Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have an site that is running on IIS7 on Windows Server 2008 R2, my site is under Default Web Site node under the Sites node.

On my site's authentication tab, I have:

  • Windows Authentication
  • Basic Authentication
  • Anonymous Access
  • Forms Authentication
  • ASP.NET Impersonation

These are all enabled -I didn't set those myself, a fellow developer on the team did. Everybody on the same network is able to access the site without any issues, except for one user who is on another domain -don't know if it's a trusted or not.

When that user on the other domain tries to access the site, IE displays a security dialogue asking for credentials. My site doesn't make use of any windows credentials, so I don't really need to know the Windows username and password for the visitor. The dialogue that is displayed by IE doesn't block the user from accessing the site, in fact no matter what she does (enter some blah blah credentials, or even cancel out off the dialogue) the site will still open as intended and she will be able to use the different functionality of the site.

My question is: What are the correct settings that I should be using to force IE not to display the security popup?

share|improve this question
Have you tried disabling all the authentication methods except Anonymous Access? – Bart De Vos Sep 8 '11 at 13:04
Nope, will experiment. – Galilyou Sep 12 '11 at 17:19

Since cancelling allows her to view the site still, I bet that it's one of the dependencies on the page that requires authentication. It may be .css, .js or maybe an ad, or something that her environment adds to the page via a proxy server.

You can test this by giving her a test.html page that simply says "Testing". If she can review that without a prompt, then my theory is correct. If my theory is correct, then review the page to find out which file isn't allowed, and trace that down to find out why.

Since you only want to allow anonymous access, you can remove all other forms of authentication to rule that out. However, I think it's something more than that.

share|improve this answer

(Four years later..)

I really hope you're not still waiting for an answer to this issue ! But, for any other readers with the same problem, here's one thing to check.

On your IIS server, use Explorer to find the Windows directory where your web site files are stored, right-click, select Properties, go into the Security tab, and make sure that YOURSERVERNAME\Users have at least some permissions on this folder.

enter image description here

In our case, we found that developers could log into an IIS website, but some other users were just getting the unhelpful "Windows Security" dialog box.

We thought it must be an issue with our web.config, or the authentication method on the IIS site.


Simply, we'd created a directory on our IIS server, which had somehow been given read-write permissions to the Administrators on that particular server, but gave no permissions to regular users.

It's frustrating that even now in 2015, IIS 7.5 doesn't provide some kind of helpful error message when problems like this occur.

Popping up a Windows Security dialog which just reappears when you click on OK isn't helpful at all...

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.