Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Our web server is on a different box than our SQL server. When I first set up the website, I could access it, but it wasn't passing the authenticated user credentials to our SQL server (as expected).

I did the SETSPN -A configuration to add the SPN to our domain for the new website on the webserver (as we always do), and now the website is challenging for user id and password, but won't accept the credentials (3 times, then no access 401).

The website is configured for Identity Impersonation and windows authentication, just like the other 8 websites on the same server with the same configuration, that all work.

This only occurs on NEW websites, and usually, we have to reboot the server to fix it.

Any suggestions to get this to work with out a reboot?

share|improve this question
Tried an IISreset? – Nixphoe Jul 29 '11 at 1:48
NTLM authentication in IIS, standard application pool using ApplicationPoolIdentity, and single server, no farm. As far as IIS Reset, I'd like to reitterate: This is a production server! The point is, I'd like to be able to set up a new website on it, without having to take down all of the other existing websites. But so far, since we run SETSPN, we haven't been able to do this. And no, IISRESET /RESTART does not work. – BlueProdigy Jul 29 '11 at 13:28
OK I still am not clear on what you mean. Does your application pool run as a domain account or not? Please look in the identity tab for details. When you say NTLM authenticationdo you mean that is the only provider configured in settings for Windows Integrated authentication? You dont have negotiate as a provider? – maweeras Jul 29 '11 at 17:18
I would look at trusting the computer for delegation in Active Directory. – user89811 Jul 29 '11 at 20:23
+1 to Will. yes this would be one of the required steps if the app pool identity is network service. Else you'd configure the SPN on the service account used for the app pool and also configure this service account to be trusted for delegation as applicable. Either unconstrained or constrained to the SQL related SPN's specifically. But hard to suggest an answer until BlueProdigy is clear about exactly what is his configuration. I.e. account used for app pool, kernel mode auth usage etc. – maweeras Jul 29 '11 at 20:43

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.