--- title: Browser prompts for Username/Password slug: browser-prompts-for-usernamepassword createdAt: 2025-06-11T20:26:19.224Z --- Integrated Security within IIS does not work and users are repeatedly asked to enter their username and password by the browser. # Solution The Activate Intranet site uses a domain service account to run as. Internet Explorer by default attempt to content using Kerberos to the Activate application. This will fail unless the domain service account is registered in Active Directory. ## Option 1: Creating Service Principal Names (SPNs) for Domain Accounts Register an SPN for the domain service account and the web server it runs on. ### To create an SPN for a domain account 1. Install the Windows Server 2003 Support Tools from the Windows Server 2003 installation media. 2. Open a command prompt and run the **setspn** tool as follows: :::BlockQuote setspn -A HTTP/webservername domain\serviceAccount ::: **Example (NetBIOS server name):** :::BlockQuote setspn -A HTTP/web01 contoso\svcWebApp ::: In this example: - **web01** is the server name - **contoso** is the Active Directory domain - **svcWebApp** is the domain service account :::BlockQuote setspn -A HTTP/webservername.fullyqualifieddomainname domain\serviceAccount ::: **Example (fully qualified domain name):** :::BlockQuote setspn -A HTTP/web01.contoso.com contoso\svcWebApp ::: By running the command twice—once for the NetBIOS server name and once for the fully qualified domain name—you associate the service account with both name formats. This ensures the SPN functions correctly in environments where fully qualified domain names are not used consistently. :::hint{type="success"} **Note:** You cannot have multiple Web applications with the same host name if you want them to have multiple identities. This is an HTTP limitation, not a Kerberos limitation. The workaround is to have multiple DNS names for the same host, and start the URLs for each Web application with a different DNS name. For example, you would use http\://app1 and http\://app2 rather than http\://site/app1 and *[http://site/app2](#)*. ::: ## Option 2: Disable Kerberos  Integrated security can be used with NTLM authentication  by disabling Kerberos. Kerberos can be disabled on the client or on the server. **To disable Kerberos on the client** 1\. Open browser and select 'Tools -> Internet options' 2\. Click on 'Advanced tab'. 3\. Turn off 'Security->Enable Integrated Windows Authentication (required restart) 4\. Click on and restart the browser **To Disable Kerberos on the Server (recommended option)** ### IIS 6.0 | | | | ------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | 1. | Click **Start**, click **Run**, type cmd, and then press ENTER. | | 2. | Locate the directory that contains the Adsutil.vbs file. By default, this directory is C:\Inetpub\Adminscripts. | | 3. | Use the following command to retrieve the current values for the **NTAuthenticationProviders**metabase property\:In this command, `WebSite` is a placeholder for the Web site ID number. The Web site ID number of the default Web site is 1. **Warning** Do not perform a copy-and-paste operation to paste the command from this article. This operation may cause issues with the property setting. To avoid these issues, type the whole command at a command prompt. **Note** This command fails if the **NTAuthenticationProviders** metabase property is not defined. For more information, see the note earlier in this section. If Kerberos is enabled, this command returns the following information: | | 4. | If the command in step 3 does not return the string "NTLM," use the following command to disable Kerberos : | | 5. | Repeat step 3 to verify that the result is "NTLM". | NTAuthenticationProviders : (STRING) "Negotiate,NTLM" **cscript adsutil.vbs get w3svc/**`WebSite`**/root/NTAuthenticationProviders** **cscript adsutil.vbs set w3svc/**`WebSite`**/root/NTAuthenticationProviders "NTLM"** **IIS 5.1 or IIS 5.0** | | | | ------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | 1. | Click **Start**, click **Run**, type cmd, and then press ENTER. | | 2. | Locate the directory that contains the Adsutil.vbs file. By default, this directory is C:\Inetpub\Adminscripts. | | 3. | Use the following command to retrieve the current values for the **NTAuthenticationProviders**metabase property:**Warning** Do not perform a copy-and-paste operation to paste the command from this article. This operation may cause issues with the property setting. To avoid these issues, type the whole command at a command prompt. **Note** This command fails if the **NTAuthenticationProviders** metabase property is not defined. For more information, see the note earlier in this section. If Kerberos is enabled, this command returns the following information:**Note** By default, the **NTAuthenticationProviders** metabase property is set to **Negotiate,NTLM** when you install IIS 5.1 or IIS 5.0. | | 4. | If the command in step 3 does not return the string "NTLM," use the following command to enable the Negotiate process: | | 5. | Repeat step 3 to verify that kerberos has been disabled. | NTAuthenticationProviders : (STRING) "Negotiate,NTLM" **cscript adsutil.vbs get w3svc/NTAuthenticationProviders** **cscript adsutil.vbs set w3svc/NTAuthenticationProviders "NTLM"** ## Troubleshooting Microsoft troubleshooting Kerberos failures guide can be found here: [https://docs.microsoft.com/en-us/troubleshoot/iis/troubleshoot-kerberos-failures-ie](https://docs.microsoft.com/en-us/troubleshoot/iis/troubleshoot-kerberos-failures-ie)