When a user first logs into his windows user profile and loads Outlook 2016, the Outlook profile setup wizard starts, and the user is only expected to click 'next' a few times to get it setup automatically and correctly.
*Please note that this was functioning as expected prior to an office update probably 6 or more months ago.
The problem that occurs is our email service provider (1and1) or Outlook does not initially except the login credentials passed through the Outlook 2016 autodiscover process on the Outlook Profile setup/wizard. It requires the user to enter their credentials a minimum of 3 or more times. This is for users that load their account/profile for the first time.
Environment and Info:
I have domain connected windows 10 client computers with the user account(s) stored on the active directory server and MS Outlook 2016 MSI installation deployed. The email domain/account is not the same as the AD FQDN, nor is it a Office365 account. It is 1and1's standard email service. I have the user information and email address on AD. When the user opens Outlook for the first time, the profile setup wizard runs. As the user goes through the setup, the wizard prefills the email address from AD and the autodiscover process begins, as expected. On the third step, "Log onto server" the login prompt for the 1and1 account pops up. The user provides their password (the email address is already filled in) and submits it. However, the prompt keeps returning. I have tested this and if you select "Save password" it will ask a total of 3 times until it accepts it and is saved.
To my understanding, the auto-discovery process will pull the connection settings from the autdiscover.xml file and then pass the user's windows account credentials as it did before. When looking at the log, it appears to find the autodiscover.xml file off the 1and1 server and load the settings, but fails authentication. Does anyone have an idea what is going on? Is there a workaround or way to force a particular auth protocol for the user/pass?
I was trying a few settings in group policy for the authentication process, but it appears the settings are only for Exchange/Office365.
Any help or direction to find a solution is appreciated.
I attempted to perform the answer below suggested by Magnus, but this dialog box is not available when no Outlook profile exists at the time user users load Outlook. However, I setup a test GPO for a specific user/machine in our network and with the following settings:
User Config > Admin Templates > MS Outlook 2016 > Account Settings > Exchange > Authentication with Exchange Server set to NTLM
User Config > Admin Templates > MS Outlook 2016 > Account Settings > Exchange > RPC Proxy Authentication Setting set to NTLM
With these set, still not go. Once again it prompts the user 3 times with the login credentials. I did read an article somewhere (cant find it on google) that with the current Outlook 2016 version with updates, it is heavily dependant on what is set in autodiscovery. I am assuming that it is looking for the protocol in autodiscovery (if it exisits) regardless of what I set in my test GPO.
With that said, I am including the log and result data from the 'Test Autoconfig Tool' in Outlook. Please reference below and let me know if anyone has any suggestions. I am thinking I might have to create my own xml response somehow.
<?xml version="1.0" encoding="utf-8"?> <Autodiscover xmlns="http://schemas.microsoft.com/exchange/autodiscover/responseschema/2006"> <Response xmlns="http://schemas.microsoft.com/exchange/autodiscover/outlook/responseschema/2006a"> <User> <DisplayName>FirstName LastName (email@example.com)</DisplayName> <AutoDiscoverSMTPAddress>firstname.lastname@example.org</AutoDiscoverSMTPAddress> </User> <Account> <AccountType>email</AccountType> <Action>settings</Action> <Protocol> <Type>IMAP</Type> <LoginName>email@example.com</LoginName> <Encryption>SSL</Encryption> <Port>993</Port> <Server>imap.1and1.com</Server> <SPA>off</SPA> <TTL>0</TTL> </Protocol> <Protocol> <Type>POP</Type> <LoginName>firstname.lastname@example.org</LoginName> <AuthRequired>on</AuthRequired> <Encryption>SSL</Encryption> <Port>995</Port> <Server>pop.1and1.com</Server> <SPA>off</SPA> <TTL>0</TTL> </Protocol> <Protocol> <Type>SMTP</Type> <LoginName>email@example.com</LoginName> <Encryption>Auto</Encryption> <Port>587</Port> <Server>smtp.1and1.com</Server> <SPA>off</SPA> <UsePOPAuth>on</UsePOPAuth> <TTL>0</TTL> </Protocol> </Account> </Response> </Autodiscover>