Exchange 2013 - Admins can only log into one ECP server

Question

Simple run down of my environment:
• Two AD sites (Site1 and Site2)
• One 2008 R2 domain controller at each site (DC1 w/ FSMOs and DC2) running AD forest function level 2008 R2
• One 2012 Std server with Exchange 2012 Std CU3 at each site (EX1 and EX2) – CAS/MBX on both, No DAG
• Half of mailboxes on each server
Using https://webmail.domain.com for all of our internal and external virtual directories. Adding /OWA or /ECP will get you into the respective site from either internal or external.
All Domain Admin/Exchange Admin (Organization Management) do NOT have mailboxes. Those individuals can log into ECP from https://webmail.domain.com/ecp, or FQDN or IP of EX2 only. If John Smith has no mailbox then he must use:
https://webmail.domain.com/ecp
or
https://ex2.domain.com/ecp
or
https://10.16.109.31/ecp
If EX2 goes offline or they use https://ex1.domain.com/ecp or https://10.16.108.31/ecp then none of the admins can login and they get the following:
Use the following link to open this mailbox with the best performance:
https://webmail.domain.com/owa/auth.owa
X-FEServer: EX2
Date: 2/18/2014 10:37:42 PM
s ECP or the https://webamil.domain.com/ecps ECP.
They can access EMS from either server and run Get-ECPVirtualDirectory and it shows what we would expect:
– https://webmail.domain.com/ecp
– https://webmail.domain.com/ecp
Why can an admin with no mailbox only log into the ECP on EX2? What is forcing the login to EX2 only? How can I move that “forced login” to EX1 if we ever get into a situation where EX2 is having problems? What happened in Active Directory or Exchange that
made EX2 the primary login server for ECP and OWA? My FSMOs are located at Site 1…the same location where EX1 is located. The same server that I cannot log into ECP directly.
~Rick

Answer 1

Any admin that is mail enabled can then only log into the server that hosts his mailbox. Admins without mailboxes can only log into EX2. And again, all admins can log into https://webmail.domain.com/ecp unless one of the servers goes offline
and that's when the problems occur. Nothing obvious or unusual regarding mail flow. Done various internal and external tests and have not seen anything obvious or in the logs.
Yesterday's change that MS Support had me do was to delete the ExternalURL for the ECP virtual directories. No difference. So, my latest update from MS Support that requested me to try today's change...
set-owavirtualdirectory “owa (default web site)” -RedirectToOptimalOWAServer $false
After performing an IIS reset and making sure replication had completed there was no difference. So, I am now forced to wait till Monday for MS to respond if the pattern stays at one email per day.
Has anyone with multiple servers at different AD sites been able to log directly into the either server like I'm trying? I get this problem in my labs and I even had MS, while on the phone, remote in to make sure I was setting it up properly.
The guy on the phone never said if their labs do the same thing cause they don't have multiple AD sites in their labs. In my lab if I have two servers at each site then I can log into both servers at the site, but not the other site. It appears it becomes
site dependent then.
MS has taken numerous logs and they are acting like this is the first time they've seen this. Yet I can reproduce it with no problem time after time. I'll create new VMs and start all over from scratch and make this happen every time I create a new AD/Exchange
environment (it does take me a while to build all those VMs from scratch). No fancy GPOs to AD and no radical changes to the Exchange servers. Other than obvious config changes to make sure email can flow internally and externally, this is pretty much out
of the box.
~Rick