r/exchangeserver • u/Ok_Eye9777 • 5d ago

HCW fails with HCW8125 set-authserver

have an exchange 2016 environment, cu23. when i run the HCW, it fails both using classic and modern with HCW8125 set-authserver failed. i've checked all of the settings for EWS, OAB, autodiscover and everything comes up correct. if i try and run the set-authserver command via powershell, it fails with an LDAP error. An Active Directory error 0x51 occurred when trying to check the suitability of server 'xxx.com'. Error: 'Active directory response: The LDAP server is unavailable.' if I try an LDAP query to the domain, it works on both 389 and 3268.

Any ideas? This is baffling me.

Thanks!

1 Upvotes

67% Upvoted

5 comments sorted by

1

u/farva_06 5d ago

Is there a Global Catalog DC available in the same site as your Exchange server?

1

u/Ok_Eye9777 5d ago

yes, and it is the server answering my ldap query

1

u/thelordfolken81 3d ago

can you confirm that your exchange server DNS servers are 'only' the domain controllers in your environment. If you have an offline server or a public dns server stuff breaks. What OS are you using for both exchange and domain controller? Also check your DC firewall zone is set to 'domain network' and not 'public network'

1

u/Ok_Eye9777 2d ago

DNS is only pointing to DC's. Need to verify the OS on the servers and the firewall settings. It's just strange that every test i run, checks out fine but the config keeps failing.

1

u/7amitsingh7 2d ago

Since 389 and 3268 work with a manual LDAP query, it sounds like basic connectivity is fine, but Exchange may be selecting a different domain controller or having an issue with AD site/DC discovery.

I’d check which DC/GC Exchange is actually using and run nltest /dsgetdc:<domain> from the Exchange server. Also check DNS settings on the Exchange server and make sure the NIC is pointing only to internal AD DNS servers.

If possible, check the Exchange event logs around the time Set-AuthServer fails. The 0x51 error can be misleading because it doesn't necessarily mean that LDAP port 389 is simply unreachable.