I'm a developer that's been asked to maintain the IIS configuration for the web app that we're building, so bear with me.
We have an internal website that is accessible to employees once they've logged into the Windows LAN. The servers are Windows Server 2008 R2, they are remotely managed by an external service provider, and they have Symantec Endpoint Protection installed on them.
I rebooted our test server and now the website is asking for user credentials to view the page. Unfortunately, when I enter a valid user name and password for the corporate domain, it's not accepted. The server can still be Remotely connected through Citrix Jumpservers using a user account and the corporate domain, so it seems to be specific to IIS.
The IIS permissions for the website are set to:
Anonymous Authentication - disabled ASP.NET Impersonation - enabled Forms Authentication - disabled Windows Authentication - enabled
I need to leave anonymous authentication disabled because of a flow through requirement in the system to Hummingbird's DM webservice.
This was working before the reboot and there were other issues going on with the company at the time (internet proxy spontaneously denied all internet webpages, and a samba share wasn't remounting for service account users). The code wasn't changed, and the IIS configuration wasn't changed (to my knowledge), so it seems like something on the network has changed, or maybe the service account.
This issue is likely going to get moved to corporate IT, but I need some sort of evidence that points to this being a network or security issue. Otherwise, they will simply dismiss it saying that it's our web app's fault or our IIS setup. Maybe it is, but I'm not sure what else to check and nothing was changed except rebooting the machine.
Are there any tests or tools that I can run to test the authentication configuration and isolate potential causes? Given that the server has Symantect Endpoint Protection on it, is there a setting that may have been changed that would cause this behaviour? Are there other settings in the Server Management Console that might cause this behaviour?