tag:blogger.com,1999:blog-559969103248710395.post1258937356579638284..comments2011-11-01T09:52:16.628ZJason Joneshttp://www.blogger.com/profile/06409402559050650812noreply@blogger.comBlogger29125tag:blogger.com,1999:blog-559969103248710395.post-36753365080762387692011-10-31T08:11:54.807Z2011-10-31T08:11:54.807Z

Thanks for the useful information, I will use this along with my work.

Email Protectionhttp://chipremier.com/email_protection.htmlnoreply@blogger.comtag:blogger.com,1999:blog-559969103248710395.post-52599059648671356512010-11-30T12:26:30.883Z2010-11-30T12:26:30.883Z

Thanks Wyvern...used it for that scenario too ;)

Jason Joneshttp://www.blogger.com/profile/06409402559050650812noreply@blogger.comtag:blogger.com,1999:blog-559969103248710395.post-23421819039396597122010-11-30T12:24:28.374Z2010-11-30T12:24:28.374Z

Hi Jason,<br /><br />Thank for you info, this works with Exchange 2010 and TMG, split DNS and 1 certificate with CN=mail.domain.org &amp; SAN=mail.domain.org,domain.org,autodiscover.domain.org<br /><br />I use two IPs, one for Discover,RPC,CDP - Certificate validation point, and other for OWA &amp; ActiveSync.<br /><br />Cheers.

Wyvernhttp://www.blogger.com/profile/10337442913470001498noreply@blogger.comtag:blogger.com,1999:blog-559969103248710395.post-342361771664066192010-08-28T01:07:15.670+01:002010-08-28T01:07:15.670+01:00

Hi Eric,<br /><br />Yep, http auth combined with basic auth delegation should be fine for mobile devices.<br /><br />Cheers<br /><br />JJ

Jason Joneshttp://www.blogger.com/profile/06409402559050650812noreply@blogger.comtag:blogger.com,1999:blog-559969103248710395.post-91165237793119341372010-08-25T04:59:42.369+01:002010-08-25T04:59:42.369+01:00

Can autodiscover for ActiveSync be accomplished without using KCD, for example, if the ISA servers are not in a domain? All I care about is autodiscover for ActiveSync.

Erichttp://www.blogger.com/profile/07881982695475104835noreply@blogger.comtag:blogger.com,1999:blog-559969103248710395.post-75918956636503741752010-05-17T14:45:16.045+01:002010-05-17T14:45:16.045+01:00

Hi Aaron,<br /><br />This looks resolved now ;)<br /><br />http://forums.isaserver.org/m_2002100926/mpage_1/key_/tm.htm#2002100926<br /><br />Cheers<br /><br />JJ

Jason Joneshttp://www.blogger.com/profile/06409402559050650812noreply@blogger.comtag:blogger.com,1999:blog-559969103248710395.post-88932135651107583752010-05-14T19:18:10.146+01:002010-05-14T19:18:10.146+01:00

I did all of this; and I still get the login prompt... what&#39;s the first place I should check? <br /><br />&#39;Set-OutlookProvider&#39; do I need to do anything with that command? my EXPR is set to NULL currently... help.

Aaronhttp://www.blogger.com/profile/15442582204004678766noreply@blogger.comtag:blogger.com,1999:blog-559969103248710395.post-29423705658355613852010-03-09T20:44:24.562Z2010-03-09T20:44:24.562Z

Hi Mike,<br /><br />Wow, how many questions! ;)<br /><br />Please find answers below:<br /><br />1. I have only used this approach for Exchange 2007, so not sure about Exchange 2003. I don&#39;t think Exchange 2003 supported NTLM authentication for Outlook Anywhere, but I could be wrong here.<br /><br />2. I can confirm 100% that a non-domain member *can* connect to Exchange using Outlook

Jason Joneshttp://www.blogger.com/profile/06409402559050650812noreply@blogger.comtag:blogger.com,1999:blog-559969103248710395.post-43323813894511951092010-02-26T19:31:56.206Z2010-02-26T19:31:56.206Z

Hi Jason,<br /><br />I have multiple questions (all related to the goal of securing the corporate data by ensuring we connect via trusted client machines, bear with me...)<br /><br />1. First of all does this work with Exchange 2003? I have not been able to get confirmation on KCD working with Exchange 2003 with Outlook 2007 RPC/HTTPS<br /><br />2. Secondly, I&#39;m a little confused about the

Anonymousnoreply@blogger.comtag:blogger.com,1999:blog-559969103248710395.post-80508865068668275612010-01-21T16:34:33.113Z2010-01-21T16:34:33.113Z

&gt;&gt; Paul<br /><br />Yep, that is workable, but I prefer to use internal PKI for internal certs and public PKI for ISA certs.<br /><br />This is more manageable, felxible and cost effective in the long term...<br /><br />Cheers<br /><br />JJ

Jason Joneshttp://www.blogger.com/profile/06409402559050650812noreply@blogger.comtag:blogger.com,1999:blog-559969103248710395.post-34485790528751474002010-01-21T16:32:30.343Z2010-01-21T16:32:30.343Z

Nope, you can listen on two different public names with different certs, but send them to the same destination server name; the differing paths will be used as appropriate...

Jason Joneshttp://www.blogger.com/profile/06409402559050650812noreply@blogger.comtag:blogger.com,1999:blog-559969103248710395.post-76738428852451313412010-01-21T16:29:19.417Z2010-01-21T16:29:19.417Z

thank you for this information. quick question. if i&#39;m using a two certificates, one for owa and activesync and one for autodiscover and outlook anywhere. on the exchange server, don&#39;t i have to set up a new website for autodiscover, rpc, ews, and oab? any help would be appreciated.

allinbaby76http://www.blogger.com/profile/14419774533772619135noreply@blogger.comtag:blogger.com,1999:blog-559969103248710395.post-7618032418301143592010-01-04T14:22:42.335Z2010-01-04T14:22:42.335Z

Hi Jason,<br />Re certificates; any thoughts on using one public CA UC Certificate, for both Exchange and ISA.<br /><br />The UC certificate would be<br />email.msfirewall.org.uk with a SAN of autodiscover.msfirewall.org.uk<br /><br />If I use this this certificate on the email ISA rule, its obviously valid. If I use it for the Autodiscover rule, I believe the only consequence is the SSL setting

Paulnoreply@blogger.comtag:blogger.com,1999:blog-559969103248710395.post-64530602260135226832009-12-04T23:33:37.610Z2009-12-04T23:33:37.610Z

&gt;&gt;VileTasteOfDeath<br /><br />That is true for user objects, but for KCD to work the ISA Server computer object(s) and the published server computer object(s) MUST exist in the same domain.<br /><br />Check &quot;The Limitations: Windows Requirements Item 2&quot; in the article URL you provided...<br /><br />Cheers<br /><br />JJ

Jason Joneshttp://www.blogger.com/profile/06409402559050650812noreply@blogger.comtag:blogger.com,1999:blog-559969103248710395.post-21932494679444653532009-12-04T14:26:14.724Z2009-12-04T14:26:14.724Z

According to this article: http://technet.microsoft.com/en-us/library/cc752953.aspx <br />You can now use KCD to authenticate users cross-forest/domain with the appropriate trusts in place. You would need to be @ISA 2006 SP1 as it has a couple necessary hotfixes.

VileTasteOfDeathhttp://www.blogger.com/profile/16100393841685321873noreply@blogger.comtag:blogger.com,1999:blog-559969103248710395.post-8674673651136815852009-09-28T08:59:33.899+01:002009-09-28T08:59:33.899+01:00

&gt;&gt; Vladislav<br /><br />You sure about that?<br /><br />I have quite a few deployments where I am publishing Exchange 2007 64bit with ISA Server 2006 SP1 and then have SAN certs...are you talking about a specific problem?

Jason Joneshttp://www.blogger.com/profile/06409402559050650812noreply@blogger.comtag:blogger.com,1999:blog-559969103248710395.post-46182862045087162402009-09-27T15:04:15.562+01:002009-09-27T15:04:15.562+01:00

&quot;This configuration will negate likely problems with ISA Server 2006 pre-SP1 from reading multiple SAN entries as discussed here.&quot;<br /><br />According to my research ISA Server 2006 SP1 doesn&#39;t resolve the problem if you are using 64-bit Exchange 2007. <br /><br />Strange, there is no &quot;multiple SAN&quot; problem on non-production 32-bit Exchange 2007 SP1.<br /><br />Vladislav

Anonymousnoreply@blogger.comtag:blogger.com,1999:blog-559969103248710395.post-1616815842123129672009-08-14T15:58:13.310+01:002009-08-14T15:58:13.310+01:00

Hi Jason,<br /><br />Just re transparent authentication with non-domain joined clients.<br /><br />IE (and FF via config file) can send the credentials of the logged on user transparently if the site is in the Intranet security zone. There is no need for access to the KDC as NTLM is acceptable: http://support.microsoft.com/Default.aspx?id=258063<br /><br />Of course, for non-domain joined clients

Ken Schaeferhttp://adopenstatic.com/blognoreply@blogger.comtag:blogger.com,1999:blog-559969103248710395.post-34937528118652051992009-05-05T09:23:00.000+01:002009-05-05T09:23:00.000+01:00

&gt;&gt; Chris<br /><br />Thanks! I think this has been one of my more popular posts ;)<br /><br />Due to the way Exchange 2007 works, it is better to use ISA web server farm publishing (WSFP) than NLB fro CAS roles. You can still enable NLB for non-web service like POP3/IMAP, but WSFP is the best choice for web protocols needed for OWA, OA, EAS etc. You then use NLB VIPs for non-web services and

Jason Joneshttp://www.blogger.com/profile/06409402559050650812noreply@blogger.comtag:blogger.com,1999:blog-559969103248710395.post-15127081916013408932009-05-05T02:53:00.000+01:002009-05-05T02:53:00.000+01:00

This is an excellent article, Jason! I don't know how I would have implemented transparent authentication without your article. I do have one question... I would like to implement redundant servers, using Network Load Balancing (NLB), that host the CAS/HUB roles to provide service high availability to my users. Is there any way to do Kerberos Constrained Delegation against multiple CAS servers

Chris Bushongnoreply@blogger.comtag:blogger.com,1999:blog-559969103248710395.post-4259957086161976482008-12-17T09:04:00.000Z2008-12-17T09:04:00.000Z

&gt;&gt; Abdul<BR/><BR/>Hmmm...I&#39;m not too sure, have you actually tested this? Due to the use of KCD, I am pretty sure the machine would have to be a member of the domain in order to provide correct authentication. Not something I have tried though to be honest! ;)

Jason Joneshttp://www.blogger.com/profile/06409402559050650812noreply@blogger.comtag:blogger.com,1999:blog-559969103248710395.post-89855712239594238922008-12-16T11:26:00.000Z2008-12-16T11:26:00.000Z

I think even if you are connecting from a non-domain joined client, you should be able to achieve transparent authentication by adding the CAS and Mailbox server netbios and fqdn and saving the credentials for each of them in the local password store (start---&gt;run--&gt;control userpasswords2)<BR/><BR/>A very good and informative article. Keep up the good work!

Abdul Aziznoreply@blogger.comtag:blogger.com,1999:blog-559969103248710395.post-36068287818144131462008-11-14T14:51:00.000Z2008-11-14T14:51:00.000Z

&gt;&gt; Tim<BR/><BR/>Hey, Tim - yep, non-domain joined machines will receive an authentication prompt as there will be no transparent authentication using cached credentials. I have tested this and all works fine if you enter valid credentials in the authentication pop-up for a non-domain joined machine.<BR/><BR/>Cheers<BR/><BR/>JJ

Jason Joneshttp://www.blogger.com/profile/06409402559050650812noreply@blogger.comtag:blogger.com,1999:blog-559969103248710395.post-21399705040441160412008-11-14T00:31:00.000Z2008-11-14T00:31:00.000Z

What happens with Outlook clients on machines that are not in the domain? Do they simply get prompted for authentication, or do they not work at all?

Timhttp://www.blogger.com/profile/10940964836559789140noreply@blogger.comtag:blogger.com,1999:blog-559969103248710395.post-758195343450221822008-09-26T12:10:00.000+01:002008-09-26T12:10:00.000+01:00

Pingback: http://forums.isaserver.org/m_2002055762/mpage_2/key_/tm.htm#2002074426

Jason Joneshttp://www.blogger.com/profile/06409402559050650812noreply@blogger.com