u/marshmalllow1

Environment: Exchange Server SE, DAG with 4 members (2 production + 2 DR).

Here's exactly what I did, in order:

1. 08/10/2026, 11:56 AM — Ran New-ExchangeAuthCertificate on one of the DAG members to rotate the Auth Certificate.

2. Log output confirmed the new certificate was generated and staged:

   • New cert thumbprint: E6C74DBE...B5268 (masked)
   • Effective date is: 08/14/2026 12:11:31
   • Log explicitly stated: "The renewal action was successfully performed - the new Auth Certificate will become active on: 08/14/2026 12:11:31"
   • Log also recommended running Hybrid Configuration Wizard (HCW) once the new cert becomes active.

3. Confirmed via (Get-AuthConfig).NextCertificateThumbprint that the new cert is correctly staged as "Next":

   • Thumbprint: E6C74DBE...B5268
   • NotBefore: 8/10/2026 12:09:19 PM
   • NotAfter: 8/10/2031 12:09:19 PM (5-year self-signed cert)

4. Current cert, confirmed via (Get-AuthConfig).CurrentCertificateThumbprint:

   • Thumbprint: E31DFF2D...4497
   • NotBefore: 8/27/2021 1:16:50 AM
   • NotAfter: 8/27/2026 1:16:50 AM

   (So the current cert isn't even expired yet — about 11 days of validity left — which is a separate point but confirms this wasn't an emergency/forced rotation scenario.)

5. To make sure the AuthAdmin servicelet (which checks the effective date every 12 hours) would pick up the change without waiting, I manually restarted MSExchangeServiceHost on all 4 DAG members (2 prod + 2 DR).

6. Verified the restart worked by checking:

   [xml]$xml = Get-ExchangeDiagnosticInfo -Process "Microsoft.Exchange.ServiceHost" -Server $server
   $xml.Diagnostics.Components.AnchorApplication.AnchorServiceComponents.CacheScheduler.lastRunTime

on each server — all 4 servers show a recent lastRunTime (8/15/2026, evening), confirming the servicelet actually ran on every member.

Problem

Today is 8/16/2026 — 2 days after the stated effective date (8/14) — but:

(Get-AuthConfig).CurrentCertificateThumbprint

still returns the old certificate (E31DFF2D...4497). The new certificate is still sitting as NextCertificateThumbprint, it never got promoted to Current.

Questions

• Given the servicelet has clearly run (confirmed via lastRunTime) on all 4 members after the effective date, why hasn't the promotion from Next → Current happened?
• Is there something DAG/multi-AD-site specific I'm missing? (The tool's own log warned about Exchange being installed in multiple AD sites and mentioned the servicelet may fail to deploy the cert to other AD sites in rare cases.)
• Is Set-AuthConfig -PublishCertificate something I need to run manually here, even though the tool I used already set the NewCertificateEffectiveDate and the log said it was "successfully performed"?
• Could this be a timezone issue between when the effective date was stored vs. how the servicelet evaluates "now"?

Any input appreciated before I just run Set-AuthConfig -PublishCertificate manually and force it.

Setup:

• DC-A (physical): Domain Controller for a child/tree domain, located in Prod Site
• DC-B (physical): Forest Root Domain Controller, same Prod Site
• Additionally in the same tree domain: 4 virtual DCs
• Additionally for the forest root domain: 1 more virtual DC

So both DC-A and DC-B are the only physical DCs in their respective roles at this site, but each has virtual DC counterparts providing redundancy within their own domain.

Question:

I need to run driver/firmware (HPE SPP) updates on both physical servers, which host these two DCs (different domains — one is forest root, one is a child domain). Each update takes ~1 hour + reboot, and I'm considering running both maintenance windows at the same time to save scheduling effort.

What are the downsides of running firmware/driver upgrades on both physical DCs simultaneously, given:

• They're in different domains (forest root vs. child domain)
• Virtual DC redundancy exists for each domain separately
• Same physical site

Is this actually risky given the virtual DC redundancy, or does the "different domain" aspect make simultaneous patching more acceptable than patching two DCs in the same domain? What's the best practice here — same window with staggered reboots, fully separate windows, or is simultaneous fine in this topology?

I have a custom app added as a connector to Claude. When I add the connector through the browser (web) version first, I can see and use it in the Claude mobile app too.

However, if I don't add it via browser first, my app doesn't show up in the connector catalog inside the Claude mobile app at all — I can't find it there directly.

Has anyone else run into this? What's causing the connector to be missing from the mobile app's catalog?