I have created an application with asp.net core mvc v8 that works with Windows authentication in IIS 10. Setting: Authentication: all are disabled except Windows authentication. I have it mounted on a server and I need it to work on my local network. And the users are connected to the same local network. When I set everything up, it works properly. But then users get a 401.2 error and it always asks for credentials. They are correct but he does not access. This application does not have a domain name so it is in the ip:port. I have an active directory. Users log in with domain1\user and my server has domain2\user. What I have tried: Do the research and several have had this problem. And many have solved them by configuring in regedit creating a multi-string value in HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0 with the name of BackConnectionHostNames and placing the host, since I do not have a domain name, place ip:port and not It worked for me. Go to my application in iis, click on authentication and modify the providers, leaving only the NTLM and it didn't work either. Also this: Disable NEGOTIATE protocol in the client workstation to confirm the issue is the one described. Open the Registry Editor (start - run - regedit.exe) Navigate to HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ Locate the registry entry EnableNegotiate Change the value to 0 Restart the client workstation and neither. Also try disabling windows authentication, enabling anonymous authentication, and selecting Application pool identity. Also giving my application pool permissions on my project folder. Which didn't work either. At this point I don't know what to do. I appreciate your help.

IIS 10 with Windows Authentication not working anymore HTTP Error 401.2 - Unauthorized

Luis Cáceres 5

I have created an application with asp.net core mvc v8 that works with Windows authentication in IIS 10.

Setting:

Authentication: all are disabled except Windows authentication.

I have it mounted on a server and I need it to work on my local network. And the users are connected to the same local network.

When I set everything up, it works properly. But then users get a 401.2 error and it always asks for credentials. They are correct but he does not access.

This application does not have a domain name so it is in the ip:port.

I have an active directory.

Users log in with domain1\user and my server has domain2\user.

What I have tried:

Do the research and several have had this problem. And many have solved them by configuring in regedit creating a multi-string value in HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0 with the name of BackConnectionHostNames and placing the host, since I do not have a domain name, place ip:port and not It worked for me.
Go to my application in iis, click on authentication and modify the providers, leaving only the NTLM and it didn't work either.
Also this:

Disable NEGOTIATE protocol in the client workstation to confirm the issue is the one described.

Open the Registry Editor (start - run - regedit.exe)

Navigate to HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\

Locate the registry entry EnableNegotiate

Change the value to 0

Restart the client workstation and neither.

Also try disabling windows authentication, enabling anonymous authentication, and selecting Application pool identity. Also giving my application pool permissions on my project folder. Which didn't work either.

At this point I don't know what to do.

I appreciate your help.

AgaveJoe 26,201 Reputation points

2024-03-18T17:29:18.8833333+00:00

Your Windows authentication description is a little confusing so I'll leave that bit alone. If you want to go with anonymous authentication then all you have to do is grant the application pool identity access to the application folder on the server. If you are using the default app pool identity then it is...

IIS APPPOOL\DefaultAppPool

Otherwise it is the name you used when creating the IIS application.
Lex Li (Microsoft) 4,742 Reputation points Microsoft Employee

2024-03-18T18:45:33.38+00:00

"I don't have an active directory" is the cause. Windows authentication is primarily designed for domain users to be authenticated among domain enrolled machines. Without a domain, you can only use machine local user accounts, which come with tons of limitations. Can you set up a domain and enroll all users/machines and try again?
Luis Cáceres 5 Reputation points

2024-03-19T13:44:09.6766667+00:00

Thank you for your time, but I have checked with my team and we have an active directory working.
Lex Li (Microsoft) 4,742 Reputation points Microsoft Employee

2024-03-19T15:33:09.4333333+00:00

If you have engaged your domain administrators, let them do these: 1) enable user logon audit on this IIS machine, so that all failed logon can be tracked and analyzed. 2) use a tool like Wireshark to analyze the HTTP requests for users who cannot login. The Windows authentication challenge pattern can tell what might be wrong.