2

We have some servers that we're trying to allow domain users to log into the web site. Unfortunately, it seems that only administrators can do so. All other users get 401.2 authentication errors.

I'm trying to track down what group policy setting may be in effect that overrides the application configured authorization. Does anyone have any suggestions on where to look?

More info:

Site hosts an asp.net web forms application configured to use Windows Authentication. The Web.config is configured to allow all users access <allow users="*"/>. Administrators can access the page, and their identity is shown. Non-administrators get an authentication dialog, which does not accept their username/password.

The server is configured to not allow interactive login from non-administrators, but that shouldn't affect IIS authentication, should it?

3 Answers 3

2

Both gpresult /H and RSOP.msc are the standard tools for troubleshooting group policy issues.

Give them a whirl and you'll see every policy item applying to your server.

1
  • Thanks, I am aware of those and have used them, but we have a lot of group policies, and I'm looking to narrow down what policies might be affecting this. May 31, 2013 at 6:33
3

Check your permissions on the web site's folders on your filesystem. Windows authentication passes the user to the system, if the user doesn't have access to read the files for the website you will get your 401.2, the actual app pool user performs the server side actions but the user will still need read access to the filesystem.

So if you want all users to have access add: YourDomain\Authenticated Users

And add that group to have read & execute and read. On occassion you might want list folder contents. Just filesystem access no share or anything else.

6
  • Permission errors return 403's, not 401's. 401 means that the username/password are not accepted. May 31, 2013 at 6:30
  • well, with windows auth and IIS you'll notice this if the username/password is valid but doesn't have access to the filesystem: 2013-05-31 12:14:42 server-ip GET / - 80 domain\user source-ip Mozilla/5.0+(Windows+NT+6.1;+WOW64;+rv:21.0)+Gecko/20100101+Firefox/21.0 401 0 0 62 May 31, 2013 at 12:17
  • You always get at least one 401, because that issues the challenge. But that's the 401.0 (notice the number after the 401 is 0). The next one will be a 403 if it's a permissions problem. If a 401.2 follows it, it means the user was not authenticated. May 31, 2013 at 13:46
  • Yea just dug some more, I actually get a 401.1 not a 403. I would still define this as a IIS problem more than a group policy problem. Which IIS version are you running? Can I get a screen shot of the IIS authentication settings? May 31, 2013 at 14:16
  • Users that are in the Administrators group can access the page just fine, non-administrators cannot authenticate. If it were a configuration of IIS problem, then admins wouldn't be able to authenticate. The screen shot would just show Windows Auth enabled, and everything else disabled. That's not going to show you anything. May 31, 2013 at 14:30
0

One more thing worth to check: is your physical folder hosting web site content accessable to domain users? In my case, when I added read permission to domain users, the problem gone.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .