This morning, something wierd happened with our Active Directory.

We have a website that authenticates users against our Active Directory. It has worked flawlessly for weeks. The code involving this has never changed. When I launch a copy of the website on my local computer within the IDE (Visual Studio 2008), it authenticates users correctly, and determines what groups they belong to correctly. When I navigate to the actual website though, it authenticates but fails to retrieve any group information. While I am open to the possibility that it would be code, I am very skeptical of this since the code has not changed since the last time it was working, which was yesterday.

Being a programmer and not a server administrator, I am unsure where to begin in hunting down this problem and will appreciate any assistance the community at large can provide.

EDIT: I wrote a quick application using the same exact programming code, but in a compiled Windows Forms application instead of a web page. The application can authenticate and retrieve all the groups flawlessly. So it is just the website that, all of a sudden, cannot access the groups. I am sure this is relevant, but I am not sure how =)

  • So what's the query? What errors are you getting? Are you using ADSI or S.DS.P? ... Aug 28 '09 at 23:18

Is your web application being granted permission to the directory by way of a privileged IIS application pool? If so, there may be an issue with the service account that the pool is running under.


The first place I would look would be in your AD logs in the Event Viewer, my first thought is there is a replication issue going on. Are there any KCC errors in the logs?

  • I just checked, and there is 1, but the timing of it is after the problem appeared and I suspect it is a result of our blindly poking around at things. God that sounds sad even as I type it. Aug 27 '09 at 21:33
  • Was .Net framework updated recently? Any errors in the IIS or Systems logs?
    – Zypher
    Aug 28 '09 at 1:56

Did any Windows Updates install recently? Might try rolling it/them back temporarily.


By the sound of it I'd guess it's a problem local to the configuration of that particular server and your Active Directory is otherwise working fine - though the problem is a bit too vague.

What do the event logs on it say? If you copy that deployment to another machine, will the problem follow? As Mike wrote, how is the web site querying Active Directory? Perhaps the account it's using for that has a problem (expired, password changed aso)? It could be a network issue, firewall blocking or some other issue with that server reaching domain controllers correctly?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.