RPC clients cannot use Kerberos authentication to authenticate with a server that you publish behind ISA Server 2004, Enterprise Edition

You publish Microsoft Exchange MAPI or other remote procedure call (RPC) services by using a rule in Microsoft Internet Security and Acceleration (ISA) Server 2004, Enterprise Edition. However, an RPC client that uses Kerberos authentication in this situation cannot authenticate with the published server. If you perform a network trace, you determine that ISA Server closes the RPC connection immediately after it receives an RPC Alter Context packet.

This problem occurs because RPC protocol validation in ISA Server 2004 Enterprise Edition does not correctly identify and handle the RPC Alter Context packet. Therefore, ISA Server closes the connection.

To resolve this problem, install the hotfix that is described in the following Microsoft Knowledge Base article:

To temporarily work around this problem, configure the messaging client to use Windows authentication (NTLM). To configure Microsoft Office Outlook 2003 to use Windows authentication, follow these steps:

1. In Control Panel, double-click Mail.
2. In the Mail Setup dialog box, click E-mail Accounts, click View or change existing e-mail accounts, and then click Next.
3. In the Name list, click the Exchange server name, and then click Change.
4. Click More Settings, and then click the Security tab.
5. In the Logon network security list, click Password Authentication (NTLM).
6. Click OK, click Next, and then click Finish.
7. Click Close to exit the Mail Setup dialog box.

Microsoft has confirmed that this is a problem in the Microsoft products that are listed in the "Applies to" section.

In an environment where the client can communicate with the Kerberos Key Distribution Center (KDC) and where the client can access internal DNS servers, the client may use Kerberos authentication. This behavior may occur if the following conditions are true:

• A service or program that uses RPC is located behind ISA Server 2004. Additionally, this service or program is published by using a server publishing rule.
• The client computers are members of the internal domain.

For more information, click the following article number to view the article in the Microsoft Knowledge Base: