Otdfbt

I'm a developer that's been asked to maintain the IIS configuration for the web app that we're building, so bear with me.

We have an internal website that is accessible to employees once they've logged into the Windows LAN. The servers are Windows Server 2008 R2, they are remotely managed by an external service provider, and they have Symantec Endpoint Protection installed on them.

I rebooted our test server and now the website is asking for user credentials to view the page. Unfortunately, when I enter a valid user name and password for the corporate domain, it's not accepted. The server can still be Remotely connected through Citrix Jumpservers using a user account and the corporate domain, so it seems to be specific to IIS.

The IIS permissions for the website are set to:

Anonymous Authentication - disabled
ASP.NET Impersonation - enabled
Forms Authentication - disabled
Windows Authentication - enabled

I need to leave anonymous authentication disabled because of a flow through requirement in the system to Hummingbird's DM webservice.

This was working before the reboot and there were other issues going on with the company at the time (internet proxy spontaneously denied all internet webpages, and a samba share wasn't remounting for service account users). The code wasn't changed, and the IIS configuration wasn't changed (to my knowledge), so it seems like something on the network has changed, or maybe the service account.

This issue is likely going to get moved to corporate IT, but I need some sort of evidence that points to this being a network or security issue. Otherwise, they will simply dismiss it saying that it's our web app's fault or our IIS setup. Maybe it is, but I'm not sure what else to check and nothing was changed except rebooting the machine.

Are there any tests or tools that I can run to test the authentication configuration and isolate potential causes? Given that the server has Symantect Endpoint Protection on it, is there a setting that may have been changed that would cause this behaviour? Are there other settings in the Server Management Console that might cause this behaviour?

Check the Administrative (for Vista and later) or System and Application event logs on the IIS box (Start, run, EventVwr if you haven't looked before) for indications of any problems with domain connectivity.

Events from Netlogon or UserEnv may indicate a problem contacting a Domain Controller, which is typically used to verify authentication credentials (simplification, but works for both NTLM and Kerberos in this scenario if the DCs have had a problem with the computer account, for example). Don't limit your investigation to those items - take a broad look at what's happening.

Security event logs may show the reason for logon failure by that user too, and looking those errors up may help (as a note, there are likely to be more than a few failures not related to the actual problem, so find one involving the user account you're testing with at the time you tried it).