Here's the scenario:
I have a lot of users who use shared computers to do work (with a public shared login). They also have individual email accounts. I want them all to be able to use OWA to get to their accounts.
Right now, Integrated Authentication and Basic Authentication are enabled on the two CAS boxes. I've forced IE on those boxes to prompt for username and password so that they are given the basic auth prompt to login to OWA. This works.
The problem is that when their accounts are set to change password at next logon, basic auth doesn't let them get to the change password screen. It just acts like the credentials are invalid.
I have set the enablepasswordexpired registry keys on the CAS boxes, and it works as expected when accounts expire; there's something about the 'change password at next login' that's causing problems.
Any ideas?