Warning message: "This page contains both secure and nonsecure items"

When a user on a Microsoft Windows 2000-based computer uses Microsoft Internet Explorer 5 or later to gain access to Microsoft Outlook Web Access, the user may receive the following security warning message: If the user clicks Yes, the user receives the following error message in one of the panes: The user may also receive the following error message:

This issue can occur if the Exchange 2000 Server virtual directory is set up to use Secure Sockets Layer (SSL) and Kerberos authentication (Integrated Windows authentication).

This method of authentication depends on time synchronization between the client and the server. The difference in the time on the two computers must be no more than a five minutes. Time zone differences do not affect this method of authentication, because these differences are already accounted for.

To resolve this issue, synchronize the time on the client computer with the time on the server. To do this automatically, set up an authoritative time server. For more information about how to set up an authoritative time server, click the following article number to view the article in the Microsoft Knowledge Base:

To work around this issue, disable Integrated Windows authentication on the Exchange 2000 virtual directory by using Internet Services Manager. To do this, follow these steps:

1. Click Start, point to Programs, point to Administrative Tools, and then click Internet Services Manager.
2. Locate the Exchange 2000 virtual directory.
3. Click Exchange, click Action, and then click Properties.
4. Click the Directory Security tab.
5. Under Anonymous access and authentication control, click Edit.
6. Click to clear the Integrated Windows authentication check box, and then make sure that either the Basic or Digest authentication for Windows domain servers check box is selected.
   
   Note If you use basic authentication, passwords are transmitted in clear text. A certificate is required to enable Secure Sockets Layer (SSL) client authentication.

This behavior is by design. This is a requirement of Kerberos authentication.

If a user on a Windows 2000-based computer uses Internet Explorer 5 or later to authenticate against a Microsoft Internet Information Service (IIS) 5.0 resource that has Integrated Windows authentication enabled, a negotiate procedure is performed, and Kerberos authentication is likely to be used. Kerberos authentication requires time synchronization as a method of protecting against replay attacks.