Authentication may fail with “401.3″ Error if Web site’s “Host Header” differs from server’s NetBIOS name
Symptoms
When you are using Internet Explorer on a Windows 2000 or later client and browsing to a Web site where the host header name is different from the NetBIOS name of the computer, Integrated Authentication may fail with an HTTP error 401.1, error 401.2, orerror 401.3.
NoteInternet Explorer clients that are using Windows NT 4 or Windows 95 or Windows 98 will not fail. Also, other authentication schemes will work.
Microsoft ASP.NET users may see an error message that is similar to the following:
Server Error in ‘<application name>’ Application.
Login failed for user ‘NT AUTHORITY\ANONYMOUS LOGON’.
Description: An unhandled exception occurred during the execution of the current web request.
Please review the stack trace for more information about the error and where it originated in the code.
Exception Details: System.Data.SqlClient.SqlException: Login failed for user ‘NT AUTHORITY\ANONYMOUS LOGON’.
Resolution
During Kerberos authentication, a domain controller that is running Windows 2000 or Windows Server 2003grants tickets based on the Server Principle Name (SPN) of the Internet Information Services (IIS) Web server.If the host header (Web site name) being requested differs from the NetBIOS name of the IIS 5.0 computer, Kerberos authentication will fail, causing 401.3 errors on the client.
Clients using Windows NT 4 or Windows 95 or Windows 98 succeed because they do not natively support Kerberos and thus use Windows NT Challenge/Response (NTLM) authentication.

Leave a Reply