Outlook Anywhere breaks when changing Internal Auth Method to NTLM

Question

I have an Exchange 2013 environment that I'm migrating to from Exchange 2007, and many of our Outlook clients are still 2007, which means they can't save passwords by default.  We have OA published through TMG's for machines on 4 separate domains to
connect into the mail servers, which all reside on one domain.  We published this rule with Basic auth, and we've been happy, so we config'ed Exchange 2013 the same way.
Since all clients use OA to connect to Exchange 2013, our Outlook 2007 clients are now being prompted for creds every single time they open outlook.  When I try to change the internalclientauthenticationmethod to NTLM, it fixes the cred challenge for
domain members, but it breaks OA even though the externalclientauthenticationmethod is still Basic.  The internal and external host names are the same.  It's just the auth methods that differ, and both auth methods are set in IISAuthenticationMethods.
 Checking an Outlook client's proxy settings show NTLM.  If manually switched to Basic, it'll work until Autodiscover switches it back to NTLM.  The weird thing is that testconnectivity.microsoft.com tests come back no problem when using autodiscover
and basic.  Is Outlook just not smart enough to do that?
I'd attempt to use Negotiate on both, but I've read that's incompatible with Exchange 2007, and I'll users for a while trying to connect to resource mailboxes and public folders on Exchange 2007.  Is there a way to get to this to work?  If it can't
work this way, why do they even bother having separate auth methods?
Thanks!

Answer 1

Thanks.  That's what I was afraid of.
I've seen the article. We want to do preauth for OA, so we'd need to hack at it.
Alternatively, create a separate external host name and ensure the internal host name is not resolvable on the Internet. That will ensure external Outlook users will use the external name and the external auth.
Twitter!:
Please Note: My Posts are provided “AS IS” without warranty of any kind, either expressed or implied.
Yes.  Thanks.  That's what I was figuring. The problem with that is that our internal host name is the same external name that provides the entry point for EAS and EWS for a large number of users, so I'd have to rearchitect everything with the
majority of our mobile devices already using that.  It's simply not going to happen.  I'll have to hack a bit to figure out a way to make it work.  I suppose I could use legacywebmail.domain.com, which is a SAN on the cert we use for Exchange
and will now be unused during the migration, as the internal name and make it unresolvable externally. It's just ugly since Outlook clients will see that in proxy settings.  I like things neat.  
Funny how with the introduction of internal/external hostnames and auth methods, that our Exchange 2007 environment is now setup the same way I'd want our 2013 setup (same hostnames internally and externally resolvable - NTLM internal/Basic external), and
it works fine.