I'm not sure this is an Exchange problem but since for now it only pops up with webmail, I will post it here and hope that anyone has a clue...
Scenario: single Exchange 2016 environment. Split DNS in place for webmail.domain.com. Basic authentication is used for OWA. Clients are all domain joined and on the internal network. Browsers used are Internet Explorer 11, Edge and Chrome.
Symptom: when a user tries to open webmail.domain.com then a credential popup appears that keeps popping up, whether correct credentials are provided or not and no access to the mailbox is given. There are 2 workarounds for this issue:
opening autodiscover.domain.com/owa => this also gives a credential popup but login is possible and successful. Note that autodiscover.domain.com points to the exact same IP address as webmail.domain.com, namely the internal IP address of the Exchange server. Connecting on IP address also works.
opening webmail.domain.com with Chrome => this also works without problems
I have been completely stumped as to what could cause this but I have the feeling it has something to do with identity/authentication. Why?
When I open internet explorer on the Exchange server and I open webmail.domain.com then I also get a credential popup but the user ID is already filled in by the system and it is not the user ID with which I am logged in on the Exchange server. In this specific case it was filled in with the "archive" account, which is a functional account used for the journaling mailbox/archive application. So it seems that the connection to the website is being made with the wrong user instance. When I try to open autodiscover.domain.com from the Exchange server, I get an empty credential popup (no user ID is filled in) and this is how it should be I believe.
It's not the first time that I come across an issue like this: at another customer internet was blocked for most users by means of a proxy/firewall. Internet access was permitted on a per user basis. The user I used on the Exchange server had permissions to go on internet, however, sometimes my internet was still blocked and the blocking page indicated the following: "Application blocked for user "domain.local\HealthMailbox04ca435d49044cf4b4f41c48dg52641"
So here as well, access to sites was seemingly initiated by the wrong user instance. I don't know if those 2 problems are exactly the same but they do look very alike in any case.
Has anyone experienced something like this? Does anyone have an idea in which direction I can look to solve this problem or in which forum I should post this kind of issue?
Additional info: if the client computer is taken out of the domain then the problem disappears. If it is joined to the domain again, the problem appears again. Anybody an idea in which direction I need to look?
Thanks and kind regards