1

This is a weird one. We were happily running with Windows Authentication on our intranet site until I demoted one of our domain controllers. Now some workstations still work fine and are authenticated automatically, but others cannot get authenticated at all. The browser prompts for credentials and it doesn't matter what credentials you put in, it refuses to authenticate. (401.1) The problem is per workstation. (I cannot get in from my own workstation, but another works fine for me.) I have not yet found a pattern of working vs non-working workstations. (Two identical workstations in the same OU - one works and the other doesn't)

I've followed all the links on this article: https://stackoverflow.com/questions/12517127/windows-authentication-not-working-in-iis-7-5 and have tried all the solutions suggested, with no luck. (Tried moving NTLM to the top of the list, tried disabling loopback checking and strict name checking) I've also compared HTTP headers between a working computer and a non-working one, and they appear to all be the same. No relevant entries in the Event Logs, except the Audit Failure in the Security Log (Unknown user name or bad password, 0xc000006d, 0xc000006a) Kernel-mode authentication is also disabled and extended protection is turned off.

As a workaround, we're running on Basic authentication which is working fine. But I'd like to get Windows authentication working again.

Where should I try to look next?

Domain is 2003 with 2003 and 2008 R2 domain controllers. IIS server is 2008 R2 member server. Workstations are XP Professional SP3 32-bit and Windows 7 Enterprise 64-bit SP1.

Community
  • 1
NorbyTheGeek
  • 415
  • 1
  • 6
  • 22

1 Answers1

2

Ensure that your domain is healthy - dcdiag, netdiag, etc.

Ensure that your IIS server has only valid DNS servers (ie, all of them will serve up the proper AD-required records) and not external or invalid ones, like your demoted server.

mfinni
  • 35,711
  • 3
  • 50
  • 86
  • 1
    Thank you very much, you pointed me in the right direction. I didn't know about netdiag, and it was very helpful. It pointed out that one of my DCs did not have its time service configured correctly, and that we still have some old WINS settings around. But what I think was the main cause was DNS still had _ldap service entries for the demoted DC. Once I cleaned them all out IIS started working correctly. Thanks! – NorbyTheGeek Aug 26 '13 at 20:56