Exchange Mailbox Restore Issue

when i try to use the current account instead of the administrator accessing exchange, it tells me “"The HTTP request is unauthorized with client authentication scheme 'Negotiate'. The authentication header received from the server was 'Negotiate,NTLM'".”

Yeah, following that is the right steps but if it does not progress, I would contact Support to open a ticket to get them to check the logs.

hi ​@mhakmd 

check port Ports - Veeam Backup & Replication User Guide

check permission requirments Permissions - Veeam Backup & Replication User Guide

Check system prerequisite System Requirements - Veeam Backup & Replication User Guide

• Is the Veeam server and its connectivity with Active Directory and the Exchange server correct?
• Check configure delegation
• I hope the error comes from the Veeam MAPI/EWS proxy when it tries Kerberos first (SPNEGO Negotiate) and Exchange answers with NTLM only — so the security context cannot be established.

So authentication never reaches MAPI/EWS → Veeam cannot mount mailbox DB.

These are the possible causes of the error you encountered: Kerberos missing/wrong SPN, Delegation account not trusted for delegation, TLS wrong IIS binding/certificate, Exchange MAPI/EWS auth misconfigured, Veeam using hostname not matching SPN.

• Are you using Veeam 12 or 13? Is the Veeam server up to date with the latest patch
• Which version of Exchange Onprem are you using and Installed CU?

In the Extended Protection version (Exchange 2019 CU12+ environments)

When enabled, recent Veeam versions < build do not pass authentication.

Temporarily disable to confirm:

Set-OrganizationConfig -ExtendedProtectionTokenChecking None
iisreset

• Check DNS resolution “nslookup” from VBR of your CAS
• Test onnectivity fron veeam to CAS

 Test-WebServicesConnectivity -ClientAccessServer <CAS>

• Check SPN (is used to list all Service Principal Names (SPNs) currently registered for that particular server.)

setspn -L <ExchangeServerName>

• If it does not return the correct SPN because it is not registered, proceed with its creation.

exemple:

setspn -S HTTP/mail.domain.local EXCHANGE01

• reset IIS

iisreset

• Check IIS authentication on Exchange

Get-MapiVirtualDirectory | fl Identity,IISAuthenticationMethods
Get-WebServicesVirtualDirectory | fl Identity,*auth*

The command must return IISAuthenticationMethods: {Negotiate, NTLM}