Jun 3, 2011

IIS 7.5: 401 Unauthorized Access Error (Keep prompting Username/password)

Background

Yesterday, my ASP.net applications were migrated to Windows 2008 R2 (64bit).

All applications configurations are,

  1. Developed using .NET v 2.0 & 3.5
  2. Using 32bit COM/wrapper for ERP access
  3. Windows Authentication

Without recompiling, applications were migrated to IIS 7.5. Actions taken on IIS for above 3 are, respectively,

  1. Used “Classic .NET AppPool”
  2. Set “Enable 32-Bit Applications
    iis7_AdvaSett
  3. Enabled Windows Authentication
    iis7_Auth 

Problem

All are accessed by our local intranet users. 95% of the workstations using Windows 7. Rest the XP users complaining me they cannot use the applications, in which keep asking the User Name/password. Though they have entered their domain user name and password it did not accept.

Solution

After one & half day attempt, I solved this issue. Solution can be found in KB 896861. Folks, if you face the same problem, go head with Method 2 in the KB.

Excerpt from the KB

Method 2: Disable the loopback check (less-recommended method)
The second method is to disable the loopback check by setting the DisableLoopbackCheck registry key.
To set the DisableLoopbackCheck registry key, follow these steps:
  1. Set the DisableStrictNameChecking registry entry to 1. For more information about how to do this, click the following article number to view the article in the Microsoft Knowledge Base:

    281308 (http://support.microsoft.com/kb/281308/ ) Connecting to SMB share on a Windows 2000-based computer or a Windows Server 2003-based computer may not work with an alias name

  2. Click Start, click Run, type regedit, and then click OK.
  3. In Registry Editor, locate and then click the following registry key:

    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa

  4. Right-click Lsa, point to New, and then click DWORD Value.
  5. Type DisableLoopbackCheck, and then press ENTER.
  6. Right-click DisableLoopbackCheck, and then click Modify.
  7. In the Value data box, type 1, and then click OK.
  8. Quit Registry Editor, and then restart your computer.

4 comments:

Kelum Warnajith Ganegoda said...

Without anything happen, today only windows XP users are getting this dialog box again.

Kelum Warnajith Ganegoda said...

I think, I resolved it. I changed identity of ApplicationPool to NetworkService, which were ApplicationPoolIdentity.

It's suddenly happen. I don't know why have to monitor.

AL from London said...

I had also add "\Users" + IIS_IUSRS + CREATOR OWNER + SYSTEM to the security permissions. Thanks for the help.

Alex Paul said...



I faced the same problem and I got solution from: http://www.microsoftsupportchat.com/blog/post/Error-code-401.2/