: How OWA Authentication Really WorksPart 2: Forms-Based and Basic Authentication – What Really Changes?Part 3: Frontend vs Backend Authentication – Controlled A/B TestsPart 4: Troubleshooting OWA Authentication with IIS and HttpProxy Logs…

06Sep 2026 by Ceyhun Kirmizitas No Comments

Windows 11 25H2 System Tray Disappears After KB5121003 and KB5120998 – Reproduced and Tested

Windows 11, Windows Client

Summary: In my Windows 11 25H2 lab, the entire system tray disappeared after installing KB5121003 and disappeared again after installing the later KB5120998 cumulative preview. Removing KB5121003 rolled the VM back to OS Build 26200.8037 and immediately restored the clock, network, volume and notification area. This post documents the reproduction, rollback, temporary block and the follow-up test with KB5120998. This is a lab reproduction, not a claim that every Windows 11 25H2 device will experience the same problem. At the time of writing, Microsoft does not list this exact whole-system-tray symptom as a known issue for KB5121003. Lab environment and starting point The test system was a non-touch Windows 11 25H2 virtual machine. The affected starting build was 26200.9168. Microsoft documents that build as the Windows 11 25H2 build delivered…

04Sep 2026 by Ceyhun Kirmizitas No Comments

Exchange Server SE / 2019 OWA Authentication Deep Dive – Part 3: Frontend vs Backend Authentication – Controlled A/B Tests

Exchange

Summary: In Part 2, we changed the frontend authentication methods and watched the browser behavior change with them. In this part, the frontend stays on the normal FBA configuration while we change only the backend OWA authentication settings. The goal is to separate “the user authenticated at the frontend” from “the request reached the backend successfully.” A user can enter valid credentials and still be returned to the Exchange OWA logon page because the failure happened after frontend authentication. This part shows how to prove where the failure occurs instead of assuming the password or the frontend authentication method is the problem. Part 1: How OWA Authentication Really WorksPart 2: Forms-Based and Basic Authentication – What Really Changes?Part 3: Frontend vs Backend Authentication – Controlled A/B Tests — you are…

02Sep 2026 by Ceyhun Kirmizitas No Comments

Exchange Server SE / 2019 OWA Authentication Deep Dive – Part 2: Forms-Based and Basic Authentication – What Really Changes?

Exchange, Exchange Server SE / 2019 / 2016

Summary: In Part 1, we mapped the OWA authentication layers and captured the default configuration. In this part, we change only the frontend OWA authentication settings and watch what happens in Exchange, IIS, and the browser. Changing one Exchange OWA authentication setting can completely change what IIS allows and what the browser shows. Understanding those differences makes it much easier to tell a real authentication failure from an expected 401 challenge, a Basic prompt, or the normal Exchange OWA sign-in flow. Part 1: How OWA Authentication Really WorksPart 2: Forms-Based and Basic Authentication – What Really Changes? — you are herePart 3: Frontend vs Backend Authentication – Controlled A/B Tests This is not a production hardening guide. The point is to change one thing at a time, observe the result,…

31Aug 2026 by Ceyhun Kirmizitas No Comments

Exchange Server SE / 2019 OWA Authentication Deep Dive – Part 1: How OWA Authentication Really Works

Exchange, Exchange Server SE / 2019 / 2016

Summary: OWA authentication is easier to troubleshoot once the frontend, Exchange authentication layer, HttpProxy, and backend are treated as separate parts of the same request. This first part sets the baseline, shows the main commands, and explains which settings matter before we start changing anything. Exchange OWA authentication problems are easy to misdiagnose because the browser, frontend IIS, Exchange authentication layer, HttpProxy, and backend do not tell the same story. Before changing any setting, you need to know which layer actually owns the failure. Version scope: The behaviors and configurations covered in this series apply to Exchange Server 2019 CU15 and Exchange Server Subscription Edition (SE) RTM. Microsoft states that SE RTM is code-equivalent to Exchange 2019 CU15 apart from the license agreement, product name, and build number. Earlier Exchange…

25Aug 2026 by Ceyhun Kirmizitas 2 Comments

Get Exchange Server URLs and Authentication Settings with PowerShell

Exchange, Exchange Server SE / 2019 / 2016

The original GetExchangeURLs.ps1 script was written by Paul Cunningham to provide a simple way to display Exchange Server Client Access URLs from a single PowerShell script. Ali Tajran later updated the script to version 1.10, adding the PowerShell virtual directory and reorganizing the output. I recently revisited the script and decided to continue the same approach rather than create a completely new one. The result is Get-ExchangeURLs-v2.ps1. View / Download the PowerShell Script View Get-ExchangeURLs-v2.ps1 The script opens directly in the browser so the contents can be reviewed before saving or running it. Version 2 keeps the original read-only URL reporting concept, but updates and extends it with additional options for authentication visibility, service filtering, multi-server output, grouping, and text-file export. What Changed in Version 2 The main changes added…

24Aug 2026 by Ceyhun Kirmizitas No Comments

Get-ExchangeCertificate Returns Blank with a Valid Auth Certificate

Exchange, Exchange Server SE / 2019 / 2016

While validating a fresh Exchange Server 2019 CU15 installation, I started capturing the default configuration before making any namespace, certificate, or authentication changes. One of the first checks was Get-ExchangeCertificate. Unexpectedly, the cmdlet returned only the column headers and no certificate objects, even though the Exchange Admin Center showed the certificates normally. PowerShellGet-ExchangeCertificateGet-ExchangeCertificate Thumbprint Services Subject ---------- -------- ------- At first, this looked like the known Exchange Auth Certificate issue associated with PowerShell Serialization Payload Signing. However, the Auth Certificate was present, valid, correctly configured, and Microsoft's validation script reported no problem. What initially looked like a certificate problem eventually turned out to be related to the timing of certificate activation and HMAC key selection. Certificates were present and the Auth Certificate was valid The Exchange Admin Center showed all…

22Aug 2026 by Ceyhun Kirmizitas No Comments

Troubleshooting Microsoft Entra Pass-through Authentication in Multi-Forest Environments

Hybrid Identity, Identity, Microsoft Entra ID

Microsoft Entra Pass-through Authentication (PTA) allows users to sign in to Microsoft Entra ID using passwords that are validated directly against on-premises Active Directory. In a single Active Directory forest, this password validation path is usually straightforward. In a multi-forest environment, however, the PTA agent may need to validate users located in another forest through an Active Directory forest trust. In this scenario, the PTA agent itself can be healthy and successfully validate users in one forest, while Microsoft Entra sign-ins for users in another forest fail through the same agent. In this article, we will look at how Forest Trust and Name Suffix Routing can affect cross-forest password validation with Microsoft Entra Pass-through Authentication. Scenario The lab contains two Active Directory forests: lab.local lab3.local A two-way forest trust is…