Click here to get back home

User can't connect to particular webserver from his PC.

 HomeNewsGroups | Search | About
 microsoft.public.windows.server.security    Post an article   get this group's latest topics as an RSS feed add this group's latest topics to your My MSN content add this group's latest topics to your My Yahoo content
Subject Author Date
User can't connect to particular webserver from his PC. TK 12-22-2005
Posted by TK on December 22, 2005, 6:08 pm
Please log in for more thread options
Hi,
I am running into a strange problem. Let me begin with a few facts:
-We are on Active Directory
-Webservers are win2k3
-Client is on XP professional
I have a user that is not able to access a website running on a
particular server. All other clients are working fine, however this one
user is not able to access any website running on ServerX. He keeps
getting prompted for userid/pass, and when he enters it it let's him do
it three times before throwing an unauthorized to view this page error
page.
Some more facts:
-It's not an issue with the user, as he can access this website from
another PC.
-He can access other webservers in the domain from his PC fine (in fact
there is a development server (ServerA) that is set up exactly the same
as ServerX). He can access ServerA with no prompts and no issues from
his PC, but not ServerX.
-There is no special security set on ServerX (i.e. restricted ips,
etc...)
-His IE settings on his PC are all fine, and match other users (who
don't have any issues), authentication settings, advanced settings,
security, etc...
-He can access the website on ServerX from his PC using the sites IP
address in the URL, but that messes up kerberos authentication which is
required to get to the backend data.
Is there anything else I can check on his PC that would not allow him
to access serverX.

Any help would be greatly appreciated.
Thanks,
Tom


Posted by S. Pidgorny on December 23, 2005, 6:52 am
Please log in for more thread options
I'd assume the Web site requires Windows-integrated authentication. To me,
the key indicator is that the user can access the same site by IP and not by
FQDN, even though the authentication requirements are the same.

My version: the user's PC is configured for some kind of proxy that doesn't
support pass-through Windows-integrated authentication, but IP address
communication is direct - because of a routing script or something. I'd load
a protocol analyser (Ethereal or MS Network Monitor) to do captures and pin
point the problem.

--
Svyatoslav Pidgorny, MS MVP - Security, MCSE
-= F1 is the key =-

> Hi,
> I am running into a strange problem. Let me begin with a few facts:
> -We are on Active Directory
> -Webservers are win2k3
> -Client is on XP professional
> I have a user that is not able to access a website running on a
> particular server. All other clients are working fine, however this one
> user is not able to access any website running on ServerX. He keeps
> getting prompted for userid/pass, and when he enters it it let's him do
> it three times before throwing an unauthorized to view this page error
> page.
> Some more facts:
> -It's not an issue with the user, as he can access this website from
> another PC.
> -He can access other webservers in the domain from his PC fine (in fact
> there is a development server (ServerA) that is set up exactly the same
> as ServerX). He can access ServerA with no prompts and no issues from
> his PC, but not ServerX.
> -There is no special security set on ServerX (i.e. restricted ips,
> etc...)
> -His IE settings on his PC are all fine, and match other users (who
> don't have any issues), authentication settings, advanced settings,
> security, etc...
> -He can access the website on ServerX from his PC using the sites IP
> address in the URL, but that messes up kerberos authentication which is
> required to get to the backend data.
> Is there anything else I can check on his PC that would not allow him
> to access serverX.
>
> Any help would be greatly appreciated.
> Thanks,
> Tom
>



Posted by TK on December 23, 2005, 10:11 am
Please log in for more thread options
Svyatoslav,
Thank you for the response. I will try to use the protpcol analyzer to
see what I can determine. Unfortunately I do not have much experience
with analyzing packets, so I'm not sure I willbe able to determine the
cause.
In responce to your message:
You are correct that the website requires windows integrated
authentication.
I will have the user check his lan settings to see if there are any
special proxy settings.
However, what doesn't make sense, is the fact that he can connect to
ServerA with the FQDN with no issues. And ServerA is set up exactly the
same way as ServerX(which is casuing the problem).

Thanks again for the reply.


Posted by Steven L Umbach on December 23, 2005, 1:25 pm
Please log in for more thread options
Have another user logon to his computer to see if they get the same problem.
If they do not then there is a setting somewhere in his user profile that is
causing the problem. Be sure to check the web content zones to make sure
they are configured identically for this user compared to other users. Maybe
that particular URL is in a different web content zone [trusted, etc] that
has different settings from the other users. --- Steve


> Hi,
> I am running into a strange problem. Let me begin with a few facts:
> -We are on Active Directory
> -Webservers are win2k3
> -Client is on XP professional
> I have a user that is not able to access a website running on a
> particular server. All other clients are working fine, however this one
> user is not able to access any website running on ServerX. He keeps
> getting prompted for userid/pass, and when he enters it it let's him do
> it three times before throwing an unauthorized to view this page error
> page.
> Some more facts:
> -It's not an issue with the user, as he can access this website from
> another PC.
> -He can access other webservers in the domain from his PC fine (in fact
> there is a development server (ServerA) that is set up exactly the same
> as ServerX). He can access ServerA with no prompts and no issues from
> his PC, but not ServerX.
> -There is no special security set on ServerX (i.e. restricted ips,
> etc...)
> -His IE settings on his PC are all fine, and match other users (who
> don't have any issues), authentication settings, advanced settings,
> security, etc...
> -He can access the website on ServerX from his PC using the sites IP
> address in the URL, but that messes up kerberos authentication which is
> required to get to the backend data.
> Is there anything else I can check on his PC that would not allow him
> to access serverX.
>
> Any help would be greatly appreciated.
> Thanks,
> Tom
>



Posted by stephen.evans on January 1, 2006, 1:17 am
Please log in for more thread options
One more thing to check, see if someone added that address to the HOSTS
file as a nasty joke, it would have a similar effect on things.


Similar ThreadsPosted
Best practices regarding anti-virus software on production webserver September 12, 2007, 12:46 pm
Can connect via Remote Desktop September 26, 2005, 12:36 pm
connect to event log on a non admin account? December 7, 2005, 4:23 pm
can I connect to an external server using a local account? February 20, 2008, 12:45 pm
Suddenly Unable to connect to other machines on local network January 8, 2006, 5:45 pm
Web applications cannot connect to SQL Server on new Windows 2003 R2 machine June 28, 2008, 4:16 pm
Unexpected security restriction for a user in both a user and administrative group. April 24, 2008, 10:05 pm
SBS new user wizard -v- manual user setup June 7, 2006, 10:19 pm
User Account Created - 624 And User Account Enabled - 626 for Hel October 13, 2005, 1:56 pm
Is it possible to use the Windows 2003 user names instead of pre-Windows 2000 user names in Windows Authentication? September 5, 2006, 9:27 am

Our other projects:

Art Dolls, Fairies and Mermaids - Sunnyfaces.net

Roy's Linux, Programming and Search Engines messages

1-Script XML SitemapXML Sitemap