23

Long text, sorry for that. I'm trying to be as specific as possible.

I'm on Windows 7 and I experience a very frustrating Internet Explorer 8 behavior. I'm in a company LAN with some intranet servers and a proxy for connecting with the outside world.

On sites that are clearly recognized as being "Local Intranet" (as indicated in the IE status bar) I keep getting "Windows Security" dialog boxes that ask me to log in. These pages are served off an IIS6 with "Integrated Windows Security" enabled, NTFS permits Everyone:Read on the files themselves.

  • If I enter my Windows credentials, the page loads fine. However, the dialog boxes will be popping up the next time, regardless if I ticked "Remember my credentials" or not. (Credentials are stored in the "Credential Manager" but that does not make any difference as to how often these login boxes appear.)
  • If I click "Cancel", one of two things can happen: Either the page loads with certain resources missing (images, styleheets, etc), or it does not load at all and I get HTTP 401.2 (Unauthorized: Logon Failed Due to Server Configuration). This depends on whether the logon box was triggered by the page itself, or a referenced resource.
  • The behavior appears to be completely erratic, sometimes the pages load smoothly, sometimes one resource triggers a logon message, sometimes it does not. Even simply re-loading the page can result in changed behavior.

I'm using WPAD as my proxy detection mechanism. All Intranet hosts do bypass the proxy in the PAC file.

I've checked every IE setting I can think of, entered host patterns, individual host names, IP ranges in every thinkable configuration to the "Local Intranet" zone, ticked "Include all sites that bypass the proxy server", you name it. It boils down to "sometimes it just does not work", and slowly I'm losing my mind. ;-)

I'm aware that this is related to IE not automatically passing my NTLM credentials to the webserver but asking me instead. Usually this should only happen for NTLM-secured sites that are not recognized as being in the "Intranet" zone.

As explained, this is not the case here. Especially since half of a page can load perfectly and without interruption and some page's resources (coming from the same server!) trigger the login message.

I've looked at http://support.microsoft.com/kb/303650, which gives the impression of describing the problem, but nothing there seems to work. And frankly, I'm not certain if "manually editing the registry" is the right solution for this kind of problem. I'm not the only person in the world with an IE/intranet/IIS configuration, after all.

I'm at a loss, can somebody give me a hint?

1
  • Sorry, I couldn't resist: So, Captain, how long shall we stare at each other across the neutral zone?! Sep 4, 2013 at 18:26

6 Answers 6

11

The only time we see this is if a user's password has expired. When ever we see this we get the user to change their password, and for good measure log out and back in with the new credentials. The Intranet site no longer requests credentials.

Makes for a lot of quick support calls...

Also, make sure the Local Intranet zone is set up to Automatic logon with current user name and password. You can do this by:

  1. Tools
  2. Internet options
  3. Left click on Security tab
  4. Left click on Custom level
  5. Scroll down to User Authentication
  6. Under Logon, select Automatic logon with current user name and password
1
  • No, passwords are fine. That was the first thing I checked, naturally. Besides, there would be no partial page loads and erratic "sometimes it works, sometimes it doesn't" behavior if the password was expired.
    – Tomalak
    Jul 19, 2011 at 6:56
2

Perhaps some of the 4 part handshake going on with ntlm is getting lost in ie talking with the proxy? That is, if ie is asking the proxy about intranet pages...

I know you said you've tried putting sites in the intranet zone and setting them to bypass the proxy. Just curious though, what happens if you disable the proxy config in the browser altogether? No more pop-ups, right?

3
  • The intranet sites are not being loaded through the proxy. But I can give it a shot.
    – Tomalak
    Aug 22, 2011 at 14:13
  • 1
    After switching off the proxy altogether and manually adding our Intranet FQDN to the "Intranet" zone in IE, it seems to work ATM. I've not tested for long, so I can't be absolutely sure. Maybe it's some WPAD peculiarity? After all, the PAC file returns "DIRECT" for this FQDN as well…
    – Tomalak
    Aug 22, 2011 at 14:20
  • Seems like you found your answer if disabling the proxy worked. I was going to suggest trying Firefox and adding the site's name to the ntlm setting in the about:config page and see if that was working.
    – Marlon
    Aug 23, 2011 at 3:12
0

Try looking under administrative tools under the control panel; open .NET 1.1 wizards and adjust .NET security to "Full Trust" for intranet.

1
  • There is no .NET involved at all in the pages in question. It wont matter what I configure there.
    – Tomalak
    Jun 5, 2010 at 7:49
0

Have you checked/changed your 'Network security: LAN Manager authentication level' in 'Control Panel/Administrative Tools/Local Security Policy/Local Policies/Security Options'? (Q823659)

We run a workgroup here (no windows servers) with a local intranet and wide use of MySQL... Until we'd changed (or enabled) the above key/option nothing seemed to work 100% of the time, this wasn't just a Windows 7 issue. We have also disabled the 'Require 128-bit encryption' options on the 2 NTLM keys below this on Windows 7 PC's... Still get occasional database issues but SQL has been fine since we did.

1
  • Unfortunately, this is nothing I can change. Domain GPOs are controlling this setting. Also this does not explain the erratic behavior, I would expect it to fail all the time when low level authentication settings are wrong. :-\
    – Tomalak
    Oct 25, 2011 at 9:05
0

Since you're on a domain and the problem is unexpected I always wonder two things...

  1. Does the same behaviour occur for other users?
  2. Does the same behaviour occur for a different domain user on your machine?
2
  • To 1 and 2: Yes. Very puzzling.
    – Tomalak
    Oct 29, 2011 at 15:56
  • That makes it feel like GPO or the IIS config are to blame... Oct 30, 2011 at 16:46
0

Did you check this suggestions on the MS answer site ? (probably you did...)

3
  • I would, but that link is broken.
    – Tomalak
    Oct 30, 2011 at 8:31
  • I'm sorry, link is fixed. Nov 2, 2011 at 6:13
  • Hm. No dice. I also rather not use the credential manager for something that should be transparent authentication with my own account.
    – Tomalak
    Nov 2, 2011 at 7:42

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .