Exchange 2013 schema prep failed

Upon running setup /prepareschema /iacceptexchangeserverlicenseterms, the prerequisite check indicated our Edge server is not at SP3.  However, it is, I manually updated it last week.

When I run get-exchangeserver from the Edge server's EMS, it returns version 14.3 for all three of our servers.  When I run the cmdlet from our Hub Transport/CAS/Mailbox servers, it returns 14.0 for the Edge server and 14.3 for the other two.

In the Event Viewer of the Edge server, I see the following error message...

"Microsoft Exchange could not find a certificate that contains the domain name Exch-Edge.<internaldomainname>.local in the personal store on the local computer. Therefore, it is unable to support the STARTTTLS SMTP verb for the connector Default internal receive connector EXCH-EDGE with a FQDN parameter of Exch-Edge.<internaldomainname>.local.  If the connector's FQDN is not specified, the computer's FQDN is used. Verify the connector configuration and the installed certificates to make sure that there is a certificate with a domain name for that FQDN. If this certificate exists, run Enable-ExchangeCertificate -Services SMTP to make sure that the Microsoft Exchange Transport service has access to the certificate key".

In the Event Viewer of one of our Hub Transport/CAS/Mailbox servers, I see the following error message...

The remote internal transport certificate expired. Certificate subject: CN=Exch-Edge".

Is the certificate issue why the prerequisite check is failing? If so, what steps are necessary to get everything re-synchronized? Also, the SMTP service is assigned to our 3rd party cert on both Hub Transport/CAS/Mailbox servers. Will this certificate be used here, or is something else necessary?
Who is Participating?

[Product update] Infrastructure Analysis Tool is now available with Business Accounts.Learn More

I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

AmitIT ArchitectCommented:
Can you run this command and post the result or verify the version.
GCM exsetup |%{$_.Fileversioninfo}
MatthewDKAuthor Commented:
On the Hub Transport/CAS/Mailbox server, the result is 14.03.0248.002 for both the product and file versions.

On the Edge server, the result is 14.03.0248.002 for both the product and file versions.
Simon Butler (Sembee)ConsultantCommented:
Prep cannot see the Edge in most cases.
Therefore it "sees" the Edge as the version it was on when the subscription was created.
Create new subscriptions and all should be well.

Creating Active Directory Users from a Text File

If your organization has a need to mass-create AD user accounts, watch this video to see how its done without the need for scripting or other unnecessary complexities.

Simon Butler (Sembee)ConsultantCommented:
For the certificate error, on each server with the hub transport role, run


no further switches.
When prompted to replace the default SMTP certificate, say yes.

MatthewDKAuthor Commented:

I took it a little farther than that.  I created a new certificate on our Edge server and then a new subscription.  I then resubscribed the Edge subscription in our organization using the EMC.  That took care of the version issue.

Please note that prior to resubscribing, I did not remove the existing Send Connectors.

Currently, we are not receiving mail from the internet.  I since have removed the send connectors and created a new Edge subscription, yet we are still not receiving mail from the internet.  I assume I need to configure a few settings in the properties for the EdgeSync - Inbound to Default-First-Site-Name for this to work properly, but I'm stumped at this point.
MatthewDKAuthor Commented:
Also, test-edgesynchronization comes back with a Normal SyncStatus, and Event Viewer logs are clear. Yet still no mail from the internet.
MatthewDKAuthor Commented:
The cause of our Edge Transport problem had nothing to do with the new certificate and re-subscription.  in the Server Configuration section of the EMC, an old receive connector was set up with the IP address of our Edge Transport server.

Mail flowed just fine until resubscribing the Edge server.  Once it was resubscribed, the receive connector wound up blocking authentication between the Edge server and the Hub Transport servers.

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
MatthewDKAuthor Commented:
No one thought to mention that (and I wouldn't expect anyone to have thought about that as a cause).
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today

From novice to tech pro — start learning today.