Hybrid moves fail since Oct 2026: MRSProxy 401, Event 4625 shows "Administrator" with empty domain (endpoint credentials ignored)

Dario Steck (dplan AG) 5 Reputation points
2026-10-16T17:36:55.3633333+00:00

Since ~12 Oct 2026 23:53 UTC, all onboarding moves (Exchange 2019 CU15 -> Exchange Online, Modern Hybrid / Hybrid Agent) fail with TooManyTransientFailureRetriesPermanentException / CommunicationErrorTransientException right after "Connected to target mailbox". Test-MigrationServerAvailability still succeeds.

  • The start time matches the EXO MRS servers moving from build 15.21.496.x to 15.21.522.x.
  • IIS: POST /EWS/mrsproxy.svc -> 401 1 2148074252.
  • Event 4625 on the Exchange server: Account Name "Administrator", Account Domain empty, Sub Status 0xC000006A, NTLM, Workstation = EXO server.
  • The configured endpoint account (dedicated service account, also tried UPN format) is ignored, even though RemoteCredentialUsername on the move requests shows it.

Workaround that made us succeed with the migration at the end: renaming the local Administrator account on the Exchange server makes the moves work again.

Is anyone else seeing this? Is there a known issue or incident ID from Microsoft?

1_event4625_empty_domain.png 2_remotecred_vs_4625.png5_local_admin_renamed_moves_working.png4_status_all_three_users.png

Exchange | Hybrid management
Exchange | Hybrid management

The administration of a hybrid deployment that connects on-premises Exchange Server with Exchange Online, enabling seamless integration and centralized control.

10 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Srfndoc 5 Reputation points
    2026-10-21T16:49:24.4933333+00:00

    Anyone running Exchange SE and seeing this issue?

    Was this answer helpful?

    2 people found this answer helpful.
    0 comments
  2. Ronald Chan 0 Reputation points
    2026-11-06T17:22:20.0666667+00:00

    Thank you so much for sharing this workaround! You saved me hours of troubleshooting!

    I was experiencing the exact same issue with Exchange 2016 Hybrid, trying to offboard a mailbox from Exchange Online back to our on-premises server.

    The migration endpoint connectivity tests were all successful, but the actual mailbox move kept failing with TransientFailureTarget and Negotiate Unauthorized, with 0 bytes transferred.

    After reading your post, I checked Event ID 4625 on our Exchange server and found repeated failed NTLM authentication attempts using administrator with a blank Account Domain.

    I renamed the local Administrator account on our Exchange server to something else (leaving the domain Administrator account unchanged), resumed the migration, and it immediately started working!

    The migration is now progressing and transferring data!

    Really appreciate you taking the time to share your findings. Hopefully Microsoft will investigate and address the underlying issue.

    Thanks again!

    Was this answer helpful?

    0 comments
  3. AT 0 Reputation points
    2026-11-05T12:18:13.53+00:00

    I renamed the local admin and the service user for the migration endpoint. First it works fine but on the next day I get the same error again. Do someone has the same issue or has an idea to solve my problem

    Was this answer helpful?

    0 comments
  4. Nicolas P 0 Reputation points
    2026-10-28T16:35:54.3766667+00:00

    I have multiple clients running Exchange SE, and I’m experiencing the same issue with all of them. Thanks a lot for the tip! I’ve been trying to figure out the problem for two days. I had correctly identified it as a credential issue, but even when using a different account instead of the administrator account, I was still encountering the same problem.

    Was this answer helpful?

  5. Todd R. Humphrey 0 Reputation points
    2026-10-28T00:06:54.8933333+00:00

    Thank you @Dario Steck (dplan AG) , wow most random issue \ bug i've seen in a while. Again thank you for sharing!

    Was this answer helpful?

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.