I don't know if this could be connected, but we found the same issue in
reverse with Windows XP clients connecting to Windows 2000 servers using
integrated authentication, where the 2000 clients would get dialog asking
for username, password and domain, while the XP clients would get a dialog
asking for just the username and password, and not the domain. In the end we
found that if the username was entered as \ it would
login. Perhaps there's some difference between the way that Windows 2000
sends the login information compared to the way that XP sends it.
Keith
"Dave" wrote in message
news:406AA128-DE4F-4E12-A3CC-BCE69EDEF560@microsoft.com...
> Hi All,
>
> I've tried posting this in the IE groups without much luck so I'm hoping
> that you can help.
>
> I have a website sitting on an IIS 6 box with anonymous access switched
off.
> We are (for the time being) just using Windows integrated authentication
to
> gain access to the site. All XP client machines are fine. All Windows
2000
> clients (no matter how well/badly patched) get the login page, you enter
the
> details and then you get a blank page with the error 'The function
requested
> is not supported'. Even if you put in incorrect authentication details we
> get the same error. There is obviously some sort of authentication issue
> between the win2k clients and the IIS6 server. The IIS logs don't reveal
> much (but will post if requested) but was wondering if anyone has come
> accross this before?
>
> Any info would be great.
>
> Cheers,
>
> Dave.
XP IE 6.0 client in the advance option is set to enable Integrated
Authentication. I would make sure your 2000 workstation have IE 6.0
client, then check to see in the advance option, that this is checked.
Also to remove all prompts for intranet site, go to IE
option-->security-->select local intranet-->select sites
button-->select advance button--> then type your web address as a
trusted site. This will tell your IE browser that this is a trusted
site and will automatically send the logged in user credentials
Try this, if this doesn't help, I have a few other things that you can
try.
I've got this same problem, I can't figure it out, is there something else to try because adding the site to the local intranet didn't fix my situation.
Posted via DevelopmentNow Groups
www.developmentnow.com/g
www.developmentnow.com
Hey, checkout the following:
Have a look at the local security policy where IIS is running:
1st Networksecurity: LAN Manager authentication level (NTLMV2 only?)
2nd Network security: Minimum session security NTLM SSP for Client and Server.
If all 4 options are selected there, go to the W2k-client
and set in local security policy: LAN Manager authentication level to NTLMV2 only/reject NTLM&LM
If you still need NTLM & LM responses, disable the "128bit...blabla" and "require ntlmv2 ...blabla" in the session security NTLM SSP for client @your IIS
This was the solution @ my site.
hope its also yours.
Best practice: make these settings domain-wide in the default domain group-policy, so clients and servers/clients will inherit it (of course, it depends on YOUR AD-configuration)
regards
Joerg
PS: sorry about my bad language, I'm from germany, but I think you know what I meant.
Posted via DevelopmentNow Groups
www.developmentnow.com/g
www.developmentnow.com
That did it, thanks alot...
"Joerg Wegner" wrote:
> Hey, checkout the following:
> Have a look at the local security policy where IIS is running:
> 1st Networksecurity: LAN Manager authentication level (NTLMV2 only?)
> 2nd Network security: Minimum session security NTLM SSP for Client and Server.
> If all 4 options are selected there, go to the W2k-client
> and set in local security policy: LAN Manager authentication level to NTLMV2 only/reject NTLM&LM
>
> If you still need NTLM & LM responses, disable the "128bit...blabla" and "require ntlmv2 ...blabla" in the session security NTLM SSP for client @your IIS
>
> This was the solution @ my site.
> hope its also yours.
>
> Best practice: make these settings domain-wide in the default domain group-policy, so clients and servers/clients will inherit it (of course, it depends on YOUR AD-configuration)
>
> regards
> Joerg
>
>
> PS: sorry about my bad language, I'm from germany, but I think you know what I meant.
>
>
> Posted via DevelopmentNow Groups
> www.developmentnow.com/g
> www.developmentnow.com
>
|
|
|
|
|