Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

We have two Windows Server 2008 R2 Web Edition servers, both VIRTUAL on VM Ware hosts, and every....single...time we create a new website on the server, add the proper domain users to the web site folder on the hard drive, and publish the website, no matter what, even on the server itself, the website challenges for a userid and password. And to boot, even if you login with proper credentials, it continues to prompt, not accepting the credentials at all.

The ONLY resolution: rebooting the server. This is unacceptable since one of the two servers is a production server.

I'm open to suggestions before, much to the Admins dismay, I start tossing servers out non-existent windows....

Thanks!

share|improve this question
    
ok. i have some more information. our web server is on a different box than our sql server, keep this in mind. so, we changed the name of the bindings and the DNS entry. And, i could access the website. But, it wasn't passing the authenticated user credentials to our SQL server. So we did SETSPN -D and removed the previous entry. Then a SETSPN -A and added the new dns entry name....and bam. it's back to challenging for user id and password. It's once we set the service principal name so the credentials are passed to other servers that this happens. and yes...a reboot WILL fix this. –  BlueProdigy Jul 28 '11 at 16:35
    
What type of authentication are you using? What URL is being used to access the site? What IE security zone is the site in when you access it and experience this behavior? –  Somantra Jul 28 '11 at 16:59
add comment

3 Answers

That is odd since a reboot rarely fixes anything to do with permissions. I recommend using process monitor next time to find out which permission it's hanging up on.

Check out week 20 from this series for a quick walkthrough on how to use procmon.

share|improve this answer
add comment

we are using windows authentication in IIS 7 (NTLM) as well as identity impersonation. the website would be similiar to ourwebsite.ourdomain.com, and access would be http://ourwebsite for example. this happens regardless of who's machine and version of browser. it's not an issue with IE.

share|improve this answer
    
reboot: the server, the actual windows 2008 server server. this is not a development environment. we set up the new website on the production server and then tryied to access it from the browser and it's a no-go ,ONLY after we ran the SETSPN utility. if we reboot the server (server server), then miraculously everything is hunky dory. i'm starting to think a tag needs to be added for ACtive Directory. –  BlueProdigy Jul 29 '11 at 1:43
add comment

Just a comment: Never bother testing from the local computer. It has security protections in place by default (since 2003 or 2003 SP1, I think) that disable loopback authentication, to prevent reflection attacks.

This doesn't fit with your scenario because a reboot fixes it. If a reboot fixes it, I'd experiment with:

  • disabling kernel-mode authentication and/or
  • enabling UseAppPoolCredentials

It sounds like the SPN stuff might be OK... except that you've mentioned delegation is in use, which would require actions on your part you haven't documented in the question.

Does recycling the app pool in question help? ('The ONLY solution is rebooting' doesn't cover what you've tried as an alternative, and I don't know you, so I don't know what that means to you. It could mean IISReset, it could mean recycling an app pool, it could mean sacrificing a chicken.)

In case you missed the subtext... you've skipped a whole lot of probably-obvious-to-you detail, which might determine a better troubleshooting path than "well if you meant this, try X, and if you meant that, try Y".

Time for my morning coffee. Apologies for any undue snark.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.