quote:

---

> Is there a way to permanently turn off Integrated Windows Authentication

---

quote:

---

> Windows 2000 SP4 IIS 5.0?
>
>
>
> We know that you can uncheck the box for it on the Properties for that
> specific virtual directory under Authentication Methods, but every time

---

quote:

---

> server is rebooted or if the IIS Admin Service is restarted it

---

quote:

---

> checks that box back on.
>
>
>
> We have Exchange 2000 Post-SP3 running on this box (not a DC) and we don't
> want the Domain field box showing up for clients logging into OWA. We

---

quote:

---

> want Basic Authentication over forced SSL (which we have configured and
> working fine). We've noticed that down-level clients for some home users
> can't login IF Integrated Windows Authentication is checked on.
>
>
>
> Is there a registry setting to disable this or a script that will disable

---

quote:

---

> that we could run at machine start up? Thanks for any ideas or

---

quote:

---

>
>
>
>

---

quote:

---

> This has been happening to me ever since 2001. I believe it's a known

---

quote:

---

> possibly where the IIS Metabase isn't properly being saved on exit. What

---

quote:

---

> was able to do is make that change AND ONLY that one change in one place,
> and then right-click to stop and restart the web server instance [and/or
> stop and restart the WWW service in Windows]. Then immediately go back

---

quote:

---

> IIS and confirm that the setting is still there. If it is, you should be
> OK.
>
>
> "Research Services" <key@lamar.n0-sp@m.colostate.edu.NO> wrote in message
> news:eDXqDrnxDHA.2436@TK2MSFTNGP09.phx.gbl...
> on
> the
> automatically
don't[QUOTE][color=darkred]
> only
users[QUOTE][color=darkred]
disable[QUOTE][color=darkred]
> it
> suggestions.
>
>

---

quote:

---

> This has been happening to me ever since 2001. I believe it's a known

---

quote:

---

> possibly where the IIS Metabase isn't properly being saved on exit. What

---

quote:

---

> was able to do is make that change AND ONLY that one change in one place,
> and then right-click to stop and restart the web server instance [and/or
> stop and restart the WWW service in Windows]. Then immediately go back

---

quote:

---

> IIS and confirm that the setting is still there. If it is, you should be
> OK.
>
>
> "Research Services" <key@lamar.n0-sp@m.colostate.edu.NO> wrote in message
> news:eDXqDrnxDHA.2436@TK2MSFTNGP09.phx.gbl...
> on
> the
> automatically
don't[QUOTE][color=darkred]
> only
users[QUOTE][color=darkred]
disable[QUOTE][color=darkred]
> it
> suggestions.
>
>

---

quote:

---

> Ok, I've described basically the same solution as Karl. Only difference

---

quote:

---

> that I *know* that stopping IISADMIN will trigger the metabase flush.
>
> I'll describe what's going on.
>
> The basic problem is this:
> 1. When you make a configuration change to IIS via the UI, it is kept in
> memory (since IIS will frequently take the change live) and NOT

---

quote:

---

> written to disk.
> 2. Later, IIS attempts to write the change to disk using an algorithm to
> determine "idleness".
> 3. I've seen instances where "idleness" doesn't happen, so the changes are
> not written to disk after a given time period. This isn't exactly bad

---

quote:

---

> IIS will eventually write the change to disk when you stop the IISADMIN
> service... but it's bad news if #4 happens...
> 4. Something manages to kill the IISADMIN service before IIS writes the
> change. This can be an inproc ISAPI crashing, or using IISRESET and IIS
> takes >30 seconds to restart (probably likely with Exchange as a
> dependency). When this happens, the unwritten changes are lost, and upon
> restart, you get the old settings.
>
> What you're describing is that somehow, #4 is happening prior to your

---

quote:

---

> being flushed to disk. Thus, you're losing your change. The way you work
> around this is to basically make the change and IMMEDIATELY cause a

---

quote:

---

> flush to disk to happen. Stopping the IISADMIN service is one way, but

---

quote:

---

> using IISRESET. The sure way to do this is to type:
> NET STOP /y IISADMIN on the commandline
>
> With IIS6, what we changed was:
> 1. Give you a menu option to immediately save all configuration to disk.
> 2. When you exit the UI, automatically initiate a flush to disk.
>
> We will probably never change this behavior on prior IIS versions since

---

quote:

---

> change can be dangerous and cause other potential unknown problems. It's
> better to have a known problem and workaround than an unknown problem with
> an unknown workaround.
>
> --
> //David
> IIS
> This posting is provided "AS IS" with no warranties, and confers no

---

quote:

---

> //
> "Research Services" <key@lamar.n0-sp@m.colostate.edu.NO> wrote in message
> news:uOPN55JyDHA.1736@TK2MSFTNGP09.phx.gbl...
> Yes, I believe this is a bug as well, I have seen several posts in this
> newsgroup over the last several months with others having the same issue.
> Could the MS guy elaborate of what might be wrong or where to look for the
> source of the problem, what to fix?
>
> Our issue has been very inconsistent, we stop all web services during our
> offline Exchange backup every night. And even though we have unchecked

---

quote:

---

> box for "Integreated Windows Authentication" it will sometimes stay
> unchecked when the web services are restarted but most of the time the box
> is rechecked automatically.
>
> Thanks Karl, I try what you have suggested.
>
>
> "Karl Levinson [x y] mvp" <levinson_k@despammed.com> wrote in message
> news:%2349xah9xDHA.2116@TK2MSFTNGP11.phx.gbl...
> bug,
What[QUOTE][color=darkred]
> I
place,[QUOTE][color=darkred]
> into
be[QUOTE][color=darkred]
message[QUOTE][color=darkred]
Authentication[QUOTE][color=darkred]
time[QUOTE][color=darkred]
> don't
and[QUOTE][color=darkred]
> users
> disable
>
>
>

---

quote:

---

> Okay, we've tried what you suggested, making the change to the virtual
> directory and unchecking the "Integrated Windows Authentication" box, and
> then immediately run "NET STOP /y IISADMIN" from a Cmd Prompt, it
> successfully stops the service and all other dependant Exchange services.
> We start all of the services back up and the box remains unchecked. It
> remained uncheck for the next 2 days, but then on the 3rd day it was

---

quote:

---

> again automatically. Just a reminder, this is a Member Server running
> Windows 2000 SP4 and Exchange 2000 Post-SP3, we stop/start all Exchange

---

quote:

---

> IIS services every night for offline backups. We are attempting to change
> this on a Virtual Directory, not the top level of the website. Is there
> something we are missing? Thank you for your help.
>
>
>
>
> "David Wang [Msft]" <someone@online.microsoft.com> wrote in message
> news:OdijbuSyDHA.2508@TK2MSFTNGP12.phx.gbl...
> is
> immediately
are[QUOTE][color=darkred]
> since
upon[QUOTE][color=darkred]
> change
work[QUOTE][color=darkred]
> metabase
> NOT
> the
It's[QUOTE][color=darkred]
with[QUOTE][color=darkred]
> rights.
message[QUOTE][color=darkred]
issue.[QUOTE][color=darkred]
the[QUOTE][color=darkred]
our[QUOTE][color=darkred]
> the
box[QUOTE][color=darkred]
> What
> place,
[and/or[QUOTE][color=darkred]
back[QUOTE][color=darkred]
> be
> message
> Authentication
that[QUOTE][color=darkred]
> time
We[QUOTE][color=darkred]
> and
>
>

---

quote:

---

> You might want to change Exchange related setting via System Manager.
> as when it start it might overwrite the setting configure in IIS MMC.
>
> --
> Regards,
> Bernard Cheah
> http://support.microsoft.com/
> Please respond to newsgroups only ...
>
>
>
> "Research Services" <key@lamar.n0-sp@m.colostate.edu.NO> ????
> news:#4V3VRXzDHA.2680@TK2MSFTNGP11.phx.gbl...
and[QUOTE][color=darkred]
services.[QUOTE][color=darkred]
> checked
> and
change[QUOTE][color=darkred]
difference[QUOTE][color=darkred]
in[QUOTE][color=darkred]
to[QUOTE][color=darkred]
> are
IISADMIN[QUOTE][color=darkred]
the[QUOTE][color=darkred]
IIS[QUOTE][color=darkred]
> upon
> work
but[QUOTE][color=darkred]
disk.[QUOTE][color=darkred]
since[QUOTE][color=darkred]
> It's
> with
> message
this[QUOTE][color=darkred]
> issue.
> the
> our
unchecked[QUOTE][color=darkred]
> box
known[QUOTE][color=darkred]
> [and/or
> back
should[QUOTE][color=darkred]
> that
we[QUOTE][color=darkred]
> We
configured[QUOTE][color=darkred]
home[QUOTE][color=darkred]
>
>

---

quote:

---

> Well this is actually an IIS setting - and if you do anything related to

---

quote:

---

> from the Exchange System Manager it tells you to use the IIS MMC Console.
> Unless there is somewhere else we can make this change...?
>
>
>
>
> "Bernard" <qbernard@hotmail.com.discuss> wrote in message
> news:e8HpkobzDHA.604@tk2msftngp13.phx.gbl...
> and
> services.
It[QUOTE][color=darkred]
Exchange[QUOTE][color=darkred]
> change
there[QUOTE][color=darkred]
> difference
flush.[QUOTE][color=darkred]
kept[QUOTE][color=darkred]
> in
algorithm[QUOTE][color=darkred]
> to
changes[QUOTE][color=darkred]
bad[QUOTE][color=darkred]
> IISADMIN
> the
> IIS
your[QUOTE][color=darkred]
you[QUOTE][color=darkred]
> but
> disk.
> since
problem[QUOTE][color=darkred]
> this
for[QUOTE][color=darkred]
during[QUOTE][color=darkred]
> unchecked
the[QUOTE][color=darkred]
message[QUOTE][color=darkred]
> known
exit.[QUOTE][color=darkred]
> should
for[QUOTE][color=darkred]
every[QUOTE][color=darkred]
and[QUOTE][color=darkred]
> we
OWA.[QUOTE][color=darkred]
> configured
> home
will[QUOTE][color=darkred]
>
>

---

quote:

---

> Ok, I've described basically the same solution as Karl. Only difference

---

quote:

---

> that I *know* that stopping IISADMIN will trigger the metabase flush.
>
> I'll describe what's going on.
>
> The basic problem is this:
> 1. When you make a configuration change to IIS via the UI, it is kept in
> memory (since IIS will frequently take the change live) and NOT

---

quote:

---

> written to disk.
> 2. Later, IIS attempts to write the change to disk using an algorithm to
> determine "idleness".
> 3. I've seen instances where "idleness" doesn't happen, so the changes are
> not written to disk after a given time period. This isn't exactly bad

---

quote:

---

> IIS will eventually write the change to disk when you stop the IISADMIN
> service... but it's bad news if #4 happens...
> 4. Something manages to kill the IISADMIN service before IIS writes the
> change. This can be an inproc ISAPI crashing, or using IISRESET and IIS
> takes >30 seconds to restart (probably likely with Exchange as a
> dependency). When this happens, the unwritten changes are lost, and upon
> restart, you get the old settings.
>
> What you're describing is that somehow, #4 is happening prior to your

---

quote:

---

> being flushed to disk. Thus, you're losing your change. The way you work
> around this is to basically make the change and IMMEDIATELY cause a

---

quote:

---

> flush to disk to happen. Stopping the IISADMIN service is one way, but

---

quote:

---

> using IISRESET. The sure way to do this is to type:
> NET STOP /y IISADMIN on the commandline
>
> With IIS6, what we changed was:
> 1. Give you a menu option to immediately save all configuration to disk.
> 2. When you exit the UI, automatically initiate a flush to disk.
>
> We will probably never change this behavior on prior IIS versions since

---

quote:

---

> change can be dangerous and cause other potential unknown problems. It's
> better to have a known problem and workaround than an unknown problem with
> an unknown workaround.
>
> --
> //David
> IIS
> This posting is provided "AS IS" with no warranties, and confers no

---

quote:

---

> //
> "Research Services" <key@lamar.n0-sp@m.colostate.edu.NO> wrote in message
> news:uOPN55JyDHA.1736@TK2MSFTNGP09.phx.gbl...
> Yes, I believe this is a bug as well, I have seen several posts in this
> newsgroup over the last several months with others having the same issue.
> Could the MS guy elaborate of what might be wrong or where to look for the
> source of the problem, what to fix?
>
> Our issue has been very inconsistent, we stop all web services during our
> offline Exchange backup every night. And even though we have unchecked

---

quote:

---

> box for "Integreated Windows Authentication" it will sometimes stay
> unchecked when the web services are restarted but most of the time the box
> is rechecked automatically.
>
> Thanks Karl, I try what you have suggested.
>
>
> "Karl Levinson [x y] mvp" <levinson_k@despammed.com> wrote in message
> news:%2349xah9xDHA.2116@TK2MSFTNGP11.phx.gbl...
> bug,
What[QUOTE][color=darkred]
> I
place,[QUOTE][color=darkred]
> into
be[QUOTE][color=darkred]
message[QUOTE][color=darkred]
Authentication[QUOTE][color=darkred]
time[QUOTE][color=darkred]
> don't
and[QUOTE][color=darkred]
> users
> disable
>
>
>

---

quote:

---

> If that's the case, then your problem is not the setting being lost. It
> sounds like something elsewhere is intentionally turning it back on
> (probably Exchange), so you want to configure Exchange (or however it

---

quote:

---

> you to configure it) to not use Integrated Windows Authentication.
>
> --
> //David
> IIS
> This posting is provided "AS IS" with no warranties, and confers no

---

quote:

---

> //
> "Research Services" <key@lamar.n0-sp@m.colostate.edu.NO> wrote in message
> news:%234V3VRXzDHA.2680@TK2MSFTNGP11.phx.gbl...
> Okay, we've tried what you suggested, making the change to the virtual
> directory and unchecking the "Integrated Windows Authentication" box, and
> then immediately run "NET STOP /y IISADMIN" from a Cmd Prompt, it
> successfully stops the service and all other dependant Exchange services.
> We start all of the services back up and the box remains unchecked. It
> remained uncheck for the next 2 days, but then on the 3rd day it was

---

quote:

---

> again automatically. Just a reminder, this is a Member Server running
> Windows 2000 SP4 and Exchange 2000 Post-SP3, we stop/start all Exchange

---

quote:

---

> IIS services every night for offline backups. We are attempting to change
> this on a Virtual Directory, not the top level of the website. Is there
> something we are missing? Thank you for your help.
>
>
>
>
> "David Wang [Msft]" <someone@online.microsoft.com> wrote in message
> news:OdijbuSyDHA.2508@TK2MSFTNGP12.phx.gbl...
> is
> immediately
are[QUOTE][color=darkred]
> since
upon[QUOTE][color=darkred]
> change
work[QUOTE][color=darkred]
> metabase
> NOT
> the
It's[QUOTE][color=darkred]
with[QUOTE][color=darkred]
> rights.
message[QUOTE][color=darkred]
issue.[QUOTE][color=darkred]
the[QUOTE][color=darkred]
our[QUOTE][color=darkred]
> the
box[QUOTE][color=darkred]
> What
> place,
[and/or[QUOTE][color=darkred]
back[QUOTE][color=darkred]
> be
> message
> Authentication
that[QUOTE][color=darkred]
> time
We[QUOTE][color=darkred]
> and
>
>
>

---

quote:

---

> We haven't been able to determine if and where Exchange might be setting
> Integrated Windows Authentication on other than in IIS. Does anyone know

---

quote:

---

> Exchange is doing this, and if so, how to prevent it? Thanks!
>
>
>
> "David Wang [Msft]" <someone@online.microsoft.com> wrote in message
> news:ORA1MwpzDHA.560@TK2MSFTNGP11.phx.gbl...
> wants
> rights.
message[QUOTE][color=darkred]
and[QUOTE][color=darkred]
services.[QUOTE][color=darkred]
> checked
> and
change[QUOTE][color=darkred]
difference[QUOTE][color=darkred]
in[QUOTE][color=darkred]
to[QUOTE][color=darkred]
> are
IISADMIN[QUOTE][color=darkred]
the[QUOTE][color=darkred]
IIS[QUOTE][color=darkred]
> upon
> work
but[QUOTE][color=darkred]
disk.[QUOTE][color=darkred]
since[QUOTE][color=darkred]
> It's
> with
> message
this[QUOTE][color=darkred]
> issue.
> the
> our
unchecked[QUOTE][color=darkred]
> box
known[QUOTE][color=darkred]
> [and/or
> back
should[QUOTE][color=darkred]
> that
we[QUOTE][color=darkred]
> We
configured[QUOTE][color=darkred]
home[QUOTE][color=darkred]
>
>

---

quote:

---

> Go into Exchange System Manager and drill down to the http - Exchange
> Virtual Server. Exchange and Public directories. Note that you cannot
> modify the properties of the Exchange Virtual server itself - those must

---

quote:

---

> managed by IIS. However, if you are going to make authentication settings
> changes, such as on the Exchange and Public virtual directories, you want

---

quote:

---

> do them here, not in IIS. Exchange will periodically refresh the IIS
> Metabase with it's settings. If you set the authentication in IIS, rather
> than in ESM, it will quite likely be overwritten by Exchange the next time
> the settings are refreshed.
>
> --
> Ben Winzenz
> Network Engineer
> Gardner & White
>
> Exchange FAQ's: http://www.swinc.com/resource/exch_faq.htm
> Exchange 2000 FAQ's: http://www.swinc.com/resource/e2kfaq.htm
>
>
> "Research Services" <key@lamar.n0-sp@m.colostate.edu.NO> wrote in message
> news:eOkMD8uzDHA.536@tk2msftngp13.phx.gbl...
know[QUOTE][color=darkred]
> IF
It[QUOTE][color=darkred]
> message
> and
> services.
It[QUOTE][color=darkred]
Exchange[QUOTE][color=darkred]
> change
there[QUOTE][color=darkred]
> difference
flush.[QUOTE][color=darkred]
kept[QUOTE][color=darkred]
> in
algorithm[QUOTE][color=darkred]
> to
changes[QUOTE][color=darkred]
bad[QUOTE][color=darkred]
> IISADMIN
> the
> IIS
your[QUOTE][color=darkred]
you[QUOTE][color=darkred]
> but
> disk.
> since
problem[QUOTE][color=darkred]
> this
for[QUOTE][color=darkred]
during[QUOTE][color=darkred]
> unchecked
the[QUOTE][color=darkred]
message[QUOTE][color=darkred]
> known
exit.[QUOTE][color=darkred]
> should
for[QUOTE][color=darkred]
every[QUOTE][color=darkred]
and[QUOTE][color=darkred]
> we
OWA.[QUOTE][color=darkred]
> configured
> home
will[QUOTE][color=darkred]
>
>

---

quote:

---

> Excellent! We'll try changing it here (and the possible combination of

---

quote:

---

> "net stop /y iisadmin") and see if it holds longer than a few days.

---

quote:

---

> you!
>
>
> "Ben Winzenz" <benwinzenz@NOSPAM.gardnerwhite.com> wrote in message
> news:uYd$8LvzDHA.556@TK2MSFTNGP11.phx.gbl...
> be
settings[QUOTE][color=darkred]
want[QUOTE][color=darkred]
> to
rather[QUOTE][color=darkred]
time[QUOTE][color=darkred]
message[QUOTE][color=darkred]
setting[QUOTE][color=darkred]
> know
> It
it[QUOTE][color=darkred]
virtual[QUOTE][color=darkred]
box,[QUOTE][color=darkred]
> It
running[QUOTE][color=darkred]
> Exchange
> there
> flush.
> kept
> algorithm
> changes
> bad
writes[QUOTE][color=darkred]
and[QUOTE][color=darkred]
and[QUOTE][color=darkred]
> your
> you
a[QUOTE][color=darkred]
way,[QUOTE][color=darkred]
problems.[QUOTE][color=darkred]
> problem
no[QUOTE][color=darkred]
> for
> during
stay[QUOTE][color=darkred]
> the
> message
> exit.
one[QUOTE][color=darkred]
go[QUOTE][color=darkred]
in[QUOTE][color=darkred]
> for
> every
> and
> OWA.
on.[QUOTE][color=darkred]
> will
or[QUOTE][color=darkred]
>
>

---