{"id":5394,"date":"2026-07-08T17:20:08","date_gmt":"2026-07-08T17:20:08","guid":{"rendered":"https:\/\/geekmungus.co.uk\/?p=5394"},"modified":"2026-07-08T17:20:08","modified_gmt":"2026-07-08T17:20:08","slug":"msexchange-oauth-error-event-id-2004","status":"publish","type":"post","link":"https:\/\/geekmungus.co.uk\/?p=5394","title":{"rendered":"MSExchange OAuth Error – Event ID: 2004"},"content":{"rendered":"\n

We had an issue with event ID 2004 being logged on our Exchange Servers, grumbling about a missing certificate.<\/p>\n\n\n\n

Warning Observed<\/h1>\n\n\n\n

The following error is observed:<\/p>\n\n\n\n

Log Name:      Application\nSource:        MSExchange OAuth\nDate:          07\/07\/2026 15:23:12\nEvent ID:      2004\nTask Category: Configuration\nLevel:         Warning\nKeywords:      Classic\nUser:          N\/A\nComputer:      server1.domain.com\nDescription:\nUnable to find the certificate with thumbprint EF5BB74A1811B457429AE9DC78CEAF20581AE152 in the current computer or the certificate is missing private key. The certificate is needed to sign the outgoing token.\nEvent Xml:\n<Event xmlns=\"http:\/\/schemas.microsoft.com\/win\/2004\/08\/events\/event\">\n  <System>\n    <Provider Name=\"MSExchange OAuth\" \/>\n    <EventID Qualifiers=\"32772\">2004<\/EventID>\n    <Version>0<\/Version>\n    <Level>3<\/Level>\n    <Task>2<\/Task>\n    <Opcode>0<\/Opcode>\n    <Keywords>0x80000000000000<\/Keywords>\n    <TimeCreated SystemTime=\"2026-07-07T14:23:12.4546344Z\" \/>\n    <EventRecordID>1920928<\/EventRecordID>\n    <Correlation \/>\n    <Execution ProcessID=\"0\" ThreadID=\"0\" \/>\n    <Channel>Application<\/Channel>\n    <Computer>server1.domain.com<\/Computer>\n    <Security \/>\n  <\/System>\n  <EventData>\n    <Data>EF5BB74A1811B457429AE9DC78CEAF20581AE152<\/Data>\n  <\/EventData>\n<\/Event><\/code><\/pre>\n\n\n\n
Analysis<\/h1>\n\n\n\n
It seems to indicate that an expected certificate is missing. Running the “get-authconfig” gives this output, and we can see that the PreviousCertificateThumbprint <\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
Confirm Current Certificate<\/h2>\n\n\n\n
Confirm that the “Current Certificate” exists and that it exists on all of the Exchange Servers, to do this run the following commands:<\/p>\n\n\n\n
$thumb = (Get-AuthConfig).CurrentCertificateThumbprint\n\nGet-ExchangeCertificate -Server server1 | Where-Object Thumbprint -eq $thumb | ft Thumbprint,HasPrivateKey,NotAfter -Auto<\/code><\/pre>\n\n\n\n
We check to see the certificate (current certificate) is present. It should be.<\/p>\n\n\n\n
Confirm Previous Certificate<\/h2>\n\n\n\n
We can then confirm that the Previous Certificate is missing from all Exchange Servers, we already know this however because of the Event Log event being generated!<\/p>\n\n\n\n
$prevthumb = (Get-AuthConfig).PreviousCertificateThumbprint\n\nGet-ExchangeCertificate -Server server1 | Where-Object Thumbprint -eq $prevthumb  | ft Thumbprint,HasPrivateKey,NotAfter -Auto<\/code><\/pre>\n\n\n\n
We should see nothing, there should be no entry shown, that shows it is not present on any of the Exchange Servers. Which means it can’t possibly be being used, therefore removal of the stale entry is safe.<\/p>\n\n\n\n
Resolution<\/h1>\n\n\n\n
We have confirmed that the previous certificate the one highlighted is not physically present on any of the Exchange Servers, therefore we can remove the stale reference safely.<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
To remove this therefore we use:<\/p>\n\n\n\n
Being this is a global configuration, we only need to run it once, we don’t need to run on each Exchange Server individually.<\/p>\n\n\n\n
We can now see that the certificate has been removed:<\/p>\n\n\n\n
[PS] C:\\Windows\\system32>get-authconfig\n\nRunspaceId                    : 9ae12d86-0bba-4dd6-97aa-ab5ba3b47335\nCurrentCertificateThumbprint  : 28fe9d0e8a65adxxxxxxxxxxxxxb5373f1fca7\nPreviousCertificateThumbprint : \nNextCertificateThumbprint     :\nNextCertificateEffectiveDate  :\nServiceName                   : 00000002-0000-0ff1-ce00-000000000000\nRealm                         :\nDeploymentId                  :\nIssuerIdentifier              :\nName                          : Auth Configuration\nAdminDisplayName              :\nExchangeVersion               : 0.20 (15.0.0.0)\nDistinguishedName             : CN=Auth Configuration,CN=PLACE,CN=Microsoft Exchange,CN=Services,CN=Configuration,DC=internal,DC=DOMAIN,DC=COM\nIdentity                      : Auth Configuration\nGuid                          : 2526943a-ba1f-4c0d-8d19-476c04a39274\nObjectCategory                : DOMAIN.COM\/Configuration\/Schema\/ms-Exch-Auth-Auth-Config\nObjectClass                   : {top, container, msExchContainer, msExchAuthAuthConfig}\nWhenChanged                   : 16\/10\/2023 14:58:13\nWhenCreated                   : 21\/05\/2018 14:46:36\nWhenChangedUTC                : 16\/10\/2023 13:58:13\nWhenCreatedUTC                : 21\/05\/2018 13:46:36\nOrganizationId                :\nId                            : Auth Configuration\nOriginatingServer             : MYDC.DOMAIN.COM\nIsValid                       : True\nObjectState                   : Unchanged<\/code><\/pre>\n\n\n\n
You should now no longer see Event ID 2004 appear in the logs, because Exchange is no longer looking for the removed certificate.<\/p>\n","protected":false},"excerpt":{"rendered":"
We had an issue with event ID 2004 being logged on our Exchange Servers, grumbling about a missing certificate. Warning Observed The following error is observed: Analysis It seems to indicate that an expected certificate is missing. Running the “get-authconfig” gives this output, and we can see that the PreviousCertificateThumbprint  Confirm Current Certificate Confirm that … Read more<\/a><\/p>\n","protected":false},"author":4,"featured_media":4384,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[32],"tags":[],"class_list":["post-5394","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-microsoft-exchange"],"_links":{"self":[{"href":"https:\/\/geekmungus.co.uk\/index.php?rest_route=\/wp\/v2\/posts\/5394","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/geekmungus.co.uk\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/geekmungus.co.uk\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/geekmungus.co.uk\/index.php?rest_route=\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"https:\/\/geekmungus.co.uk\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=5394"}],"version-history":[{"count":1,"href":"https:\/\/geekmungus.co.uk\/index.php?rest_route=\/wp\/v2\/posts\/5394\/revisions"}],"predecessor-version":[{"id":5397,"href":"https:\/\/geekmungus.co.uk\/index.php?rest_route=\/wp\/v2\/posts\/5394\/revisions\/5397"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/geekmungus.co.uk\/index.php?rest_route=\/wp\/v2\/media\/4384"}],"wp:attachment":[{"href":"https:\/\/geekmungus.co.uk\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=5394"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/geekmungus.co.uk\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=5394"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/geekmungus.co.uk\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=5394"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}