Exchange 2013 uses Managed Availability to monitor its own health. One part of this monitoring is achieved through the use of synthetic transactions, mimicking regular user activity, such as accessing mailboxes, send/receive e-mail, etc. For this to work properly, the monitoring system uses so-called Health Mailboxes. These are just regular mailboxes (with a regular AD account), but are created automatically and used for the sole purpose of health monitoring. Depending on the CU-version of Exchange 2013, these are created for every database on every CAS (or just one per CAS and one per database, starting from CU6).

Sometimes, these mailboxes may become corrupt or unusable, in which case the health monitor will incorrectly detect this as a problem with Exchange.

"Corrupt" HealthMailboxes

"Corrupt" mailboxes usually occur if a HealthMailbox was removed because its corresponding database was removed. The most obvious sign when this has happened, is the following error when running Get-Mailbox -Monitoring:

Get-Mailbox Monitoring

HealthMailbox<suffix> has been corrupted, and it's in an inconsistent state. The following validation errors happened: Database is mandatory on UserMailbox

The database, along with the HealthMailbox is gone, but the account still exists in AD, in which case, it is then incorrectly detected as a "corrupt" HealthMailbox.

The quick and obvious solution is to delete the AD account.

Account lockouts

As HealthMailboxes are just regular AD accounts with regular user mailboxes, they adhere to the same password and account lockout policies as any other AD user. It may therefore very well be possible that the AD user for a HealthMailbox has been locked out or has its password expired.

You can verify password change/failure activity from the log:

<ExchangeRootFolder>\Logging\Monitoring\Monitoring\MSExchangeHMWorker\ActiveMonitoringTraceLogs

Exclude HealthMailbox AD accounts from any password or account lockout policies, and set their password to never expire.