Active Monitoring probe fails and returns SecurityException after the default accepted domain is changed

Method 1

If all health mailbox UPN domain parts are the same, change the default accepted domain so that it matches the value that is stamped in the health mailboxes.

To check the UPN domain for the health mailboxes, run the Get-Mailbox –Monitoring cmdlet.

Note If the health mailboxes have different UPN domains, such as bar.local and bar1.local, you cannot use this method because all the UPN domains must match the default accepted domain in order to avoid this issue. In this case, try method 2.

Method 2

Disable any related probe responders. This prevents a database failover that is caused by related probes.

For example, run the Add-ServerMonitoringOverride cmdlet, as follows:

Add-ServerMonitoringOverride -ItemType Responder -Identity RPS.Protocol\RpsDeepTestPSProxyFailover
-PropertyValue 0 -PropertyName Enabled -Duration "60.00:00:00" -Server Server_name

Add-ServerMonitoringOverride -ItemType Responder -Identity ActiveSync\ActiveSyncSelfTestDatabaseFailover
-PropertyValue 0 -PropertyName Enabled -Duration "60.00:00:00" -Server Server_name Note In this cmdlet example, Server_name represents the actual server name.

If you cannot change the default accepted domain, manually change the UPN and SMTP address of the health mailboxes, as in the following example:

# THIS CODE IS MADE AVAILABLE AS IS, WITHOUT WARRANTY OF ANY KIND. THE ENTIRE RISK
# OF THE USE OR THE RESULTS FROM THE USE OF THIS CODE REMAINS WITH THE USER.
$newDomain = "bar.local" # This is the new domain name. Must be changed according to the environment.
$healthMailboxes = Get-Mailbox -Monitoring;
foreach ($mailbox in $healthMailboxes)
{
$upn = $mailbox.Name + "@" + $newDomain
Set-User $mailbox -UserPrincipalName:$upn  
Set-Mailbox $mailbox -PrimarySmtpAddress:$upn -EmailAddressPolicyEnabled:$false
$adUser = [ADSI]("LDAP://"+$mailbox.DistinguishedName)
$adUser.msExchRecipientTypeDetails = "549755813888"
$adUser.SetInfo()
}