Explicit proxy and client NTLM

It's a bit confusing, but all you need to do is start policy with NTLM Auth result when you use NTLM as the authentication mechanism - no 407 VPE actions needed. Only Kerberos and Basic need 407 action box - NTLM implements it behind the scenes.