1

I have a test active directory domain named ad.example.com and have joined some Windows clients stations to the AD domain.

I'm able to log on the client station as AD\username. However, when I try to access protected IIS resource on the the DC (dchostname.ad.example.com) I have to use EXAMPLE\username because AD\username does not work.

Why is this the case? I want to be able to logon to the IIS resource as the logged on user AD\username. Am I missing any setting in IIS to be able to use AD\username to access it?

[Additional Information] The server is Windows Server 2008 R2 with IIS 7. The client is Windows 7. Netbios name is dchostname. The protected resouce being accessed is ADFS trust points hosted under IIS Default Web Site to test single signon. As you can tell this is a test setup so I'm not too concerned about sharing on the DC.

In my other setup where the domain name is simply example.com everything works as expected. I'm trying to understand what is different about naming a domain ad.example.com and why that behaves differently. In this case is the domain AD being considered a subdomain? This is the only domain in the forest.

|improve this question
  • One or more AD groups must be granted permissions in IIS as well as the resource on the filesystem. What do the permissions look like, what version of Windows? Not enough information. – dartonw Apr 13 '15 at 5:05
  • 2
    What is the NETBIOS name of your domain? – Mark Henderson♦ Apr 13 '15 at 5:20
  • I've added [Additional Information] to my original post. I'm not accessing file shares, but rather ADFS trust points as part of single signon. – user3669561 Apr 13 '15 at 14:10
-2

Check permissions: who's allowed to use these shares. Also, sharing something on DC is the bad idea.

|improve this answer
  • 2
    There are things that need to be shared on the DC, such as the netlogon and sysvol shares. DFS roots also sometimes show up on domain controllers, as to certificate server resources (like the root certificate). So whilst you shouldn't use your DC as a general purpose file server, it's not unheard of to have shared folders on there. – Mark Henderson♦ Apr 13 '15 at 5:19
  • @MarkHenderson see, the q's author explicitly connects to dchostname.ad.example.com. Netlogon, sysvol and DFS should not be accessed as "host's shares", instead they must be accessed as "domain's shares", regardless of their physical location, aren't they? – Troublemaker-DV Apr 13 '15 at 5:42

Your Answer

By clicking "Post Your Answer", you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.