Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Technical Setup

We have a website set with no anonymous access on a webserver (, and making use of two hostheader values (with appropriate DNS entries created):

The domain we use is work.local

IIS Directory security is set to:

Enamble Anonymouse Access = False (unticked)  
Integrated Windows Authentication = True (ticked)  
Digest Authentication = True (ticked)  
Realm = **work.local**


When I access it correctly identifies the currently logged in user to the domain (no login window displayed)

When I access it always prompts me to supply the username and password.

Things tried

  1. Looked at the Windows Server 2003 SP1 issue, that didn't work (though it did get the working)
  2. Looked at using Authentication and Access Control Diagnostics tool to try and spot issues with authentication, it reported no errors

I think it has something to do with thinking that if you're accessing then you are not part of the work.local domain and so therefore don't even attempt Integrate Windows Authentication, but that's just a theory

share|improve this question
up vote 0 down vote accepted

By default, Internet Explorer only performs "transparent" authentication for sites in the "Local Intranet" security zone. Your "" is probably being identified as being in the "Internet" security zone and, thus, no automatic logon is occurring.

You can add that site to the "Local Intranet" zone through the "Advanced" settings on the "Local Intranet" zone from the "Security" tab in "Internet Options", or you can modify the setting re: automatic logon in the "Internet" zone settings.

share|improve this answer
Is there a way to add to the domain server (rather than updating all potential client machines)? – Andrew Bickerton Oct 28 '09 at 0:08
You can either write a script to add this entry to each client's registry, you can use "Internet Explorer Maintenance" policy, or you can use the "Site to Zone Assignment" Administrative Template policy (located in Windows Components / Internet Explorer / Internet Control Panel / Security Page in both computer and user settings) to affect the desired change. I believe that the last method is the currently encouraged (by Microsoft) method for making such a change. – Evan Anderson Oct 28 '09 at 13:22
Thanks for that Evan! – Andrew Bickerton Oct 28 '09 at 17:13

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.