You publish Microsoft Exchange MAPI or other remote procedure call (RPC) services by using a rule in Microsoft Internet Security and Acceleration (ISA) Server 2004, Enterprise Edition. However, an RPC client that uses Kerberos authentication in this situation cannot authenticate with the published server. If you perform a network trace, you determine that ISA Server closes the RPC connection immediately after it receives an RPC Alter Context packet.

Back to the top

This problem occurs because RPC protocol validation in ISA Server 2004 Enterprise Edition does not correctly identify and handle the RPC Alter Context packet. Therefore, ISA Server closes the connection.

Back to the top

To resolve this problem, install the hotfix that is described in the following Microsoft Knowledge Base article:

Back to the top

To temporarily work around this problem, configure the messaging client to use Windows authentication (NTLM). To configure Microsoft Office Outlook 2003 to use Windows authentication, follow these steps:

1.	In Control Panel, double-click Mail.
2.	In the Mail Setup dialog box, click E-mail Accounts, click View or change existing e-mail accounts, and then click Next.
3.	In the Name list, click the Exchange server name, and then click Change.
4.	Click More Settings, and then click the Security tab.
5.	In the Logon network security list, click Password Authentication (NTLM).
6.	Click OK, click Next, and then click Finish.
7.	Click Close to exit the Mail Setup dialog box.

Back to the top

Microsoft has confirmed that this is a problem in the Microsoft products that are listed in the "Applies to" section.

Back to the top

In an environment where the client can communicate with the Kerberos Key Distribution Center (KDC) and where the client can access internal DNS servers, the client may use Kerberos authentication. This behavior may occur if the following conditions are true:

•	A service or program that uses RPC is located behind ISA Server 2004. Additionally, this service or program is published by using a server publishing rule.
•	The client computers are members of the internal domain.

For more information, click the following article number to view the article in the Microsoft Knowledge Base:

Back to the top