How to fix 500 HTTP login Exchange 2019 ecp

Hi @Nguyễn Bá Hiếu 

Based on my research, there are several checks you can perform to support further troubleshooting: 

1/ Verify arbitration mailboxes 

Please confirm that the arbitration mailboxes are present and were not accidentally deleted during a decommissioning process. You can do this by running the following command: 

 Get-Mailbox –Arbitration. 

If the output shows no arbitration mailboxes or returns an error, you may refer to the following Microsoft article for step-by-step guidance on recreating them: Re-create missing arbitration mailboxes | Microsoft Learn  

2/ Confirm the mailbox and database status 

Please double check that the account has an associated mailbox and that it is linked to the correct, mounted mailbox database by running: 

 Get-Mailbox -Identity "Administrator" | Format-List Name, Database, ServerName 

Using the database name returned from this command, you can verify the database mount status with: 

Get-MailboxDatabaseCopyStatus -Identity "Mailbox Database xxxxx" for verify the mount status 

3/ Review the authentication certificate 

Another potential cause may be an issue with the authentication certificate. You can review the current certificate details by running: 

(Get-AuthConfig).CurrentCertificateThumbprint | Get-ExchangeCertificate | Format-List Subject, Thumbprint, NotAfter, NotBefore 

If the certificate is missing or has expired, please refer to the following Microsoft documentation for guidance on creating a new authentication certificate: Maintain the Exchange server OAuth certificate | Microsoft Learn 

For additional insight, reviewing relevant entries in Event Viewer may also provide useful information to support troubleshooting. 

I hope these steps provide helpful insight and assist you in moving forward.  If you have any updates or additional findings, please feel free to share them. 

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Based on the described scenario (freshly installed Exchange 2019 servers, HTTP 500 when accessing OWA/ECP), use the following targeted checks and fixes that match known 500-error causes in the context.

1. Check for post‑update HTTP 500 issues If any cumulative update (CU) or security update (SU) was installed on the new Exchange 2019 servers, a failed or incomplete update can cause HTTP 500 for OWA/ECP with assembly‑load errors.
2. On each Exchange server, open an elevated Command Prompt.
3. Re‑run the latest Exchange security update .msp locally:
   • Run cmd as Administrator.
   • Type the full path to the Exchange security update .msp file and press Enter.
   • Let the update complete, then restart the server.

This specifically addresses HTTP 500 errors where OWA/ECP cannot load Microsoft.Exchange.Common or related assemblies after an update.

2. Check for OAuth certificate issues after July 2021 or later SUs If the July 2021 SU or any later SU is installed, missing or expired Exchange OAuth certificates can prevent login to OWA/ECP and result in HTTP 500 or login loops.
3. On an Exchange Management Shell, verify the Exchange authorization (OAuth) certificate status.
4. If the OAuth certificate is missing or expired, renew it by following the steps in the article referenced in the context (“cannot access OWA or ECP if OAuth expired”).
5. If a load balancer is used in front of the two new Exchange servers:
   • Ensure both servers are updated to at least the July 2021 SU (or later) before putting them behind the load balancer.
   • As a temporary workaround, configure persistence/affinity on the load balancer to source-ip so that a user’s session stays on the same server.
6. Verify Exchange 2019 RTM cipher suite issue (if using RTM without CU1+) If the new servers are still on Exchange 2019 RTM (no CU1 or later), incorrect cipher suite configuration can prevent secure sessions to OWA/ECP and cause browser errors or failures.
7. Confirm the exact Exchange 2019 build (RTM vs CU1+).
8. If RTM is in use:
   • Apply Exchange 2019 Cumulative Update 1 or later.
   • Alternatively, apply the documented PowerShell workaround on each server to correct the cryptography cipher suites so that HTTP/2 and supported ciphers are enabled for all supported browsers.
9. Validate admin mailbox and arbitration mailboxes If the admin account used to access ECP does not have a mailbox, or arbitration mailboxes are unhealthy or missing (especially after removing the original Exchange servers and reinstalling), EAC/ECP sign‑in can fail with HTTP 500.
10. Ensure the admin account has a mailbox:
    • In Exchange Management Shell:

            Enable-Mailbox -Identity <admin ID>
      

11. Check arbitration mailboxes:
    • Run:

            Get-Mailbox -Arbitration
      

    • Healthy output should list the expected arbitration mailboxes without warnings or errors.
12. If any arbitration mailboxes are missing or unhealthy, re‑create or repair them by following the steps in “Re-create missing arbitration mailboxes” referenced in the context.
13. Re‑check environment variables and virtual directory paths (if EMS/EAC remote PowerShell also fails) If starting Exchange Management Shell or remote PowerShell also shows HTTP 500 errors, verify:
14. The ExchangeInstallPath system environment variable is present and points to the correct Exchange installation folder.
15. In IIS Manager, under Default Web Site, the PowerShell virtual directory points to the correct ClientAccess\PowerShell folder for the installed Exchange version.

These steps address common HTTP 500 causes for OWA/ECP on new or rebuilt Exchange 2019 servers after decommissioning older servers and installing updates.

References:

• Fix failed Exchange Server updates
• Cannot log in to OWA or ECP after July 2021 SU for Exchange Server 2019, 2016, and 2013 (KB 5005341)
• Users get a security warning when trying to connect OWA and ECP
• HTTP server error status (500) when signing in to EAC
• HTTP server error status (500) when you try to start Exchange Management Shell or Exchange Management Console