3

I have a website that runs on IIS that uses windows authentication.

On the website level, under 'Authentication' I have only Windows Authentication (NTLM only as a provider) enabled.

On the virtual directory level, under 'Authentication', I have ASP.NET Impersonation and Windows Authentication (NTLM only as a provider) enabled. (Disabling ASP.NET Authentication here does not change anything)

  • The IP address of the server running IIS is: 172.0.0.10
  • The computer name of the server running IIS is: myiisserver
  • The FQDN on the server running IIS is: myiisserver.mydomain.com
  • A DNS 'A Record' exists to point 172.0.0.10: myapp.mydomain.com

On the website bindings, I have:

Type | IP Address | Port | Host Name -------------------------------------------------------------- http | All Unassigned | 80 | localhost http | All Unassigned | 80 | myiisserver http | All Unassigned | 80 | myiisserver.mydomain.com http | All Unassigned | 80 | myapp.mydomain.com

This is the only website that I have running on the IIS server.

The App Pool running the web site and the virtual directory is the same and uses 'NetworkService' as the identity.

On the IIS server and on other workstations in the network:

  • myiisserver is added to 'Trusted Sites'
  • myiisserver.mydomain.com is added to 'Trusted Sites'
  • myapp.mydomain.com is added to 'Trusted Sites'

On the trusted sites zone, Automatic logon using current user name and password is selected on the IIS server and other workstations.

On Internet Options -> Advanced, Enable Integration Windows Authentication was enabled on the IIS server and other workstations.

On other workstations in the network:

On IIS server:

Improve this question
5
  • 1
    So that I make sure I understand the problem - http://myapp.mydomain.com is working for all/most workstations, except for one? Commented Sep 16, 2015 at 13:26
  • It works on all workstations except for the server running IIS. I've seen this happen in multiple customer environments. Want to know how we can make it work on the server running IIS as well. Thanks for your help! Commented Sep 17, 2015 at 3:15
  • This is going to sound crazy, but when you ping myapp.mydomain.com, it responds how you expect? That is, 127.0.0.1? Commented Sep 24, 2015 at 23:00
  • Yup it did reposed I believe. That may have been because of the hosts file entry I had pointing that to 127.0.0.1. However even with that, IIS could not authenticate with ntlm when the request was coming from the IIS server to using that url. Commented Sep 25, 2015 at 1:07
  • The current post has a very inclusive title while this post has a more generic, however both are suggesting the same solution, plus one more in the latter. Commented Jan 5, 2021 at 13:46

2 Answers 2

Reset to default
6

Updating the registry key below on the server running IIS fixed the issue!

  1. In Registry Editor, locate and then click the following registry key:

    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0

  2. Right-click MSV1_0, point to New, and then click Multi-String Value.

  3. Type BackConnectionHostNames, and then press ENTER.

  4. Right-click BackConnectionHostNames, and then click Modify.

  5. In the Value data box, type the host name or the host names for the site(s) that are on the local computer (i.e. myapp.mydomain.com), and then click OK.

BackConnectionHostNames registry key value in the registry editor

Improve this answer
1
0

slayernoah's solution is working perfectly fine, but I want to add that above solution will work even if site is being browsed over Internet not just Intranet. Plus I didn't do any steps other than

  1. Enable Windows Integrated Authentication on IIS website.
  2. Add registry key and added Each Cname / Host on separate Line

This fixed and saved lot of time

Improve this answer

You must log in to answer this question.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.