Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

my web server randomly asks for a password as though basic authentication is turned on. It's an IIS 7 web server and you have to specifically install basic authentication in the roles section. It isn't installed.

The message that pops up is "Warning: This server is requesting that your username and password be sent in an insecure manner (basic authentication without a secure connection)"

I cannot reproduce the problem but a number of customers have reported the problem and it only seems to appear to a small number of customers.

It pops up when they visit the homepage, nothing is generated by the IIS logs to indicate a password box is being served (e.g. no 401 errors etc)

Can anyone offer any advice?


share|improve this question

Try using processmon ( to capture the issue and find out where the access denied is coming from. If you add a filter for the PID of your site's app pool you won't have too many events.

Type iisapp from the command prompt to see the app pool to PID mapping.

After you get a capture, search for the word 'denied'. It's likely that you'll find out what is causing this.

share|improve this answer
good idea Scott, only I can't seem to reproduce the problem which is making it difficult to examine! I will try your suggestion if I can reproduce the issue - thanks – Paul Mar 16 '10 at 13:54
Hi Scott, I tried your suggestion in a controlled environment and it helpfully shows up a 401.2 error which is also shown in the IIS logs. The odd thing is that in the "live" error it simply doesn't stamp any 401 errors in the log. It's like my servers aren't serving this prompt up! – Paul Mar 16 '10 at 16:39
Hi Paul. That can make it more difficult. Any chance that another IIS site catches some requests, or that you have a load balancer in front that might be coming into play? processmon may still be able to catch access denied errors as long as the requests are actually getting to the server. – Scott Forsyth - MVP Mar 16 '10 at 18:27
Hi Scott, yes we have a small load balancing set up I have a method of eliminating by using the servers browser - this uses the NLB address locally. Unfortunately the ProcessMonitor app killed my server after I left it running - ouch. It's such a random problem, when it happens it seems to happen to a few customers at a time. What is most confusing is the fact I'm not seeing any 401 errors anywhere. – Paul Mar 17 '10 at 11:10
Are you saying that you can repro it locally on the nodes? If you do, does it log it in that situation? I would still be suspect of something with NLB or the servers rather than IIS. Check Event Viewer too, for any further hints. Bummer on procmon killing the server. It can generate a lot of data waiting for a repro. There is a setting to limit how many it keeps at a time, also the more narrow the filter, the longer it can run. For example, at the very least, filter by PID, but you may have to filter by the word 'denied'. It won't show the info around it, but it will show what is denied. – Scott Forsyth - MVP Mar 17 '10 at 13:59

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.