Recommendation: Enabling Kerberos Authentication for MAPI Clients

Hi.

There is one caveat with http/ SPNs. Documentation says "For Exchange Web Services and the Autodiscover service", but there are more things with integrated auth, which are usualy accesed with same hostname - OAB, Exchange, Exchweb and Public virtual directories.

Since those virtual directories runs in ApplicationPoolIdentity context (in DefaultAppPool), kerberos authentication will fail if http/ SPN is set for service account. So typicaly Outlook 2007 and higher will throw authentication window during OAB download unless your OAB url uses different hostname than EWS/Autodiscover url. Solution could be to change DefaultAppPool context to the service account, but then password generation feature of the ASA script cannot be used.

d.