Hi,
Has decided to update Excahnge 2010 on 2013.
Settings Exchange 2013:

ECPVirtcomlDirectory
ExternalURL https://mail.company.com/ecp
InternalURL https://mail.company.com/ecp
BasicAuthentication $false
WindowsAuthentication $true
DigestAuthentication $false

OWAVirtcomlDirectory
ExternalURL https://mail.company.com/owa
InternalURL https://mail.company.com/owa
BasicAuthentication $false
WindowsAuthentication $true
DigestAuthentication $false

OabVirtcomlDirectory
ExternalURL https://mail.company.com/OAB
InternalURL https://mail.company.com/OAB

WebServicesVirtcomlDirectory
InternalUrl https://mail.company.com/EWS/Exchange.asmx
ExternalUrl https://mail.company.com/EWS/Exchange.asmx

ClientAccessServer
AutoDiscoverServiceInternalUri https://mail.company.com/Autodiscover/Autodiscover.xml

OutlookAnywhere
InternalHostname mail.company.com  
ExternalHostname mail.company.com
ExternalClientsRequireSsl $True
InternalClientAuthenticationMethod NTLM
ExternalClientAuthenticationMethod Basic
InternalClientsRequireSsl $True
SSLOffloading $false
IISAuthenticationMethods Basic, Ntlm

OutlookProvider:

EXPR -CertPrincipalName msstd:*.company.com

The certificate on *.company.com (from the internal Centercertificates) on service SMTP, IIS

WNLB for CAS servers addressed to mail.company.com

I have added the owa site to local trust site, but when i open http://mail.company.com/owa or /ecp, only domain\username is fill in, password never.

Hi,

According your post, I understand that login OWA and popup for username and password even use Integrated Windows Authentication.
If I misunderstand your concern, please do not hesitate to let me know.

This function works in local network, and only support on computer that are running a Windows operating system and Internet Explorer.
When you login ECP or OWA with Integrated Windows Authentication, the server negotiates with the Windows security packages that are installed on the client computer
For your reference: https://technet.microsoft.com/en-us/library/bb430796%28v=exchg.141%29.aspx?f=255&MSPPError=-2147217396

For your question, please run below command to double check the authentication for OWA and ECP:
Get-OwaVirtualDirectory | FL Identity,*URL*,InternalAuthticationMethods,ExternalAuthicationMethods
Get-EcpVirtualDirectory | FL Identity,*URL*,InternalAuthticationMethods,ExternalAuthicationMethods

Thanks

Hi,

According your post, I understand that login OWA and popup for username and password even use Integrated Windows Authentication.
If I misunderstand your concern, please do not hesitate to let me know.

This function works in local network, and only support on computer that are running a Windows operating system and Internet Explorer.
When you login ECP or OWA with Integrated Windows Authentication, the server negotiates with the Windows security packages that are installed on the client computer
For your reference: https://technet.microsoft.com/en-us/library/bb430796%28v=exchg.141%29.aspx?f=255&MSPPError=-2147217396

For your question, please run below command to double check the authentication for OWA and ECP:
Get-OwaVirtualDirectory | FL Identity,*URL*,InternalAuthticationMethods,ExternalAuthicationMethods
Get-EcpVirtualDirectory | FL Identity,*URL*,InternalAuthticationMethods,ExternalAuthicationMethods