OWA question 1

[AndyE45]

We have a situation where OWA is setup to use the credentials of whoever's logged in to the computer to pass through. This works fine.

What we need to do now is to enable prompted logons for specific users and I was hoping there would be a way I could do it so that I don't have to disturb the current users.

I was thinking about making a copy of the web site but modified slightly so that it has a different url but still points to the same directory. On this one of course I'd enable logon prompting. I was wondering if anybody has tried something like this.

 

[Zelandakh]

What are you trying to achieve?

 

[AndyE45]

I'm trying to set it up so that OWA will prompt users to log on while others don't. I was thinking I might be able to do this if I had a parallel site on the same Exchange server but with a slightly different URL.

 

[Zelandakh]

OK, you can't have some people needing to log on and some doing NTLM.

Why do you want some people to log on?

 

[58sniper]

Probably for a shared machine(s).

The only way I can think of would involve creating another set of vdirs and assigning the authentication to those. But that would be a mess to deal with.

Pat Richard MVP
Plan for performance, and capacity takes care of itself. Plan for capacity, and suffer poor performance.

http://www.ucblogs.net/blogs/exchange/

 

[AndyE45]

58sniper,

You're almost right, we have a number of users who don't have to logon now and we'd like to leave them that way. We have another group that we want to be prompted to logon.

I know we could put up another front end server to do this but Exchange server licenses are expensive. I was hoping we could set up another site with a different URL that points to the same directory as the current production site.

If this isn't advisable or even possible I'll abandon this idea.

 

[Zelandakh]

I don't get the exact reason for them not needing to log on now but if they don't need to log on then they don't need to log on. If the other pot needs prompting then turn everyone into requiring to logon...

Does that work?

 

[AndyE45]

Zelandakh,

I'm trying to have it so that I we can have 2 different URLs pointing to the same Exchange server, one forces logons, the other doesn't. I know I could force them all to logon but that's not what I'm trying to achieve.

 

[Zelandakh]

Yes - so if it is from a security point of view then Fred wants to have to log on so uses the URL needing him to log on.

John decides to look at Fred's emails, goes to his machine and uses the URL where you don't need to log on.

If you have the option to log on or pass through, surely everyone will use the easier option?

 

[AndyE45]

These groups of users are physically separated, there is no chance that "John" can go over to "Fred's" desk and read his e-mail.

The actual point of the exercise has nothing to do with security. It's so users who are used to using the current pass through setup are not disturbed. The new group of users have shared machines and need to be able to get to their own mailbox if they have one, having them prompted for credentials is how we'd like to do it.

 

[noveyron]

Would having the new users log on locally then log on to OWA via serverip/exchange be an option that would work for you, or would it raise other issues?

 

[AndyE45]

Using the form

http://servername/exchange

is what we use now for internal users. Ideally I'd want to have a second URL like

http://servername/exchange1234

for the new set of users.

 

[58sniper]

As in my original response, you CAN create new vdirs to get you want you want. It's going to be a pain, but it can be done.

Pat Richard MVP
Plan for performance, and capacity takes care of itself. Plan for capacity, and suffer poor performance.

http://www.ucblogs.net/blogs/exchange/

 

[AndyE45]

58Sniper,

Yes, I hadn't forgotten what you posted. Would you happen to have a link with instructions for doing this?

Thanks again.

 

[Zelandakh]

Ah, things are now clearer.

The shared machines - presumably they log on as a joint account. If that has no mailbox, they would fail to connect to it and could then connect by logging on.

Or you could create new vdirs as Pat says though I've not got a doc on how to do it.

 

[AndyE45]

You've got the picture now.

As to a doc on this, if it's not available then, oh well.

Thanks for the input.

 

[mmcm888]

Here is a document on how to create a new virtual directory on Exchange 2003 - not exactly what you need (ignore the SSL stuff) but should get you started.

http://support.accessmylan.com/kb/article-56.html

 

[AndyE45]

Thanks!