We have IIS7 running on Windows Web Server 2008 R2. It's set up to support Web Deploy. It worked fine when we used the default Administrator account. We recently disabled this account (for security reasons) and are now trying to deploy using another account which is member of the Administrators group.

With this account, the deploy fails with 401 (Unauthorized). More specifically, it says:

Connected to '<IP>' using Web Deployment Agent Service, but could not authorize. Make sure you are an admin on '<IP>'. The remote server returned an error: (401) Unauthorized.

How can I resolve this issue?

4 Answers 4


Well it's a rights issues : Correct fix :

Quick fix (not recommended ) add the win user that you make deployment with to the administrators group .

Hope this helps .

  • As mentioned in my original question, the windows user that we currently use is a member of the Administrators group (which is also what you're suggesting as the quick fix). My question was why it doesn't work...
    – Trex
    May 28, 2012 at 16:05
  • 1
    It might be possible that you have all the security configured with IIS users instead of Windows users , please have a look at the first link technet.microsoft.com/en-us/library/cc732621%28v=ws.10%29.aspx .If you're deployng from Visual Studio , please have a look here learn.iis.net/page.aspx/1182/… . Please check on IIS what is the authentication mode (Authentication) and IIS Manager Users.
    – Alex H
    May 29, 2012 at 6:38

Check the access rights on Application Site and folder, go to Start Page/server(Name)(account)/Management. Or on SITE/APLICATION Management.


If you are getting this issue you can fix it by creating the following Windows Registry Key:

HKLM:\Software\Microsoft\WebManagement\Server "WindowsAuthenticationEnabled" set to "1"

You can easily achieve this by copying the following lines into a Powershell Console running it as an admin:

$webDeployWindowsAuth = "HKLM:\Software\Microsoft\WebManagement\Server" $winAuthEnabled = "WindowsAuthenticationEnabled" $winAuthValue = "1" if(Test-Path $webDeployWindowsAuth) { New-ItemProperty -Path $webDeployWindowsAuth -Name $winAuthEnabled -Value $winAuthValue -PropertyType DWORD -Force }

Then after checking if this key is successfully created on the Windows Registry you have to restart the Web Management Service to then be able to try to deploy again your application.


If you look at the location that will store the application files, its possible that the "Administrator" account has access but the "Administrators" group was never setup with such permissions. Also, the C:\windows\system32\inetsvr folder will likely need writes (because the deployment needs to update the config/ files and some application deployments update the eventlog registry keys. Just being a member of the administrators group is not always a "fix-all."

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .