Outlook Authentication prompt after migrating from 2007/2013

Question

I have a very simple environment.  3 new Exchange 2013 servers in a DAG behind a load balancer.  Most users are still on Exchange 2007 environment.  Autodiscover has been configured for load balanced name.  There is no External Outlook
Anywhere connectivity.  I have NOT enabled Outlook Anywhere in the 2007 environment.  I have a simple Lync 2013 environment.  1 Server in a standard pool with no external connectivity.  I have integration with OWA 2013 and Lync working. 
All versions of Outlook are at least on the patch level required for Exchange 2013.
My issue is random password prompts in Outlook for some (not all) users with mailboxes on Exchange 2013.  This password prompt appears to be coming from the load balanced Outlook anywhere name.  I have had a few reports of users on Exchange 2007
getting an error stating they cannot open default set of folders.  If I have them exit Lync 2013 client and open Outlook again it works fine.  They can then open Lync without issue.  Closing and opening Outlook will no longer reproduce the issue. 
It seems like Lync is causing an issue here somewhere, but I have no idea where.
Lync BPA completes without any warning or errors.  All test cmdlets complete without any errors.
2013 Outlook Anywhere settings:
Name                               : Rpc (Default Web Site)
ExternalHostname                   :
InternalHostname                   : mail.company.com
ExternalClientAuthenticationMethod : Ntlm
InternalClientAuthenticationMethod : Ntlm
IISAuthenticationMethods           : {Basic, Ntlm, Negotiate}
Get-AutodiscoverVirtualDirectory|select *auth*
InternalAuthenticationMethods : {Basic, Ntlm, WindowsIntegrated, WSSecurity, OAuth}
ExternalAuthenticationMethods : {Basic, Ntlm, WindowsIntegrated, WSSecurity, OAuth}
LiveIdNegotiateAuthentication : False
WSSecurityAuthentication      : True
LiveIdBasicAuthentication     : False
BasicAuthentication           : True
DigestAuthentication          : False
WindowsAuthentication         : True
OAuthAuthentication           : True
AdfsAuthentication            : False
brian smith

Answer 1

I just could not let this go last night.  The issue was occurring when I moved a mailbox to 2013.  
2 scenarios
#1. Users mailbox moved from 2007 to 2013.  Profile has a secondary mailbox that is still on 2007. When entering Outlook they are prompted for
a password into the internally resolvable load balanced name (mail.company.com). If I remove this secondary 2007 mailbox they work fine, UNTIL they try to access anything on 2007 (calendar, Public Folder, another mailbox, etc).  When they do attempt they
are prompted for a password.
I have seemingly fixed this error by adding the external URL back to AutoDiscover on 2013 based on
http://support.microsoft.com/kb/2839517<u5:p></u5:p>.  Even though we have no intentions of using Outlook Anywhere externally.
 During this troubleshooting I also changed InternalClientsRequireSsl from false to true.  Now I have clients reporting errors in their event log “A fatal error occurred while
creating an SSL client credential. The internal error state is 10013."  I do not think changing this to require SSL, but I’m almost scared to change it because  this issue
is seemingly resolved.
#2 mailbox that is only accessed as a shared mailbox Mailbox is moved from 2007 to 2013.  Users attaching to the mailbox are still on 2007. This works perfectly fine for some.  However others receive a password prompt each time they open Outlook. 
If the 2013 mailbox is removed from their outlook profile they receive no prompt.  If I manually remove the mailbox from their profile and add it back the prompts go away.  I have not been tracking client versions, but these last 4 are running 12.0.6691.5000. 
I also noticed in checking the connection status all 2007 references are using [Nego] for authentication and mail.company.com is using NTLM.  Is this normal?  This is the same in my test environment, but I can’t replicate this issue in my test environment
either.
I’m very stumped.
2013 Outlook anywhere config:
ExternalClientAuthenticationMethod : Ntlm
InternalClientAuthenticationMethod : Ntlm
IISAuthenticationMethods           : {Basic, Ntlm, Negotiate}
SSLOffloading                      : True
ExternalClientsRequireSsl          : True
InternalClientsRequireSsl          : True
2007 Outlook anywhere config:
ExternalClientAuthenticationMethod : Ntlm
InternalClientAuthenticationMethod : Ntlm
IISAuthenticationMethods           : {Basic, Ntlm}
SSLOffloading                      : True
ExternalClientsRequireSsl          : True
InternalClientsRequireSsl          : False
brian smith