I apologize if this is a simple or commonly answered question. I'm having trouble finding a clear answer and my tests have been unsuccessful.
We have a large user base that connects their mobile devices to active sync. This causes lockout issues every three months which has become extremely frustrating when users can't find the source of the lockout. What we would like to do is deploy certificate authentication to those users who have the most issues. However we don't want to role this out to the entire company because of the overhead required. Does exchange allow using basic authentication OR certificate auth? That way they can still use their normal credentials but we can also manage the certs along side so that password changes are not as hectic.
On a side note if there is a better way of logging the lockout attempts or finding out where they are coming from that would be an even better alternative. Microsoft lockout tools are only helpful when the lockout is coming from withing the network, anything from Exchange is a black hole.
I've setup exchange to accept certificates but it still requires a username and password on the client side. Maybe I'm missing the obvious.
Thank you in advance.