Sign in with Microsoft
Sign in or create an account.
Hello,
Select a different account.
You have multiple accounts
Choose the account you want to sign in with.

Symptoms

Assume that you use the following command to enable Integrated Windows Authentication or Basic Authentication:

Set-OwaVirtualDirectory “CAS1\owa (Default Web Site)” -WindowsAuthentication $true -BasicAuthentication $trueSet-ECPVirtualDirectory “CAS1\ecp (Default Web Site)” -WindowsAuthentication $true -BasicAuthentication $true

After you do this, FormsAuthentication is displayed as disabled in the Outlook Web Access (OWA) and Exchange Control Panel (ECP) virtual directories:

ClientAuthCleanupLevel : High
BasicAuthentication : True
WindowsAuthentication : True
DigestAuthentication : False
FormsAuthentication : False
LiveIdAuthentication : False
AdfsAuthentication : False
OAuthAuthentication : False
ExternalAuthenticationMethods : {Fba}However, clients keep encountering forms-based authentication (FBA) when they try to log on to OWA or ECP.

Note Clients can log on successfully after they provide the correct credentials.

Resolution

To resolve this issue, install the following cumulative update:

2936880 Cumulative Update 5 for Exchange Server 2013

Workaround

To work around this issue, make sure that you specify -FormsAuthentication $false when you disable FBA and enable other authentication types in the OWA or ECP virtual directories. To do this, follow these steps:

  1. Enable forms-based authentication.

    • For OWA, run the following command:

      Set-OwaVirtualDirectory -Identity "CAS1\owa (Default Web Site)" -FormsAuthentication $True

    • For ECP, run the following command:

      Set-ECPVirtualDirectory -Identity "CAS1\ECP (Default Web Site)" -FormsAuthentication $True

  2. Enable the authentication type that you want, and specify -FormsAuthentication $false.

    • For OWA, run the following command:

      Set-OwaVirtualDirectory -Identity "CAS1\owa (Default Web Site)" -FormsAuthentication $False -WindowsAuthentication $true -BasicAuthentication $true

    • For ECP, run the following command:

      Set-ECPVirtualDirectory -Identity "CAS1\ECP (Default Web Site)" -FormsAuthentication $False -WindowsAuthentication $True -BasicAuthentication $True

  3. Perform an IISReset operation. For more information about how to do this, see How to restart IIS.

Need more help?

Want more options?

Explore subscription benefits, browse training courses, learn how to secure your device, and more.

Communities help you ask and answer questions, give feedback, and hear from experts with rich knowledge.

Was this information helpful?

What affected your experience?
By pressing submit, your feedback will be used to improve Microsoft products and services. Your IT admin will be able to collect this data. Privacy Statement.

Thank you for your feedback!

×