I have a puzzling situation here....for some reason I can't get Outlook
2003 to change the password for the user. The situation is a location
without it's own Exchange 2003 server...the email is being hosted
off-site...accessible thru the corporate WAN. Communication to the
Exchange server is fine...except when you try to change the password. The
users get the usual generic "Your Windows password could not be changed.
To change your password, you must log on to your organization's network or
contact your system administrator." message. Which, from what I can tell
is the same message for almost any problem.

The site in question does not share a AD domain with the mail system. So
the message is somewhat correct as the local user on the Win2k workstation
is not logged into the domain the email system is on.

I was able to change the password ok when I plugged the machine into the
DMZ between the corporate WAN and BM...and if I unload the filters on BM
(version 3.8 sp3) I can change the password when behind the firewall also.
So it's gotta be a filter issue, right?

So I fired up good ol' Ethereal and did some packet captures when it was
working (both scenarios) and when it wasn't...to compare. When it was
working the client behaved the same way...but when it wasn't it was doing
weird things.

So from what I can tell about the captures....Outlook is a very chatty
beast! It likes to try all kinds of things...not too mention NetBIOS Name
look-up broadcasts...nasty!

Outlook appeared to like to communicate on Port 389 (LDAP) and Port 445
(Microsoft DS). So I opened both of those. I already had Port 135 (RPC)
open for initial client authentication. So once I had those ports opened
the client seemed to do it's communication fine thru the firewall...just as
it did when the filters were unloaded. However, when the filters are
loaded the client gets a point where it trys a "LSA" authentication
attempt...which fails. I'm stumped! Nothing in the previous packets would
indicate why it would try that...even when the filters were unloaded.

Has anyone been successful in getting Outlook 2003 password changes to work
thru a BorderManager firewall? Or any ideas to try next?