IIS Server Security, Getting prompted on IIS web

We have run a .NET app on a test and prod server for months. We are running
IIS 5 on Windows 2000 and are fully patched with current versions of ADO.
In order to browse the application we only use the server name in the URL.
For example: http://MyServer/MyApp/default.aspx . We are not prompted for
our credentials because we only have Windows authentication enabled.

Some of our end users have used the fully qualified domain name. For
example: http://MyServer.MyDomain.Com/MyApp/default.aspx . At this point we
are prompted for our credentials even though it is the same web app.
Authentication method has not changed, only the URL now uses the entire
domain name.

What gives?

We ran FileMon on the servers and only got SUCCESS for all file access.
When we tracert we get the same (two hop) results.

Why does the slight change in the URL cause us to get prompted? Could it be
that the first solution uses a different domain controller to authenticate
than the second?

Many thanks,

Keith

It's to do with your IE security Zones. surf to the FQDN and make a note of
the zone (bottom right on the staus bar). then do the same on the netbios
name. See the difference?

Add the FQDN to the intranet or trusted zone and the problem ought to go
away


--
Jason Brown
Microsoft GTSC, IIS

This posting is provided "AS IS" with no warranties, and confers no rights.

Hi Keith,

When using FQDN/DNS name, IE will consider it's an internet site and
therefore it will not send credential to IIS to automatically perform
integrated authentication. The work around is explicitly adding the
FQDN into IE intranet or trusted zone. All the detailed info is
explained in the following article:

Internet Explorer May Prompt You for a Password
http://support.microsoft.com/?id=258063

Thanks.

Best regards,

WenJun Zhang
Microsoft Online Partner Support

When responding to posts, please "Reply to Group" via your newsreader
so that others may learn and benefit from your issue.

=====================================================

Business-Critical Phone Support (BCPS) provides you with technical
phone support at no charge during critical LAN outages or "business
down" situations. This benefit is available 24 hours a day, 7 days a
week to all Microsoft technology partners in the United States and
Canada.

This and other support options are available here:

BCPS:
https://partner.microsoft.com/US/technicalsupport/supportoverview/4001
0469
Others:
https://partner.microsoft.com/US/technicalsupport/supportoverview/

If you are outside the United States, please visit our International
Support page: http://support.microsoft.com/common/international.aspx

=====================================================

This posting is provided "AS IS" with no warranties, and confers no
rights.

Thank you both. Will try when I put out this fire first.

Is there a way to automatically add the FQDN to the Intranet Zone? We do
not want our end-users to ever get prompted because this truly is an
intranet app.

many, many thanks,

Keith

Use Group Policy

Cheers
Ken

--
Blog: www.adopenstatic.com/cs/blogs/ken/
Web: www.adopenstatic.com




: Thank you both. Will try when I put out this fire first.
:
: Is there a way to automatically add the FQDN to the Intranet Zone? We do
: not want our end-users to ever get prompted because this truly is an
: intranet app.
:
: many, many thanks,
:
: Keith
:
:


: > Hi Keith,
: >
: > When using FQDN/DNS name, IE will consider it's an internet site and
: > therefore it will not send credential to IIS to automatically perform
: > integrated authentication. The work around is explicitly adding the
: > FQDN into IE intranet or trusted zone. All the detailed info is
: > explained in the following article:
: >
: > Internet Explorer May Prompt You for a Password
: > http://support.microsoft.com/?id=258063
: >
: > Thanks.
: >
: > Best regards,
: >
: > WenJun Zhang
: > Microsoft Online Partner Support
: >
: > When responding to posts, please "Reply to Group" via your newsreader
: > so that others may learn and benefit from your issue.
: >
: > =====================================================
: >
: > Business-Critical Phone Support (BCPS) provides you with technical
: > phone support at no charge during critical LAN outages or "business
: > down" situations. This benefit is available 24 hours a day, 7 days a
: > week to all Microsoft technology partners in the United States and
: > Canada.
: >
: > This and other support options are available here:
: >
: > BCPS:
: > https://partner.microsoft.com/US/technicalsupport/supportoverview/4001
: > 0469
: > Others:
: > https://partner.microsoft.com/US/technicalsupport/supportoverview/
: >
: > If you are outside the United States, please visit our International
: > Support page: http://support.microsoft.com/common/international.aspx
: >
: > =====================================================
: >
: > This posting is provided "AS IS" with no warranties, and confers no
: > rights.
: >
:
:

Keith,

In case all the client machines are in the same domain, using group
policy will help you achieve this.

How To Set Advanced Settings In Internet Explorer by Using Group
Policy Objects
http://support.microsoft.com/kb/274846/

Best regards,

WenJun Zhang
Microsoft Online Partner Support

This posting is provided "AS IS" with no warranties, and confers no
rights.

months. We are running
versions of ADO.
name in the URL.
are not prompted for
authentication enabled.
domain name. For
http://MyServer.MyDomain.Com/MyApp/default.aspx . At this
point we
same web app.
uses the entire
all file access.
prompted? Could it be
controller to authenticate

Perfect. Thanks.

You are welcome.

Best regards,

WenJun Zhang
Microsoft Online Partner Support

This posting is provided "AS IS" with no warranties, and confers no
rights.