I have re-created an IIS7 site hosting an asp.net application. The old site allowed both local and domain accounts to log in.

The new site is working fine for local accounts, but no domain accounts can log into the site.

My settings:

  • Authentication: Only Windows Authentication is enabled. Negotiate & NTLM providers.
  • Authorization: Anonymous access denied; all others are allowed.
  • Domain users have read access to the wwwroot directory (is this even necessary?)

When I access the site as a domain user, IE9 asks my credentials repeatedly, eventually yielding to HTTP Error 401.1 - Unauthorized.

*Update: Binding is related. If I set the binding to use host header "x.y.com", and access the site via http://x.y.com, I get the error (local user accounts can authenticate, domain users cannot)

Binding to localhost:80 works fine for domain and local accounts.


The solution is to make sure the NTLM windows authentication provider is at the top of the list. "Negotiate" was denying access.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.