3

I have a website that runs on IIS that uses windows authentication.

On the website level, under 'Authentication' I have only Windows Authentication (NTLM only as a provider) enabled.

On the virtual directory level, under 'Authentication', I have ASP.NET Impersonation and Windows Authentication (NTLM only as a provider) enabled. (Disabling ASP.NET Authentication here does not change anything)

  • The IP address of the server running IIS is: 172.0.0.10
  • The computer name of the server running IIS is: myiisserver
  • The FQDN on the server running IIS is: myiisserver.mydomain.com
  • A DNS 'A Record' exists to point 172.0.0.10: myapp.mydomain.com

On the website bindings, I have:

Type  |  IP Address      |  Port  |  Host Name
--------------------------------------------------------------
http  |  All Unassigned  |  80    |  localhost
http  |  All Unassigned  |  80    |  myiisserver
http  |  All Unassigned  |  80    |  myiisserver.mydomain.com
http  |  All Unassigned  |  80    |  myapp.mydomain.com

This is the only website that I have running on the IIS server.

The App Pool running the web site and the virtual directory is the same and uses 'NetworkService' as the identity.

On the IIS server and on other workstations in the network:

  • myiisserver is added to 'Trusted Sites'
  • myiisserver.mydomain.com is added to 'Trusted Sites'
  • myapp.mydomain.com is added to 'Trusted Sites'

On the trusted sites zone, Automatic logon using current user name and password is selected on the IIS server and other workstations.

On Internet Options -> Advanced, Enable Integration Windows Authentication was enabled on the IIS server and other workstations.

On other workstations in the network:

On IIS server:

5
  • 1
    So that I make sure I understand the problem - http://myapp.mydomain.com is working for all/most workstations, except for one?
    – mfinni
    Sep 16 '15 at 13:26
  • It works on all workstations except for the server running IIS. I've seen this happen in multiple customer environments. Want to know how we can make it work on the server running IIS as well. Thanks for your help!
    – slayernoah
    Sep 17 '15 at 3:15
  • This is going to sound crazy, but when you ping myapp.mydomain.com, it responds how you expect? That is, 127.0.0.1?
    – jski
    Sep 24 '15 at 23:00
  • Yup it did reposed I believe. That may have been because of the hosts file entry I had pointing that to 127.0.0.1. However even with that, IIS could not authenticate with ntlm when the request was coming from the IIS server to using that url.
    – slayernoah
    Sep 25 '15 at 1:07
  • The current post has a very inclusive title while this post has a more generic, however both are suggesting the same solution, plus one more in the latter.
    – mchar
    Jan 5 at 13:46
5

Updating the registry key below on the server running IIS fixed the issue!

  1. In Registry Editor, locate and then click the following registry key:

    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0

  2. Right-click MSV1_0, point to New, and then click Multi-String Value.

  3. Type BackConnectionHostNames, and then press ENTER.

  4. Right-click BackConnectionHostNames, and then click Modify.

  5. In the Value data box, type the host name or the host names for the site(s) that are on the local computer (i.e. myapp.mydomain.com), and then click OK.

BackConnectionHostNames registry key value in the registry editor

1
  • Oh this solved my problem thank you Jun 9 '20 at 3:40
0

slayernoah's solution is working perfectly fine, but I want to add that above solution will work even if site is being browsed over Internet not just Intranet. Plus I didn't do any steps other than

  1. Enable Windows Integrated Authentication on IIS website.
  2. Add registry key and added Each Cname / Host on separate Line

This fixed and saved lot of time

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.