Can't logon to NT Mailboxes through ExpressPro

When attempting to logon to NT Mailboxes through ExpressPro an 'Invalid Username or Password' error is returned even though the logon on credentials are correct.

An additional privilege is needed by Windows 2000 to enable NT mailbox users to login to ExpressPro. The ASPNET account that aspnet_wp.exe uses doesn't have SE_TCB_NAME privilege. On Windows XP and Windows 2003 this may not be an issue because the privilege is not required to call the LogonUser method however it is required by Windows 2000.

To confirm if you have this issue please follow the stages below.

Domain User for MSIISUSER

Ensure that your MSIISUSER to access ExpressPro as your anonymous access is a domain user account. Check that the account and password are correct in the following locations as stated in steps 1 - 6 in This Article

Create a Registry Mailbox

Create a new registry mailbox and attempt to login to this through ExpressPro. If this succeeds but a NT mailbox fails follow the next stage.

SE_TCB_NAME Privilege

To allow ASP.Net to access the domain to check the logon for a user we need to make sure that the account has SE_TCB_NAME privilege also known as "act as part of the operating system" right.

Active Directory Implementations

To have the most secure login we need to follow these steps to allow the local account ASPNET the correct privileges within the Active Directory domain.

1. Within the 'Active Directory Users and Computer' you need to create a Global Users Group.
2. Open 'Domain Security Policy' and go to this location - Local Policies - User Rights Assignment and open the option 'Act as part of the operating system'. Click Define these policy settings, Click Add User or Group and add the group in step 1.
3. On the Mail Server we need to add a local group for the ASPNET account. Add the local account ASPNET to the group and also add the group added within Step 1.
4. IIS will need to be restarted.
5. Now see if you can login to ExpressPro.

NT Domain Implementation

If you have a NT Domain then this extra privilege can be set locally on your mail server.

• Go to Run > gpedit.msc
• Within Group Policy > Computer Configuration > Windows Settings > Security Settings > Local Policies > User Rights Assignment locate the policy 'Act as part of the operating system'
• Right click on this and choose Properties
• Click 'Add User or Group' and add the ASPNET user. Click Ok and Exit Group Policy.
• Run the following command within the Command line to refresh all the policies
  secedit /refreshpolicy machine_policy /enforce
• Restart IIS
• Load ExpressPro and attempt to login to a NT mailbox

A less secure way to allow ExpressPro to login NT mailboxes is if the Box directory is on the same machine. This is not recommended. We would prefer you to use either of the two methods listed above. However to make this change:

• Open the folder '%WINDIR%\Microsoft.NET\Framework\v2.0.50727\CONFIG'
• Open the file machine.config in a text editor.
• Within the Section <system.web> make this change.
  Original Option:
  <processModel autoConfig="true"/>
  
  Change to this value:
  <processModel username="SYSTEM"/>
  
• Restart IIS and try to login to ExpressPro

For more details on this please look at these Microsoft web pages

Process and request identity in ASP.NET
How To Validate User Credentials on Microsoft Operating Systems