1

I'm having pretty similar problems as described in case 139099, but the fix there doesn't seem to work for me. Here's the details:

Server:

  • Win2003Srv R2 SP2
  • Stadalone, not a member of a domain.
  • IIS6, TCP/443 (https).
  • Anonymous access disabled.
  • Integrated Windows authentication enabled.
  • Local useraccouts
  • Each useraccount has own virtual folder with change access and read access to site root.
  • The 'adsutil NTAuthenticationProviders "NTLM"' -thing set to site root and useraccount's virtual folder (as described in MS KB article 215383).

Client:

  • Win7 Enterprise
  • Member of a AD-Domain
  • IE8
  • Allows three login attepts then fails.
  • Using [webservername]\[username] in the logon window (Windows security)
  • Logon using other browsers (Chrome and Firefox) works OK.

The Web services log shows one 401.2 and two 401.1 events. The Security Event log shows two events, first is Fauilure Audit (680), The second event is Fauilure Audit (529) with these details:

Logon Failure:
Reason:     Unknown user name or bad password
User Name:  [username]
Domain:     [webservername]
Logon Type: 3
Logon Process:  NtLmSsp 
Authentication Package: NTLM
Workstation Name:   [MyWorkstation]
Caller User Name:   -
Caller Domain:  -
Caller Logon ID:    -
Caller Process ID:  -
Transited Services: -
Source Network Address: [999.999.999.999]
Source Port:    20089

Any ideas appreciated.

4 Answers 4

1

The solution is: YOU CANNOT PASTE PASSWORD in WINDOWS 7 and/or IE8. This 'feature' is described e.g. here.

Thank you mikeymousesoft for this.

Well, actually there might be some sense to this. Here is a simple javascript, which reveals password in java-capable browser. However, since the Windows passwords aren't located in the actual browser window, but in a window called 'Windows Security', this script most propably won't apply in this case.

I've thought that copying/pasting passwords is secure because:

  1. It prevents typos,
  2. Keyloggers won't be able to detect the password, since it's not typed.

Many thanks for your assistance.

It took me a week to figure out this. Can I send bill to Bill?

1
  • Actually you can cut and paste passwords, you just have to use certain keystrokes. This works: Copy marked password with Ctrl+C and paste it with Ctrl+V.
    – Ciove
    Apr 20, 2012 at 8:37
0

Logging on using [webservername][username] and Integrated Windows Authentication are mutually exclusive. You should not have Integrated authentication checked if you want to logon by specifying a user account. Integrated Authentication means that IE will use the user's AD credentials to logon to the application.

4
  • Hi Greg, thanks for your answer. You may be right, I'll do testing and get back to you. However, my problem does not exist when using IE7 on WinXP. Somehow it seems to me that the Win7 tries to force the domain the user has logged into Win7 and/or the IE8 does not pass the [webservername]\ to the IIS6.
    – Ciove
    Feb 21, 2011 at 12:42
  • Hi. I'm still in the middle of testing. I've changed the authetication to Basic. I needed to ponder security issues, because the Basic authetication sends the usr and pw in cleartext, but this is in my case OK, because the connection is protected SSL/TLS. The Basic authetication works with WinXp and IE7, however I need to do some networking in order to connect my Win7 to my test service.
    – Ciove
    Feb 22, 2011 at 8:16
  • 1
    Hi. No results yet, but found an interesting MS Technet article: 401.1 and 401.2-Authentication Problems (IIS 6.0).
    – Ciove
    Feb 22, 2011 at 13:53
  • Hi again. No success yet, Basic auth. in use. Win7/IE8 machine still does not autheticate properly. Now accountOne can log in, but accountTwo cannot. I haven't found the difference in between these accounts. The Web service log shows that accountOne sc-status is 401.2 when Web service asks for the credentials and 200.0 when the logon succeeds. The accountTwo log events are 401.2 and 401.1 with sc-win32-status value 1326 (Logon failure: unknown user name or bad password). The password is absolutely positively 100% correct. Any more ideas how to debug this further?
    – Ciove
    Feb 23, 2011 at 15:27
0

Sounds like you're having a problem with "Extended Protection" outlined here. If IIS6 is set to "Negotiate,NTLM" (or nothing) you're likely going to get the 401.2 error using IE8. You can check/set the authentication value by following these instructions.

3
  • 1
    Hi Vinny and thanks for your answer. I had already done that, see my last bullet in the Server chapter.
    – Ciove
    Feb 22, 2011 at 8:03
  • hangs head in shame for not reading more completely and skips the basic auth answer as it's also in a comment above
    – vinny
    Feb 22, 2011 at 14:59
  • FYI, according to the doc @vinny referenced, if NTAuthenticationProviders are set to nothing then IIS6 defaults to Negotiate,NTLM
    – uSlackr
    Jun 2, 2011 at 20:52
0

Workaround: How to Copy+Paste passwords in Windows 7 and/or InternetExplorer 8

You can copy and paste passwords in in Win7 and IE8

  1. Mark and copy the password to clipboard with mouse's right-click+Copy function.
  2. Paste the password hitting Ctrl+V -keys.

This solution is described here:
http://social.technet.microsoft.com/Forums/en-US/w7itprosecurity/thread/80f59d82-84ca-4d87-93d4-dacc61f46a3f

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .