Não é possível usar credenciais UPN com New-MoveRequest?

Question

Estamos em uma configuração híbrida (Exchange 2013 no local) e o MRSproxy está ativado e funcionando. Queremos arquivar a caixa de correio do usuário quando ele sair da empresa. Portanto, queremos migrar essas caixas de correio do Office 365 de volta para o nosso servidor local. Estou tentando criar um script de saída, e o cmdlet New-MoveRequest continua dando o seguinte erro:

The Mailbox Replication Service was unable to connect to the remote server using the credentials provided. Please check the credentials and try again. The call to 'https://webmail.blah.com/EWS/mrsproxy.svc' failed.
Error details: The HTTP request is unauthorized with client authentication scheme 'Negotiate'. The authentication header received from the server was 'Negotiate,NTLM'. --> The remote server returned an error:
(401) Unauthorized.. --> The HTTP request is unauthorized with client authentication scheme 'Negotiate'. The authentication header received from the server was 'Negotiate,NTLM'. --> The remote server returned an
error: (401) Unauthorized.
    + CategoryInfo          : NotSpecified: (:) [New-MoveRequest], RemotePermanentException
    +9,Microsoft.Exchange.Man
   agement.Migration.MailboxReplication.MoveRequest.NewMoveRequest
    + PSComputerName        : outlook.office365.com

Então eu testei com Test-MigrationServerAvailability -ExchangeRemoteMove -RemoteServer webmail.blah.com -Credentials $UserName<#> com os 3 seguintes tipos de PSCredentials:

UserName1 : <domain>\<SamAccountName>

UserName2 : <SamAccountName>

UserName3 : <SamAccountName>@<domain> (UPN)

Com UserName1 e UserName2 obtenho

RunspaceId         : 3966b356-0f49-46c3-9373-e914827fc6ed
Result             : Success
Message            :
ConnectionSettings : <ExchangeConnectionSettings HasAdminPrivilege="True" HasAutodiscovery="False" HasMrsProxy="True" AutodiscoverUrl="" IncomingEmailAddress="" IncomingRPCProxyServer="webmail.blah.ccom"
                     IncomingExchangeServer="webmail.blah.com" IncomingNSPIServer="" IncomingDomain="" IncomingUserName="UserName<#>" EncryptedIncomingPassword="something"
                     IncomingAuthentication="Basic" ServerVersion="" TargetDomainName="" SourceMailboxLegDn="" PublicFolderDatabaseServerLegacyDN="" IsPublicFolderMailboxesMigrationSource="False" />
SupportsCutover    : False
ErrorDetail        :
IsValid            : True
Identity           :
ObjectState        : New

mas com UserName3 eu recebo:

RunspaceId         : 3966b356-0f49-46c3-9373-e914827fc6ed
Result             : Failed
Message            : The connection to the server 'webmail.blah.com' could not be completed.
ConnectionSettings :
SupportsCutover    : False
ErrorDetail        : Microsoft.Exchange.Migration.MigrationServerConnectionFailedException: The connection to the server 'webmail.blah.com' could not be completed. --->
                     Microsoft.Exchange.MailboxReplicationService.RemotePermanentException: The Mailbox Replication Service was unable to connect to the remote server using the credentials provided. Please check
                     the credentials and try again. The call to 'https://webmail.blah.com/EWS/mrsproxy.svc' failed. Error details: The HTTP request is unauthorized with client authentication scheme 'Negotiate'. The
                     authentication header received from the server was 'Negotiate,NTLM'. --> The remote server returned an error: (401) Unauthorized.. --> The HTTP request is unauthorized with client
                     authentication scheme 'Negotiate'. The authentication header received from the server was 'Negotiate,NTLM'. --> The remote server returned an error: (401) Unauthorized. --->
                     Microsoft.Exchange.MailboxReplicationService.RemotePermanentException: The call to 'https://webmail.blah.com/EWS/mrsproxy.svc' failed. Error details: The HTTP request is unauthorized with client
                     authentication scheme 'Negotiate'. The authentication header received from the server was 'Negotiate,NTLM'. --> The remote server returned an error: (401) Unauthorized.. --->
                     Microsoft.Exchange.MailboxReplicationService.RemotePermanentException: The HTTP request is unauthorized with client authentication scheme 'Negotiate'. The authentication header received from
                     the server was 'Negotiate,NTLM'. ---> Microsoft.Exchange.MailboxReplicationService.RemotePermanentException: The remote server returned an error: (401) Unauthorized.
                        --- End of inner exception stack trace ---
                        --- End of inner exception stack trace ---
                        --- End of inner exception stack trace ---
                        at Microsoft.Exchange.MailboxReplicationService.MailboxReplicationServiceFault.<>c__DisplayClass97_0.<ReconstructAndThrow>b__0()
                        at Microsoft.Exchange.MailboxReplicationService.ExecutionContext.Execute(Action operation)
                        at Microsoft.Exchange.MailboxReplicationService.MailboxReplicationServiceFault.ReconstructAndThrow(String serverName, VersionInformation serverVersion)
                        at Microsoft.Exchange.MailboxReplicationService.WcfClientWithFaultHandling'2.<>c__DisplayClass7_0.<CallService>b__0()
                        at Microsoft.Exchange.Net.WcfClientBase'1.CallService(Action serviceCall, String context)
                        at Microsoft.Exchange.MailboxReplicationService.WcfClientWithFaultHandling'2.CallService(Action serviceCall, String context)
                        at Microsoft.Exchange.Migration.MigrationExchangeProxyRpcClient.CanConnectToMrsProxy(Fqdn serverName, Guid mbxGuid, NetworkCredential credentials, LocalizedException& error)
                        --- End of inner exception stack trace ---
                        at Microsoft.Exchange.Migration.DataAccessLayer.ExchangeRemoteMoveEndpoint.VerifyConnectivity()
                        at Microsoft.Exchange.Management.Migration.MigrationService.Endpoint.TestMigrationServerAvailability.InternalProcessEndpoint(Boolean fromAutoDiscover)
IsValid            : True
Identity           :
ObjectState        : New

Olhando o artigo da TechNet para os parâmetros New-MoveRequest e Test-MigrationServer , o Credentials/RemoteCredential deve aceitar nomes de usuário UPN.

Este é um limite com o Exchange 2013? Eu posso Remote-PSSession para o servidor Exchange local com o nome de usuário UPN e importar o CMDlet, então estou perdido porque ele não funciona com New-MoveRequest e Test-MigrationServer carregado do Office 365?

    

Answer 1

Poderia ser apenas a implementação do CMDLET e como ele está negociando a conexão. Seu endpoint é configurado com Negotiate, portanto, o cliente e o servidor devem decidir se você está usando kerberos ou NTLM. Em sua tentativa falhada, ele não foi detectado corretamente e tentou voltar para a Autenticação Básica - que seu servidor não está configurado para suportar.

O NTLM não suporta o formato UPN e você não possui um ticket do kerberos, portanto, esse pode ser o motivo. Você geralmente não se depara com isso com clientes / servidores Windows, muitas vezes, como a maioria dos aplicativos parecem se encarregar de reformatar o nome do usuário. No entanto, se a sua pré-correção samAccountName e UPN forem diferentes, as credenciais não corresponderão.

Eu tenho certeza de que os seus prefixos samAccountName e UPN coincidem com a conta. Caso contrário, ou se ainda falharem, você poderá ativar a autenticação básica no EWS. Isso deve permitir que ele volte ao lado do cliente e seja aceito no lado do servidor. Como essa é uma conexão O365, acho que podemos assumir com segurança que você já está usando HTTPS - o que, obviamente, é fundamental se você estiver usando a Autenticação Básica, pois as credenciais são enviadas no texto do plano.