Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

we are using Virtual PCs for some testing mockup. One VPC is running as Domain Controller with AD configured on it. The domain name is testing.local. We have another VPC in domain running web application (configured as web site listening at port 198) using Integrated Windows Authentication and basic authentication (to send login id/pwd). Now the problem is that some users created in AD can access this application (http://testsystem:198/) and some cannot. IIS gives 401.2 error even after entering right login id/pwd combination.

I tried to search web and was directed to AuthDiag tool. I installed it and ran Active Directory (Kerberos Key Distribution Center) Information. It shows following error many times (there are many web sites running in this VPC):

Service principal name (SPN) for machine 'testsystem' not found in Active Directory

Please help we are stuck and cannot test application.

share|improve this question

It's some problem with the Kerberos authentication, possibly connected to the account you're running the website under - take a look at this:

If that isn't the exact problem the debugging steps listed there should allow you to add more details to your question that should help people to come up with a correct answer.

share|improve this answer

If you aren't using any delegation, set IIS to use NTLM only to eliminate kerberos.

For the default web site, use

cscript adsutil.vbs set w3svc/1/root/NTAuthenticationProviders "NTLM"
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.