MS Dynamics CRM 2011 - HTTP Error 401.1 - Unauthorized: Access is denied -- "when usig the server name only" RRS feed

  • Question

  • I have an installation of MS Dynamics CRM 2011.  Access to CRM was working just fine when the link used referred to the server name and corresponding port.  I just applied the recommended Windows updates for CRM and now I get the 

    Click on “Package Work 1.dtsx”

    "HTTP Error 401.1 - Unauthorized:  Access is denied" error.  When I replace the server name with the IP address, the CRM application works fine.  What configuration setting changed to cause this issue?


    Sunday, January 29, 2012 6:31 PM

All replies

  • Please ignore the "Click on Package Work 1.dtsx" phrase. 
    Sunday, January 29, 2012 6:32 PM
  • This sounds like a kerberos configuration issue. When using AD authentication your browser will use Kerberos we connecting to the hostname. If you use the IP address the browser will use NTLM. For kerberos configuration there are some configurations to do, this page contains some information on the subject: http://thecrmarchitect.com/2009/01/23/crm_401_unauthorized/.

    Most important things to check are that the SPNs are set on the proper user (running the CRM IIS Application Pool), if the Network service is used the SPNs must be configured on the computer account. Also ensure no duplicate SPNs are defined.

    Patrick Verbeeten
    Monday, January 30, 2012 5:08 PM
  • Patrick:

    Thank you very much for taking the time to read my issue and providing me your advice.  I will look at the information on the links you provided me and work on fixing it tonight.


    Monday, January 30, 2012 7:28 PM
  • This issue seems to be Authentication Failure as the URL is working all fine with IP address.

    1) Check with what account you are running teh CRM Application Pool.(Custome Account or Network Service)

    2) Select CRM Website -> Authentication -> Windows Authentication -> Advanced Settings -> See if Kernal Mode Authentication is enabled.

    3) If the custom account is running the app pool and kernal mode authentication is checked and SPNs are set on custom account please run the following command on CRM server :-

    Set the IIS useAppPoolCredentials value to True


    1. Open an elevated command prompt window. To open an elevated Command Prompt window, click Start, point to All Programs, click Accessories, right-click Command Prompt, and then click Run as administrator. 
    2. Navigate to %windir%\system32\inetsrv.
    3. Type appcmd.exe set config -section:system.webServer/security/authentication/windowsAuthentication -useAppPoolCredentials:true

                 4. Do an IISRESET

    Tuesday, January 31, 2012 1:46 AM
  • Arpita:

    Thank you for taking the time to review my issue and providing me your advice.  I started troubleshooting the issue last night with the advice from Patrick and will continue tonight with your recommendations.


    Tuesday, January 31, 2012 3:41 PM