0

Expected Behavior:

When a user first logs into his windows user profile and loads Outlook 2016, the Outlook profile setup wizard starts, and the user is only expected to click 'next' a few times to get it setup automatically and correctly.

*Please note that this was functioning as expected prior to an office update probably 6 or more months ago.

Error:

The problem that occurs is our email service provider (1and1) or Outlook does not initially except the login credentials passed through the Outlook 2016 autodiscover process on the Outlook Profile setup/wizard. It requires the user to enter their credentials a minimum of 3 or more times. This is for users that load their account/profile for the first time.

Environment and Info:

I have domain connected windows 10 client computers with the user account(s) stored on the active directory server and MS Outlook 2016 MSI installation deployed. The email domain/account is not the same as the AD FQDN, nor is it a Office365 account. It is 1and1's standard email service. I have the user information and email address on AD. When the user opens Outlook for the first time, the profile setup wizard runs. As the user goes through the setup, the wizard prefills the email address from AD and the autodiscover process begins, as expected. On the third step, "Log onto server" the login prompt for the 1and1 account pops up. The user provides their password (the email address is already filled in) and submits it. However, the prompt keeps returning. I have tested this and if you select "Save password" it will ask a total of 3 times until it accepts it and is saved.

To my understanding, the auto-discovery process will pull the connection settings from the autdiscover.xml file and then pass the user's windows account credentials as it did before. When looking at the log, it appears to find the autodiscover.xml file off the 1and1 server and load the settings, but fails authentication. Does anyone have an idea what is going on? Is there a workaround or way to force a particular auth protocol for the user/pass?

I was trying a few settings in group policy for the authentication process, but it appears the settings are only for Exchange/Office365.

Any help or direction to find a solution is appreciated.

--------Update 8-17-2017---------

I attempted to perform the answer below suggested by Magnus, but this dialog box is not available when no Outlook profile exists at the time user users load Outlook. However, I setup a test GPO for a specific user/machine in our network and with the following settings:

  • User Config > Admin Templates > MS Outlook 2016 > Account Settings > Exchange > Authentication with Exchange Server set to NTLM

  • User Config > Admin Templates > MS Outlook 2016 > Account Settings > Exchange > RPC Proxy Authentication Setting set to NTLM

With these set, still not go. Once again it prompts the user 3 times with the login credentials. I did read an article somewhere (cant find it on google) that with the current Outlook 2016 version with updates, it is heavily dependant on what is set in autodiscovery. I am assuming that it is looking for the protocol in autodiscovery (if it exisits) regardless of what I set in my test GPO.

With that said, I am including the log and result data from the 'Test Autoconfig Tool' in Outlook. Please reference below and let me know if anyone has any suggestions. I am thinking I might have to create my own xml response somehow.

Autodiscover Log Screenshot

<?xml version="1.0" encoding="utf-8"?>
<Autodiscover
  xmlns="http://schemas.microsoft.com/exchange/autodiscover/responseschema/2006">
  <Response
    xmlns="http://schemas.microsoft.com/exchange/autodiscover/outlook/responseschema/2006a">
    <User>
      <DisplayName>FirstName LastName (user@domain.com)</DisplayName>
      <AutoDiscoverSMTPAddress>user@domain.com</AutoDiscoverSMTPAddress>
    </User>
    <Account>
      <AccountType>email</AccountType>
      <Action>settings</Action>

      <Protocol>
        <Type>IMAP</Type>
        <LoginName>user@domain.com</LoginName>
        <Encryption>SSL</Encryption>
        <Port>993</Port>
        <Server>imap.1and1.com</Server>
        <SPA>off</SPA>
        <TTL>0</TTL>
      </Protocol>

      <Protocol>
        <Type>POP</Type>
        <LoginName>user@domain.com</LoginName>
        <AuthRequired>on</AuthRequired>
        <Encryption>SSL</Encryption>
        <Port>995</Port>
        <Server>pop.1and1.com</Server>
        <SPA>off</SPA>
        <TTL>0</TTL>
      </Protocol>

      <Protocol>
        <Type>SMTP</Type>
        <LoginName>user@domain.com</LoginName>
        <Encryption>Auto</Encryption>
        <Port>587</Port>
        <Server>smtp.1and1.com</Server>
        <SPA>off</SPA>
        <UsePOPAuth>on</UsePOPAuth>
        <TTL>0</TTL>
      </Protocol>

    </Account>
  </Response>
</Autodiscover>
0

It might be that Outlook tries to authenticate using the Negotiate method, which is using Kerberos. You can see a list of things to try here.

Outlook Anywhere is not configured to use NTLM Authentication

The Outlook Anywhere feature allows you to access your Exchange account remotely from the Internet when you are working outside your organization's firewall.

When using Outlook Anywhere to connect to your Exchange server, we need to choose the authentication method among Basic Authentication, NTLM Authentication and Negotiate Authentication. The difference among them is the way that the passwords are sent when connecting to the server. With Basic Authentication, the password is sent in clear text. Using NTLM Authenticationcan significantly reduce the number of password prompts.

To check the authentication setting, please go to File > Account Settings > Account Settings, select the Exchange account, and then click Change. In the Change Account wizard, click More Settings, and then click the Connection tab. Click the Exchange Proxy Settings button and now, you can see the settings under Proxy authentication settings. Try to change the authentication to NTLM Authentication and then check the issue again. enter image description here

  • Do you know if this setting corresponds to the GPO: User Config > Policies > Admin Templates > MS Outlook 2016 > Account Settings > Exchange > RPC Proxy Authentication Setting? I can't test it now, but will later today – user27636 Aug 14 '17 at 8:29
  • I don't know, but it certainly sounds like it.. But before you apply it in a policy, make sure to test it manually first.. – Magnus Aug 14 '17 at 8:38
  • @Magus, wasn't able to get back to this issue till now, but these proxy settings are not configurable because the Outlook profile does not exist at the time the user loads Outlook 2016. Please note that these proxy settings are available to existing accounts within the profile. However, even with the Oultook 2016 profile and account setup, the there was no 'Connections' tab within the account in my enviroment. Please reference update above for more info. – user27636 Aug 17 '17 at 22:43

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.