I am currently having trouble with some IIS .NET Authorization Rules which are restricting access to an site based on the AD Group Membership.
The groups are configured as Global Groups, with names GROUP NAME and the Rules in IIS are set to <allow roles="GROUP NAME" />. As an example there are two users within this group, AccessUser1 and AccessUser2.
AccessUser1 has a User Logon Name specified as well as a pre-2000 Logon Name, but when attempting to log into the site, an unauthorized message is displayed.
AccessUser2 has only a pre-2000 Logon Name, but when they access the site, they are successfully authorized and can view the site.
Is there some misconfiguration between the Authorization Rules and the User Logon Names which means allow roles will only work with pre-2000 Logons, and the Rules need to be specified differently for post-2000 Logon Names?
