I run several web sites using IIS on both Windows Server 2003 and Windows Server 2008. These web sites use windows authentication with only the NTLM option specified (no Kerberos).
These servers are both members of the same active directory domain, functional level Windows Server 2003. There are domain controllers running both Windows Server 2008 and Windows Server 2012.
The domain has a two-way trust with another active directory domain in its own forest.
Occasionally, users cannot authenticate to the IIS web sites when using a user account from the trusted domain. They are repeatedly prompted for credentials by their browser and after several attempts a blank page is shown. The credentials are valid. As a troubleshooting step I granted a test account from the trusted domain permission to logon to the web server locally and was able to logon to the web server using that account at the same time that IIS would not allow the user to logon with the same credentials.
The problem does not happen to all web servers at the same time, one will be affected while the others continue to process login requests from the trusted domain successfully.
Restarting the workstation service resolves the problem (as well as restarting the entire server).
My questions are:
How can I determine which active directory domain controller is processing the login requests from IIS for: a: the primary domain b: the trusted domain
When a login request for the trusted domain is received by IIS, how is that request handled? Specifically, is the request sent to a domain controller in the primary or secondary domain, and how is the specific domain controller chosen?