I run several web sites using IIS on both Windows Server 2003 and Windows Server 2008. These web sites use windows authentication with only the NTLM option specified (no Kerberos).

These servers are both members of the same active directory domain, functional level Windows Server 2003. There are domain controllers running both Windows Server 2008 and Windows Server 2012.

The domain has a two-way trust with another active directory domain in its own forest.

Occasionally, users cannot authenticate to the IIS web sites when using a user account from the trusted domain. They are repeatedly prompted for credentials by their browser and after several attempts a blank page is shown. The credentials are valid. As a troubleshooting step I granted a test account from the trusted domain permission to logon to the web server locally and was able to logon to the web server using that account at the same time that IIS would not allow the user to logon with the same credentials.

The problem does not happen to all web servers at the same time, one will be affected while the others continue to process login requests from the trusted domain successfully.

Restarting the workstation service resolves the problem (as well as restarting the entire server).

My questions are:

  1. How can I determine which active directory domain controller is processing the login requests from IIS for: a: the primary domain b: the trusted domain

  2. When a login request for the trusted domain is received by IIS, how is that request handled? Specifically, is the request sent to a domain controller in the primary or secondary domain, and how is the specific domain controller chosen?


1 Answer 1


To answer your second question first:

Since you're still using NTLM, reading about the flow of NTLM in a multi-domain environment might help you out a bit with this. IIS will contact a Domain Controller (DC) in its domain, which will in turn contact a DC in the trusted domain.

The trusting DC does a DNS lookup against the trusted domain's name and sends LDAP and NetBIOS requests to all the DCs returned by that query. The first one that responds "wins". That's likely why you're seeing some non-determinism in this process. You could influence this process by monkeying with DNS.

Locating the authenticating DC is going to be a matter of either capturing the authentication traffic, or watching the Security Event Log of all the DCs where the authentication could be occurring.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.