MS Dynamics CRM 2011 - HTTP Error 401.1 - Unauthorized: Access is denied -- "when usig the server name only"
Sunday, January 29, 2012 6:31 PM
I have an installation of MS Dynamics CRM 2011. Access to CRM was working just fine when the link used referred to the server name and corresponding port. I just applied the recommended Windows updates for CRM and now I get the
Click on “Package Work 1.dtsx”
"HTTP Error 401.1 - Unauthorized: Access is denied" error. When I replace the server name with the IP address, the CRM application works fine. What configuration setting changed to cause this issue?
Sunday, January 29, 2012 6:32 PMPlease ignore the "Click on Package Work 1.dtsx" phrase.
Monday, January 30, 2012 5:08 PM
This sounds like a kerberos configuration issue. When using AD authentication your browser will use Kerberos we connecting to the hostname. If you use the IP address the browser will use NTLM. For kerberos configuration there are some configurations to do, this page contains some information on the subject: http://thecrmarchitect.com/2009/01/23/crm_401_unauthorized/.
Most important things to check are that the SPNs are set on the proper user (running the CRM IIS Application Pool), if the Network service is used the SPNs must be configured on the computer account. Also ensure no duplicate SPNs are defined.
Monday, January 30, 2012 7:28 PM
Thank you very much for taking the time to read my issue and providing me your advice. I will look at the information on the links you provided me and work on fixing it tonight.
Tuesday, January 31, 2012 1:46 AM
This issue seems to be Authentication Failure as the URL is working all fine with IP address.
1) Check with what account you are running teh CRM Application Pool.(Custome Account or Network Service)
2) Select CRM Website -> Authentication -> Windows Authentication -> Advanced Settings -> See if Kernal Mode Authentication is enabled.
3) If the custom account is running the app pool and kernal mode authentication is checked and SPNs are set on custom account please run the following command on CRM server :-
Set the IIS useAppPoolCredentials value to True
- Open an elevated command prompt window. To open an elevated Command Prompt window, click Start, point to All Programs, click Accessories, right-click Command Prompt, and then click Run as administrator.
- Navigate to %windir%\system32\inetsrv.
- Type appcmd.exe set config -section:system.webServer/security/authentication/windowsAuthentication -useAppPoolCredentials:true
4. Do an IISRESET
- Proposed As Answer by Khaja Mohiddin Monday, June 18, 2012 4:47 PM
Tuesday, January 31, 2012 3:41 PM
Thank you for taking the time to review my issue and providing me your advice. I started troubleshooting the issue last night with the advice from Patrick and will continue tonight with your recommendations.