Hi Everyone, 

   I've been having issues with clients connecting to an existing Exchange server (Getting login prompt- but not usual reason).  

We currently run Exchange 2010 with approx 200 mailboxes on the server.  Last night I renewed the certificate on the 2010 server (go daddy SAN cert, all ok) and added the cert to my new Exchange 2013 server.  I tested it with my account, and a test account approx 12 times, and had not login prompt when launching Outlook. All seemed ok, until this morning.....

This morning, most (not all) users are getting the login prompt.  We are able to get by this by inputting domain\username and Outlook opens fine and is able to connect.  No users are on the Exchange 2013 server yet (only 1 test account) 

I've been googling all morning and I'm not seeing anything directly relating to my issue.  I've read about the Anon vs Negotiate issues (KB2834139) - But - the strange thing is all clients are set to negotiate network security (And encrypt data) This is opposite of what the MS article says.  CLients are all Outlook 2010 

Here are my outlook anywhere settings: 

ServerName               : exchange2010
IISAuthenticationMethods : {Basic}

ServerName               : exchange2013A
IISAuthenticationMethods : {Basic, Ntlm}

ServerName               : exchange2013B
IISAuthenticationMethods : {Basic, Ntlm}

Identity                          ClientAuthenticationMethod IISAuthenticationMethods
--------                          -------------------------- ------------------------
exchange2010\Rpc (Default Web Site)                        Basic {Basic}
exchange2013a\Rpc (Default Web Site)                       Ntlm {Basic, Ntlm}
exchange2013b\Rpc (Default Web Site)                       Ntlm {Basic, Ntlm}

If I change the Exchange 2010 server to NTLM, will this resolve what I'm seeing? And do I need to restart RPC Client Access and Transport Service to make changes take effect? Or reboot the whole server? 

If you need more info or logs please let me know

Thank you for any help! 

-Jeff

Hi,

Please confirm if the Login prompt issue occurs when users open the Outlook client at first time after renewing Exchange certificate or happens when opening the Outlook every time.

I noticed that the user can connect to Exchange server after inputting domain\username. Please confirm if the issue happens to external users who use Outlook Anywhere. For Outlook Anywhere coexistence, please choose NTLM for IIS authentication.

Set-OutlookAnywhere -Identity "exchange2010\Rpc (Default Web Site)" -IISAuthenticationMethods Basic,Ntlm

Regards,

If the Exchange 2013 server is holding CAS role, it will publish itself to AD so that Outlook connect to this server for AutoDiscover although there is no mailbox hosted there.

A quick solution is to disable it for autodiscover,

Set-ClientAccessServer <Exchange2013CAS> -AutoDiscoverServiceInternalUri $null