Exchange Server (2016) Maintenance Mode

I'm having the exact same issue.

I ended up searching my logs and found a reference to the HealthManagerWorkItemQuarantineMonitor in Microsoft\Exchange\ManagedAvailability\Monitoring:

Workitem "E4eException.Maintenance.WorkItem" (ID: 37) repeatedly caused
Exchange Health Manager worker process to restart. As a result it has 
been quarantined and will not be scheduled to run for 24 hours.

-------------------------------------------------------------------------------

States of all monitors within the health set:
Note: Data may be stale. To get current data, run: Get-ServerHealth -Identity '<SERVERNAME>' -HealthSet 'E4E'

I've recently had an issue with the DAG that this server is in and had been working on it. So for me, I'm going to check it again tomorrow and check the health status again.

Hope this is somewhat useful.

It sounds like RC4 was an allowed Kerberos encryption type on the 2012 DCs, and your AD team introduced 2016 DCs with RC4 disabled. I say this with some confidence, because it is the recommended security setting on Server 2016. The goal is to remove RC4 from the environment, but not without first updating your mission critical applications to support AES. My suggestion would be to ensure the allowed Kerberos encryption types are configured the same on all DCs and then enable Kerberos service ticket success auditing on all Domain Controllers to see which applications are still trying to use RC4. It will show up in EventId 4769 with an encryption type of 0x17. If you see this, then RC4 is being used. You need to make sure all involved user accounts, computer accounts, and the Kerberos policy on each server (including the DCs) is configured properly for AES to work.