Exchange 2k OWA only allows Admin Access

When the user opens a browser and types the address of the exchange server what message is displayed in the browser? Or if a logon prompt is displayed what message is returned when the enters their account details?

Point value changed by question poster.

I always hated OWA! I have seen this problem myself, and heard of it often.
Unfortunately, I don't know of the specific fix for it. It could be several things.

First off, Technet article 311422 states that, "In earlier versions of Microsoft Outlook Web Access (OWA), users must have the "Log on locally" right to gain access to OWA. In the Exchange 2000 version of OWA and later, this right is no longer required. The only right that users must have is the "Access this computer from the network" right, which is given to the Users group by default in Microsoft Windows 2000."

So, make sure that your domain users in your AD domain have the "access this computer from the network" right. I would NOT remove the "log on locally" right you gavethem, just to be safe!

Now, another Technet article I read (I didn't save the article #, sorry) stated to use the e-mail address for the login name when your users log in, instead of a DOMIAN\USERNAME login name. Ok. It also said to make sure that all of your e-mail accounts were unique in your mailboxes (i.e., that 2 mailboxes did NOT have the same e-mail address). If there were duplicate e-mail addresses in mailboxes, the OWA login using e-mail address as login name would not work (not to mention the e-mail problems).

Next, Technet article 317471 talks about the default NTFS permissions on the C:\Program Files\Exchsrvr folder that are needed for OWA logins to work. The article is here:
http://support.microsoft.com/default.aspx?scid=kb;en-us;317471
(please remove any spaces)

Lastly, Technet article 322309 talks of a bunch of settings for Exchange 2K and OWA. Take a look at this article also if needed:
http://support.microsoft.com/default.aspx?scid=kb;en-us;322309
(please remove any spaces)

Everyone group should have had Domain Users permission by default. I will say check you DNS configuration properly. Try creating a cache only DNS server close to the users.

Point value changed by question poster.

Try accessing the web site as follows, rather than the "normal" OWA URL:

[servername]/exchange/email alias

For example, if your server name is mail.domain.com and your email address is user@domain.com, the URL would be:

mail.domain.com/exchange/user

See if this works. I had a similar situation where this would work, but just typing the URL without the user alias wouldn't work. MS couldn't tell me why, and it mysteriously corrected itself after some time. Go figure, but I thought it might be worth a try for you, since you seem to have exhausted all the other avenues.

Additional question - are you trying to access OWA internally or from the Internet?

Hope this helps!

Point value changed by question poster.

I am not in an Exchange environment anymore, so I can't look this up to be sure. But, to view the properties of the web site virtual directory that is used by OWA, do you do that in the Exchange MMC snap-in, or in the IIS Internet Services Manager snap-in?
I am still leaning towards the account that is used for the virtual directory for OWA. I think if you changed the account used with your Administrator account, that that would then make it work.

Here is the idea. Let's say that you find the virtual directory (the directory that points to the Exchange folder where the OWA HTML files are kept) in Internet Services Manager. YOu expand the default web site. The virtual directory that points to the OWA files is there. Ok. Right-click on the virtual directory and choose Properties.
Select the Directory Security tab.
Next, click Edit in the "Anonymous access and authentication control" section.
In the "Authentication Methods" window that comes up, click Edit in the Anonymous Access portion.

You get an account listed. It should be your IUSR_Machinename account. Click the Browse button, and select your Administrator account. Type in the password for this account in the box. Click OK until all windows are closed.
Then try andconnect to OWA as a normal user.
See what happens.

So, I don't know if this virtual directory is in ISM, or if it is in the Exchange snap-in. I know you will find it. But try this and see what happens.

Good luck!

Hi

"Open User Manager. Set the focus to the local machine (the webserver,
NOT its domain). Go into the user rights dialog and grant the right 'Log
on locally' to everyone. NOTE!!!! This opens your server up to anyone
with a valid NT account to walk up to it and log in. Physical security
of the server is called for here."

there is more info from :

Appendix G - Microsoft Outlook Web Access HowTo
http://www.swinc.com/Resource/exch_faq_appxg.htm

more info from MS:

Troubleshooting Guide for Outlook Web Access

http://support.microsoft.com/default.aspx?scid=/support/Exchange/Content/Whitepapers/owa_tshoot.asp

Good luck

Mohamed

Note1:
***Very Important NOTE *********
After you copy the URL a space or a %20 maybe gets inserted in the URL when you paste it into your browser. Delete any spaces or such characters from the URL for the page to be loaded.
***Very Important NOTE *********

Have you tried creating and installing security certificates to users to allow access.

OWA works on port 80 by default(or another port you select)
First, make sure the pix is allowing port 80 in/out for the ip address of your exchange server.

Second, setup a dns record with your isp with yourdomain.com pointing to the ip address of the pix.before you do this, run the IIS lockdown tool and Microsoft Baseline security ananlyzer on you exchange server, otherwise a hacker could use port 80 to takeover your system.

try this sites for extended details.

detailed doc
http://www.mail.nih.gov/admin/exinfo/owaguide.doc

Server Configuration Checklist
MAKE SURE LOG ON LOCALLY is checked read on
This sections covers basic settings to ensure proper configuration of the Outlook Web Access components on the Exchange or IIS server. Before troubleshooting a specific error message, you may wish to check this information for items that may be missing from your installation.
 The 'Log on Locally' right - Each Windows NT account that will be accessing the Exchange Server via the Outlook Web Access client must have the Log on Locally right assigned on the IIS. The administrator can assign this right to the Everyone group or to specific groups if access restriction is needed. To assign this right to an account, follow these steps:
1. Start User Manager for Domains.
2. Click User Rights on the Policies menu.
3. In the Right list, click Log on Locally.
4. Click the Add... button.
5. In the Add Users and Groups dialog box, click the Show Users button and choose one or more user or group accounts from the Names list.
6. Click the Add button and click OK when you are finished.
7. Click OK again and exit User Manager for Domains.
Note If the IIS computer is a Member server in a Windows NT domain, you must grant the Log on locally right to the appropriate Windows NT account using the local computer's accounts database, not the domain's accounts database. To do this, start User Manager for Domains in one of the following ways before you grant the Log on Locally right to the user account:
 Log on to the IIS computer using the local computer's Administrator account and start User Manager for Domains.

Did you give your user's individual AD logon accounts and make sure they are logging on to AD?.
Just submitting different possibilities

This question was closed by the author

Called M$. Had me remove/reapply NTFS permission to Authenticated Users Group, on the exchweb, bin, and RES folders. It seemed to have work.