Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a site installed on a server owned by a client. The client now, due to using MobileIron for single-sign-on capabilites on mobile devices, requires my site to work with Kerberos authentication. The web server is IIS 7.5.

The client has set up Kerberos in IIS, but somehow this does not seem to work. When testing on a computer, I can see with Fiddler that authentication falls back on using NTLM. As far as I can see everything is set up correctly in IIS(I've used this site to validate the setup: ).

Enabling event viewer logging for Kerberos, gives me the following error:

A Kerberos Error Message was received:
 on logon session 
 Client Time: 
 Server Time: 14:23:14.0000 12/19/2013 Z
 Error Code: 0x1b Unknown Error
 Extended Error: 
 Client Realm: 
 Client Name: 
 Server Realm: [CLIENT].LOCAL
 Server Name: [user]@[CLIENT].LOCAL
 Target Name: [user]@[CLIENT].LOCAL@[CLIENT].LOCAL
 Error Text: 
 File: 9
 Line: f09
 Error Data is in record data.

How can I troubleshoot this? What tools are available for testing the Kerberos setup?

share|improve this question
Using Kerberos Authentication Tester by Michel Barneveld, I get a "unexpected authorization header" error message, even if I try the tool from another machine on the network. – hazard Dec 23 '13 at 7:55
up vote 0 down vote accepted

After quite a few hours digging into this, I finally found the solution, through running the DeleConfig wizard, and changing the identity of the application pool to NETWORK SERVICE. For future reference, here's the two most helpful resources that I used:

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.