PRB: IIS 4.0 Automatic Password Synchronization and CDO

• Collaboration Data Objects (CDO), versions 1.1, 1.2

SYMPTOMS

An error occurs when any or all of the following conditions are true:

• Using Active Server Pages to access an Exchange Server.
• Using Internet Information Server version 4.0.
• You are attempting to use an Anonymous Exchange mailbox.
• Internet Information Server (IIS) is set to "Allow Anonymous Access".
• Anonymous Access is set to "Enable Automatic Password Synchronization".

   Collaboration Data Objects error '000004f9'
   The information store could not be opened.
   [MAPI 1.0 - [MAPI_E_LOGON_FAILED(80040111)]]

   -or-

   401.1 Unauthorized: Logon Failed

CAUSE

This happens when you are attempting to access an Exchange mailbox that has been set up to allow Anonymous access to Exchange. This is most frequently done to allow users to send mail from a Web application using Microsoft Exchange where you do not need to or are unable to authenticate the user with Windows NT Challenge\Response Authentication (also referred to as NTLM) or Basic Authentication.

Internet Information Server (IIS) version 4.0 has an additional feature that allows for password synchronization between IIS 4.0 and the computer user accounts. Password synchronization should only be used with anonymous user accounts defined on the local computer, not with anonymous accounts remote computers. This feature will not work to authenticate an anonymous user to a remote Exchange server.

RESOLUTION

You must turn "Automatic Password Synchronization" off. To accomplish this task follow these steps:

1. Right-click the virtual server in question.

2. Select Properties.

3. Select Directory Security.

4. Select "Allow Anonymous Access" to enable the "Edit" control.

5. Select "Edit".

6. Clear the "Enable Automatic Password Synchronization" option.

7. Choose OK twice and click Apply to save the settings.

Keywords          : cdo
Version           : WINDOWS:1.1,1.2
Platform          : WINDOWS
Issue type        : kbprb