Currently have Exchange 2010 SP3 environment with load balancers. Kerberos is enabled for Outlook connectivity. All SPNs are still pointing to the Exchange 2010 exchangeASA$ account in AD. Outlook Anywhere is enabled.
Installed Exchange 2016 infrastructure in two different Active Directory sites (which are separate from the Exchange 2010 AD site). Note we have not set up an additional ASA for Exchange 2016, nor have we applied an account in the Client Access Server settings.
Exchange 2016 servers have the following settings:
MAPI Virtual Directory:
Identity : EX16-DB-01\mapi (Default Web Site)
IISAuthenticationMethods : {Ntlm, OAuth, Negotiate}
InternalAuthenticationMethods : {Ntlm, OAuth, Negotiate}
ExternalAuthenticationMethods : {Ntlm, OAuth, Negotiate}
Autodiscover:
InternalAuthenticationMethods : {Basic, Ntlm, WindowsIntegrated, WSSecurity, OAuth}
ExternalAuthenticationMethods : {Basic, Ntlm, WindowsIntegrated, WSSecurity, OAuth}
EWS Virtual Directory:
Identity : EX16-DB-01\EWS (Default Web Site)
CertificateAuthentication :
InternalAuthenticationMethods : {Ntlm, WindowsIntegrated, WSSecurity, OAuth}
ExternalAuthenticationMethods : {Ntlm, WindowsIntegrated, WSSecurity, OAuth}
LiveIdNegotiateAuthentication :
WSSecurityAuthentication : True
LiveIdBasicAuthentication : False
BasicAuthentication : False
DigestAuthentication : False
WindowsAuthentication : True
OAuthAuthentication : True
AdfsAuthentication : False
When we change DNS to point to Exchange 2016 servers, Exchange 2016 and Exchange 2010 mailbox users cannot create an Outlook 2016 profile or access their mailboxes.
If we remove “Negotiate” from the MAPI Authentication Settings (in Italiacs above), then Exchange 2016 mailbox users can create profiles and access their mailboxes. However, Exchange 2010 mailbox users still cannot access their mailboxes.
Questions:
- If we add Negotiate to MAPI Virtual Directory authentication, are we required to have ASA for Exchange 2016 set up, or will Outlook continue on and use NTLM? It appears from our issue that it MUST be set up. Is this true?
- What are the proper authentication settings for the different virtual directories listed above? If we use Kerberos with Exchange 2016 (which it appears may be the case), what should be set to Negotiate and what should be set to NTLM?
