Troubleshooting Exchange Issues relating to OWA \EWS \ IIS (226325)

1. Stop Change Auditor Agent
2. Increase Change Auditor for Exchange logging level to 3
   • Open Registry and go to HKEY_LOCAL_MACHINE\SOFTWARE\Quest\ChangeAuditor for Exchange\Logging
   • Set Logging Level to 3
   • Set LoggingMaxFileAmount to 20
   • Start the Agent and let it come online fully
3. Reproduce the issue and grab a screenshot of the issue (Important)
4. Take dumps of the Powershell application pool process and whatever process is the one noted in the PowerShell logging
5. To identify the PID of the process, please follow the steps here
6. Collect all the Agent Logs from 
   • C:\Program Files\Quest\ChangeAuditor\Agent
   • C:\Program Files\Quest\ChangeAuditor\Agent\Plug-in for Exchange\CAEXLOGS
   • The Process dumps from step 4
   • The Windows Event Logs saved as EVTX format from 
     • Application
     • System
     • MSExchange Management
7. Once completed disable the logs as follow:
   1. Open Registry and go to HKEY_LOCAL_MACHINE\SOFTWARE\Quest\ChangeAuditor for Exchange\Logging
      • Set LoggingLevel to 1
        
      • Set LoggingMaxFilesAmount to 5
8. Disable Powershell Auditing in ChangeAuditor agent for Exchange IIS as above as mentioned in the Description section
9. Send all Logs to Support

Solution

Issue fixed in 6.9.1 so please upgrade to latest version here