Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have an ASP.NET app on a Windows 2008 server, IIS 7.5.

When I try to access web site, I get a login popup. If I click "cancel" I get a 401 - Unauthorized: Access is denied due to invalid credentials. The app is using Windows authentication (anonymous is disabled).
The app has it's own app pool, running under the App Pool Identity. If I change the app pool to run under the NetworkService account, my website functions just fine.

I'm guessing that this is just a permissions issue, but can't figure out what permissions I need to change.
I gave the App Pool Identity permissions on the physical directory of the app, but that didn't solve the problem.

share|improve this question

2 Answers 2

I also had this issue occur when I switched my IIS application pool account from NetworkService to a domain user account. I could not access the site externally (401 - Unauthorized), but on the server itself I could access the site.

The issue seems to be linked with Kerberos authentication. IIS 7 attempts to use Kerberos first and can't authenticate properly - (must require more configuration). If you disable Kerberos, you might find that you can actually access the website from an external machine:

You can perform a quick test to check if your issue relates to Kerberos authentication by:

  • In Internet explorer open Tools > Internet Options > Advanced > Security > Enable Windows Integrated Authentication - UNCHECK this option. This forces IE to authenticate with your site (or any site) using NTLM only. If you can successfully authenticate, then your issue is that Kerberos isn't fully configured.

This issue occurred for me several times when i migrated sites from IIS6 (defaults to NTLM) to 7 (defaults to Kerberos). I did not want to configure Kerberos, so instead i forced my IIS web server to use only NTLM with the following command: cscript "F:\inetpub\AdminScripts\adsutil.vbs" set w3svc/NTAuthenticationProviders "NTLM"

The default value is "Negotiate,NTLM". To check your existing value, use: cscript "F:\inetpub\AdminScripts\adsutil.vbs" get w3svc/NTAuthenticationProviders

If anyone has a deeper understanding of why Kerberos authentication fails please let me know. Also, if anyone knows how to force NTLM authentication only for specific application pools rather than the entire IIS web server please also let me know.

share|improve this answer
    
There must be some way to force an application pool to only use NTLM, because SharePoint can create app pools that do exactly that. This issue doesn't occur for a SharePoint IIS site because IIS doesn't even attempt to use Kerberos for that site only. –  Shane Jun 6 '12 at 2:06

Granting the app pool identity access to the content should be enough in most cases. Since it still prompts, but doesn't for NetworkService, my guess is that a sub-folder didn't get the new permissions you added, or there is another dependency that the site has to something like the registry.

Try a standard .htm page to confirm that the root of the site works. Double check that the correct app pool identity was granted and that it was granted to the correct path.

share|improve this answer
    
I verified the permissions, paths, etc., but still didn't solve the issue. However, I was able to find a solution to the problem, but I'm somewhat confused. The App pool identity wasn't a member of the IIS_IUSRS Group. Once I added it, the site worked just fine. Here's the confusing part. I then went back and removed the app pool identify from the group and still works. Even after a server reboot. I thought when iis app pool identities were created, they were automatically in the IIS_IUSRS group. Some sites say yes, others say "at runtime." –  Eric Gatesman Mar 29 '11 at 18:47
    
You're right that the app pool identity is automatically injected into the IIS_IUSRS group at runtime. So your situation sounds like some issue prevented that from working as it should. You may find an answer in Event Viewer, but if it works from now on, I would just consider it a rare exception. If it occurs again, watch for clues in Event Viewer and other patterns. –  Scott Forsyth - MVP Mar 29 '11 at 19:42
    
Will do. Thanks –  Eric Gatesman Mar 30 '11 at 19:47

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.