SP2016 Incoming E-Mail Error

Question

I have had this working for some time and previously configured libraries with incoming email continue to function, however, when I attempt to assign an Email address to a previously unconfigured library, I receive an error (Something went wrong). ULS errors show:

ListUpdate Failure: System.Net.WebException: The request failed with HTTP status 401: Unauthorized.   

at System.Web.Services.Protocols.SoapHttpClientProtocol.ReadResponse(SoapClientMessage message, WebResponse response, Stream responseStream, Boolean asyncCall)
at System.Web.Services.Protocols.SoapHttpClientProtocol.Invoke(String methodName, Object[] parameters)
at Microsoft.SharePoint.DirectorySoap.SPDirectoryManagementProxy.DeleteContact(String Alias, String Requestor)
at Microsoft.SharePoint.SPList.UpdateDirectoryManagementService(String oldAlias, String newAlias)
at Microsoft.SharePoint.SPList.Update(Boolean bFromMigration)

Application error when access /_layouts/15/EmailSettings.aspx, Error=The request failed with HTTP status 401: Unauthorized. at System.Web.Services.Protocols.SoapHttpClientProtocol.ReadResponse(SoapClientMessage message, WebResponse response, Stream responseStream, Boolean asyncCall)
at System.Web.Services.Protocols.SoapHttpClientProtocol.Invoke(String methodName, Object[] parameters)
at Microsoft.SharePoint.DirectorySoap.SPDirectoryManagementProxy.DeleteContact(String Alias, String Requestor)
at Microsoft.SharePoint.SPList.UpdateDirectoryManagementService(String oldAlias, String newAlias)
at Microsoft.SharePoint.SPList.Update(Boolean bFromMigration)
at Microsoft.SharePoint.ApplicationPages.EmailSettingsPage.SubmitButton_Click(Object sender, EventArgs args)
at System.Web.UI.WebControls.Button.OnClick(EventArgs e)
at System.Web.UI.WebControls.Button.RaisePostBackEvent(String eventArgument)
at System.Web.UI.Page.ProcessRequestMain(Boolean includeStagesBeforeAsyncPoint, Boolean includeStagesAfterAsyncPoint)

I have ensured that the central admin app pool as well as the application app pool are running under the same, farm-admin account, which is also in the domain admin group. I have wire-sharked the connection to verify that it is querying AD and is not generating errors in that direction. I can find no reason that it would be getting a 401 error. I have also attempted to update the list via powershell, where I get the same 401 unauthorized error.

Does anyone have any suggestions where else I might look to overcome this?

Answer 1

I have ensured that the central admin app pool as well as the application app pool are running under the same, farm-admin account, which is also in the domain admin group.

Super bad practice ;)

It looks like what you're hitting is:

[WebMethod]
public RequestStatus DeleteContact(string Alias)
{
    if (!SPEWSUtil.CheckCurrentUserIsAppPoolAccount())
    {
        return RequestStatus.AccessDenied;
    }
    return this.ADManager.DeleteContact(Alias);
}

The code just determines if the calling account (which will be the account assigned ton the Web Apps IIS App Pool) is a Managed Account and is assigned to the identity of a. SharePoint Application Pool.

Other than that, the Timer Service account needs the Create and Delete Contact permissions on the OU which contains the Contact objects.