Linked mailbox authentication failure in Exchange Server 2019 resource forest

Hi @Imran Qureshi

Thank you for posting your question in Microsoft Q&A. 

I understand you’re encountering an authentication issue with linked mailboxes in Exchange Server 2019 (resource forest setup). 

You could try to follow these steps to troubleshoot it:  

Confirm the Mailbox is Truly a Linked Mailbox  

Run this in Exchange Management Shell (EMS): 

Get-Mailbox useraddress | fl Name, RecipientTypeDetails, IsLinked, LinkedMasterAccount, LinkedDomainController 

It's should show RecipientTypeDetails= LinkedMailbox and IsLinked = True. 

Also verify SID mapping: In resource forest (using AD PowerShell): 

Get-ADUser "CN=UserName,OU=Linked,DC=resource,DC=local" -Properties msExchMasterAccountSid | fl msExchMasterAccountSid 

Compare msExchMasterAccountSid to the real user's objectSid in the account forest (use Get-ADUser there). They must match exactly. 

Check and Fix Forest Trust Direction 

Linked mailbox authentication (client logon via Outlook/OWA) requires the account forest to trust the resource forest (outgoing trust from account forest > resource forest), or ideally a two-way forest trust. 

A one-way trust where only the resource forest trusts the account forest allows mailbox creation (with admin creds), but often breaks client authentication (credential loops or access denied). 

Open Active Directory Domains and Trusts on a DC in the account forest: 

Right-click your domain > Properties > Trusts tab. 

Look for an outgoing trust to the resource forest domain/forest. 

Validate the trust (right-click > Properties > Validate). 

Ensure its forest-wide authentication (not selective unless you've granted "Allowed to Authenticate" permissions). 

If missing or wrong direction: Create or add the correct outgoing trust from account forest to resource forest. 

If using selective authentication: On resource forest Exchange server computer objects (or OU), grant "Allowed to Authenticate" permission to "Authenticated Users" (or specific groups) from the account forest. 

Also test basic cross-forest auth: From a machine in account forest, try accessing a share/resource in resource forest using account forest credentials. 

Validate Authentication on Virtual Directories  

Run: 

Get-OwaVirtualDirectory | fl Server, *Auth* Get-EcpVirtualDirectory | fl Server, *Auth* Get-MapiVirtualDirectory | fl Server, *Auth* 

Ensure WindowsAuthentication is enabled (primary for internal/cross-forest SSO). 

If needed, enable Forms/Basic for external, then run iisreset 

Test Autodiscover 

In Outlook on account forest machine: Use Test E-mail AutoConfiguration (Ctrl+Right-click Outlook icon) to check if Autodiscover points to resource forest endpoints. 

I hope this helps.

Please understand that our initial reply may not always immediately resolve the issue. However, with your help and more detailed information, we can work together to find a solution.

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".      

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.