Outlook 2013 NTLM GPO

I have a exchange 2010 server and outlook clients using outlook 2013.
I've noticed that Outlook 2013 prompts many times for credentials if basic authentication is set. NTLM however does not seem to prompt so much.
I tried to set the GPO in the outlook 2013 template "Microsoft Outlook 2013-Account Settings-exchange-Authentication to exchange server to force NTLM but, it does NOT change on the client.
The GPO is user based and I filtered the GPO based upon just a few test users.
Any Ideas?

You no need to configure any Outlook template on GPO.
Your Exchange is 2010 right? so this is for outlook anywhere right?
If you want your clients connect via NTML authen for outlook anywhere , you just logon to Exchange Management Console and then on OutlookAnywhere setting >> change Authentication to NTLM (by default is "basic authen")..
After that just waiting for autodiscover process and clients will change it to NTLM by automatically.

Similar Messages

Outlook 2013 NTLM

I have a exchange 2010 server and outlook clients using outlook 2013.
I've noticed that Outlook 2013 prompts many times for credentials if basic authentication is set. NTLM however does not seem to prompt so much.
I tried to set the GPO in the outlook 2013 template "Microsoft Outlook 2013-Account Settings-exchange-Authentication to exchange server to force NTLM but, it does NOT change on the client.
The GPO is user based and I filtered the GPO based upon just a few test users.
Any Ideas?

It is enabled yes.
[PS] C:\Windows\system32>Get-ClientAccessServer | fl OutlookAnywhereEnabled,AutoDiscoverServiceInternalUri
OutlookAnywhereEnabled         : True
AutoDiscoverServiceInternalUri : https://owa.costandcompliance.com/Autodiscover/Autodiscover.xml
OutlookAnywhereEnabled         : True
AutoDiscoverServiceInternalUri : https://owa.costandcompliance.com/Autodiscover/Autodiscover.xml
OutlookAnywhereEnabled         : True
AutoDiscoverServiceInternalUri : https://owa.costandcompliance.com/Autodiscover/Autodiscover.xml
[PS] C:\Windows\system32>Get-AutodiscoverVirtualDirectory | fl InternalAuthenticationMethods,MetabasePath
InternalAuthenticationMethods : {Basic, Ntlm, WindowsIntegrated, WSSecurity}
MetabasePath                  : IIS://CCA-EXCHTNJ1.CCACloud.local/W3SVC/1/ROOT/Autodiscover
InternalAuthenticationMethods : {Basic, Ntlm, WindowsIntegrated, WSSecurity}
MetabasePath                  : IIS://CCA-EXCHTNJ3.CCACloud.local/W3SVC/1/ROOT/Autodiscover
InternalAuthenticationMethods : {Basic, Ntlm, WindowsIntegrated, WSSecurity}
MetabasePath                  : IIS://CCA-EXCHTNJ2.CCACloud.local/W3SVC/1/ROOT/Autodiscover

OUTLOOK 2013 - Calendar GPO / GPO Partial apply

Hello,
I got problem with the application of the gpo in order to tune new outlook 2013.
I've download and added to the central store microsoft office 2013 ADMX. The issue is:
-I've created GPO for office users, as I can check with gpresult.exe the policy is well applied to users.
-Part of GPO is applied : like to disable weather module in calendar.
-I've noticed that following part of the GPO is not applied: First day of week" / add week number on calendar / first week of year.
I've check in registry " HKCU \ Software \ Policies \ Microsoft \ Office \ 15.0 \ outlook \ option \ calendar " and dword firstwoy / weeknum ... are here and set to 1.
Somebody notice the same issue & have any idea to solve this ?

Hi,
It should be options instead of option in the registry:
HKCU\Software\Microsoft\Office\15.0\Outlook\Options\Calendar
Go to the registry and modify it manually, does it work?
Before doing anything to the registry keys, I suggest you back it up, or serious problems may occur.
http://windows.microsoft.com/en-US/windows7/Back-up-the-registry
Thanks,
Melon Chen
Forum Support
Come back and mark the replies as answers if they help and unmark them if they provide no help.
If you have any feedback on our support, please click
here

How to disable attachment preview in Outlook 2013 - group policy

How do I disable attachment preview in Outlook 2013 in GPO?

Hi,
We may follow the steps below to disable attachment preview in Outlook 2013:
1. Download
Office 2013 Administrative Template files, and then follow the instructions in the "Loading the ADMX templates" section of the
Use Group Policy to enforce Office 2010 settings article to load the ADMX templates.
2. Navigate to User Configuration > Administrative Templates > Microsoft Outlook 2013 > Outlook Options > Preferences > Email Options
3. Double-click Do not allow attachment previewing in Outlook from the right pane.
4. Select Enable bullet.
5. Click OK.
6. Run gpupdate /force command to force an update of GPO settings.
7. Start Outlook and you should see the attachment previewing feature is disabled.
Regards,
Steve Fan
TechNet Community Support
It's recommended to download and install
Configuration Analyzer Tool (OffCAT), which is developed by Microsoft Support teams. Once the tool is installed, you can run it at any time to scan for hundreds of known issues in Office
programs.

Exchange 2013 SP1 On-prem - Disable Outlook Anonymous NTLM?

I'm aware there is a Group Policy admin template available to force Outlook to request only NTLM or basic authentication, however, I'd like to disable Outlook Anonymous NTLM on the server side in our Exchange 2013 SP1 on-premises installation.
Is there a method to disable Anonymous NTLM for Outlook client connections for the cas or organization? I've tried the "Set-OutlookAnywhere" InternalClientAuthenticationMethod and ExternalClientAuthentcationMethod but Outlook is still
able to connect with Anonymous Authentication selected for the logon network security.
Thanks
John Lowery

Hi Jim,
No luck. I checked the CAS Default Web Site\Rpc Authentication and the MBX Exchange Back End\Rpc as well, and both have Anonymous Authentication disabled. However, Exchange still allows Outlook to establish Anonymous NTLM connections.
My understanding is that the Authentication controls for the web site do not control the Outlook RPC over HTTP connection.
I have been able to use an administrative template to force Outlook clients to avoid Anonymous NTLM, but I would prefer to enforce it on the CAS or MBX, because doing it on the client side causes Office 365 Exchange connection failures - there's no way to
specify connection restrictions only for on-premises servers. See
http://support.microsoft.com/kb/2975918.
Thanks,
John

Outlook 2013 continually prompting for credentials on new domain

Greetings,
I first posted this in the Office365 community forums and was directed here.
We are experiencing an issue where Outlook 2013 (Office365 install) is prompting for user credentials every time it is opened, despite checking the option to remember the credentials. So far we've tried a number of troubleshooting steps, but nothing
has resolved the issue. The issue is happening to multiple users on multiple computers.
We are running:
Outlook 2013 (32-bit) (Office 365 install)
Windows 7.1 Professional (x64)
Computer is domain joined (Server 2012 R2 Domain Controllers)
Mail is hosted on Office 365
We've tried:
Clearing the Outlook and Office credentials from Credential Manager.
Removing the mail profile and the saved credentials from Credential Manager, then re-adding the mail profile.
We've tried adding the mail profile with both a manual configuration of the server settings and allowing Outlook to automatically configure them.
Ensuring that "Always prompt for logon credentials" is unchecked.
Setting "Always prompt for logon credentials" to disabled via registry (see
http://support.microsoft.com/kb/2984912)
Confirming that Autodiscover is able to connect (http://www.microsoft.com/en-us/showcase/details.aspx?uuid=e8db028a-06f4-45fb-aff1-e8ac896d29c5)
Deleting the Autodiscover.xml file so that it is recreated
Doing an Online Repair of Office 365.
Reinstalling Office 365
Recreating the user's Windows profile.
Ensuring all applicable Windows updates and Office updates are installed.
Changing Proxy Authentication from Basic to NTLM (will not connect with NTLM)
The machines this is occurring on are on a new domain that we are in the process of setting up. The user accounts are still on the old domain. Cross-domain trusts are set up in both directions and all other services are working fine. GPO settings across
both domains have been set up to be identical. The issue occurs on computers that were built directly on the new domain as well as computers built on old domain and migrated over. Machines that are not domain joined or are still on the old domain are not experiencing
the issue.
If any of you could provide any insight or other steps that we could try I'd greatly appreciate it.
Thanks

Hi,
For the issue that Outlook keeps prompting for password, I usually suggest users follow the steps in this article below, but apparently you have tried almost all the steps:
Why does Outlook keep prompting for password
I've seen some similar issues that were caused by an old "network driver", which for some reason caused a wrong server name to propagate up from the network layer to the application layer. Updating the network driver would fix the issue, I'm
not sure if this works in your scenario though.
Regards,
Melon Chen
TechNet Community Support
It's recommended to download and install
Configuration Analyzer Tool (OffCAT), which is developed by Microsoft Support teams. Once the tool is installed, you can run it at any time to scan for hundreds of known issues in Office
programs. Please remember to mark the replies as answers if they help, and unmark the answers if they provide no help. If you have feedback for TechNet Support, contact
[email protected]

Fully automated Outlook 2013 with Exchange 2010 client setup

Hi,
I'm trying to create a situation where a user fires up Outlook 2013 for the first time and the Exchange account is configured for them without any intervention whatsoever.
I currently have it that when a user opens Outlook, they see the "Welcome to Outlook 2013" screen and they click next. They are asked if the want to setup Outlook to connect to an email account and click Next. On the next screen, there
primary SMTP address is automatically filled out, and then autodiscover takes over and configures the rest for them.
I have configured AutoDiscover correctly (including SCP), and configured a GPO with "Automatically configure profile based on Active Directory Primary SMTP address".
However, I still get that "Welcome to Outlook 2013" screen.
How do I get rid of that to make the whole process fully automated?
Many thanks,
-Mark

Hi Mark,
I have this issue before.
When we first add our accout to Outlook, we should better create a new profile manually.
I suggest removing our accout from Outlook via "Mail" and re-creating new profile.
Operation details as below:
1. Start-->Control Panel-->Mail-->E-mail Accounts...-->select your account and Remove it-->Close
2. Show Profiles...-->Add-->then configure your account again.
Hope it is helpful
Thanks
Mavis
Mavis Huang
TechNet Community Support

Windows Server 2008 R2 Terminal Server and Outlook 2013 Profile

Really hoping someone can offer some advice on this one as I have wasted far to many cycles trying to figure this out.
Company I work for recent purchased another company and we are in the process of bringing them into our network. They currently run a a 2008 R2 terminal server where all users connect to for there day to day work. A number of applications
are installed including Office 2013.
All users have Outlook 2013 configured to access their exchange server for email and this works fine.
The first step in bringing them into our fold is to add an email account for Our Exchange server without removing their existing exchange configuration or Outlook Profile. So the one profile will have both exchange accounts listed and they can
continue to get email from their server but as well email from our domain.
I created a MSP file and tested pushing this out using PDQ Deploy to a few workstations here in our office and it works fine. I then started to work on deploying in their environment. PDQ Deploy will not work as they are all terminal Services
Clients. So I tried to push out via GPO. I created the GPO Initially wanting to use a package and apply that GPO to an AD group. However it will not let me deploy a MST as a package. So I then tried moving it to a script that would
run at logon. That too is not working.
I know I could enter install mode then run the MSIEXEC.EXE \config.MSP but that takes away the ability to control the role out.
Any other ideas on how to get this done.

Hi,
Your issue seems to be out of the scope of this forum. We only focus on issue about RDS/VDI deployment, management and operations. For Oultook related issue you can ask to our MS Office Forum:
https://social.technet.microsoft.com/Forums/office/en-US/home?category=officeitpro
Thanks.
Dharmesh Solanki
TechNet Community Support
Please remember to mark the replies as answers if they help and unmark them if they provide no help. If you have feedback for TechNet Support, contact [email protected]

MAPI over HTTP not working correctly, Outlook 2013 clients prompting for credentials during profile creation or opening depending on security of virtual directory

ENVIRONMENT
-1 Exchange 2013 SP1 CU7 server with all roles that is also a hybrid server with Office 365 tenant, mailboxes are all on premise only LYNC online is being utilized right now.
-Exchange 2013 public folders
-Mix of Outlook 2013 SP1 and Outlook 2010 SP3 clients all fully update to day as of Feb 2015
Outlook anywhere is working perfectly across all clients both internally and externally using autodiscover. Both Outlook 2013 and 2010 clients can open the program and create a profile automatically via autodiscover and no additional logon prompts
are seen.
We set the internal and external mapi virtual directory URLs to a valid URL that also matches the Exchange 2013 SSL certificate. We set the security to ntlm, negotiate on the mapi virtual directory. We reset IIS and enabled mapi over http in
the org config. We run in to problems here.
Outlook 2010 clients appear to be working fine. We can create a new profile and open and close Outlook without any logon prompts and verify that MAPIHTTP and Negotiate are used to connect to Exchange.
Outlook 2013 clients are having problems. As soon as we try to create a profile it says your administrator has made a change that requires you to restart outlook and then a windows logon prompt appears. If we authenticate Outlook will open and connect.
This logon prompt should not occur. We can confirm that it is connecting via MAPI HTTP and Negotiate.
If we set the mapi virtual directory to NTLM only then a logon prompt also appears during every open of Outlook 2013. We can confirm that it is trying to connect with MAPIHTTP via NTLM in the outlook connection test screen.
I do not understand this behavior by Outlook 2013 which was supposed to be designed with MAPI HTTP in mind. I would think the same issues would occur with Outlook 2010 but they do not. I am not sure how to resolve this and I am looking for help.

I have the same problem. Exchange and Outlook are both up to date. After creating a new profile Outlook prompts for username/password. A lot of users also get this prompt while
working - the profiles have been "migrated" from Exchange server 2010. <o:p></o:p>
Niko, as i can see in your screenshot you do not have Mapi over HTTP enabled. Why? You can change settings in the security tab – if you have Mapi over
HTTP enabled all options are grayed out (please correct me if I
am wrong):
This is a very annoying thing – does anybody else have the same problem?
Any suggestions on this?
Marc

Cannot connect to an Exchange account in Outlook 2013 using "Microsoft Exchange Server or Compatible Service"

Dear All,
I cannot connect to my Exchange account in Outlook 2013 using "Microsoft Exchange Server or Compatible Service".
First I would like to present my network environment, I have 4 physical servers;
The first one is holding the Domain Controller 1, IP@: 192.168.1.10
The second server is holding the additional Domain Controller which it is DC2, IP@: 192.168.1.11
The third server is holding the Exchange 2013 Mailbox, IP@: 192.168.1.15
And the last server is holding the Exchange 2013 CAS-HT, IP@: 192.168.1.16
I am doing the steps below:
1-Creating a new profile in outlook and start configuring the exchange account by entering the IP address of the Exchange-CAS Server, 192.168.1.16
2-entering the account name: [email protected]
3-Go to "More Settings" > "Connection" > "Connect to Microsoft Exchange using HTTP" > and entering the "Exchange Proxy Settings"
4-type the exchange CAS Server URL, https://192.168.1.16
5-Check the "Connect using SSL Only"
6-Authentication Settings: "NTLM Authentication", and pressing Apply
7-When I press the "Check Name" button, a message occurred> "The action cannot be completed. The connection to Microsoft Exchange is unavailable. Outlook must be online or connected to complete this action".
8-I go back to the "Exchange Proxy Settings" and I Uncheck the "Connect using SSL Only" and pressing Apply
9-i press the "Check Name" Button, a small window occurred to enter a Username and Password, so I enter the Administrator username and the administrator password and pressing "OK", but nothing is changed, I tried to enter my
username and password in the small window and I still got the same result.
I cannot verify the account name and I cannot complete the process.
I appreciate you kind assistance.

Hi,
To narrow down the cause, I’d like to recommend the following troubleshooting:
1. Try to login the test account through OWA.
2. Check the Autodiscover settings: get-clientaccessserver |fl autodiscoverserviceinternaluri
3. Check the result of directly accessing the following URL:
https://autodiscover.domain.com/autodiscover/autodiscover.xml
Thanks,
Angela
Angela Shi
TechNet Community Support

Outlook 2013 - Calendar - weather bar

can I populate the locations with Powershell,GPO or registry settings?

Hi,
You can make this via GPO. You need to specify a custom weather service url under
User Configuration\Administrative Templates\Microsoft Outlook 2013\Outlook Options\Preferences\Calendar Options
in Group Policy.
You need to append the "weasearchstr=city" parameter to the base URL. This parameter indicates the location,
city, for which the user wants a weather forecast (for example, London).
For more reference, please refer to Weather Bar Protocol:
http://msdn.microsoft.com/en-us/library/office/jj228383(v=office.15).aspx#ol15_weatherbar_theprotocol
If you have any doubts about how to use this protocol, please seek assistance in our
Office for Developers forum.
Thanks,
Ethan Hua CHN
Forum Support
Come back and mark the replies as answers if they help and unmark them if they provide no help.
If you have any feedback on our support, please click
here

Outlook 2013 XLS Attachments cannot be opened in Excel 2013 due to Trusted Center restrictions with Outlook Secure Temp Folder

Dear all,
I'm having some serious issues with Office 2013's Trusted Center settings. In Outlook 2013 XLS Attachments cannot be directly opened in Excel 2013 with double-clicking due to Trusted Center restrictions for Excel 2013 regarding Outlook's Secure Temp Folder.
I tried to adjust the corresponding Office 2013 Administrative Template within my GPOs but to no prevail.
I did find out that Outlook 2013 places an attachment within the Outlook Secure Temp Folder located at "C:\Users\a.ollischer\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Outlook\PPIU10RW” before passing it to Excel 2013 in order to
open it. It fails due to not trusting this location though I added the corresponding path to my Trusted Locations.
What can I do in order to make this work without having to tediously save each and every attachment to "My Documents" prior to opening it? Any help would be greatly appreciated.
Alex
Alexander Ollischer Diplom-Wirtschaftsinformatiker (FH) Citrix & Microsoft Certified Engineer (CCEA, CCEE, MCSA, MCSE, MCDBA, MCTS) Afontis IT+Services GmbH Baierbrunner Straße 15 81379 München Deutschland Telefon (089) 74 34 55-0 Fax (089) 74 34 55-55
mailto:[email protected] http://www.afontis.de http://www.itganzeinfach.de Amtsgericht München, HRB 109 005 Geschäftsführer: Thomas Klimmer

Hi Maurice 7785,
Deal and customize attachment security behavior to access such kind of blocked file format. Usually, Outlook does not allow users to open such unsafe type of attachments. It means they are blocked them by default, so you need to unblock such items using REG
values.
Take more help from the similar thread:
http://social.technet.microsoft.com/Forums/en-US/53563c4b-d27f-4866-a5a8-95eb1ad1a3e6/hide-attachements?forum=outlook
Note: Improve community discussions by marking the answers helpful otherwise respond back for further help.
Thanks
Clark Kent

Client side disabling of Outlook anywhere in Outlook 2013

Hi
Our admins recently had to disable external access for Outlook while keeping ActiveSync for Mobile Clients working. This was done by placing the autodiscover service (autodiscover.ourexternaldomain.com) behind a TMG with two factor authentication, and also
putting our mail.ourexternaldomain.com behind the same TMG. So, Outlook from outside the network can't connect anymore (it will show you the login/pass prompt but what it wants is the two factor credentials, not your domain credentials.. so essentially you
can't connect anymore), and mobile client still work.
In addition, they've disabled the "Outlook anywhere" options (specifically, "Connect to Microsoft Exchange using HTTP" is not only grayed out, it is forced disabled) by GPO.
Unfortunately, that doesn't work for the handful that's already using Outlook 2013. There, even when the "Connect to Microsoft Exchange using HTTP" option is unchecked, the client will query autodiscover.ourexternaldomain.com, and eventually gets
the response containing not only the EXCH protocol (which contains the internal urls), but also the EXPR protocol containing the public urls. That in turn re-enables "Connect to Microsoft Exchange using HTTP", so now clients, even when inside the
organization will try to access the mail.ourexternaldomain.com which is behind the TMG, resulting in perpetual login prompts being displayed (the login actually comes from the TMG, not Exchange).
So, is there a way to force disable "Connect to Microsoft Exchange using HTTP" for Outlook 2013, preferably without changing anything on Exchange and the GPO. I guess I'm looking for the registry key that is set for outlook 2010. I checked up on
the GPO for Outlook 2010 and it seems it sets HKCU/Software/Policies/Microsoft/Office/14.0/Outlook/RPC/ProxyServerFlags = 0. Doing the same for Outlook 2013 (so using the Office/15.0/Outlook/RPC key) results in outlook no longer being able to connect altogether.
When I manually remove the checkbox and restart Outlook, it first connects using the internal url, then after getting autodiscover it sets the checkbox "Connect to Microsoft Exchange using HTTP" again, and since the external url can be resolved
from inside the network, I get the password prompts again even from inside the corporate network.
Is there a registry key combination that keeps outlook connecting but never using the http proxy?

Hi Stephan,
How about the suggestion from Ed.
Feel free to contact me if there is any update.
Thanks
Mavis
If you have feedback for TechNet Subscriber Support, contact
[email protected]
Mavis Huang
TechNet Community Support

Outlook 2013 ask credential for connecting to Exchange 2007

Hi,
i've a big problem into my business from about 2 weeks. We have deployed 5 new pc with Office 2013 Professional and Windows 7 professional, into our server we have exchange 2007 version 8.3 and build 83.6
Only for 1 client outlook works correctly but into other 4 client we have same problem. After open outlook 2013 is all ok and i see "connected to Microsoft Exchange" but after 2 minutes outlook always asks for password prompt. When i insert the
password the client request the same password into loop.
Despite asks for credential i receive correctly the emails.
From now i've tried this solution that i read online but none of these works correctly.
1- delete and create new outlook profile
2- I have changed the authentication to NTLM instead of Basic Authentication
3- Delete credential from Control Panel --> Credential Manager
4- Disable the setting "Always prompt for logon credentials"
5- try to change user password from owa
Other information:
User can access to owa and work correctly, autodiscover is running correctly because i setup the account with it.
I've tried to test outlook connection with press ctrl and left click into outlook taskbar.
Why outlook always ask me for credential? This is very frustrating because only 1 client works correcly.
I'm waiting for your kindly response.
Matteo

Hi Matteo,
What’s your Outlook connection status? Confirm your Protocol is RPC/TCP (internal) or RPC/HTTP (external)? Please try to configure your problematic account in the Outlook client which is the only one working correctly to check whether the issue persists.
If all other 4 accounts can work well in the “good” one client, please check whether there is any difference between the account settings in different PC.
Thanks,
Winnie Liang
TechNet Community Support

Outlook Anywhere Prompts for Credentials only for Outlook 2010, not Outlook 2013

I'm having a heck of a time with this one. We have Exchange 2010 on premise, with our filtering through EOP. Clients that are using Outlook 2010 Professional Plus are continuously getting prompted for credentials when off network and relying
on Outlook Anywhere.
I've read many threads about configuring credential manager appropriately for the internal domain and our external domain. I can get them to authenticate just fine, and email flows, but they continue to be prompted everytime they connect again.
Here is the kicker: When I install Outlook 2013 on the same computer, outlook anywhere functions just fine, no problems, no authentication prompt.
Like I said I have read a plethera of articles and threads about this, I have gone through all settings on Exchange, our edge server, our firewall, our certificate. The MSSTD string matches our "Issued To" string. NTLM authentication
is configured on both the client and the server. Appropriate settings are configured on the firewalls.
Anyone know why Outlook 2010 would have this problem, but not Outlook 2013 on the same computer, same user, same mailbox database?
Thanks in advance!!!

I'd still Echo Ed's original question.
Do you have Outlook 2010 patched up? At this time you need to be on SP1, and SP2 by October the 14th.
Also I expect you to have a recent update ontop of that as well.
http://blogs.technet.com/b/rmilne/archive/2014/04/14/office-2010-sp2_1320_-do-you-need-to-upgrade_3f00_.aspx
Cheers,
Rhoderick
Microsoft Senior Exchange PFE
Blog:
http://blogs.technet.com/rmilne
Twitter:   LinkedIn:
  Facebook:
  XING:
Note: Posts are provided “AS IS” without warranty of any kind, either expressed or implied, including but not limited to the implied warranties of merchantability and/or fitness for a particular purpose.

Outlook 2013 NTLM GPO

Similar Messages

Maybe you are looking for