Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a machine that was a domain controller and everything else, includin an IIS site. I built new 2 new domain controllers and transferred the FSMO roles and waited a day and then demoted the original domain controller. Now the IIS site says :

HTTP Error 401.2 - Unauthorized You are not authorized to view this page due to invalid authentication headers.

I have a call in with the web app vendor, but maybe someone can guess what I need to fix now. I haven't looked at IIS since this was installed and am pretty lost.

I thought about restoring the machine from a backup, but I think that would be an Active Directory disaster, right?

The server is Windows 2008 (not R2). The new DCs are 2008 R2

share|improve this question
Actually, having re-read your question, are the new DCs part of the same domain as the old one? – Chris McKeown Apr 3 '12 at 23:07
@ChrisMcK yes, same domain – tladuke Apr 3 '12 at 23:11
In that case it may be a similar problem related to the IUSR account - did you enable Anonymous authentication when you installed IIS on the new DCs? I'll edit my response accordingly – Chris McKeown Apr 3 '12 at 23:13
IIS is not installed on the new DCs. Just on the old one I demoted. – tladuke Apr 3 '12 at 23:20
In that case try removing/readding the anonymous authentication subfeature. – Chris McKeown Apr 3 '12 at 23:21
up vote 2 down vote accepted

A guess...

Domain controllers have no local users and groups - they're all held in Active Directory.

When you installed IIS on the DC, it would have created an IUSR account for anonymous access to the sites. This would have been stored in AD and likely was deleted when you demoted it.

Now that the DC has been demoted, the IUSR account is no longer valid. You'll need to re-create the anonymous internet user account. It might actually be easier to back the sites up and remove/reinstall IIS.

Edit: You may need to enable Anonymous Authentication on the new 2008 DCs in the IIS features.

share|improve this answer
I would backup the sites and reinstall the OS. – Mathias R. Jessen Apr 3 '12 at 23:06
I'm hoping to not need to reinstall the OS because of all the other stuff running on it. I'm about to get yelled at for this site being down. Oops. – tladuke Apr 3 '12 at 23:13
There really shouldn't be any need for DC restore or OS reinstall. Just follow Chris' advice and set proper user account for IIS – Dusan Bajic Apr 5 '12 at 12:01

The person is correct, DC's "don't have local accounts while a DC". When you dcpromo'd down the box, local users were available, you might need to set the IUSR account in the anonymous authentication module. The error you are seeing is because no authentication providers are enabled.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.