Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I/we have a problem with our Windows Server 2008 forest and Exchange. We are buying Exchange hosting from another firm and Exchange Server is in their Windows Server 2008 forest. So, we have two forests and there isn't any trusts between these two forests. Our own forest logon name is first.surname@firm.com and we also use the same email address to logon to the Exchange mailbox.

Everything works fine if both our AD account and Exchange mailbox account have the same password, but if the passwords don't match, our AD account gets locked out. I have tried to figure out why Outlook sends false logon attemps to our AD. If someone can help, please do.

share|improve this question
    
Something weird going on with the two ADs. Try an experiment .. use a different username on the local network, and see what happens. –  tomjedrz Aug 26 '09 at 20:19
    
Tried that, everything works fine when username isn't same as our case it's email address. –  Down Town Aug 26 '09 at 20:22
    
Please post some details about how the Exchange account is configured in Outlook .. perhaps screen shots of the profile screens. –  tomjedrz Aug 26 '09 at 20:45
add comment

2 Answers 2

As your usernames are the same, this is going to be a problem. Outlook will first attempt single sign-on by using the currently logged in user's credentials. As the username matches that as the one in the other forest, you are going to get account lockouts when the passwords do not match.

Ideally, you would create a trust relationship between forests and then give your users Full Access to the mailboxes in the Exchange forest.

If that is not possibly, you could try forcing Outlook to prompt for logon credentials every time it is opened by checking the box below (Advanced settings on the mailbox setup in Outlook).

Outlook prompt for logon

I guess a last option would be to rename the accounts (or use a different UPN) in one of the domains.

share|improve this answer
add comment

Clearly Outlook is confused about the domains. I suggest that you try and authenticate to the Exchange server without the "@firm.com". I suspect that Outlook is interpreting that to mean that the user authenticates in the firm.com domain, which it knows all about!

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.