I'm trying to set up Windows authentication for a new website in IIS 7.5. I have the Windows authentication module enabled for the site and all other authentication types(such as anonymous, Basic etc) disabled. The App pool for the site runs under a custom identity for which the SPN and host headers have been set appropriately. On trying to access any content(such as a text file) hosted under the site via the browser, I get a 401.2 error. I followed this suggestion and added the useAppPoolCredentials attribute to the applicationHost.config and I'm able to access the resource using Windows auth.
I then removed the attribute and saved applicationHost.config again effectively undoing my changes and I'm still able to access the resource.What gives? Can some one help me understand this behavior?
Also in one particular installation of IIS 7.5 on Win server 2008R2 I have noticed that any changes to the default configuration of a site (or an application) causes IIS to generate a Web.config file automatically at the root of the site/application. Is there a setting to enable this instead of having to update applicationHost.config directly?
EDIT The browser was caching the response and hence undoing the changes ans saving the file seemed to make no difference. So the only question I have now is related to generation of the Web.config