Okay, here is the situation.

I effectilvely have 3 offices involved.

Office A
Office 1

both different companies.

Office 1 has users sitting in Office A.  We will call these people Office 1A.

Office A has it's own domain and shares it's infrastructure with another smaller organization called Office 1A.  Office 1A's users' are using computers associated with Office A's domain; however, they use a VPN to retrieve drives and email from their parent company, Office 1.  Office 1 and Office A are in different cities.

Office A and Office 1's domains are not trusted.  Office A and Office 1 both use ISA server 2006.  There is a site-to-site VPN between Office A and Office 1 so that user's within Office 1A do not have to fire off personal VPN tunnels.  VBScripts on the users' desktops map the drives and send Office 1 domain credentials across the VPN.

So - here is where it gets confusing:

We purchased a server for Office 1A running Windows server 2008/Hyper-V.  We've replicated the shared data and installed Exchange 2007 on that server.  Those servers were built at Office 1 so that they could join the Office 1 domain, then we brought them to Office A.  This server has hard coded IP addresses, but these addresses are still within the IP range at Office 1.  The hope was to continue to allow these servers to traverse the same VPN for replication, but allow Office 1A users faster access to data files and email while onsite at Office 1.

Everything seemed to be working; however, there is a major glitch.

It appears that Office 1A users require NTLM authentication for Outlook Anywhere while at Office 1 and Basic Authentication while working remotely.  Keep in mind that when Office 1A users are out of the office at Office 1A, they use personal VPN's back to Office A, as Office A's Exchange 2007 server is the one that has Outlook Anywhere enabled on it.

Does anyone have any idea why this would be the case?