Event ID 1309: Cookie Authentication Failed - Fix Guide 2025

Log Name:      Application
Source:        ASP.NET 4.0.30319.0
Event ID:      1309
Level:         Warning
Description:   Event code: 3005
               Event message: An unhandled exception has occurred.
               Exception information:
               Exception type: CryptographicException
               Exception message: Error occurred during a cryptographic operation.
               Request information:
               Request URL: https://mail.company.com/owa/
               User: DOMAIN\username
               Authentication Type: Forms

# Quick fix - recycle app pools to clear cached state
Import-Module WebAdministration

# Recycle OWA pool
Restart-WebAppPool -Name "MSExchangeOWAAppPool"
Write-Host "OWA app pool recycled"

# Recycle ECP pool
Restart-WebAppPool -Name "MSExchangeECPAppPool"
Write-Host "ECP app pool recycled"

# Wait and verify
Start-Sleep -Seconds 10
Get-WebAppPoolState "MSExchangeOWAAppPool", "MSExchangeECPAppPool"

# If app pool recycle doesn't help, full IIS reset
iisreset /noforce

# Verify services restarted
Get-Service W3SVC, WAS | Select-Object Name, Status

# Check OWA pool is running
Start-Sleep -Seconds 15
(Get-WebAppPoolState "MSExchangeOWAAppPool").Value

# Step 1: Generate new machine key (run on one server)
# Use IIS Manager or PowerShell

# Generate keys using .NET
Add-Type -AssemblyName System.Web
$validationKey = [System.Web.Security.Membership]::GeneratePassword(128, 0) -replace '[^a-fA-F0-9]'-F0-9]',''
$decryptionKey = [System.Web.Security.Membership]::GeneratePassword(48, 0) -replace '[^a-fA-F0-9]'-F0-9]',''

# Ensure correct lengths
$validationKey = $validationKey.Substring(0, 128).ToUpper()
$decryptionKey = $decryptionKey.Substring(0, 48).ToUpper()

Write-Host "Add this to web.config on ALL Exchange servers:"
Write-Host @"

<machineKey
  validationKey="$validationKey"
  decryptionKey="$decryptionKey"
  validation="SHA1"
  decryption="AES" />

"@

# Backup existing web.config
$owaPath = "$env:ExchangeInstallPath\ClientAccess\Owa\web.config"
Copy-Item $owaPath "$owaPath.backup.$(Get-Date -Format 'yyyyMMdd-HHmmss')"Get-Date -Format 'yyyyMMdd-HHmmss')"

# The machineKey element goes inside <system.web> section
# Example location in web.config:
#
# <configuration>
#   <system.web>
#     <machineKey validationKey="YOUR_KEY" decryptionKey="YOUR_KEY" ... />"YOUR_KEY" ... />
#   </system.web>
# </configuration>

# IMPORTANT: Apply the SAME key to all Exchange servers
# Copy web.config to each server or manually add the machineKey element

# After editing, recycle the app pool
Restart-WebAppPool -Name "MSExchangeOWAAppPool"

# Repeat for ECP if experiencing ECP auth issues
$ecpPath = "$env:ExchangeInstallPath\ClientAccess\ecp\web.config"
Copy-Item $ecpPath "$ecpPath.backup.$(Get-Date -Format 'yyyyMMdd-HHmmss')"Get-Date -Format 'yyyyMMdd-HHmmss')"
# Add same machineKey to ECP web.config
Restart-WebAppPool -Name "MSExchangeECPAppPool"

# Force time sync with domain controller
w32tm /resync /force

# If still off, reconfigure time source
w32tm /config /syncfromflags:DOMHIER /update
Restart-Service w32time

# Verify sync
w32tm /query /status
w32tm /stripchart /computer:DC01.domain.local /samples:3

# Check time on all Exchange servers
$servers = Get-ExchangeServer | Select-Object -ExpandProperty Name
foreach ($server in $servers) {
    $time = Invoke-Command -ComputerName $server -ScriptBlock {Get-Date}
    Write-Host "$server : $time"$time"
}

# If using SSL offloading, Exchange needs to know it's being accessed via HTTPS
# even though the LB forwards HTTP

# Option 1: Configure OWA to trust X-Forwarded-Proto header-Forwarded-Proto header
# This requires Registry modification

# Set Exchange to expect SSL offloading
$servers = Get-ExchangeServer | Select-Object -ExpandProperty Name
foreach ($server in $servers) {
    Invoke-Command -ComputerName $server -ScriptBlock {
        $path = "HKLM:\SYSTEM\CurrentControlSet\Services\MSExchange OWA"
        Set-ItemProperty -Path $path -Name "SSLOffloaded" -Value 1 -Type DWord
    }
}

# Option 2: Don't offload SSL - let Exchange handle it
# This is more secure and avoids cookie issues

# Verify OWA external URL matches what users access
Get-OwaVirtualDirectory | Set-OwaVirtualDirectory -ExternalUrl "https://mail.company.com/owa"

# Recycle after changes
Get-ExchangeServer | ForEach-Object {
    Invoke-Command -ComputerName $_.Name -ScriptBlock {
        Import-Module WebAdministration
        Restart-WebAppPool -Name "MSExchangeOWAAppPool"
    }
}

# Nuclear option - recreate virtual directory
# WARNING: This removes customizations

# Document current settings first
Get-OwaVirtualDirectory | Format-List * | Out-File "OWA-Config-Backup.txt"-Backup.txt"

# Remove existing virtual directory
Get-OwaVirtualDirectory -Server $env:COMPUTERNAME | Remove-OwaVirtualDirectory -Confirm:$false

# Recreate with defaults
New-OwaVirtualDirectory -Server $env:COMPUTERNAME -WebSiteName "Default Web Site"

# Reconfigure URLs
$internalUrl = "https://mail.company.com/owa"
$externalUrl = "https://mail.company.com/owa"
Get-OwaVirtualDirectory -Server $env:COMPUTERNAME |
  Set-OwaVirtualDirectory -InternalUrl $internalUrl -ExternalUrl $externalUrl

# Enable Forms authentication
Get-OwaVirtualDirectory -Server $env:COMPUTERNAME |
  Set-OwaVirtualDirectory -FormsAuthentication $true

# Recycle IIS
iisreset /noforce

# 1. Test OWA connectivity
Test-OwaConnectivity -URL "https://mail.company.com/owa" |
  Select-Object Scenario, Result, Latency, Error

# 2. Check for new 1309 events (wait 10+ minutes)1309 events (wait 10+ minutes)
$startTime = (Get-Date).AddMinutes(-10)
Get-WinEvent -FilterHashtable @{
    LogName = 'Application'
    Id = 1309
    StartTime = $startTime
} -ErrorAction SilentlyContinue | Measure-Object

# 3. Verify machine keys match across servers (load-balanced)-balanced)
$servers = @("EX01", "EX02", "EX03")
foreach ($server in $servers) {
    $key = Invoke-Command -ComputerName $server -ScriptBlock {
        $config = [xml](Get-Content "$env:ExchangeInstallPath\ClientAccess\Owa\web.config")
        $config.configuration.'system.web'.machineKey.validationKey.Substring(0,20)
    }
    Write-Host "$server : $key..."$key..."
}

# 4. Test multiple logins through load balancer
for ($i = 1; $i -le 5; $i++) {
    $result = Test-OwaConnectivity -URL "https://mail.company.com/owa" -TrustAnySSLCertificate
    Write-Host "Test $i : $($result.Result)"$result.Result)"
}

# Create backup of machine key configuration
$backupPath = "C:\ExchangeBackups\MachineKeys"
New-Item -ItemType Directory -Path $backupPath -Force

$configs = @(
    "$env:ExchangeInstallPath\ClientAccess\Owa\web.config",
    "$env:ExchangeInstallPath\ClientAccess\ecp\web.config"
)

foreach ($config in $configs) {
    $name = (Get-Item $config).Directory.Name
    Copy-Item $config "$backupPath\$name-web.config.$(Get-Date -Format 'yyyyMMdd')"$name-web.config.$(Get-Date -Format 'yyyyMMdd')"
}

Write-Host "Backups saved to $backupPath"

# Add to monitoring - alert if time drift > 60 seconds
$threshold = 60

$dc = (Get-ADDomainController -Discover).HostName[0]
$dcTime = Invoke-Command -ComputerName $dc -ScriptBlock {Get-Date}
$localTime = Get-Date
$drift = [math]::Abs(($dcTime - $localTime).TotalSeconds)

if ($drift -gt $threshold) {
    # Send alert
    Send-MailMessage -To "admin@company.com" -From "monitor@company.com" -Subject "Time Drift Alert: $env:COMPUTERNAME" -Body "Time drift: $drift seconds" -SmtpServer localhost
}