Software

Ask something
Discussion Locked

Sec Pass Authen Outlook Expr/ Xchg 5.5

0 helpful
5 replies

by kymmie

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

Recently we have tried to enforce Secure Password Authentication and have run into a problem.

When using Outlook Express (configured for Mary) logged into Windows 2000 under Bob, the e-mail for Bob comes into the Outlook Express account. Nowhere in the Outlook Express configuration do you see information for Bob's account, so I am thinking the Secure Password Authentication is looking at the cached credentials of Bob's account.

We would like to find a workaround and understand why this is happening. Creating a different profile is not an option. Thanks.

The Outlook Express account is popping an Exchange 5.5 server.

5 replies

by brasslet

I think your problem is you have Windows NT challenge/response authentication enabled. To check, open the properties of the POP3 protocol in the Exchange Administrator program. Click on the Authentication tab. You will see a dialog box, if Win NT challenge/response is checked (the default), I think you'll see the behavior you mention. You can go to Basic authentication to eliminate this.

by kymmie

I want to use the Win NT challenge/response because of security and this is what I would like to enforce. Thanks.

by brasslet

Well, to put it a different way: the behavior you're seeing is by design. NT Challenge uses the computer logon credential for authentication, and assumes the mailbox alias is the same as the username. This is how SPA works.

You could use Basic/SSL authentication instead, which protects password and data and would display the behavior I believe you're looking for. A bit of a hassle to setup, but it may the ticket for you.

There may be other ways to accomplish this as well, depending on why one user is opening the mailbox of another. Perhaps your user could use a MAPI client to open both mailboxes? The more info we have, the more likely someone could offer a good workaround.

This discussion is closed to new replies.