Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have an IIS 7.5 (Win2k8R2) Webserver, which publishes an UNC Share (on a Fileserver) with restricted access. The AppPool Identity is a Domain User-Account with read access to mentioned UNC path. Authentication modes are set to Anonymous and Integration Authentication.

When I access the path via localhost from the Webserver itself, it works, but if I try the Hostname or IP from either the Webserver or a Client, I get three authentication prompts (does not accept my credentials) and a 401.3 Unauthorized error message (but it states that I am logged in as my normal credentials which definitely have access rights to the UNC path and its files). Security Zone is set to Local Intranet. Sysiniternals Process Monitor lists CreateFile operations on the UNC path (and other existing files in it) with Access Denied and Impersonating on the correct credentials.

I don't understand why it is not working, it seems to use the correct credentials on every step on the way but fails with is operations.

share|improve this question

You need to set the Physical Path Credentials in your site/virtual directory advanced settings.

  • Click on the Site / Virtual Directory
  • Click the Advanced Settings in the right side-bar
  • Set the Physical Path Credentials to a specific user then set it to the domain user you used for the app pool.
share|improve this answer
Well, I do get access with this modification, but it seems like everyone now gets access, even if they would not gain access via ACL, which makes the authentication pretty pointless ;) – Pharao2k Feb 16 '11 at 17:01
Ah, that's what it sounded like you wanted from your question. You will have to use pass-through authentication for that but I've not gone there with IIS7 yet. – squillman Feb 16 '11 at 17:18
pass-through-auth was already enabled when I wrote the first question. Do I really have to configure Constrained Delegation for this to work? The link is pretty old ^^, pre-IIS7, which changed quite a bit. – Pharao2k Feb 16 '11 at 17:33
@Pharao2k I noticed that I posted an old old link and pulled it... But yes, I believe you will still need to go through two-hop authentication to do what you want. – squillman Feb 16 '11 at 18:44
Hmm thats odd, since I have similar setup on an IIS6/Win2k3-SBS Server, just with a local path instead of an UNC path. Does the change to UNC require two-hop auth, is it IIS 7.5 or is it just misconfiguration? – Pharao2k Feb 17 '11 at 13:36

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.