HTTP 401 Unauthorized: OWA/ECP Auth Loop - Fix Guide 2025

# Browser console shows:
GET https://mail.company.com/owa/ 401 (Unauthorized)
WWW-Authenticate: Negotiate
WWW-Authenticate: NTLM

# IIS Log entry:
2025-01-15 09:23:45 W3SVC1 GET /owa/ - 443 - 192.168.1.100 Mozilla/5.0 - 401 2 5 1250

# Status codes breakdown:
# 401 0 - Generic unauthorized0 - Generic unauthorized
# 401 1 - Logon failed (bad credentials)1 - Logon failed (bad credentials)
# 401 2 - Logon failed due to server configuration2 - Logon failed due to server configuration
# 401 5 - ISAPI/CGI authorization failed5 - ISAPI/CGI authorization failed

# Set Exchange OWA to Forms authentication
Get-OwaVirtualDirectory -Server $env:COMPUTERNAME |
  Set-OwaVirtualDirectory -FormsAuthentication $true -BasicAuthentication $false -WindowsAuthentication $false -DigestAuthentication $false

# Configure IIS to match
Import-Module WebAdministration
$authPath = "IIS:\Sites\Default Web Site\owa"

# Disable all except anonymous (Forms needs anonymous for login page)
Set-WebConfigurationProperty -Filter "/system.webServer/security/authentication/anonymousAuthentication" -PSPath $authPath -Name enabled -Value $true
Set-WebConfigurationProperty -Filter "/system.webServer/security/authentication/basicAuthentication" -PSPath $authPath -Name enabled -Value $false
Set-WebConfigurationProperty -Filter "/system.webServer/security/authentication/windowsAuthentication" -PSPath $authPath -Name enabled -Value $false
Set-WebConfigurationProperty -Filter "/system.webServer/security/authentication/digestAuthentication" -PSPath $authPath -Name enabled -Value $false

# Restart IIS
iisreset /noforce

Write-Host "Forms authentication configured - test OWA now"

# Force immediate time sync
w32tm /resync /force

# If that doesn't work, reconfigure time source
w32tm /config /syncfromflags:DOMHIER /update
Restart-Service w32time
w32tm /resync /force

# Verify sync status
w32tm /query /status | Select-String "Source|Offset"

Write-Host "Time synchronized - test authentication now"

# On the client experiencing issues, run:
# Clear Kerberos tickets
klist purge

# Clear all cached credentials
cmdkey /list  # Show cached credentials
# cmdkey /delete:targetname  # Remove specific credential

# For stubborn issues, also clear browser credentials
# Chrome: chrome://settings/passwords
# Edge: edge://settings/passwords
# IE: Control Panel > Credential Manager

Write-Host "Cached tickets cleared - try OWA again in new browser window"

# First, identify what SPNs exist
setspn -L $env:COMPUTERNAME

# Remove duplicate SPNs if found
# setspn -D HTTP/duplicatename.domain.com WRONGSERVER$

# Register required SPNs for Exchange OWA
$computerAccount = $env:COMPUTERNAME
$fqdn = "$env:COMPUTERNAME.$env:USERDNSDOMAIN"$env:USERDNSDOMAIN"
$externalName = "mail.company.com"  # Your external OWA URL hostname

# Register server name SPN
setspn -S HTTP/$env:COMPUTERNAME $computerAccount
setspn -S HTTP/$fqdn $computerAccount

# Register external name SPN (if different from server name)
setspn -S HTTP/$externalName $computerAccount

# Verify registration
Write-Host "`nVerifying SPNs..."
setspn -L $computerAccount | Select-String "HTTP"

# Note: If using a service account for app pool, register SPNs there instead
# setspn -S HTTP/$externalName DOMAIN\ServiceAccount$externalName DOMAIN\ServiceAccount

# For internal OWA where you want single sign-on
# WARNING: Don't use this for internet-facing OWA

# Configure Exchange
Get-OwaVirtualDirectory -Server $env:COMPUTERNAME |
  Set-OwaVirtualDirectory -FormsAuthentication $false -WindowsAuthentication $true -BasicAuthentication $false

# Configure IIS
Import-Module WebAdministration
$authPath = "IIS:\Sites\Default Web Site\owa"

Set-WebConfigurationProperty -Filter "/system.webServer/security/authentication/windowsAuthentication" -PSPath $authPath -Name enabled -Value $true
Set-WebConfigurationProperty -Filter "/system.webServer/security/authentication/anonymousAuthentication" -PSPath $authPath -Name enabled -Value $false
Set-WebConfigurationProperty -Filter "/system.webServer/security/authentication/basicAuthentication" -PSPath $authPath -Name enabled -Value $false

# Configure Kerberos providers (Negotiate first)
$providers = Get-WebConfigurationProperty -Filter "/system.webServer/security/authentication/windowsAuthentication/providers" -PSPath $authPath -Name "."
Write-Host "Current providers: $($providers.Collection.Value -join ', ')"

# Ensure Negotiate is first (Kerberos before NTLM)
# In IIS Manager: Authentication > Windows Auth > Providers > Move Negotiate to top

iisreset /noforce

# Test direct to each backend server
$servers = @("EX01.company.local", "EX02.company.local")
$url = "/owa/auth/logon.aspx"

foreach ($server in $servers) {
    Write-Host "`nTesting $server..."
    try {
        $response = Invoke-WebRequest -Uri "https://$server$url"$url" -UseBasicParsing -TimeoutSec 10
        Write-Host "  Status: $($response.StatusCode)" -ForegroundColor Green
    } catch {
        Write-Host "  Error: $($_.Exception.Message)" -ForegroundColor Red
    }
}

# If direct works but LB doesn't, check:
# 1. Session persistence (sticky sessions) - REQUIRED for auth
# 2. SSL passthrough vs termination
# 3. X-Forwarded headers being passed-Forwarded headers being passed
# 4. Health check isn't consuming auth sessions

# For SSL offloading, Exchange needs to know:
# Check/configure RequireSSL settings
Get-OwaVirtualDirectory | Select-Object Server, InternalUrl, ExternalUrl

# If LB terminates SSL, consider changing to SSL passthrough
# Or configure Exchange to trust X-Forwarded-Proto header-Proto header

# Check current Exchange certificate
Get-ExchangeCertificate | Where-Object {$_.Services -like "*IIS*"} |
  Select-Object Thumbprint, Subject, NotAfter, Status,
  @{N='SANs';E={$_.CertificateDomains -join ', '}}

# Verify certificate name matches OWA URL
$owaUrl = (Get-OwaVirtualDirectory).ExternalUrl
$certDomains = (Get-ExchangeCertificate | Where-Object {$_.Services -like "*IIS*"}).CertificateDomains

Write-Host "`nOWA External URL: $owaUrl"
Write-Host "Certificate covers: $($certDomains -join ', ')"-join ', ')"

# Check if URL hostname is in certificate
$urlHost = ([uri]$owaUrl).Host
if ($certDomains -contains $urlHost) {
    Write-Host "Certificate includes $urlHost - OK" -ForegroundColor Green
} else {
    Write-Host "Certificate MISSING $urlHost - may cause auth issues!" -ForegroundColor Red
}

# If certificate expired or wrong, assign correct one:
# Enable-ExchangeCertificate -Thumbprint THUMBPRINT -Services IIS-Thumbprint THUMBPRINT -Services IIS

# 1. Test OWA connectivity
Test-OwaConnectivity -URL "https://mail.company.com/owa" |
  Select-Object Scenario, Result, Latency, Error | Format-Table

# 2. Check IIS logs for successful auth
$logPath = "$env:SystemDrive\inetpub\logs\LogFiles\W3SVC1"
$latestLog = Get-ChildItem $logPath -Filter "*.log" | Sort-Object LastWriteTime -Descending | Select-Object -First 1

Get-Content $latestLog.FullName -Tail 20 | Where-Object {$_ -match "/owa"} |
  ForEach-Object {
    if ($_ -match "200") { Write-Host $_ -ForegroundColor Green }
    elseif ($_ -match "401") { Write-Host $_ -ForegroundColor Red }
  }

# 3. Verify no Kerberos errors
Get-WinEvent -FilterHashtable @{
    LogName = 'Security'
    Id = 4771
    StartTime = (Get-Date).AddMinutes(-15)
} -ErrorAction SilentlyContinue | Measure-Object

# 4. Test from different clients/locations
Write-Host "`nAsk users to test from:"
Write-Host "  - Internal network (domain-joined PC)"
Write-Host "  - External network (home/mobile)"
Write-Host "  - Different browsers (Chrome, Edge, Firefox)"

# Run monthly to detect SPN issues early
$servers = Get-ExchangeServer | Select-Object -ExpandProperty Name

foreach ($server in $servers) {
    Write-Host "`n=== $server ===" -ForegroundColor Cyan
    $spns = setspn -L $server 2>&1
    $httpSpns = $spns | Select-String "HTTP/"
    if ($httpSpns) {
        $httpSpns | ForEach-Object { Write-Host $_ -ForegroundColor Green }
    } else {
        Write-Host "No HTTP SPNs found!" -ForegroundColor Red
    }
}

# Check for duplicates
Write-Host "`n=== Duplicate SPN Check ===" -ForegroundColor Cyan
$dupes = setspn -X 2>&1
if ($dupes -match "found 0") {
    Write-Host "No duplicates found" -ForegroundColor Green
} else {
    Write-Host $dupes -ForegroundColor Red
}

# Run after any Exchange/IIS/Certificate changes
$testUrl = "https://mail.company.com/owa/"

# Test anonymous access to login page
try {
    $loginPage = Invoke-WebRequest -Uri "$testUrl/auth/logon.aspx" -UseBasicParsing
    Write-Host "Login page accessible: $($loginPage.StatusCode)" -ForegroundColor Green
} catch {
    Write-Host "Login page error: $($_.Exception.Message)" -ForegroundColor Red
}

# Full connectivity test
Test-OwaConnectivity -URL $testUrl | Format-Table Scenario, Result