I'm trying to get an ASP .NET website up and running on IIS6. The site will run in its own application pool, and uses Windows authentication, with anonymous access turned off.

When I run the app pool under NETWORK SERVICE, everything works fine. However we need the app pool to run under a different account, because this account needs some extra privileges (we are printing Word documents).

This new account is a member of the local users group, and the IIS_WPG group. It has also been granted the "Log on as a service right". When I browse to the site I am prompted for credentials, not once, but several times. When the page finally loads it looks wrong because the style sheets have not been applied.

My suspicion is that I am being prompted once for each file (e.g. all the images, styles and script files) the browser requests, and that for some reason the website is unable to validate those credentials in order to serve the files back.

If I allow anonymous access the page loads fine - we don't want to allow it but I mention it in case it offers any further clues.

My theory is that perhaps the account the app pool runs under needs permissions to validate domain credentials? If that is so, how do I enable this?


I found the answer in the workaround section of this KB article.

  • Kerberos is the key! Please detail your steps (either with SetSPN or turning off Kerberos) – Christopher_G_Lewis Oct 8 '09 at 14:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.