AKA "When developers have to be their own sysadmins"

I've tried every configuration from the top 10 stack overflow and server fault results for WebDAV 405 on IIS (for verb PROPFIND and PUT). I'm running server 2008 SP2. Followed all the instructions here. I'm no stranger to configuring servers. This has gotten nowhere after 8 hours.

Confirmed system.webserver in applicationhost.config:

<add name="WebDAV" path="*" verb="PROPFIND,PROPPATCH,MKCOL,PUT,COPY,DELETE,MOVE,LOCK,UNLOCK" modules="WebDAVModule" resourceType="Unspecified" requireAccess="None" />
  • Port 443 with basic auth, same issue.

  • Tried port 80 with windows auth. Broken. (405)

  • Windows authentication. Check.

  • Added authoring rules for default site and application. Check.

  • Not the firewall. Check.

  • added "Desktop Experience" role feature

  • Tried HTTPS with Basic Authentication on port 443. Does not work.

  • No other services are running like Sharepoint. Check.

  • confirmed user has read/write NT level permissions for the folder/virtual dir

  • tried net use * http://localhost /user:MYDOMAIN\me myPass get error 1920, if I don't authenticate I get error 67

  • confirmed I'm not applying filtering to WebDAV:

        <fileExtensions applyToWebDAV="false" />
        <verbs applyToWebDAV="false" />
        <hiddenSegments applyToWebDAV="false" />

    405 - HTTP verb used to access this page is not allowed.

    The page you are looking for cannot be displayed because an invalid method (HTTP verb) was used to attempt access.


enter image description here

Other questions that helped none:

405 - ‘Method not Allowed’ adding service hosted in IIS7

webdav on iis7.5 - simply cannot make it work


  • +1 We're evaluating non-Windows solutions for WebDav. Our 2003R2 setup works flawless, 2008R2 not so much.
    – jscott
    Jul 7 '12 at 1:13
  • Get Head Options Trace are the default set of verbs for a non-DAV site. Sure the host header is lining up OK? (also: nice of you to blank out the URL target (aside: is a double-trailing-slash normal?) but you haven't blanked out the Host header. Which has the same information.)
    – TristanK
    Jul 8 '12 at 7:10
  • @jscott yeah, it seems that MS might have gotten overzealous in trying to lock down server security. Jul 9 '12 at 16:49
  • @TristanK I think that is just how the client (cyberduck) is rendering the error information. Should I be connecting to the default site host or the application directly? I've been connecting to the application (but I think I tried the default site at some point). Jul 9 '12 at 16:51

I just tried using very basic settings:

  1. Installed IIS Role with WebDAV Authoring & Windows Authentication selected (+ defaults)
  2. Enabled Windows Authentication on the default Website
  3. Disabled Anonymous authentication on the default website
  4. On the default website, in "webDAV authoring rules", i put:
    • All Content / All users / Read/Source/Write
    • And I enabled WebDAV on the default website
  5. I disabled the Firewall
  6. then, from another machine:

Maybe that helps getting you started...

  • Thanks. I will try exactly as you did. Are you running IIS 7.5 or 7.0? I've heard server 2008 R2 might work better than 7. Jul 9 '12 at 16:48
  • Windows 2008 R2 comes with IIS 7.5
    – MichelZ
    Jul 9 '12 at 16:54
  • Yeah, i'm running SP2, not R2, so I'm on IIS 7 Jul 9 '12 at 16:59
  • Cool. I think the one thing I missed was disabling anonymous auth-- not many of the installation guides mentioned this. I am now able to map the drive. I was hoping to use it with webdav API commands, but none of the clients I use can provide the correct 401 challenge authentication. Jul 9 '12 at 17:37

I've struggled and struggled with this. I have stopped my website running on port 80 and WebDav works fine. As long as I create a seperate site for WebDav and have it running on a different port then both my website AND WebDav work! Yay, I'm golden. I hope this helps someone else.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.