If your ActiveSync device keeps asking you for your password this could be the reason.
The scenario is ActiveSync to an Exchange 2007 SP3 mailbox in a multi-site environment. Only one site is internet facing. The mailbox is in another site. The description of how this works is pretty straight forward. The ActiveSync device connects to the Microsoft-Server-ActiveSync virtual directory on a CAS in the internet-facing site: Call it ‘Internet-Site’. That CAS sees that the mailbox is in another site and identifies a CAS it can proxy to in the mailbox’s site: call it ‘Mailbox-Site’. It proxy’s to – the documentation says – the ‘proxy’ directory subordinate to the Microsoft-Server-ActiveSync directory on the ‘Mailbox-Site’ CAS.
How does it authenticate? It uses windows authentication. The user (in this case a phone with the users name and password) has already authenticated to the ‘Internet-Site’ CAS. The original authentication was Basic Authentication over SSL. They only authentication method the Exchange Management Console will allow one to set on the Microsoft-Server-ActiveSync virtual directory. This should work because a look at the authentication set on the Proxy directory shows Windows Authentication and the documentation, as I said, indicates that the ‘Internet-CAS’ will proxy to the Microsoft-Server-ActiveSync/Proxy directory
So, what is the issue? It does work – sort of — but the user will be prompted again and again for their password. The prompts are every few minutes. In between, strangely, they get their mail.
The solution I have found is to ignore the documentation and set Windows Authentication on the Microsoft-Server-ActiveSync virtual directory on the ‘Mailbox-Site’ CAS. This can be done in IIS or via the ’Set-ActiveSyncVirtualDirectory’ PowerShell command.
Do it and the prompts disappear. I am not sure but it would appear the documentation is just incorrect.