AnsweredAssumed Answered

G&L AFX to enable/disable Exchange 2016 fails.

Question asked by Shlomo Katz on Sep 16, 2019
Latest reply on Sep 19, 2019 by Ian Staines

Like • Show 0 Likes0
Comment • 12

Environment:

G&L 7.1.1.P1

Process:

Joiner/Leaver rule calls a Powershell Script to enable or disable the mailbox.

Until last week, the setup was:
G&L > Utilizing PowerShellServer connected to Windows 2012 R2 server > Exchange 2010 On-Prem

What Changed - Part 1

Exchange was upgraded to 2016 on a Windows 2016 (?) DataCanter

First error: When G&L calls the Exchange power shell script, the error was Invalid Credentials.

Of course we verified the credentials and all commands - only failed when G&L made the initial call.

What Changed - Part 2

Upgraded the powershell server to Windows 2019 utilizing integrated OpenSSH

Tested by Putty from my workstation > called the powershell script and was able to verify get-mailbox was available.

However, when G&L calls the same script, with the same credentials , there is no error, but the modules do not load either.

Bottom line: Exchange 2016 does not like when G&L calls the powershell script.

Has anybody heard of this issue, or even better, a solution?

Thank you

Shlomo

Shlomo Katz Sep 19, 2019 2:24 PM

Correct Answer

Thank you for your response and additional thoughts.

1. The interactive sessions only showed the "status bar" loading modules.

2. We did not have this issue with Exchange 2010 - so this issue is mostly likely a MS issue.

3. I will keep -ErrorAction SilentlyContinue". in mind for future issue.

See the reply in context

No one else had this question

Outcomes

12 Replies

Ian Staines Sep 17, 2019 10:05 AM
Mark Correct
Correct Answer
Almost always these types of issues are permissions errors of the AD Account on the target system that is running the powershell command. Testing locally using putty may not emulate the failure exactly. Sometimes (rarely) there may be an error in the system event log on the machine hosting the powershell server. I will have to see if there are other techniques.
Like • Show 0 Likes0
Actions
- Shlomo Katz @ Ian Staines on Sep 17, 2019 10:15 AM
  Mark Correct
  Correct Answer
  Thank you , at your recommendation, I looked at the event log.
  Log Name: Windows PowerShell
  Source: PowerShell
  Date: 9/16/2019 6:44:42 PM
  Event ID: 300
  Task Category: Provider Health
  Level: Warning
  Keywords: Classic
  User: N/A
  Computer:#############
  Description:
  Provider Health: Win32 internal error "Access is denied" 0x5 occurred while reading the console output buffer. Contact Microsoft Customer Support Services..
  Details:
  ProviderName=ActiveDirectory
  ExceptionClass=ProviderInvocationException
  ErrorCategory=ReadError
  ErrorId=ReadConsoleOutput
  ErrorMessage=Win32 internal error "Access is denied" 0x5 occurred while reading the console output buffer. Contact Microsoft Customer Support Services.
  Severity=Warning
  SequenceNumber=20
  HostName=ConsoleHost
  HostVersion=5.1.17763.592
  HostId=6c892efa-f73b-477a-96e0-a3ae8b3fe7f2
  HostApplication=c:\windows\system32\windowspowershell\v1.0\powershell.exe -c ################# 2>&1
  EngineVersion=5.1.17763.592
  RunspaceId=ce920fc7-137d-4db7-b4ad-781b10db2427
  PipelineId=4
  CommandName=
  CommandType=
  ScriptName=
  CommandPath=
  CommandLine=
  Event Xml:
  <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
  <Provider Name="PowerShell" />
  <EventID Qualifiers="0">300</EventID>
  <Level>3</Level>
  <Task>3</Task>
  <Keywords>0x80000000000000</Keywords>
  <TimeCreated SystemTime="2019-09-16T22:44:42.724716400Z" />
  <EventRecordID>1074</EventRecordID>
  <Channel>Windows PowerShell</Channel>
  <Computer>##############</Computer>
  <Security />
  </System>
  <EventData>
  <Data>Win32 internal error "Access is denied" 0x5 occurred while reading the console output buffer. Contact Microsoft Customer Support Services.</Data>
  <Data> ProviderName=ActiveDirectory
  ExceptionClass=ProviderInvocationException
  ErrorCategory=ReadError
  ErrorId=ReadConsoleOutput
  ErrorMessage=Win32 internal error "Access is denied" 0x5 occurred while reading the console output buffer. Contact Microsoft Customer Support Services.
  Severity=Warning
  SequenceNumber=20
  HostName=ConsoleHost
  HostVersion=5.1.17763.592
  HostId=6c892efa-f73b-477a-96e0-a3ae8b3fe7f2
  HostApplication=c:\windows\system32\windowspowershell\v1.0\powershell.exe -c ################
  2>&1
  EngineVersion=5.1.17763.592
  RunspaceId=ce920fc7-137d-4db7-b4ad-781b10db2427
  PipelineId=4
  CommandName=
  CommandType=
  ScriptName=
  CommandPath=
  CommandLine=</Data>
  </EventData>
  </Event>
  Like • Show 0 Likes0
  Actions
  - Jayson Abrams @ Shlomo Katz on Sep 17, 2019 10:28 AM
    Mark Correct
    Correct Answer
    This sounds very likely to be a double hop issue.
    
    Review this article
    Making the second hop in PowerShell Remoting | Microsoft Docs
    
    Does it work if you execute it directly on the PowerShell Server?
    Like • Show 0 Likes0
    Actions
    - Shlomo Katz @ Jayson Abrams on Sep 17, 2019 11:01 AM
      Mark Correct
      Correct Answer
      It works directly from hosting windows server.
      It works if I use Putty on my computer to the windows server to run the commands.
      It "only" fails when G&L AFX connects to the server to run the script.
      Like • Show 0 Likes0
      Actions
Ian Staines Sep 17, 2019 11:34 AM
Mark Correct
Correct Answer
"0x5" I believe corresponds to access denied, so I expect these errors are directly related to the failure. The symptoms of failure from some endpoints and success from others is typical presentation for Windows permission errors. Under the covers windows uses kerberos delegated authentication and the embeded kerboros ticket may have very specific policies as to where specific credentials may be used and for what objects. These interact with local and domain security polices on the machine.

You can be certain that the account that powershell is running under does not have "sufficient" rights to execute the commands, but exactly what policy object is enforcing this and what the minimum requirement is may be difficult to determine.

Whatever the resolution is it will come from a change on the Microsoft side, there is nothing configurable in IG&L that will likely resolve this.
Like • Show 0 Likes0
Actions
- Shlomo Katz @ Ian Staines on Sep 17, 2019 11:36 AM
  Mark Correct
  Correct Answer
  Thank you, we will work with MS.
  Like • Show 0 Likes0
  Actions
Ian Staines Sep 17, 2019 11:46 AM
Mark Correct
Correct Answer
It might help to look at the question from the opposite viewpoint; what Domain Policy would you need to use to disable remote users from accessing powershell? The answer to this question is what you need to revert.

This came up in my search but not positive it is relevant.

Disable-PSRemoting
Like • Show 0 Likes0
Actions
- Shlomo Katz @ Ian Staines on Sep 17, 2019 2:39 PM
  Mark Correct
  Correct Answer
  Ian Staines
  Thank you for your feedback.
  What ever the issue is, it seems to be very specific to AFX calling to Exchange 2016.
  The same setup worked with exchange 2010.
  
  I even PuTy'd into G&L server > ssh connection using the same credentials as what AFX uses > called the script > validated modules loaded.
  Like • Show 0 Likes0
  Actions
  - Shlomo Katz @ Shlomo Katz on Sep 19, 2019 6:47 AM
    Mark Correct
    Correct Answer
    Ian Staines
    
    After days of searching, the solution was to add the following line:
    $progressPreference = 'silentlyContinue'
    Before the Import-Session
    This seems to be related more to Exchange 2016 when connecting from an application through SSH.
    
    Even though the following link is for "invoke-webrequest" , I decided to try with "Import-Module".
    
    How to disable invoke-webrequest progress/status bar when testing CAS services?
    
    The last comment was t word for word of my issue.
    "May help to prevent error like
```
Win32 internal error "Access is denied" 0x5 occurred while reading the console output buffer. Contact Microsoft Customer Support Services
```
    if from SSH."
    Like • Show 0 Likes0
    Actions
    - Ian Staines @ Shlomo Katz on Sep 19, 2019 12:54 PM
      Mark Correct
      Correct Answer
      Thanks for the solution Shlomo.
      
      I am sure there are multiple factors here.
      
      The error message " 0x5 occurred while reading the console output buffer" now makes a little more sense with this context. This error occurs when the powershell session attempts to send output to the console. Of course for a remote SSH session there is no console, or more correctly the windows delegated user account does not have permission to write to the console.
      
      Its not clear what powershell is attempting to display, it could be status message or a warning or even an error. (You might be able to see this in an interactive session.) Whatever it is attempting to display is informational only as the actual powershell command succeeds.
      
      From your example, whatever this message is, it seems it displays against your Exchange 2016 instance and not against Exchange 2010.
      
      Still it seems prudent in any instance to proceed whenever there is an error of this type, as you cannot always be able to predict when a command will attempt to send output to the console and in any regard sending output to the console is not desirable.
      
      I see in our examples for other PowerShell connectors we always explicitly include " -ErrorAction SilentlyContinue". I am not sure if your $progressPreference variable accomplishes the same purpose.
      Like • Show 0 Likes0
      Actions
      - Shlomo Katz @ Ian Staines on Sep 19, 2019 2:24 PM
        Unmark Correct
        Correct Answer
        Thank you for your response and additional thoughts.
        1. The interactive sessions only showed the "status bar" loading modules.
        2. We did not have this issue with Exchange 2010 - so this issue is mostly likely a MS issue.
        3. I will keep -ErrorAction SilentlyContinue". in mind for future issue.
        Like • Show 0 Likes0
        Actions
        Ian Staines @ Shlomo Katz on Sep 19, 2019 2:29 PM
        Mark Correct
        Correct Answer
        Oh yes, I see now...its specifically the progress bar that is being suppressed.
        Like • Show 0 Likes0
        Actions

G&L AFX to enable/disable Exchange 2016 fails.

Outcomes

Related Content

Recommended Content