why does Integrated Windows Authentication fail when clients access off the network

Answer 1

Most likely the cause of your problem is a proxy that your clients are going through. This proxy is probably blocking NTLM authentication from the client. This is a common problem I have seen several times in the past.

Answer 2

IE will refuse to use NTLM/Negotiate through a proxy unless that proxy injects a

Proxy-Support: Session-Based-Authentication

response header.

Furthermore, IE will take zone-settings into account when deciding what the proper behavior is. You may want to adjust your Trusted Sites setting for Logon to "Prompt for Username and Password."