The Exchange Management Shell fails to connect in Exchange 2013 environment, this is a DAG environment and previously it indicates another error message, which is in my another thread. We fixed that error by delete the retired proxy entry in the server registry, after that the error is gone but changed to below one, anyway the EMS still fails to connect to all servers:

VERBOSE: Connecting to NSWVIP999WTMBX.air.abc.au.
New-PSSession : [NSWVIP999WTMBX.air.abc.au] Connecting to remote server NSWVIP999WTMBX.air.abc.au failed with the
following error message : WinRM cannot complete the operation. Verify that the specified computer name is valid, that
the computer is accessible over the network, and that a firewall exception for the WinRM service is enabled and allows
access from this computer. By default, the WinRM firewall exception for public profiles limits access to remote
computers within the same local subnet. For more information, see the about_Remote_Troubleshooting Help topic.
At line:1 char:1
+ New-PSSession -ConnectionURI "$connectionUri" -ConfigurationName Microsoft.Excha ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : OpenError: (System.Manageme....RemoteRunspace:RemoteRunspace) [New-PSSession], PSRemotin
   gTransportException
    + FullyQualifiedErrorId : WinRMOperationTimeout,PSSessionOpenFailed
Failed to connect to an Exchange server in the current site.
Enter the server FQDN where you want to connect.:

Then it just show can't connect to all the exchange servers, from the wording it seems pointing to the Windows firewall settings for winRM, but when I look at the windows firewall found it's turned off. We use Sophos enterprise for the security, but all other 3 exchange servers didn't have the same issue.

HI 

I suggest that you open the command prompt with elevated Administrative rights and run the command WinRM QuickConfig

This command analyzes and configures the WinRM service.

Hi,

Based on your description, you have searched the entry for the expired proxy server in that server's registry and manually deleted them in another thread. So have you ever configured a Proxy Server for WinRM? We can use the following command in PowerShell to check this setting:

netsh winhttp show proxy

If this proxy server is that expired proxy server, please try to configure a new proxy server for WinRM or we can reset this setting using this command:

netsh winhttp reset proxy

If this issue persists after resetting, please check whether there is any Event log in Event Viewer about this issue and post them. I will be very glad to help you.

Best Regrads.

PS C:\Windows\system32> winrm quickconfig
WinRM service is already running on this machine.
WinRM is already set up for remote management on this computer.

Hi Lynn,

Thanks, yes there is a proxy server currently running, when I run netsh winhttp show proxy

it will show the current new proxy server. I didn't reset the proxy as I restarted the server last weekend to perform the exchange upgrade(please note there is no relationship with the upgrade, as the winRM issue happened for over 2 months already).

Which event log do you reckon can indicate any trace about the issue?

From Applications and Services Logs -- MSExchange Management, there are full of error logs like:

(Process w3wp.exe, PID 21388) "Unhandled exception 'Object reference not set to an instance of an object.' when processing request /powershell?ping=probe."

I didn't find what PID 21388 represents for, but this same error message last since July, while we delete the expired proxy entry on November.

From Applications and Services Logs -- Microsoft -- Windows -- Powershell -- Operational

It includes the error itself when open the Exchange Management Shell:

Runspace Id: a486b455-65e7-4971-9cac-eece92837fa0 Pipeline Id: 00000000-0000-0000-0000-000000000000. WSMan reported an error with error code: -2144108250.

Error message: Connecting to remote server NSWVIP999WTMBX.air.abc.au failed with the following error message : WinRM cannot complete the operation. Verify that the specified computer name is valid, that the computer is accessible over the network, and that a firewall exception for the WinRM service is enabled and allows access from this computer. By default, the WinRM firewall exception for public profiles limits access to remote computers within the same local subnet. For more information, see the about_Remote_Troubleshooting Help topic.

StackTrace:

OR which other logs may indicate any root cause and fix for this problem?

Hi,

Thanks for your cooperation, the error Runspace Id: a486b455-65e7-4971-9cac-eece92837fa0 Pipeline Id: 00000000-0000-0000-0000-000000000000. WSMan reported an error with error code: -2144108250 is exactly  what I need. This error means WinRM is not set up correctly on the remote machine, or there is something preventing communication over port 80 between the two systems. This could be a firewall or antivirus/malware programs.

We can use the netstat a o -n | findstr :80 command from command prompt to determine which program is using port 80. Please follow these steps:

1. Click Start, type cmd in the Start Search box, and then press ENTER.
2. Type netstat a o -n | findstr :80 and hit enter. netstat o option will list the PID (Process ID)
3. To determine what executable is running as a process ID, open Windows Task Manager and switch to the Processes tab.
4. Now click on View->Select Columns.
5. On the screen that opens, make sure "PID (Process Identifier)" is checked and then click OK.
6. Now click on the PID heading to sort the entries by PID.
7. Get the PID numbers from command prompt and verify from task manager.
8. Then check if there is any antivirus or malware program using port 80.

Best Regards.

Hi Lynn,

Thanks for your analyst and reply, I run the command as you suggested and checked accordingly to Task Manager, but seems none of them indicates a firewall or anti-virus.

  TCP    0.0.0.0:80             0.0.0.0:0              LISTENING       4
 TCP    0.0.0.0:808            0.0.0.0:0              LISTENING       2260
 TCP    172.17.2.123:444       172.16.2.127:8050      ESTABLISHED     4
 TCP    172.17.2.123:444       172.16.2.127:8069      ESTABLISHED     4
 TCP    172.17.2.123:444       172.17.2.127:8053      ESTABLISHED     4
 TCP    172.17.2.123:10952     172.16.2.68:80         ESTABLISHED     3296
 TCP    172.17.2.123:11185     172.16.2.90:8080       SYN_SENT        468
 TCP    172.17.2.123:11190     172.16.2.90:8080       SYN_SENT        15268
 TCP    172.17.2.123:11330     172.16.2.90:8080       SYN_SENT        1296
 TCP    [::]:80                [::]:0                 LISTENING       4
 TCP    [::]:808               [::]:0                 LISTENING       2260
 TCP    [::1]:6001             [::1]:8028             ESTABLISHED     4764
 TCP    [::1]:6001             [::1]:8029             ESTABLISHED     4764
 TCP    [::1]:6001             [::1]:8030             ESTABLISHED     4764
 TCP    [::1]:6001             [::1]:8031             ESTABLISHED     4764
 TCP    [::1]:6001             [::1]:8032             ESTABLISHED     4764
 TCP    [::1]:6001             [::1]:8033             ESTABLISHED     4764
 TCP    [::1]:6001             [::1]:8034             ESTABLISHED     4764
 TCP    [::1]:6001             [::1]:8035             ESTABLISHED     4764
 TCP    [::1]:6001             [::1]:8036             ESTABLISHED     4764
 TCP    [::1]:6001             [::1]:8037             ESTABLISHED     4764
 TCP    [::1]:6001             [::1]:8040             ESTABLISHED     4764
 TCP    [::1]:6001             [::1]:8041             ESTABLISHED     4764
 TCP    [::1]:6001             [::1]:8048             ESTABLISHED     4764
 TCP    [::1]:6001             [::1]:8049             ESTABLISHED     4764
 TCP    [::1]:6001             [::1]:8059             ESTABLISHED     4764
 TCP    [::1]:6001             [::1]:8060             ESTABLISHED     4764
 TCP    [::1]:8028             [::1]:6001             ESTABLISHED     9980
 TCP    [::1]:8029             [::1]:6001             ESTABLISHED     9980
 TCP    [::1]:8030             [::1]:6001             ESTABLISHED     9980
 TCP    [::1]:8031             [::1]:6001             ESTABLISHED     9980
 TCP    [::1]:8032             [::1]:6001             ESTABLISHED     9980
 TCP    [::1]:8033             [::1]:6001             ESTABLISHED     9980
 TCP    [::1]:8034             [::1]:6001             ESTABLISHED     9980
 TCP    [::1]:8035             [::1]:6001             ESTABLISHED     9980
 TCP    [::1]:8036             [::1]:6001             ESTABLISHED     9980
 TCP    [::1]:8037             [::1]:6001             ESTABLISHED     9980
 TCP    [::1]:8040             [::1]:6001             ESTABLISHED     9980
 TCP    [::1]:8041             [::1]:6001             ESTABLISHED     9980
 TCP    [::1]:8048             [::1]:6001             ESTABLISHED     9980
 TCP    [::1]:8049             [::1]:6001             ESTABLISHED     9980
 TCP    [::1]:8059             [::1]:6001             ESTABLISHED     9980
 TCP    [::1]:8060             [::1]:6001             ESTABLISHED     9980
 TCP    [fe80::9054:e8f5:f885:8105%20]:808  [fe80::9054:e8f5:f885:8105%20]:9901
 ESTABLISHED     2260
 TCP    [fe80::9054:e8f5:f885:8105%20]:9901  [fe80::9054:e8f5:f885:8105%20]:808
 ESTABLISHED     4868

This is the full result, among them

4 -- System -- NT Kernel & System

468 -- There is no process associated with PID 468

1296 -- svchost.exe -- Host Process for Windows Service

2260 -- SMSvcHost.exe -- SMSvcHost.exe

3296 -- CcmExec.exe -- CCM Executive

4764 -- Microsoft.Exchange.RpcClientAccess.Service.exe -- Microsoft.Exchange.RpcClientAccess.Service.exe

4868 -- Microsoft.Exchange.ServiceHost.exe -- Microsoft.Exchange.ServiceHost.exe

9980 -- w3wp.exe -- IIS Worker Process

15268 -- ServerManager.exe -- Server Manager

Hi,

In this case, I suggest to disable anti-virus directly then run winrm quickconfig in PowerShell to check this issue.

If this issue persists, we need to consider to uninstall anti-virus then reboot server to check.

Best Regards.

Hi Lynn,

This is a government environment so unfortunately it's difficult to disable/reinstall the anti-virus, I ran the Powershell for winrm quickconfig and no problem indicated.

PS C:\Windows\System32> winrm quickconfig
WinRM service is already running on this machine.
WinRM is already set up for remote management on this computer.

The issue is resolved, my manager knows some background about the issue and he fixed the problem at last:

The root cause is the old proxy server was being applied at the back end.

Once reset the WinHTTP proxy to default (none), I was able to connect through the Powershell.

open cmd, netsh winhttp show proxy

Thanks for all your reply.

• Marked as answer by kuberk 7 hours 17 minutes ago