Exchange 2013 ActiveSync Topology Access Is Denied

Hello, all. We've got a single Exch 2013 SP1 server + CU5, fully updated as of this post, sitting on a Windows 2012 R2 member server. ActiveSync devices will not connect, always failing with an "Authentication Failed" error. Each time a connection attempt is made by a mobile device, the following three errors appear in the Application Event Log of the Exchange server:

***************************
Log Name:      Application
Source:        ASP.NET 4.0.30319.0
Date:          6/12/2014 9:48:32 AM
Event ID:      1309
Task Category: Web Event
Level:         Warning
Keywords:      Classic
User:          N/A
Computer:      MailSvr.domain.local
Description:
Event code: 3005
Event message: An unhandled exception has occurred.
Event time: 6/12/2014 9:48:32 AM
Event time (UTC): 6/12/2014 2:48:32 PM
Event ID: 8fb3c4d714a840c9ba00085fb87650e1
Event sequence: 2
Event occurrence: 1
Event detail code: 0

Application information:
    Application domain: /LM/W3SVC/1/ROOT/Microsoft-Server-ActiveSync-707-130470581101105474
    Trust level: Full
    Application Virtual Path: /Microsoft-Server-ActiveSync
    Application Path: C:\Program Files\Microsoft\Exchange Server\V15\FrontEnd\HttpProxy\sync\
    Machine name: MailSvr

Process information:
    Process ID: 544
    Process name: w3wp.exe
    Account name: NT AUTHORITY\LOCAL SERVICE

Exception information:
    Exception type: HttpException
    Exception message: Unexpected error when calling the Microsoft Exchange Active Directory Topology service on server 'TopologyClientTcpEndpoint (localhost)'. Error details: Access is denied..
   at System.Web.HttpApplicationFactory.EnsureAppStartCalledForIntegratedMode(HttpContext context, HttpApplication app)
   at System.Web.HttpApplication.RegisterEventSubscriptionsWithIIS(IntPtr appContext, HttpContext context, MethodInfo[] handlers)
   at System.Web.HttpApplication.InitSpecial(HttpApplicationState state, MethodInfo[] handlers, IntPtr appContext, HttpContext context)
   at System.Web.HttpApplicationFactory.GetSpecialApplicationInstance(IntPtr appContext, HttpContext context)
   at System.Web.Hosting.PipelineRuntime.InitializeApplication(IntPtr appContext)

Unexpected error when calling the Microsoft Exchange Active Directory Topology service on server 'TopologyClientTcpEndpoint (localhost)'. Error details: Access is denied..
   at Microsoft.Exchange.Data.Directory.ServiceTopologyProvider.GetConfigDCInfo(String partitionFqdn, Boolean throwOnFailure)
   at Microsoft.Exchange.Data.Directory.TopologyProvider.PopulateConfigNamingContexts(String partitionFqdn)
   at Microsoft.Exchange.Data.Directory.TopologyProvider.GetConfigurationNamingContext(String partitionFqdn)
   at Microsoft.Exchange.Data.Directory.ADSession.GetConfigurationNamingContext(String partitionFqdn)
   at Microsoft.Exchange.Data.Directory.ADDataSession.GetNamingContext(ADNamingContext adNamingContext)
   at Microsoft.Exchange.Data.Directory.ADDataSession.GetConnection(String preferredServer, Boolean isWriteOperation, String optionalBaseDN, ADObjectId& rootId, ADScope scope)
   at Microsoft.Exchange.Data.Directory.ADDataSession.GetReadConnection(String preferredServer, String optionalBaseDN, ADObjectId& rootId, ADRawEntry scopeDeteriminingObject, DualSearchMode dualSearchMode)
   at Microsoft.Exchange.Data.Directory.ADDataSession.InternalFind[TResult](ADObjectId rootId, String optionalBaseDN, ADObjectId readId, QueryScope scope, QueryFilter filter, SortBy sortBy, Int32 maxResults, IEnumerable`1 properties, Boolean includeDeletedObjects)
   at Microsoft.Exchange.Data.Directory.SystemConfiguration.ADTopologyConfigurationSession.FindServerByFqdn(String serverFqdn)
   at Microsoft.Exchange.Data.Directory.SystemConfiguration.Server.GetLocalServerClientAccessArray()
   at Microsoft.Exchange.HttpProxy.PerfCounters.UpdateHttpProxyPerArrayCounters()
   at Microsoft.Exchange.HttpProxy.ProxyApplication.Application_Start(Object sender, EventArgs e)

Access is denied.

Server stack trace:
   at System.ServiceModel.Channels.ServiceChannel.ThrowIfFaultUnderstood(Message reply, MessageFault fault, String action, MessageVersion version, FaultConverter faultConverter)
   at System.ServiceModel.Channels.ServiceChannel.HandleReply(ProxyOperationRuntime operation, ProxyRpc& rpc)
   at System.ServiceModel.Channels.ServiceChannel.Call(String action, Boolean oneway, ProxyOperationRuntime operation, Object[] ins, Object[] outs, TimeSpan timeout)
   at System.ServiceModel.Channels.ServiceChannelProxy.InvokeService(IMethodCallMessage methodCall, ProxyOperationRuntime operation)
   at System.ServiceModel.Channels.ServiceChannelProxy.Invoke(IMessage message)

Request information:
    Request URL: https://mail.PublicDomain.com:443/Microsoft-Server-ActiveSync/default.eas?Cmd=Sync&DeviceId=4130303030303243303535363442&DeviceType=MotoDROIDX2v451
    Request path: /Microsoft-Server-ActiveSync/default.eas
    User host address: 174.238.32.160
    User:
    Is authenticated: False
    Authentication Type:
    Thread account name: NT AUTHORITY\LOCAL SERVICE

Thread information:
    Thread ID: 15
    Thread account name: NT AUTHORITY\LOCAL SERVICE
    Is impersonating: False
    Stack trace:    at System.Web.HttpApplicationFactory.EnsureAppStartCalledForIntegratedMode(HttpContext context, HttpApplication app)
   at System.Web.HttpApplication.RegisterEventSubscriptionsWithIIS(IntPtr appContext, HttpContext context, MethodInfo[] handlers)
   at System.Web.HttpApplication.InitSpecial(HttpApplicationState state, MethodInfo[] handlers, IntPtr appContext, HttpContext context)
   at System.Web.HttpApplicationFactory.GetSpecialApplicationInstance(IntPtr appContext, HttpContext context)
   at System.Web.Hosting.PipelineRuntime.InitializeApplication(IntPtr appContext)

Custom event details: Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
    <Provider Name="ASP.NET 4.0.30319.0" />
    <EventID Qualifiers="32768">1309</EventID>
    <Level>3</Level>
    <Task>3</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2014-06-12T14:48:32.000000000Z" />
    <EventRecordID>130804</EventRecordID>
    <Channel>Application</Channel>
    <Computer>MailSvr.domain.local</Computer>
    <Security />
</System>
<EventData>
    <Data>3005</Data>
    <Data>An unhandled exception has occurred.</Data>
    <Data>6/12/2014 9:48:32 AM</Data>
    <Data>6/12/2014 2:48:32 PM</Data>
    <Data>8fb3c4d714a840c9ba00085fb87650e1</Data>
    <Data>2</Data>
    <Data>1</Data>
    <Data>0</Data>
    <Data>/LM/W3SVC/1/ROOT/Microsoft-Server-ActiveSync-707-130470581101105474</Data>
    <Data>Full</Data>
    <Data>/Microsoft-Server-ActiveSync</Data>
    <Data>C:\Program Files\Microsoft\Exchange Server\V15\FrontEnd\HttpProxy\sync\</Data>
    <Data>MailSvr</Data>
    <Data>
    </Data>
    <Data>544</Data>
    <Data>w3wp.exe</Data>
    <Data>NT AUTHORITY\LOCAL SERVICE</Data>
    <Data>HttpException</Data>
    <Data>Unexpected error when calling the Microsoft Exchange Active Directory Topology service on server 'TopologyClientTcpEndpoint (localhost)'. Error details: Access is denied..
   at System.Web.HttpApplicationFactory.EnsureAppStartCalledForIntegratedMode(HttpContext context, HttpApplication app)
   at System.Web.HttpApplication.RegisterEventSubscriptionsWithIIS(IntPtr appContext, HttpContext context, MethodInfo[] handlers)
   at System.Web.HttpApplication.InitSpecial(HttpApplicationState state, MethodInfo[] handlers, IntPtr appContext, HttpContext context)
   at System.Web.HttpApplicationFactory.GetSpecialApplicationInstance(IntPtr appContext, HttpContext context)
   at System.Web.Hosting.PipelineRuntime.InitializeApplication(IntPtr appContext)

Access is denied.

</Data>
    <Data>https://mail.PublicDomain.com:443/Microsoft-Server-ActiveSync/default.eas?Cmd=Sync&DeviceId=4130303030303243303535363442&DeviceType=MotoDROIDX2v451</Data>
    <Data>/Microsoft-Server-ActiveSync/default.eas</Data>
    <Data>174.238.32.160</Data>
    <Data>
    </Data>
    <Data>False</Data>
    <Data>
    </Data>
    <Data>NT AUTHORITY\LOCAL SERVICE</Data>
    <Data>15</Data>
    <Data>NT AUTHORITY\LOCAL SERVICE</Data>
    <Data>False</Data>
    <Data>   at System.Web.HttpApplicationFactory.EnsureAppStartCalledForIntegratedMode(HttpContext context, HttpApplication app)
   at System.Web.HttpApplication.RegisterEventSubscriptionsWithIIS(IntPtr appContext, HttpContext context, MethodInfo[] handlers)
   at System.Web.HttpApplication.InitSpecial(HttpApplicationState state, MethodInfo[] handlers, IntPtr appContext, HttpContext context)
   at System.Web.HttpApplicationFactory.GetSpecialApplicationInstance(IntPtr appContext, HttpContext context)
   at System.Web.Hosting.PipelineRuntime.InitializeApplication(IntPtr appContext)
</Data>
</EventData>
</Event>
***************************

and this (two of these):

***************************
Log Name:      Application
Source:        MSExchange ADAccess
Date:          6/12/2014 9:48:32 AM
Event ID:      4027
Task Category: General
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      MailSvr.domain.local
Description:
Process w3wp.exe (FE_Eas) (PID=544). WCF request (Get Servers for domain.local) to the Microsoft Exchange Active Directory Topology service on server (TopologyClientTcpEndpoint (localhost)) failed. Make sure that the service is running. In addition, make sure that the network ports that are used by Microsoft Exchange Active Directory Topology service are not blocked by a firewall. The WCF call was retried 1 time(s). Error Details
System.ServiceModel.Security.SecurityAccessDeniedException: Access is denied.

Exception rethrown at [0]:
   at System.Runtime.Remoting.Proxies.RealProxy.HandleReturnMessage(IMessage reqMsg, IMessage retMsg)
   at System.Runtime.Remoting.Proxies.RealProxy.PrivateInvoke(MessageData& msgData, Int32 type)
   at Microsoft.Exchange.Data.Directory.TopologyDiscovery.ITopologyClient.GetServersForRole(String partitionFqdn, List`1 currentlyUsedServers, ADServerRole role, Int32 serversRequested, Boolean forestWideAffinityRequested)
   at Microsoft.Exchange.Data.Directory.ServiceTopologyProvider.<>c__DisplayClass10.<InternalServiceProviderGetServersForRole>b__f(IPooledServiceProxy`1 proxy)
   at Microsoft.Exchange.Net.ServiceProxyPool`1.TryCallServiceWithRetry(Action`1 action, String debugMessage, WCFConnectionStateTuple proxyToUse, Int32 numberOfRetries, Boolean doNotReturnProxyOnSuccess, Exception& exception)
   --- End of inner exception stack trace ---
   at Microsoft.Exchange.Data.Directory.ServiceTopologyProvider.GetConfigDCInfo(String partitionFqdn, Boolean throwOnFailure)
   at Microsoft.Exchange.Data.Directory.TopologyProvider.PopulateConfigNamingContexts(String partitionFqdn)
   at Microsoft.Exchange.Data.Directory.TopologyProvider.GetConfigurationNamingContext(String partitionFqdn)
   at Microsoft.Exchange.Data.Directory.ADSession.GetConfigurationNamingContext(String partitionFqdn)
   at Microsoft.Exchange.Data.Directory.ADDataSession.GetNamingContext(ADNamingContext adNamingContext)
   at Microsoft.Exchange.Data.Directory.ADDataSession.GetConnection(String preferredServer, Boolean isWriteOperation, String optionalBaseDN, ADObjectId& rootId, ADScope scope)
   at Microsoft.Exchange.Data.Directory.ADDataSession.GetReadConnection(String preferredServer, String optionalBaseDN, ADObjectId& rootId, ADRawEntry scopeDeteriminingObject, DualSearchMode dualSearchMode)
   at Microsoft.Exchange.Data.Directory.ADGenericReader.GetNextResultCollection(Type controlType, DirectoryControl& responseControl)
   at Microsoft.Exchange.Data.Directory.ADPagedReader`1.GetNextResultCollection()
   at Microsoft.Exchange.Data.Directory.ADGenericPagedReader`1.GetNextPage()
   at Microsoft.Exchange.Data.Directory.ADGenericPagedReader`1.<GetEnumerator>d__0.MoveNext()
   at Microsoft.Exchange.Data.Directory.ADGenericPagedReader`1.ReadAllPages()
   at Microsoft.Exchange.HttpProxy.DownLevelServerManager.InternalRefresh()
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
    <Provider Name="MSExchange Front End HTTP Proxy" />
    <EventID Qualifiers="49152">3002</EventID>
    <Level>2</Level>
    <Task>1</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2014-06-12T16:04:36.000000000Z" />
    <EventRecordID>131988</EventRecordID>
    <Channel>Application</Channel>
    <Computer>MailSvr.domain.local</Computer>
    <Security />
</System>
<EventData>
    <Data>Eas</Data>
    <Data>Microsoft.Exchange.Data.Directory.ADTopologyUnexpectedException: Unexpected error when calling the Microsoft Exchange Active Directory Topology service on server 'TopologyClientTcpEndpoint (localhost)'. Error details: Access is denied.. ---> System.ServiceModel.Security.SecurityAccessDeniedException: Access is denied.

Exception rethrown at [0]:
   at System.Runtime.Remoting.Proxies.RealProxy.HandleReturnMessage(IMessage reqMsg, IMessage retMsg)
   at System.Runtime.Remoting.Proxies.RealProxy.PrivateInvoke(MessageData& msgData, Int32 type)
   at Microsoft.Exchange.Data.Directory.TopologyDiscovery.ITopologyClient.GetServersForRole(String partitionFqdn, List`1 currentlyUsedServers, ADServerRole role, Int32 serversRequested, Boolean forestWideAffinityRequested)
   at Microsoft.Exchange.Data.Directory.ServiceTopologyProvider.<>c__DisplayClass10.<InternalServiceProviderGetServersForRole>b__f(IPooledServiceProxy`1 proxy)
   at Microsoft.Exchange.Net.ServiceProxyPool`1.TryCallServiceWithRetry(Action`1 action, String debugMessage, WCFConnectionStateTuple proxyToUse, Int32 numberOfRetries, Boolean doNotReturnProxyOnSuccess, Exception& exception)
   --- End of inner exception stack trace ---
   at Microsoft.Exchange.Data.Directory.ServiceTopologyProvider.GetConfigDCInfo(String partitionFqdn, Boolean throwOnFailure)
   at Microsoft.Exchange.Data.Directory.TopologyProvider.PopulateConfigNamingContexts(String partitionFqdn)
   at Microsoft.Exchange.Data.Directory.TopologyProvider.GetConfigurationNamingContext(String partitionFqdn)
   at Microsoft.Exchange.Data.Directory.ADSession.GetConfigurationNamingContext(String partitionFqdn)
   at Microsoft.Exchange.Data.Directory.ADDataSession.GetNamingContext(ADNamingContext adNamingContext)
   at Microsoft.Exchange.Data.Directory.ADDataSession.GetConnection(String preferredServer, Boolean isWriteOperation, String optionalBaseDN, ADObjectId& rootId, ADScope scope)
   at Microsoft.Exchange.Data.Directory.ADDataSession.GetReadConnection(String preferredServer, String optionalBaseDN, ADObjectId& rootId, ADRawEntry scopeDeteriminingObject, DualSearchMode dualSearchMode)
   at Microsoft.Exchange.Data.Directory.ADGenericReader.GetNextResultCollection(Type controlType, DirectoryControl& responseControl)
   at Microsoft.Exchange.Data.Directory.ADPagedReader`1.GetNextResultCollection()
   at Microsoft.Exchange.Data.Directory.ADGenericPagedReader`1.GetNextPage()
   at Microsoft.Exchange.Data.Directory.ADGenericPagedReader`1.<GetEnumerator>d__0.MoveNext()
   at Microsoft.Exchange.Data.Directory.ADGenericPagedReader`1.ReadAllPages()
   at Microsoft.Exchange.HttpProxy.DownLevelServerManager.InternalRefresh()</Data>
</EventData>
</Event>
***************************

If I try to access the ActiveSync page itself (https://MailSvr.domain.local/Microsoft-Server-ActiveSync) I get the following:

***************************
Server Error in '/Microsoft-Server-ActiveSync' Application.

Access is denied.
Description: An unhandled exception occurred during the execution of the current web request. Please review the stack trace for more information about the error and where it originated in the code.

Exception Details: System.ServiceModel.Security.SecurityAccessDeniedException: Access is denied.

Source Error:

An unhandled exception was generated during the execution of the current web request. Information regarding the origin and location of the exception can be identified using the exception stack trace below.

Stack Trace:

[SecurityAccessDeniedException: Access is denied.]
   System.Runtime.Remoting.Proxies.RealProxy.HandleReturnMessage(IMessage reqMsg, IMessage retMsg) +14483202
   System.Runtime.Remoting.Proxies.RealProxy.PrivateInvoke(MessageData& msgData, Int32 type) +622
   Microsoft.Exchange.Data.Directory.TopologyDiscovery.ITopologyClient.GetServersForRole(String partitionFqdn, List`1 currentlyUsedServers, ADServerRole role, Int32 serversRequested, Boolean forestWideAffinityRequested) +0
   Microsoft.Exchange.Data.Directory.<>c__DisplayClass10.<InternalServiceProviderGetServersForRole>b__f(IPooledServiceProxy`1 proxy) +152
   Microsoft.Exchange.Net.ServiceProxyPool`1.TryCallServiceWithRetry(Action`1 action, String debugMessage, WCFConnectionStateTuple proxyToUse, Int32 numberOfRetries, Boolean doNotReturnProxyOnSuccess, Exception& exception) +274

[ADTopologyUnexpectedException: Unexpected error when calling the Microsoft Exchange Active Directory Topology service on server 'TopologyClientTcpEndpoint (localhost)'. Error details: Access is denied..]
   Microsoft.Exchange.Data.Directory.ServiceTopologyProvider.GetConfigDCInfo(String partitionFqdn, Boolean throwOnFailure) +507
   Microsoft.Exchange.Data.Directory.TopologyProvider.PopulateConfigNamingContexts(String partitionFqdn) +88
   Microsoft.Exchange.Data.Directory.TopologyProvider.GetConfigurationNamingContext(String partitionFqdn) +86
   Microsoft.Exchange.Data.Directory.ADSession.GetConfigurationNamingContext(String partitionFqdn) +243
   Microsoft.Exchange.Data.Directory.ADDataSession.GetNamingContext(ADNamingContext adNamingContext) +601
   Microsoft.Exchange.Data.Directory.ADDataSession.GetConnection(String preferredServer, Boolean isWriteOperation, String optionalBaseDN, ADObjectId& rootId, ADScope scope) +686
   Microsoft.Exchange.Data.Directory.ADDataSession.GetReadConnection(String preferredServer, String optionalBaseDN, ADObjectId& rootId, ADRawEntry scopeDeteriminingObject, DualSearchMode dualSearchMode) +201
   Microsoft.Exchange.Data.Directory.ADDataSession.InternalFind(ADObjectId rootId, String optionalBaseDN, ADObjectId readId, QueryScope scope, QueryFilter filter, SortBy sortBy, Int32 maxResults, IEnumerable`1 properties, Boolean includeDeletedObjects)+3650
   Microsoft.Exchange.Data.Directory.SystemConfiguration.ADTopologyConfigurationSession.FindServerByFqdn(String serverFqdn) +184
   Microsoft.Exchange.Data.Directory.SystemConfiguration.Server.GetLocalServerClientAccessArray() +129
   Microsoft.Exchange.HttpProxy.PerfCounters.UpdateHttpProxyPerArrayCounters() +12
   Microsoft.Exchange.HttpProxy.ProxyApplication.Application_Start(Object sender, EventArgs e) +423

[HttpException (0x80004005): Unexpected error when calling the Microsoft Exchange Active Directory Topology service on server 'TopologyClientTcpEndpoint (localhost)'. Error details: Access is denied..]
   System.Web.HttpApplicationFactory.EnsureAppStartCalledForIntegratedMode(HttpContext context, HttpApplication app) +12584905
   System.Web.HttpApplication.RegisterEventSubscriptionsWithIIS(IntPtr appContext, HttpContext context, MethodInfo[] handlers) +175
   System.Web.HttpApplication.InitSpecial(HttpApplicationState state, MethodInfo[] handlers, IntPtr appContext, HttpContext context) +304
   System.Web.HttpApplicationFactory.GetSpecialApplicationInstance(IntPtr appContext, HttpContext context) +404
   System.Web.Hosting.PipelineRuntime.InitializeApplication(IntPtr appContext) +475

[HttpException (0x80004005): Unexpected error when calling the Microsoft Exchange Active Directory Topology service on server 'TopologyClientTcpEndpoint (localhost)'. Error details: Access is denied..]
   System.Web.HttpRuntime.FirstRequestInit(HttpContext context) +12601936
   System.Web.HttpRuntime.EnsureFirstRequestInit(HttpContext context) +159
   System.Web.HttpRuntime.ProcessRequestNotificationPrivate(IIS7WorkerRequest wr, HttpContext context) +12441597

Version Information: Microsoft .NET Framework Version:4.0.30319; ASP.NET Version:4.0.30319.34009
***************************

I don't know if this is related, but if I try to give a user Send-As permission for a distribution group via the ECP, I get the following error when I hit Save:

***************************
error

Active Directory operation failed on DomCon.domain.local. This error is not retriable. Additional information: Access is denied. Active directory response: 00000005: SecErr: DSID-03152612, problem 4003 (INSUFF_ACCESS_RIGHTS), data 0
***************************

We really, really need to get our Exchange accounts synchronized on our mobile devices. Any input would be greatly appreciated.

Jaymen

Exchange 2013 ActiveSync Topology Access Is Denied

Trending Articles

Practice Sheet of Right form of verbs for HSC Students

Download: FK ft Shenky – Nakuyewa ”Prod by: Shenky”

How to win at Markstrat (Markstrat Tips and Tricks) – Vodites

Ominde Commission Report and Recommendations – Ominde Report of 1964

Bureau of Internal Revenue: Regional Offices (Directory)

GO 53 on Enhancement of Ex-gratia upto 5 Lakhs Toddy Tappers in Telangana

Cakewalk CA-2A Leveling Amplifier v2.0.1.97 WiN, v2.0.1.96 OSX Incl Keygen

Mp3 Download: Mdu - Kunjenjenjena

How the kill the job , when DTP request running for long hours.

Microsoft Intune から展開しているアプリのアップデートについて

18-year-old girl was beaten for half an hour by two Northampton men in 'an...

Car crash in Dunton Bassett leaves driver in critical condition

Macky 2, Two Others In Road Accident

Application log 00000000000000089514: Could not convert queue DLVST90CLNT

Detroit mafia: D’Anna Brothers agree to plea deal

Delivery block field greyed out using VA02

Muloraki Au

【個人撮影】スマホのプライベート映像♪「中に出さないで///」カラオケ屋での生ハメ撮りが流出ｗ【リベンジポルノ】＠PornHub

BREAKING NEWS: Diamond Platnumz Is Reported Dead After Ghastly Car Accident

FIAT 500 B0111 B0112