active directory - windows authentication not working in ie7

Question

Really need help with this and tried lots of things and run out of ideas.

I have a site hosted on an internal development server, accessible for staff internally.

the server setup is windows 2008 R2, iis 7.5 sql 2008 express. Im authenticating using active directory.

in Chrome the site loads, and automatically logs me in recognising my name.

When viewing the site in IE7 the response is: "401 - Unauthorized: Access is denied due to invalid credentials. You do not have permission to view this directory or page using the credentials that you supplied."

I have tried the following:

• in iis set only windows authentication to enabled (the rest disabled)
• Moved NTLM to the top of the providers list
• given full control to the web directory to Everyone/IUSR/Network Service/DeafultAppPool ...list goes on.
• checked ie settings (enable integrated windows authentication is checked)
• user authentication in IE7 is set to "automatic logon only in intranet zone".
• set the following in web.config:
  • <anonymousIdentification enabled="false" />
  • <authentication mode="Windows" />
  • <identity impersonate="false" />
• Executed: cscript adsutil.vbs set w3svc/NTAuthenticationProviders "NTLM"

im convinced its not a browser setting as im authenticated against AD when i access the intranet in IE7.

what is wrong? how can i fix it?

Many thanks

Answer 1

From the technet article, http://technet.microsoft.com/en-us/library/cc754628(v=ws.10).aspx :

The default setting for Windows authentication is Negotiate. This setting means that the client can select the appropriate security support provider. To force NTLM authentication, you must change the value of the element under the element in the ApplicationHost.config file.

IE is using Kerberos and not falling back on NTLM like Chrome and Firefox. You must force NTLM authentication in IIS7.5 by following these steps:

1. Select your site.
2. Double click authentication.
3. Select "Windows Authentication" (ensuring that it is enabled).
4. Click "Providers..." in the right hand column.
5. Select NTLM and click "Move Up".