I'm testing a client machine that makes requests to a biztalk server using a forefront machine as a web proxy. Upon first test I put in an invalid name/password into the receive port and received the correct error message (407). Then, I set the correct name/password and everything worked correctly.

From there, I kept the correct information in the receive port but put an invalid name/password into the send adapter but the process completed successfully (should have failed with 407).

I've ensured that both the recieve and send ports are not bypassing the proxy for local addresses.

So the only thing that seems to make sense is if TMG is caching the authentication request coming from the machine I'm working on.

Is this thinking correct, and if so, does anyone know how to disable it in TMG?