Troubleshooting Outlook Web Access logon failures in Exchange 2000 and in Exchange 2003 (327843)

RESOLUTION

To resolve these issues, make sure that you are using the correct authentication methods and that you have the correct permissions to the Exchange folders. To do this, follow these steps.

Important Because of a change in Microsoft Internet Information Services (IIS) 6.0, if Exchange 2003 is installed on a computer that is running Microsoft Windows Server 2003, you may have to enter your username in the format of domain\username, even if you entered a backslash as the default domain. To work around this issue, you may either enter the network basic input/output system (NetBIOS) name of your domain as the default domain or you can apply the hotfix that is discussed in Microsoft Knowledge Base (KB) article 827991. For additional information, click the following article number to view the article in the Microsoft Knowledge Base: Additionally, you must use a backslash as the default domain when Exchange 2003 is installed on a computer that is running Windows Server 2003 and forms-based authentication is enabled on that computer. When you modify the authentication method of Outlook Web Access, you should do so in Exchange System Manager. For additional information, click the following article number to view the article in the Microsoft Knowledge Base:

1. Modify the authentication methods for the Exchange virtual directory and for the Public virtual directory in Exchange System Manager. To do this, follow these steps:
   1. Click Start, point to Programs, point to Microsoft Exchange, and then click System Manager.
   2. Expand Servers, expand Server Name, expand Protocols, expand HTTP, and then expand Exchange Virtual Server.
   3. Under Exchange Virtual Server, right-click Exchange, and then click Properties.
   4. Click the Access tab, and then click Authentication.
   5. Click to select the Basic authentication check box if it is not already selected.
   6. In the Default domain box, type the network basic input/output system (NetBIOS) name of your domain, or type a backslash if it is not already there.
   7. Click OK two times to close the property windows.
   8. Right-click the Public virtual directory, and then click Properties.
   9. Click the Access tab, and then click Authentication.
   10. Click to select the Basic authentication check box if it is not already selected.
   11. In the Default domain box, type the NetBIOS name of your domain, or type a backslash if it is not already there.
   12. Click OK two times, and then quit Exchange System Manager.
   Note The default domain that is specified for basic authentication on the Exchange virtual directory and on the Public virtual directory must match. If the default domains do not match, you will continue to be prompted for credentials after you log on to Outlook Web Access.
   For additional information about how to configure authentication methods for Exchange 2000 Outlook Web Access, click the following article number to view the article in the Microsoft Knowledge Base:

   290341 Configuring authentication methods in an Exchange 2000 OWA virtual directory

2. Modify the authentication method for the Exchweb virtual directory in Microsoft Internet Information Services (IIS). To do this, follow these steps.
   • Microsoft Windows 2000 Server (IIS 5)
     1. Click Start, point to Programs, point to Administrative Tools, and then click Internet Services Manager.
     2. Expand Default Web Site.
     3. Right-click Exchweb, and then click Properties.
     4. Click the Directory Security tab, and then click Edit under Anonymous access and authentication control.
     5. Make sure that the Basic Authentication check box and the Integrated Windows Authentication check box are not checked, and then click to select the Anonymous access check box if it is not already selected.
     6. Click OK two times.
     7. Right-click Default Web Site, click Stop, and then click Start.
   • Microsoft Windows Server 2003 (IIS 6)
     1. Click Start, point to Administrative Tools, and then click Internet Information Services (IIS) Manager.
     2. Expand Web Sites, and then expand Default Web Site.
     3. Right-click Exchweb, and then click Properties.
     4. Click the Directory Security tab, and then click Edit under Authentication and access control.
     5. Make sure that the Basic Authentication and Integrated Windows Authentication check boxes are not checked, and then click to select the Enable anonymous access check box if it is not already selected.
     6. Click OK two times.
     7. Right-click Default Web Site, click Stop, and then click Start.
3. Grant the Authenticated Users group a minimum of Read and Execute permissions, Read permissions, and List Folder Contents permissions on the appropriate Exchange and Microsoft Windows directories.
4. To assign the correct permissions, follow these steps:
   1. In Windows Explorer, locate and right-click the Exchsrvr\Exchweb folder, and then click Properties.
   2. Click the Security tab, and then make sure that the Authenticated Users group has the following permissions:
      • Read and Execute
      • List Folder Contents
      • Read
   3. Verify that the system account has the Full Control permission on the Exchweb directory.
   4. Repeat step a through step c for the following directories:
      • Winnt\System32
      • Winnt\System32\Inetsrv
      • Winnt\System32\Wbem
      • Exchsrvr\Bin
      • Exchsrvr\RES
        
        Note You may have to restart the World Wide Web Publishing service for these settings to take effect.