XWEB: Warning Message: This Page Contains Both Secure and Nonsecure Items (269348)

SYMPTOMS

When a user on a Microsoft Windows 2000-based computer uses Microsoft Internet Explorer 5 or later to gain access to Microsoft Outlook Web Access, the user may receive the following security warning message:

This page contains both secure and nonsecure items,
Do you want do display the nonsecure items?

If the user clicks Yes, the user receives the following error message in one of the panes:

The page cannot be displayed

The user may also receive the following error message:

Unable to display folder. An internal server error occurred.

CAUSE

This issue can occur if the Exchange 2000 Server virtual directory is set up to use Secure Sockets Layer (SSL) and Kerberos authentication (Integrated Windows authentication). This method of authentication depends on time synchronization between the client and the server. The difference in the time on the two computers must be no more than a five minutes. Time zone differences do not affect this method of authentication, because these differences are already accounted for.

RESOLUTION

To resolve this issue, synchronize the time on the client computer with the time on the server. To do so automatically, set up an authoritative time server. For additional information about how to set up an authoritative time server, click the article number below to view the article in the Microsoft Knowledge Base:

216734 How to Configure an Authoritative Time Server in Windows 2000

WORKAROUND

To work around this issue, disable Integrated Windows authentication on the Exchange 2000 virtual directory by using Internet Services Manager:

Click Start, point to Programs, point to Administrative Tools, and then click Internet Services Manager.
Locate the Exchange 2000 virtual directory.
Click Exchange, click Action, and then click Properties.
Click the Directory Security tab.
Under Anonymous access and authentication control, click Edit.
Click to clear the Integrated Windows authentication check box, and then make sure that either the Basic or Digest authentication for Windows domain servers check box is selected.

MORE INFORMATION

If a user on a Windows 2000-based computer uses Internet Explorer 5 or later to authenticate against a Microsoft Internet Information Service (IIS) 5.0 resource that has Integrated Windows authentication enabled, a negotiate procedure is performed, and Kerberos authentication is likely to be used. Kerberos authentication requires time synchronization, as a method of protecting against replay attacks.