ISSUE: Exchange Scan fails with error 'Failed to establish the connection to Exchange Powershell'

Last modified: 1 year ago

Overview

During an Exchange scan, the error below can be found in the exchange logs.

2023-07-26T14:49:51|DEBUG|ABC Co|192.168.150.254|T:92 |ExchangeOnPremPowershell | ||0 |1d9987ef-dadf-42d1-928d-5c97b2dd27d5| ||Create Instance of OnPremPowershell.
2023-07-26T14:49:51|DEBUG|ABC Co|192.168.150.254|T:84 |PsBaseWrapper | ||0 |485249e5-fa4c-40f2-a831-b990e878a557| ||Initializing PS Session
2023-07-26T14:49:51|INFO |ABC Co|192.168.150.254|T:84 |PsBaseWrapper | ||0 |485249e5-fa4c-40f2-a831-b990e878a557| ||Credential: admin@company
2023-07-26T14:49:51|INFO |ABC Co|192.168.150.254|T:84 |PsBaseWrapper | ||0 |485249e5-fa4c-40f2-a831-b990e878a557| ||ConnectionUrl: http://mail.yourcompany.com/PowerShell/
2023-07-26T14:49:52|WARN |ABC Co|192.168.150.254|T:84 |PsBaseWrapper | ||0 |485249e5-fa4c-40f2-a831-b990e878a557| ||Failed to establish the connection to Exchange Powershell.Error msg: [mail.yourcompany.com] Connecting to remote server mail.yourcompany.com failed with the following error message : The WinRM client received an HTTP status code of 403 from the remote WS-Management service. For more information, see the about_Remote_Troubleshooting Help topic.
2023-07-26T14:49:52|INFO |ABC Co|192.168.150.254|T:92 |PsBaseWrapper | ||0 |1d9987ef-dadf-42d1-928d-5c97b2dd27d5| ||Initializing Session 0 for OnPremExchange]
2023-07-26T14:49:52|DEBUG|ABC Co|192.168.150.254|T:92 |PsBaseWrapper | ||0 |1d9987ef-dadf-42d1-928d-5c97b2dd27d5| ||Initiating Runspace Pool
2023-07-26T14:49:52|ERROR|ABC Co|192.168.150.254|T:84 |PsBaseWrapper | ||0 |485249e5-fa4c-40f2-a831-b990e878a557| ||Initialization failed for admin@company |OnPremExchange
EXCEPTION: System.Exception: Failed to establish the connection to Exchange Powershell. Error msg: [mail.yourcompany.com] Connecting to remote server mail.yourcompany.com failed with the following error message : The WinRM client received an HTTP status code of 403 from the remote WS-Management service.

Cause

There are multiple causes for this error which can include the following:

1. A Proxy server blocking connections. To confirm, run the command below:

netsh winhttp show proxy

2. The Require SSL option within the Powershell Virtual Directory on the Exchange server is enabled (see article: https://learn.microsoft.com/en-us/exchange/troubleshoot/administration/http-403-error-start-ems)

3. WINRM is being blocked and/or not enabled for Basic mode. Confirm the commands below have been run from a command prompt.

winrm quickconfig
winrm set winrm/config/client/auth ‘@{Basic="true"}’

4. The Powershell Virtual Directory on the Exchange server is restricted based on IP's.