I also had this issue occur when I switched my IIS application pool account from NetworkService to a domain user account. I could not access the site externally (401 - Unauthorized), but on the server itself I could access the site.
The issue seems to be linked with Kerberos authentication. IIS 7 attempts to use Kerberos first and can't authenticate properly - (must require more configuration). If you disable Kerberos, you might find that you can actually access the website from an external machine:
You can perform a quick test to check if your issue relates to Kerberos authentication by:
- In Internet explorer open Tools > Internet Options > Advanced > Security > Enable Windows Integrated Authentication - UNCHECK this option. This forces IE to authenticate with your site (or any site) using NTLM only. If you can successfully authenticate, then your issue is that Kerberos isn't fully configured.
This issue occurred for me several times when i migrated sites from IIS6 (defaults to NTLM) to 7 (defaults to Kerberos). I did not want to configure Kerberos, so instead i forced my IIS web server to use only NTLM with the following command:
cscript "F:\inetpub\AdminScripts\adsutil.vbs" set w3svc/NTAuthenticationProviders "NTLM"
The default value is "Negotiate,NTLM". To check your existing value, use:
cscript "F:\inetpub\AdminScripts\adsutil.vbs" get w3svc/NTAuthenticationProviders
If anyone has a deeper understanding of why Kerberos authentication fails please let me know. Also, if anyone knows how to force NTLM authentication only for specific application pools rather than the entire IIS web server please also let me know.