Most Exchange Management Shell errors belong to a few families: the shell can't connect, RBAC won't let you run something, the identity you typed doesn't resolve to exactly one object, the object's data fails validation, or Active Directory refuses the write. This quick reference lists 34 errors as they appear in the shell and in setup, with what each means on Exchange Server SE and Exchange Server 2019, the usual cause and the first check. Search for a distinctive phrase from your message.
Codes in this quick reference
The WinRM client cannot process the request. It cannot determine the content type of the HTTP response from the destination computer.Exchange Management ShellThe WinRM client received an HTTP server error status (500)Exchange Management ShellThe WinRM client received an HTTP status code of 403 from the remote WS-Management service.Exchange Management ShellThe WinRM client sent a request to an HTTP server and got a response saying the requested HTTP URL was not available.Exchange Management ShellUnable to load the type "Microsoft.Exchange.Configuration.Authorization.ExchangeAuthorizationPlugin"Exchange Management ShellThe WinRM Shell client cannot process the request. The shell handle passed to the WSMan Shell function is not valid.Exchange Management ShellFailed to connect to an Exchange server in the current site.Exchange Management Shell (startup)The user "<user>" isn't assigned to any management roles.Exchange Management Shell
+ 26 more codes in the tables below.
How to read these codes#
The Exchange Management Shell is a remote PowerShell session to the /PowerShell virtual directory of an Exchange server, even when you open it on the server itself. RBAC decides which cmdlets and parameters you get, and the change in Active Directory is then made by Exchange (the Exchange Trusted Subsystem), not by your account. That's why an Organization Management member can still hit an AD permission error.
- Read past the first line.
CategoryInfonames the exception, for exampleManagementObjectNotFoundExceptionorADOperationException, andFullyQualifiedErrorIdoften adds a failure category such as[FailureCategory=Cmdlet-ADOperationException]. - Placeholders such as
<identity>and<DC>stand for the values in your message. - Setup errors appear in the readiness checks and in
C:\ExchangeSetupLogs\ExchangeSetup.log.
PowerShell
# The full last error: exception type, category and target
$Error[0] | Format-List * -Force
# Search the whole forest in this session (multi-domain forests)
Set-ADServerSettings -ViewEntireForest $true
# Pin a command to one domain controller to rule out replication delay
Get-Mailbox jdoe -DomainController DC01.contoso.comEvent log entries behind some of these errors are in the Exchange Server event IDs quick reference.
Connecting the shell: WinRM and remote PowerShell#
These follow Connecting to remote server … or Processing data from remote server … failed with the following error message. Each points at one link: IIS, the PowerShell virtual directory, Kerberos or Exchange's own code.
| Code | Meaning | Usual cause | First check |
|---|---|---|---|
The WinRM client cannot process the request. It cannot determine the content type of the HTTP response from the destination computer. The content type is absent or invalid. | IIS answered with something WinRM couldn't use | The kerbauth or WSMan module misconfigured on the PowerShell virtual directory, or the account not enabled for remote PowerShell | (Get-User <user>).RemotePowerShellEnabled; modules on Default Web Site › PowerShell. Guide |
The WinRM client received an HTTP server error status (500), but the remote service did not include any other information about the cause of the failure. | Exchange's PowerShell application failed | An interrupted or non-elevated update, a broken back-end site or antivirus interference | The exception in the Application log; rerun the update elevated. Guide |
The WinRM client received an HTTP status code of 403 from the remote WS-Management service. | IIS refused the request | Require SSL turned on for the PowerShell virtual directory | Clear it under Default Web Site › PowerShell › SSL Settings. Guide |
The WinRM client sent a request to an HTTP server and got a response saying the requested HTTP URL was not available. | Nothing answers at that URL | The PowerShell virtual directory is missing, or the Default Web Site port 80 binding was removed or restricted | Bindings against a healthy server; Get-PowerShellVirtualDirectory. Guide |
Unable to load the type "Microsoft.Exchange.Configuration.Authorization.ExchangeAuthorizationPlugin" specified in the "InitializationParameters" section. | Exchange's authorization code didn't load | A damaged install, usually an interrupted update; admins also report third-party antivirus interfering with Exchange files | Rerun the update from an elevated prompt; check antivirus exclusions. Guide |
The WinRM Shell client cannot process the request. The shell handle passed to the WSMan Shell function is not valid. | The session broke after it was opened | No valid certificate on the Exchange Back End site's port 444 binding | The 444 binding; HttpEvent 15021 in the System log. Guide |
Failed to connect to an Exchange server in the current site. | Every server in the local AD site failed | Whatever the first error says; all servers failing points at your account or an organization-wide change | Enter another server's FQDN at the prompt and read the first error. Guide |
Permissions: RBAC and group managers#
| Code | Meaning | Usual cause | First check |
|---|---|---|---|
The user "<user>" isn't assigned to any management roles. | RBAC found no role assignments (AuthZ-CmdletAccessDeniedException) | The account isn't in any role group | Get-ManagementRoleAssignment -RoleAssignee <user>; add a role group, open a new session. Guide |
The term 'New-MailboxExportRequest' is not recognized as the name of a cmdlet, function, script file, or operable program. | RBAC didn't load that cmdlet into your session | The Mailbox Import Export role isn't assigned to anyone by default | Get-ManagementRole -Cmdlet New-MailboxExportRequest; assign it through a role group. Guide |
The term 'New-Mailbox' is not recognized as the name of a cmdlet, function, script file, or operable program. | Recipient creation cmdlets are missing | RBAC or Active Directory split permissions, which stop Exchange administrators from creating AD users (Microsoft Learn); also a role group without Mail Recipient Creation, or a plain Windows PowerShell window with no Exchange session | Get-ManagementRoleAssignment -Role "Mail Recipient Creation"; existing AD users can still be mail-enabled with Enable-Mailbox. Guide |
A parameter cannot be found that matches parameter name '<name>'. | The cmdlet loaded, the parameter didn't | Your role has the cmdlet but not that parameter, or the parameter doesn't exist in your version | Get-ManagementRole -Cmdlet <cmdlet> -CmdletParameters <name>. Guide |
You don't have sufficient permissions. This operation can only be performed by a manager of the group. | You aren't in the group's ManagedBy list | Changing a group you don't own, often a mail-enabled security group | Add -BypassSecurityGroupManagerCheck, or add yourself to ManagedBy (Microsoft Learn) |
Finding the object: identity, scope and recipient type#
| Code | Meaning | Usual cause | First check |
|---|---|---|---|
The operation couldn't be performed because object '<identity>' couldn't be found on '<DC>'. | No object matched on the domain controller that was asked | A typo, an object in another domain, AD replication not finished, a deleted object, or a target outside your management scope | Set-ADServerSettings -ViewEntireForest $true; Get-Recipient -Anr <name>; retry with -DomainController |
The operation couldn't be performed because object 'Migration.8f3e7716-2011-43e4-96b1-aba62d229136' couldn't be found | The migration arbitration mailbox is gone | Its disabled account deleted by a cleanup script | Get-Mailbox -Arbitration; PrepareAD recreates the account. Guide |
The operation couldn't be performed because '<identity>' matches multiple entries. | The value resolves to more than one object (ManagementObjectAmbiguousException) | Duplicate names, aliases or display names; in hybrid moves, a soft-deleted or inactive Exchange Online mailbox with the same address (Microsoft Learn) | Use a unique identity: GUID, distinguished name or primary SMTP address |
This task does not support recipients of this type. The specified recipient <identity> is of type <type>. Please make sure that this recipient matches the required recipient type for this task. | Wrong cmdlet family for that object | For example Enable-RemoteMailbox on a UserMailbox, or Enable-MailUser on an existing mail user or remote mailbox | Get-Recipient <identity> | Format-List RecipientType*; use the matching cmdlet. Guide |
Recipient data and validation#
| Code | Meaning | Usual cause | First check |
|---|---|---|---|
The proxy address "SMTP:<address>" is already being used by the proxy addresses or LegacyExchangeDN of "<object>". Please choose another proxy address. | Email addresses must be unique across the organization | Another mailbox, contact, group or mail-enabled public folder already has it | The object named in the message: Get-Recipient -ResultSize Unlimited | Where-Object { $_.EmailAddresses -match '<address>' } |
The object <identity> has been corrupted or isn't compatible with Microsoft support requirements, and it's in an inconsistent state. The following validation errors happened: | A WARNING: the object's AD data breaks an Exchange validation rule; the reason is on the next line | An empty database link, invalid characters or an out-of-range value | Read the next WARNING line and fix that attribute |
Database is mandatory on UserMailbox. | The mailbox's database link (homeMDB) is empty or points to a deleted database | Arbitration or system mailboxes left in a removed database | Get-Mailbox -Arbitration | Format-Table Name, Database. Guide |
This mailbox database contains one or more mailboxes, mailbox plans, archive mailboxes, public folder mailboxes or arbitration mailboxes, Audit mailboxes. | Remove-MailboxDatabase or an uninstall refused | Hidden mailboxes still in the database | Get-Mailbox -Database <DB> with -Arbitration, -Archive, -PublicFolder and -AuditLog. Guide |
Active Directory: permissions, preparation and setup#
| Code | Meaning | Usual cause | First check |
|---|---|---|---|
Active Directory operation failed on <DC>. This error is not retriable. Additional information: Insufficient access rights to perform the operation. (problem 4003 (INSUFF_ACCESS_RIGHTS)) | AD refused the write Exchange made for you | Inheritance disabled on the object (protected admin accounts), AD split permissions, or SID filter quarantining between domains in one forest | Inheritance on the object; netdom trust with /Quarantine (Microsoft Learn). Guide |
Active Directory operation failed on <DC>. This error is not retriable. Additional information: Access is denied. (00000005, problem 4003) | The same refusal, as access denied | For Add-ADPermission Send As on groups: Exchange Trusted Subsystem lacks Modify permissions on the group's OU | Microsoft's Send As workaround; inheritance on the object |
The Active Directory schema isn't up-to-date, and this user account isn't a member of the 'Schema Admins' and/or 'Enterprise Admins' groups. | Setup must extend the schema and your token can't | New group membership without signing out, or a non-elevated prompt | whoami /groups in the elevated prompt. Guide |
Exchange organization-level objects haven't been created, and setup can't create them because the local computer isn't in the same domain and site as the schema master. | PrepareAD was run from the wrong place | The schema master is in another AD site or domain | netdom query fsmo; run PrepareAD in the schema master's domain and site. Guide |
The well-known object entry ... on the otherWellKnownObjects attribute ... points to an invalid DN or a deleted object. | A stale link in the Exchange configuration container | A deleted Exchange security group, such as Recipient Management | Remove the entry the message names, then rerun. Guide |
Setup encountered a problem while validating the state of Active Directory | A generic prefix | The text after the colon is the real problem | The full line in ExchangeSetup.log. Guide |
Server tasks: Auth certificate, DAG witness, Edge and seeding#
| Code | Meaning | Usual cause | First check |
|---|---|---|---|
A special Rpc error occurs on server <server>: The certificate with thumbprint <thumbprint> was not found. | The Auth certificate in Get-AuthConfig isn't on that server | Deleted as "unused", or never received by that server | Get-ExchangeCertificate -Thumbprint on every server. Guide |
The Exchange Trusted Subsystem is not a member of the local Administrators group on specified witness server <server>. | The DAG can't manage its witness share | A non-Exchange witness server without the group | Add Exchange Trusted Subsystem to its local Administrators. Guide |
Unable to access file shares on witness server <server>. | The witness share is unreachable | Firewall, SMB or permissions | The DAG task logs in C:\ExchangeSetupLogs\DagTasks. Guide |
The task was unable to create the default witness directory on server <server>. Please manually specify a witness directory. | The witness folder couldn't be created | The same permission or path problem | Fix permissions, then set -WitnessDirectory. Guide |
EdgeSync service cannot connect to this subscription because of error "The LDAP server is unavailable." | Mailbox servers can't reach AD LDS on the Edge | TCP 50636 blocked, DNS, or a broken subscription | Test-NetConnection <edge> -Port 50636. Guide |
couldn't create or update the Edge Subscription account on the Edge Transport server | New-EdgeSubscription failed on the Edge | The same LDAP reachability, or a stale subscription | Re-create the subscription in order. Guide |
SeedInProgressException error FE1C6491 | A seed from that source is already running | Several copies reseeded from one source at once | Reseed one copy at a time. Guide |
WARNING: Seeding of content index catalog for database '<DB>' failed. Please verify that the Microsoft Search (Exchange) and the Host Controller service for Exchange services are running and try the operation again. | An Exchange 2016 catalog reseed failed | Search services stopped | Get-Service MSExchangeFastSearch, HostControllerService. Guide |
How to verify a fix#
- The command completes: rerun the exact command in a new shell; no error and no WARNING lines.
- One identity, one object: the identity your script uses returns exactly one recipient.
- Permissions took effect: after an RBAC change, a new session lists the cmdlet and parameter.
- AD agrees everywhere: the change is visible on a second domain controller after replication.
- Setup is clean: readiness checks pass and
ExchangeSetup.logends without[ERROR]lines.
PowerShell
@(Get-Recipient -Identity jdoe@contoso.com).Count # 1
Get-Command New-MailboxExportRequest
(Get-Command Set-Mailbox).Parameters.ContainsKey('ProhibitSendQuota')
Get-Mailbox jdoe -DomainController DC02.contoso.com | Format-List EmailAddressesReferences#
- Exchange Server PowerShell (Exchange Management Shell) (Microsoft Learn)
- Error when you try to perform Exchange Server management tasks: Insufficient access rights to perform the operation (Microsoft Learn)
- "You don't have sufficient permissions" when you remove or change a distribution group (Microsoft Learn)
- The term New-Mailbox is not recognized error occurs when you create a mailbox in Exchange Server (Microsoft Learn)
