Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm having pretty similar problems as described in case 139099, but the fix there doesn't seem to work for me. Here's the details:

Server:

  • Win2003Srv R2 SP2
  • Stadalone, not a member of a domain.
  • IIS6, TCP/443 (https).
  • Anonymous access disabled.
  • Integrated Windows authentication enabled.
  • Local useraccouts
  • Each useraccount has own virtual folder with change access and read access to site root.
  • The 'adsutil NTAuthenticationProviders "NTLM"' -thing set to site root and useraccount's virtual folder (as described in MS KB article 215383).

Client:

  • Win7 Enterprise
  • Member of a AD-Domain
  • IE8
  • Allows three login attepts then fails.
  • Using [webservername]\[username] in the logon window (Windows security)
  • Logon using other browsers (Chrome and Firefox) works OK.

The Web services log shows one 401.2 and two 401.1 events. The Security Event log shows two events, first is Fauilure Audit (680), The second event is Fauilure Audit (529) with these details:

Logon Failure:
Reason:     Unknown user name or bad password
User Name:  [username]
Domain:     [webservername]
Logon Type: 3
Logon Process:  NtLmSsp 
Authentication Package: NTLM
Workstation Name:   [MyWorkstation]
Caller User Name:   -
Caller Domain:  -
Caller Logon ID:    -
Caller Process ID:  -
Transited Services: -
Source Network Address: [999.999.999.999]
Source Port:    20089

Any ideas appreciated.

share|improve this question
add comment

4 Answers 4

up vote 1 down vote accepted

The solution is: YOU CANNOT PASTE PASSWORD in WINDOWS 7 and/or IE8. This 'feature' is described e.g. here.

Thank you mikeymousesoft for this.

Well, actually there might be some sense to this. Here is a simple javascript, which reveals password in java-capable browser. However, since the Windows passwords aren't located in the actual browser window, but in a window called 'Windows Security', this script most propably won't apply in this case.

I've thought that copying/pasting passwords is secure because:

  1. It prevents typos,
  2. Keyloggers won't be able to detect the password, since it's not typed.

Many thanks for your assistance.

It took me a week to figure out this. Can I send bill to Bill?

share|improve this answer
    
Actually you can cut and paste passwords, you just have to use certain keystrokes. This works: Copy marked password with Ctrl+C and paste it with Ctrl+V. –  Ciove Apr 20 '12 at 8:37
add comment

Logging on using [webservername][username] and Integrated Windows Authentication are mutually exclusive. You should not have Integrated authentication checked if you want to logon by specifying a user account. Integrated Authentication means that IE will use the user's AD credentials to logon to the application.

share|improve this answer
    
Hi Greg, thanks for your answer. You may be right, I'll do testing and get back to you. However, my problem does not exist when using IE7 on WinXP. Somehow it seems to me that the Win7 tries to force the domain the user has logged into Win7 and/or the IE8 does not pass the [webservername]\ to the IIS6. –  Ciove Feb 21 '11 at 12:42
    
Hi. I'm still in the middle of testing. I've changed the authetication to Basic. I needed to ponder security issues, because the Basic authetication sends the usr and pw in cleartext, but this is in my case OK, because the connection is protected SSL/TLS. The Basic authetication works with WinXp and IE7, however I need to do some networking in order to connect my Win7 to my test service. –  Ciove Feb 22 '11 at 8:16
1  
Hi. No results yet, but found an interesting MS Technet article: 401.1 and 401.2-Authentication Problems (IIS 6.0). –  Ciove Feb 22 '11 at 13:53
    
Hi again. No success yet, Basic auth. in use. Win7/IE8 machine still does not autheticate properly. Now accountOne can log in, but accountTwo cannot. I haven't found the difference in between these accounts. The Web service log shows that accountOne sc-status is 401.2 when Web service asks for the credentials and 200.0 when the logon succeeds. The accountTwo log events are 401.2 and 401.1 with sc-win32-status value 1326 (Logon failure: unknown user name or bad password). The password is absolutely positively 100% correct. Any more ideas how to debug this further? –  Ciove Feb 23 '11 at 15:27
add comment

Sounds like you're having a problem with "Extended Protection" outlined here. If IIS6 is set to "Negotiate,NTLM" (or nothing) you're likely going to get the 401.2 error using IE8. You can check/set the authentication value by following these instructions.

share|improve this answer
1  
Hi Vinny and thanks for your answer. I had already done that, see my last bullet in the Server chapter. –  Ciove Feb 22 '11 at 8:03
    
hangs head in shame for not reading more completely and skips the basic auth answer as it's also in a comment above –  vinny Feb 22 '11 at 14:59
    
FYI, according to the doc @vinny referenced, if NTAuthenticationProviders are set to nothing then IIS6 defaults to Negotiate,NTLM –  uSlackr Jun 2 '11 at 20:52
add comment

Workaround: How to Copy+Paste passwords in Windows 7 and/or InternetExplorer 8

You can copy and paste passwords in in Win7 and IE8

  1. Mark and copy the password to clipboard with mouse's right-click+Copy function.
  2. Paste the password hitting Ctrl+V -keys.

This solution is described here:
http://social.technet.microsoft.com/Forums/en-US/w7itprosecurity/thread/80f59d82-84ca-4d87-93d4-dacc61f46a3f

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.