Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I/we have a problem with our Windows Server 2008 forest and Exchange. We are buying Exchange hosting from another firm and Exchange Server is in their Windows Server 2008 forest. So, we have two forests and there isn't any trusts between these two forests. Our own forest logon name is and we also use the same email address to logon to the Exchange mailbox.

Everything works fine if both our AD account and Exchange mailbox account have the same password, but if the passwords don't match, our AD account gets locked out. I have tried to figure out why Outlook sends false logon attemps to our AD. If someone can help, please do.

share|improve this question
Something weird going on with the two ADs. Try an experiment .. use a different username on the local network, and see what happens. – tomjedrz Aug 26 '09 at 20:19
Tried that, everything works fine when username isn't same as our case it's email address. – Down Town Aug 26 '09 at 20:22
Please post some details about how the Exchange account is configured in Outlook .. perhaps screen shots of the profile screens. – tomjedrz Aug 26 '09 at 20:45

As your usernames are the same, this is going to be a problem. Outlook will first attempt single sign-on by using the currently logged in user's credentials. As the username matches that as the one in the other forest, you are going to get account lockouts when the passwords do not match.

Ideally, you would create a trust relationship between forests and then give your users Full Access to the mailboxes in the Exchange forest.

If that is not possibly, you could try forcing Outlook to prompt for logon credentials every time it is opened by checking the box below (Advanced settings on the mailbox setup in Outlook).

Outlook prompt for logon

I guess a last option would be to rename the accounts (or use a different UPN) in one of the domains.

share|improve this answer

Clearly Outlook is confused about the domains. I suggest that you try and authenticate to the Exchange server without the "". I suspect that Outlook is interpreting that to mean that the user authenticates in the domain, which it knows all about!

share|improve this answer

Outlook first tries with the credentials used to sign in to the PC. If the username matches that in AD, but different password then it will lock the account.

See also Unexpected Account Lockouts Caused When Logging On to Outlook from an Untrusted Domain.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.