3

I have a website that runs on IIS that uses windows authentication.

On the website level, under 'Authentication' I have only Windows Authentication (NTLM only as a provider) enabled.

On the virtual directory level, under 'Authentication', I have ASP.NET Impersonation and Windows Authentication (NTLM only as a provider) enabled. (Disabling ASP.NET Authentication here does not change anything)

  • The IP address of the server running IIS is: 172.0.0.10
  • The computer name of the server running IIS is: myiisserver
  • The FQDN on the server running IIS is: myiisserver.mydomain.com
  • A DNS 'A Record' exists to point 172.0.0.10: myapp.mydomain.com

On the website bindings, I have:

Type  |  IP Address      |  Port  |  Host Name
--------------------------------------------------------------
http  |  All Unassigned  |  80    |  localhost
http  |  All Unassigned  |  80    |  myiisserver
http  |  All Unassigned  |  80    |  myiisserver.mydomain.com
http  |  All Unassigned  |  80    |  myapp.mydomain.com

This is the only website that I have running on the IIS server.

The App Pool running the web site and the virtual directory is the same and uses 'NetworkService' as the identity.

On the IIS server and on other workstations in the network:

  • myiisserver is added to 'Trusted Sites'
  • myiisserver.mydomain.com is added to 'Trusted Sites'
  • myapp.mydomain.com is added to 'Trusted Sites'

On the trusted sites zone, Automatic logon using current user name and password is selected on the IIS server and other workstations.

On Internet Options -> Advanced, Enable Integration Windows Authentication was enabled on the IIS server and other workstations.

On other workstations in the network:

On IIS server:

  • 1
    So that I make sure I understand the problem - http://myapp.mydomain.com is working for all/most workstations, except for one? – mfinni Sep 16 '15 at 13:26
  • It works on all workstations except for the server running IIS. I've seen this happen in multiple customer environments. Want to know how we can make it work on the server running IIS as well. Thanks for your help! – slayernoah Sep 17 '15 at 3:15
  • This is going to sound crazy, but when you ping myapp.mydomain.com, it responds how you expect? That is, 127.0.0.1? – jski Sep 24 '15 at 23:00
  • Yup it did reposed I believe. That may have been because of the hosts file entry I had pointing that to 127.0.0.1. However even with that, IIS could not authenticate with ntlm when the request was coming from the IIS server to using that url. – slayernoah Sep 25 '15 at 1:07
4

Updating the registry key below on the server running IIS fixed the issue!

  1. In Registry Editor, locate and then click the following registry key:

    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0

  2. Right-click MSV1_0, point to New, and then click Multi-String Value.

  3. Type BackConnectionHostNames, and then press ENTER.

  4. Right-click BackConnectionHostNames, and then click Modify.

  5. In the Value data box, type the host name or the host names for the site(s) that are on the local computer (i.e. myapp.mydomain.com), and then click OK.

BackConnectionHostNames registry key value in the registry editor

| improve this answer | |
  • Oh this solved my problem thank you – User2012384 Jun 9 at 3:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.