We have some servers that we're trying to allow domain users to log into the web site. Unfortunately, it seems that only administrators can do so. All other users get 401.2 authentication errors.

I'm trying to track down what group policy setting may be in effect that overrides the application configured authorization. Does anyone have any suggestions on where to look?

More info:

Site hosts an asp.net web forms application configured to use Windows Authentication. The Web.config is configured to allow all users access <allow users="*"/>. Administrators can access the page, and their identity is shown. Non-administrators get an authentication dialog, which does not accept their username/password.

The server is configured to not allow interactive login from non-administrators, but that shouldn't affect IIS authentication, should it?


Both gpresult /H and RSOP.msc are the standard tools for troubleshooting group policy issues.

Give them a whirl and you'll see every policy item applying to your server.

  • Thanks, I am aware of those and have used them, but we have a lot of group policies, and I'm looking to narrow down what policies might be affecting this. – Erik Funkenbusch May 31 '13 at 6:33

Check your permissions on the web site's folders on your filesystem. Windows authentication passes the user to the system, if the user doesn't have access to read the files for the website you will get your 401.2, the actual app pool user performs the server side actions but the user will still need read access to the filesystem.

So if you want all users to have access add: YourDomain\Authenticated Users

And add that group to have read & execute and read. On occassion you might want list folder contents. Just filesystem access no share or anything else.

  • Permission errors return 403's, not 401's. 401 means that the username/password are not accepted. – Erik Funkenbusch May 31 '13 at 6:30
  • well, with windows auth and IIS you'll notice this if the username/password is valid but doesn't have access to the filesystem: 2013-05-31 12:14:42 server-ip GET / - 80 domain\user source-ip Mozilla/5.0+(Windows+NT+6.1;+WOW64;+rv:21.0)+Gecko/20100101+Firefox/21.0 401 0 0 62 – HypnoticPancake May 31 '13 at 12:17
  • You always get at least one 401, because that issues the challenge. But that's the 401.0 (notice the number after the 401 is 0). The next one will be a 403 if it's a permissions problem. If a 401.2 follows it, it means the user was not authenticated. – Erik Funkenbusch May 31 '13 at 13:46
  • Yea just dug some more, I actually get a 401.1 not a 403. I would still define this as a IIS problem more than a group policy problem. Which IIS version are you running? Can I get a screen shot of the IIS authentication settings? – HypnoticPancake May 31 '13 at 14:16
  • Users that are in the Administrators group can access the page just fine, non-administrators cannot authenticate. If it were a configuration of IIS problem, then admins wouldn't be able to authenticate. The screen shot would just show Windows Auth enabled, and everything else disabled. That's not going to show you anything. – Erik Funkenbusch May 31 '13 at 14:30

One more thing worth to check: is your physical folder hosting web site content accessable to domain users? In my case, when I added read permission to domain users, the problem gone.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.