Technology Blog

Recently I did hosting of a website on IIS 6 on Windows XP Professional SP2. The website is applied with Basic Authentication and Windows Integrated Authentication. Strangely the Integrated Authentication does not work, but the same website on Windows 2003 Server SP2 works fine. When attempted to browse the website, it does ask for username and password; but does not login and shows the error HTTP 401.1 – Unauthorized: Logon Failed.

I did some research on the Internet and found help at Microsoft Support (ref. link below). This issue is with Windows XP SP2 and Windows 2003 Server SP1, which include a loopback check security feature that is designed to help prevent reflection attacks on the computer. When you use the fully qualified domain name (FQDN) or a custom host header to browse a local website that is hosted on a computer using IIS 6 shows the error “HTTP 401.1 – Unauthorized: Logon Failed”. This happens when the website uses Integrated Authentication and has the name which is mapped to the local loopback address.

The workaround for the issues needs changes in the registry, which should be done correctly else it would lead to serious problems. It’s advisable to keep the backup of the registry before making the changes.

Method 1: Specify Host Names

• Open Registry Editor
• Navigate to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0
• Right-click MSV1_0, point to New, and then click Multi-String Value
• Type BackConnectionHostNames, and then press ENTER
• Right-click BackConnectionHostNames, and then click Modify
• In the Value data box, type the host name or the host names for the sites that are on the local computer, and then click OK
• Quit Registry Editor, and then restart the IIS Admin service

Method 2: Disable the Loopback Check

• Open Registry Editor
• Navigate to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa
• Right-click Lsa, point to New, and then click DWORD Value
• Type DisableLoopbackCheck, and then press ENTER
• Right-click DisableLoopbackCheck, and then click Modify
• In the Value data box, type 1, and then click OK
• Quit Registry Editor, and then restart your computer

Ref. Link: http://support.microsoft.com/default.aspx?scid=kb;EN-US;896861