Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm on IIS6 and 3.5 SP1.

I decided that my web application should have a dedicated application pool and a dedicated identity, because this identity is granted access to a sensitive file share that the web application uses. The web application uses integrated windows authentication for the incoming users, and my problem is that when the application pool is set to a dedicated identity, all incoming users fail to authenticate, i.e. the login box (from internet explorer) re-appears after the user submits his password. This problem does not occur when the application pool is set to the NETWORK SERVICE identity.

The dedicated identity has been granted access to the machine's IIS_WPG group and I have tried the following command:

aspnet_regiis.exe -GA myDomain\myDedicatedIdentity

But still no luck. Any suggestions? Any privileges that I forgot to grant to this identity?

share|improve this question
up vote 2 down vote accepted

I found the solution to my problem: set up an HTTP SPN with the NetBIOS name and the fully qualified domain name (FQDN) of the domain user account that the application pool is running under. Here's the article:

share|improve this answer

Probably a kerberos issue.

I'd initally try:

cscript adsutil.vbs set w3svc/1/root/NTAuthenticationProviders "NTLM"

Where the 1 is the web site.

Once you've determined if it is Kerberos, you can either continue on NTLM only, or set the SPN's for your site/URL on the Service Account.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.