Users can not login to Outlook and OWA, password asks repeatedly

For now, I disabled the Extended Protection, I use this MS script for it:

https://microsoft.github.io/CSS-Exchange/Security/ExchangeExtendedProtectionManagement/

The solution is the Exchange Management Shell error, what I wrote in the topic:

https://techcommunity.microsoft.com/t5/exchange/eac-issue-after-exchange-2019-cu14-install/m-p/4061435

After I talked Microsoft support, I found the port 443/SSL certificate binding on Default Website and Exchange Backend sites in IIS manager changed somehow on Exchange servers after CU14 (Or the binding used to work before CU14).

Default Website 443 binding should be set to public certificate and IP address set to "All Unassigned".
Exchange Backed site binding should be set with self-signed Exchange certificate and also set to "All unassigned".

After I made changes, I have refreshed the Application pools (or do a IISReset). It worked for me.

In IIS --> Sites --> Exchange Back End --> ECP --> Authentication --> Windows Authentication --> Advanced Settings --> Set Extended Protection to "Off"
Do the same for Powershell under Exchange Back End.
Do an IISReset to restart IIS.

After it, I can use the Exchange Management Shell and can run this command to disable the Extended Protection with script:

.\ExchangeExtendedProtectionManagement.ps1 -ShowExtendedProtection

After it, the users can login to their mailbox and the Outlook don't ask their password repeatedly.

In your load balancer’s config, disable SSL offloading and ensure that you are re-encrypting HTTPS traffic with the same cert/key combo.

Use the GPMC to identify where in your domain’s config you have the LAN Manager Authentication Level policy set. My recommendation is that in your Default Domain Policy and Default Domain Controllers Policy this setting should be set to level 4 (Send NTLMv2 only. Refuse LM.). If this policy setting is set to other values in other GPOs, clear those instances.

Look up the article for configuring Kerberos in a load balanced environment: you need to create a computer account for use as an ASA credential, deploy that credential to all servers with the script, and then register your Exchange namespace SPNs against that ASA. This will upgrade your auth mechanism from NTLM to Kerberos which is both more secure and generates less “work” for your clients, your Exchange servers, and your domain controllers.

Did you activate extended protection and made sure all requirmenrs where set?

My first guess would be that your still on NTLMv1, which is no longer supported with extended protection

did you install the CU from an elevated CLI?

HKLM\System\CurrentControlSet\Control\LSA

What is the value of "CrashOnAuditFail"? 0 - not the problem 1 - not the problem 2 - this is the problem

Your security log is full thus the OS won't allow connections that cannot be logged.