The things you point out, like the fact that "it works from the internal WiFi", tell me that your IT folks may not have made sure that SMTP is visible from the outside world. Using Outlook Web Access (OWA) on the iPhone is absolutely nothing like using SMTP from another mail client, so the fact that they can get to a Webmail page is of no use whatsoever in connecting to Exchange via SMTP from the outside world. Also, checking the SMTP settings with an iPhone will work only if the iPhone is using SMTP and not Exchange ActiveSync (EAS).
Without knowing how your iPhone is set up, there's almost no way to tell if that's really a valid test. However, there are a few things I'd check with your IT people:
-----
Our campus has switched almost completely to dual-boot Macs. We're looking for the best way to manage these machines in an Active Directory-based environment. Right now, we manage deployment and imaging with DeployStudio running on a late-model Xserve; we then manage the Macs via Apple Remote Desktop (ARD) or direct interaction (with directory binds via the Snow Leopard Active Directory plugin). I know we could use dual-directory Active Directory/Open Directory for management. But what are the pros and cons of other possibilities--Active Directory schema extension, Centrify, LANrev, JSS, and so on? We need a way to gather master images, deploy them to many machines, and then (ideally) apply policies to those machines throughout their service life.
Wow, that's a lot of questions in a small space, but the gist is: how do I integrate Macs into an Active Directory (AD) environment beyond basic authentication?
The most popular way to do that is (as you say) with dual directories, also known as "The Magic Triangle," in which you use Mac OS X Server as an Open Directory (OD) server that is also bound to AD. Clients then bind to both AD and OD, and you use the Mac OS X Server to actually manage your Mac users and computers. That's a good technique, but it does come at a cost--namely, the expense of a Mac and a copy of Mac OS X Server.
The second common method is called . All directories--whether AD, OD, Novell's eDirectory, or OpenLDAP--define objects within their purview using . You can modify Active Directory schema in such a way that Workgroup Manager can manage Mac users and computers--no copy of Mac OS X Server required.
With early versions of AD (particularly 2000), this was a bit of a risk, because if such schema modifications broke something, there was no way to cleanly back out. In current versions of Active Directory, this problem has been solved, and schema modifications are now a solid way to integrate Macs into Active Directory environments--with some caveats:
In other words: Schema mods are a solid way to solve many of the problems of managing Macs in an AD environment, but they won't solve every problem and they aren't something you can just do and forget about it.
The approaches Mac integration with AD from the Windows point of view. It allows Windows administrators to integrate and manage Macs using standard Windows Active Directory management tools. For example, password policies are set via Group Policy Objects (GPOs) instead of by Apple's Managed Client for Mac OS X (MCX) settings. Centrify also helps integrate Macs into environments where smart cards and two-factor authentication are required. Centrify is not free, nor is it cheap, but it does give you a lot of capability for the money, in a way that allows AD administrators to manage Macs without needing a Mac themselves. However, Centrify is not a deployment solution. It works well with other deployment solutions, such as Apple Remote Desktop, LanRev, and Casper. But, in and of itself, it isn't a deployment solution.
, , and are all outstanding deployment/management systems, and they all work well with AD. But they won't do much to integrate your Macs into Active Directory.
This is where we hit the crux of the problem: No one package will do it all for you. What I would recommend is to deal with this as two separate but related issues:
First, AD integration: For your environment and budget, which of the three AD integration methods--dual-directory, schema modifications, or a third-party solution like Centrify-- will work best? Unfortunately, that's something you'll have to figure out with your AD administrators; any recommendation I make from here is going to be purely a guess. If your AD administrators aren't opposed to using Macs to manage Macs, then dual-directory or schema mods are an option. If they insist on using Windows, and are willing to pay to do so, then Centrify is quite usable.
Second, deployment: Almost any of the products I listed above--Casper, LANRev, or DeployStudio--will do the job. Given the choice right now, I would probably go with Casper, because it's only one with full iOS support, including Over-the-Air (OTA) and Simple Certificate Enrollment Protocol (SCEP) enrollment, wireless app distribution, and full Mobile Device Management (MDM) support for iOS devices. Casper's only problem is that it's really a Mac/iOS-only solution. But, again, there is no one uber-product that will do it all.