11142 » Resolving Problems with Forms-Based Authentication (12-Jan-07)

After I enable forms-based authentication on my Exchange Server 2003 system, why does Exchange ActiveSync no longer work?

The error you describe is a side effect of the way Exchange ActiveSync and Outlook Mobile Access (OMA) are designed to work. Both components make requests against the /Exchange virtual directory. If you turn on forms-based authentication or if you require (not just allow) Secure Sockets Layer (SSL) authentication to reach that virtual directory, you might break both the Exchange ActiveSync and OMA functionality. Depending on what you want to allow and whether you're requiring SSL or using forms-based authentication, here are some things to consider:

• If you're using forms-based authentication but not requiring SSL on the back-end server, OMA will work but Exchange ActiveSync won't.
• If you're using forms-based authentication and want to require SSL on the back-end server, to make OMA work you'll have to use either Exchange System Manager (ESM) or IIS Manager to create a new virtual directory on the back-end server.
• If you're using Exchange ActiveSync and you want to use forms-based authentication or require SSL on the back-end server, you'll have to use IIS Manager to create a new virtual directory. You can't use ESM because it copies the flag indicating whether forms-based authentication should be used from the existing virtual directory. The Microsoft article "Cannot Access Exchange Server 2003 by Using Outlook Mobile Access When the Exchange Virtual Directory Requires SSL or Uses Forms-Based Authentication" (http://support.microsoft.com/?kbid=817379) explains how to use IIS Manager to create a new virtual directory.
• After you create the new virtual directory, you'll have to set the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MasSync\Parameters\ExchangeVDir registry subkey (of type REG_SZ) to point to the alternative virtual directory.

End of Article