Event ID 1016: OWA Virtual Directory Error - Fix Guide 2025

Log Name:      Application
Source:        MSExchange Web Services
Event ID:      1016
Level:         Error
Description:   The OWA virtual directory at '/owa' is not configured correctly.
               The authentication method is invalid or the virtual directory
               does not exist in IIS.
               Details: Virtual directory authentication configuration mismatch
               Server: EXCH01.company.local

# Start the OWA app pool if stopped
Import-Module WebAdministration

# Check current state
$state = (Get-WebAppPoolState "MSExchangeOWAAppPool").Value
Write-Host "Current state: $state"

# Start if not running
if ($state -ne "Started") {
    Start-WebAppPool -Name "MSExchangeOWAAppPool"
    Write-Host "App pool started"
}

# Verify
Start-Sleep -Seconds 5
(Get-WebAppPoolState "MSExchangeOWAAppPool").Value

# Quick IIS recycle to reload configuration
iisreset /noforce

# Verify OWA is responding
Start-Sleep -Seconds 15
try {
    $response = Invoke-WebRequest -Uri "https://localhost/owa/auth/logon.aspx" -UseBasicParsing -TimeoutSec 30
    Write-Host "OWA responding: $($response.StatusCode)"
} catch {
    Write-Host "OWA error: $($_.Exception.Message)" -ForegroundColor Red
}

# Get current OWA virtual directory from Exchange
$owa = Get-OwaVirtualDirectory -Server $env:COMPUTERNAME

# Re-apply settings (forces IIS sync)
$owa | Set-OwaVirtualDirectory -FormsAuthentication $true

# Reset IIS to apply
iisreset /noforce

Write-Host "Configuration reapplied and IIS reset"

# Step 1: Document current configuration
Get-OwaVirtualDirectory -Server $env:COMPUTERNAME | Format-List * | Out-File "C:\Temp\OWA-Backup.txt"

# Step 2: Remove existing virtual directory
Get-OwaVirtualDirectory -Server $env:COMPUTERNAME | Remove-OwaVirtualDirectory -Confirm:$false

# Step 3: Remove from IIS if still present
Import-Module WebAdministration
$iisOwa = Get-WebApplication -Site "Default Web Site" -Name "owa" -ErrorAction SilentlyContinue
if ($iisOwa) {
    Remove-WebApplication -Site "Default Web Site" -Name "owa"
    Write-Host "Removed OWA from IIS"
}

# Step 4: Recreate the virtual directory
New-OwaVirtualDirectory -Server $env:COMPUTERNAME -WebSiteName "Default Web Site"

# Step 5: Configure URLs and authentication
$internalUrl = "https://mail.company.com/owa"
$externalUrl = "https://mail.company.com/owa"

Get-OwaVirtualDirectory -Server $env:COMPUTERNAME |
  Set-OwaVirtualDirectory -InternalUrl $internalUrl -ExternalUrl $externalUrl -FormsAuthentication $true

Write-Host "OWA virtual directory recreated"

# Check current Exchange settings
Get-OwaVirtualDirectory | Select-Object Server, FormsAuthentication,
  BasicAuthentication, WindowsAuthentication, DigestAuthentication

# Check IIS settings
Import-Module WebAdministration

$authTypes = @("anonymousAuthentication", "basicAuthentication",
               "windowsAuthentication", "digestAuthentication")

foreach ($auth in $authTypes) {
    $enabled = (Get-WebConfigurationProperty -Filter "/system.webServer/security/authentication/$auth" -PSPath "IIS:\Sites\Default Web Site\owa" -Name enabled).Value
    Write-Host "$auth : $enabled"$enabled"
}

# Disable all auth methods in IIS first
foreach ($auth in $authTypes) {
    Set-WebConfigurationProperty -Filter "/system.webServer/security/authentication/$auth" -PSPath "IIS:\Sites\Default Web Site\owa" -Name enabled -Value $false
}

# Enable only the methods you need
# For Forms authentication (typical OWA setup)
Set-WebConfigurationProperty -Filter "/system.webServer/security/authentication/anonymousAuthentication" -PSPath "IIS:\Sites\Default Web Site\owa" -Name enabled -Value $true

# Verify Exchange settings match
Get-OwaVirtualDirectory | Set-OwaVirtualDirectory -FormsAuthentication $true -BasicAuthentication $false -WindowsAuthentication $false -DigestAuthentication $false

iisreset /noforce

Import-Module WebAdministration

# Remove existing pool if broken
$pool = Get-Item IIS:\AppPools\MSExchangeOWAAppPool -ErrorAction SilentlyContinue
if ($pool) {
    Stop-WebAppPool -Name "MSExchangeOWAAppPool" -ErrorAction SilentlyContinue
    Remove-WebAppPool -Name "MSExchangeOWAAppPool"
    Write-Host "Removed existing app pool"
}

# Recreate with correct settings
New-WebAppPool -Name "MSExchangeOWAAppPool"

# Configure the app pool
$poolPath = "IIS:\AppPools\MSExchangeOWAAppPool"
Set-ItemProperty $poolPath -Name managedRuntimeVersion -Value "v4.0"
Set-ItemProperty $poolPath -Name managedPipelineMode -Value "Integrated"
Set-ItemProperty $poolPath -Name processModel.identityType -Value "LocalSystem"

# Enable 32-bit applications if needed (usually not for Exchange)-bit applications if needed (usually not for Exchange)
# Set-ItemProperty $poolPath -Name enable32BitAppOnWin64 -Value $false$poolPath -Name enable32BitAppOnWin64 -Value $false

# Assign to OWA application
Set-ItemProperty "IIS:\Sites\Default Web Site\owa" -Name applicationPool -Value "MSExchangeOWAAppPool"

# Start the pool
Start-WebAppPool -Name "MSExchangeOWAAppPool"

Write-Host "Application pool recreated and started"

# Reset permissions on OWA folder
$owaPath = "$env:ExchangeInstallPath\ClientAccess\Owa"

# Take ownership first if needed
takeown /f $owaPath /r /d y

# Reset to inherited permissions
icacls $owaPath /reset /t /c

# Add required permissions
$acl = Get-Acl $owaPath

# IIS_IUSRS - Read & Execute
$iisRule = New-Object System.Security.AccessControl.FileSystemAccessRule(
    "IIS_IUSRS", "ReadAndExecute", "ContainerInherit,ObjectInherit", "None", "Allow")
$acl.AddAccessRule($iisRule)

# NETWORK SERVICE - Read & Execute
$nsRule = New-Object System.Security.AccessControl.FileSystemAccessRule(
    "NETWORK SERVICE", "ReadAndExecute", "ContainerInherit,ObjectInherit", "None", "Allow")
$acl.AddAccessRule($nsRule)

# Local System - Full Control
$sysRule = New-Object System.Security.AccessControl.FileSystemAccessRule(
    "SYSTEM", "FullControl", "ContainerInherit,ObjectInherit", "None", "Allow")
$acl.AddAccessRule($sysRule)

Set-Acl -Path $owaPath -AclObject $acl

Write-Host "Permissions reset on $owaPath"

# Restart IIS to pick up changes
iisreset /noforce

# 1. Test OWA connectivity
Test-OwaConnectivity -URL "https://mail.company.com/owa" -TrustAnySSLCertificate |
  Select-Object Scenario, Result, Latency, Error | Format-Table

# 2. Verify virtual directory exists in both Exchange and IIS
Write-Host "Exchange:"
Get-OwaVirtualDirectory | Select-Object Server, Name, InternalUrl

Write-Host "`nIIS:"
Import-Module WebAdministration
Get-WebApplication -Site "Default Web Site" -Name "owa" | Select-Object Path, PhysicalPath

# 3. Check app pool is running
(Get-WebAppPoolState "MSExchangeOWAAppPool").Value

# 4. Verify no new 1016 errors1016 errors
$since = (Get-Date).AddMinutes(-15)
$errors = Get-WinEvent -FilterHashtable @{
    LogName = 'Application'
    Id = 1016
    StartTime = $since
} -ErrorAction SilentlyContinue
Write-Host "1016 errors in last 15 minutes: $($errors.Count)"15 minutes: $($errors.Count)"

# 5. Test actual page load
$response = Invoke-WebRequest -Uri "https://localhost/owa/auth/logon.aspx" -UseBasicParsing -TimeoutSec 30
Write-Host "HTTP Status: $($response.StatusCode)"

# Run after every Exchange CU installation
$vdirs = @(
    @{Type="OWA"; Cmdlet="Get-OwaVirtualDirectory"},
    @{Type="ECP"; Cmdlet="Get-EcpVirtualDirectory"},
    @{Type="EWS"; Cmdlet="Get-WebServicesVirtualDirectory"},
    @{Type="OAB"; Cmdlet="Get-OabVirtualDirectory"},
    @{Type="Autodiscover"; Cmdlet="Get-AutodiscoverVirtualDirectory"}
)

foreach ($vdir in $vdirs) {
    $result = Invoke-Expression $vdir.Cmdlet
    if ($result) {
        Write-Host "$($vdir.Type): OK - $($result.InternalUrl)"$result.InternalUrl)" -ForegroundColor Green
    } else {
        Write-Host "$($vdir.Type): MISSING!" -ForegroundColor Red
    }
}

# Schedule weekly health check
$results = @()

# Check OWA
$owaResult = Test-OwaConnectivity -URL "https://mail.company.com/owa" -TrustAnySSLCertificate -ErrorAction SilentlyContinue
$results += [PSCustomObject]@{
    Service = "OWA"
    Status = if($owaResult.Result -eq "Success"){"OK"}else{"FAILED"}
}

# Check ECP
$ecpResult = Test-EcpConnectivity -URL "https://mail.company.com/ecp" -TrustAnySSLCertificate -ErrorAction SilentlyContinue
$results += [PSCustomObject]@{
    Service = "ECP"
    Status = if($ecpResult.Result -eq "Success"){"OK"}else{"FAILED"}
}

$results | Format-Table -AutoSize

# Alert if any failed
if ($results | Where-Object {$_.Status -eq "FAILED"}) {
    Send-MailMessage -To "admin@company.com" -From "exchange@company.com" -Subject "Exchange Virtual Directory Alert" -Body ($results | Out-String) -SmtpServer localhost
}