As soon as I finished the 2013 CU6 update and rebooted the servers I started getting these RBAC related errors in the applications logs on my mailbox servers:
MSExchange RBAC 17 RBAC:
(Process w3wp.exe, PID 9000) "RBAC authorization returns Access Denied for user domain.local/Microsoft Exchange Servers/EXCHMBSVR2. Reason: No role assignments associated with the specified user were found on Domain Controller DC02.domain.local"
MSExchange RBAC Event 258 RBAC:
(Process 9000, PID w3wp.exe)"RemotePS Public API Func GetApplicationPrivateData throws Exception Microsoft.Exchange.Configuration.Authorization.CmdletAccessDeniedException: The user "domain.local/Microsoft Exchange Servers/EXCHMBSVR2" isn't assigned to any management roles.
I found a reference to this error which pointed to a Symantec article that suggested to add the service account to the Organization Management group. The problem is that this is the Computer Account for the Mailbox server that is being denied. I tried to add the server's computer account to the Organization Management group and that fixed the errors, but it also broke "Free/Busy" lookups.
I never had this error while we were running 2013 SP1, just once we upgraded to CU6 did I start seeing this error.