Why are Outlook Anywhere proxy settings mysteriously getting changed on Outlook 2007 clients?

Why do you want "Only connect to proxy servers that have this principal name in their certificate" to not be selected?

I guess I don't have a reason to not select the specific proxy server, our consultant that helped configure this to begin with told us not to check that box. I just tried it on my machine and making it use our certificate works fine so I guess we can leave that checked.

The CAS servers are configured for NTLM authentication, as our the clients by default.  Something is causing the clients to flip over to Basic authentication (which we don't want).

Is there settings in Autodiscover that I should be looking for as to why it would be making these changes?

Thanks for helping with this.

You don't configure AutoDiscover yourself. It builds the settings automatically based on information in the domain. It all happens in the background.

What does Get-OutlookAnywhere say for external authentication method?

Simon.

--
Once your question has been answered, please remember to accept an answer and close the question.

Both CAS servers say Ntlm for ExternalAuthenticationMethod in the EMS

I have a hunch the issue pops up when people are connected to Outlook Anywhere via the Internet and then establish a VPN session. I doubt that is the root cause but that seems to be a common factor when people come in the office after being on the road reporting that Outlook is mysteriously prompting for a password for some reason (aka, authentication changed to Basic in their profile settings).

Are you doing anything different internally compared to external traffic? Would autodiscover find different information internally?

Simon.

--
Once your question has been answered, please remember to accept an answer and close the question.

I don't believe so - is there anyway that I can test this to confirm?

We use the same hostname internally and externally for the Outlook Anywhere hostname.  The autodiscover hostname resolves to an internet address externally and to the CAS servers internally.  I assume that is the way it should be set up right?

The only way to really confirm if things are different internally from externally is to see how Outlook is setup when it is left to its own devices. The Autodiscover tool in Outlook can also help in some ways.

It sounds like it is correct, but it is an issue I haven't seen before, so I am not really sure where to start looking. I have a good idea what the problem is, but not the fix.
This is probably caused by the limited use of Outlook 2007, Exchange 2007, autodiscover and Outlook Anywhere. The main people who are using it are the hosted providers, but they will want Basic authentication because the clients are not members of the domain.

Simon.

--
Once your question has been answered, please remember to accept an answer and close the question.

What do you think the problem is?  it works fine for a lot if people but at some point the authentication is getting flipped in the client profile.  Is there anyway for us to lockdown a profile to prevent the changes?

Thanks for taking the time to help with this - we usually don't implement cutting edge stuff because of wierd issues like this. :)

I have no idea why the setting is being changed. You cannot lock down the profile because that defeats the object of AutoDiscover. It is designed to update Outlook on the fly so that the administrator doesn't have to.

From the clutching at straws list, I am just wondering if something is getting confused with the clients being off site and that if forcing the setting to change.

Simon.

--
Once your question has been answered, please remember to accept an answer and close the question.

It sounds like autodiscover's not being reached when they're off of your network.  The settings you're describing are the defaults that outlook assumes based on the user's smtp address.  Do you have a URL simplification in place for your OWA URL?  The method given on technet has the side effect of cutting off autodiscover (and everything else)  for clients that are not on your DNS domain.  

In case anyone runs into this I opened a SA ticket with Microsoft and we figured out the problem.  On one of our CAS servers the Server parameter for the EXPR Outlook Provider was set.  On the other server it was not defined so AutoDiscover kicked in.  Apparently if you provide a static value for the Outlook Provider, even if it is correct, it will stop AutoDiscover from kicking in.  When somoene hit this CAS server they would default down to Basic authentication since AutoDiscover wouldn't kick in and tell it NTLM.

Our CAS servers likely fell out of synch during deployment and testing.  Oh well, glad this one is behind us, thanks for everyones help.