Users can't access their mailboxes from anywhere as they get the error in the screenshot. Related errors are 3002, 3005
Event code: 3005 Event message: An unhandled exception has occurred. Event time: 7/29/2015 11:10:57 AM Event time (UTC): 7/29/2015 8:10:57 AM Event ID: 6f94ea40e3964fb1a05d9fc48ffb4299 Event sequence: 38 Event occurrence: 2 Event detail code: 0 Application information: Application domain: /LM/W3SVC/1/ROOT/owa-2-130826309519814020 Trust level: Full Application Virtual Path: /owa Application Path: C:\Program Files\Microsoft\Exchange Server\V15\FrontEnd\HttpProxy\owa\ Machine name: EX2K1301 Process information: Process ID: 19348 Process name: w3wp.exe Account name: NT AUTHORITY\SYSTEM Exception information: Exception type: NullReferenceException Exception message: Object reference not set to an instance of an object. at Microsoft.Exchange.Clients.Common.UserAgent.HasString(String str) at Microsoft.Exchange.Clients.Common.UserAgent.get_Layout() at Microsoft.Exchange.Clients.Common.UserAgent.get_LayoutString() at ASP.auth_logon_aspx.__Render__control1(HtmlTextWriter __w, Control parameterContainer) at System.Web.UI.Control.RenderChildrenInternal(HtmlTextWriter writer, ICollection children) at System.Web.UI.Page.Render(HtmlTextWriter writer) at System.Web.UI.Control.RenderControlInternal(HtmlTextWriter writer, ControlAdapter adapter) at System.Web.UI.Page.ProcessRequestMain(Boolean includeStagesBeforeAsyncPoint, Boolean includeStagesAfterAsyncPoint) Request information: Request URL: https://mail.Domain.com:443/owa/auth/logon.aspx?url=https://mail.Domain.com/owa/PowerShell-LiveID&reason=0 Request path: /owa/auth/logon.aspx User host address: 10.16.0.172 User: Is authenticated: False Authentication Type: Thread account name: NT AUTHORITY\SYSTEM Thread information: Thread ID: 67 Thread account name: NT AUTHORITY\SYSTEM Is impersonating: False Stack trace: at Microsoft.Exchange.Clients.Common.UserAgent.HasString(String str) at Microsoft.Exchange.Clients.Common.UserAgent.get_Layout() at Microsoft.Exchange.Clients.Common.UserAgent.get_LayoutString() at ASP.auth_logon_aspx.__Render__control1(HtmlTextWriter __w, Control parameterContainer) at System.Web.UI.Control.RenderChildrenInternal(HtmlTextWriter writer, ICollection children) at System.Web.UI.Page.Render(HtmlTextWriter writer) at System.Web.UI.Control.RenderControlInternal(HtmlTextWriter writer, ControlAdapter adapter) at System.Web.UI.Page.ProcessRequestMain(Boolean includeStagesBeforeAsyncPoint, Boolean includeStagesAfterAsyncPoint) Custom event details: OWA PAGE

Solution: On Exchange servers, Make sure that Exchange servers are not members of Organization Management group and if they are then remove them and run this cmdlet anyway on all Exchange Servers then restart the Servers. Get-ClientAccessServer | Add-ADPermission -AccessRights ExtendedRight -ExtendedRights "ms-Exch-EPI-Token-Serialization", "ms-Exch-EPI-Impersonation" -User (Exchange Server name)
Make sure you restart Exchange servers after you apply these cmdlet
Hope this helps  |