asked on

Outlook 2016 connections to onprem Exchange 2013 via MAPI over HTTP using NTLM auth results in constant credential prompts to appear, does not accept credentials entered.

Hello Experts. In my staging environment, I have Exchange 2013 CU18, with AD 2012 R2, and using Outlook 2016. I am testing for implementing Outlook connections to use MAPI over HTTP with NTLM auth for our production environment. Currently, Outlook is using RPC over HTTP with NTLM. I have made the required changes on the exchange server, as they relate to the MAPI virtual directory, and made the required changes to our F5 load balancer through which traffic is flowing. However, Outlook is only able to connect via MAPI over HTTP using 'Negotiate' authentication. on the mapi virtual directory, if i choose for -IISAuthenticationMethods to accept only NTLM, and OAuth, Outlook keeps prompting for credentials, and it does not accept those credentials. so Outlook is not able to connect to on-prem exchange.

for the MAPI virtual directory, for -IISAuthenticationMethods, when i select 'Negotiate' aswell, then Outlook is able to connect via MAPI, without prompting for any credentials, but is using nego* auth to connect.

On the Exchange server itself, in IIS, for the MAPI default web site IIS authentication, i've enabled Windows authentication. Why is this happening?, why is NTLM auth not working? Thanks in advance.

SOLUTION

J0rtIT

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

Start Free Trial

ASKER CERTIFIED SOLUTION

Newguy 123

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

Start Free Trial

Newguy 123

ASKER

And the script in your link seems to be for internal and external urls for virtual directories. Those all seem to be setup the right way.

J0rtIT

Sadly exchange won't work using MAPI if you haven't enabled that. So you are using the old HTTP with NTLM until you set that to true. That's the way exchange works with MAPI, don't blame it on me.

The script is to double check that your set correctly, cuz I'm pretty sure is not.

Newguy 123

ASKER

issue not resolved

J0rtIT

So did you set it to true? and it is still not working on mapi over http? or? what exactly did you do?