Field note / 14 October 2010
NTLM, keep alive connections and the 401.1 loop
An authentication prompt that never resolves can be a connection behaviour problem hiding behind a credential problem.
The 401.1 response means authentication failed, but it does not say why. In an NTLM environment, the failure can depend on the way the connection is reused. If a proxy or a load balancer breaks persistence, the authentication handshake may land on a different server or a different connection before it completes.
The browser keeps asking for credentials because each attempt begins from an earlier state. From the user’s perspective the password must be wrong. From the server’s perspective the conversation never reached the stage where the password could be evaluated.
Prove where the connection goes
Test directly against a single web server before adding the proxy or load balancer back into the path. If the direct test succeeds, compare the connection handling. Check whether affinity is enabled, whether keep alive is preserved and whether the timeout is shorter than the authentication exchange.
Review the IIS logs and the proxy logs with the same timestamp. Look for a request arriving at a different node mid sequence. Do not change authentication providers until the request path is understood, because the loop may simply move to a different layer.
The short list
Checks worth running
- Test the request directly against one server, then reintroduce each network hop.
- Compare connection persistence and timeout settings across the path.
- Correlate IIS and proxy logs for the same authentication attempt.
The 401.1 code points at authentication, but the evidence may point at connection handling. Follow the whole conversation before changing the credential configuration.
Outside reading
Reference shelf
Official documentation and independent community reading for the subjects in this note.
- Microsoft Learn: IIS documentation (opens in a new tab)Reference material for web server configuration, authentication and diagnostics.
- Microsoft Learn: Windows Server documentation (opens in a new tab)Current guidance for Windows Server roles, networking, storage and management.
- Microsoft Support (opens in a new tab)Support articles, troubleshooting steps and product help from Microsoft.
- Microsoft Learn: SharePoint administration (opens in a new tab)Operational guidance for service settings, site management and the modern admin experience.
- Microsoft Tech Community (opens in a new tab)Community discussion, product announcements and practical posts from Microsoft teams.
- Microsoft Learn Q&A (opens in a new tab)A community question and answer space hosted by Microsoft.
- SharePoint Stack Exchange (opens in a new tab)An independent question and answer community for SharePoint practitioners.
- Microsoft Security Response Center (opens in a new tab)Security advisories, update guidance and vulnerability response information.
- Microsoft Security blog (opens in a new tab)Microsoft guidance on security research, response and platform protection.
- Microsoft Download Center (opens in a new tab)Official downloads for Microsoft tools, updates and supporting packages.
- Microsoft Learn: PowerShell documentation (opens in a new tab)Language reference, cmdlet documentation and guidance for repeatable automation.
- Microsoft Learn: SharePoint documentation (opens in a new tab)The starting point for current SharePoint administration, development and hybrid guidance.
- Microsoft Learn: SharePoint search (opens in a new tab)Documentation for search architecture, crawling and result management.
- PowerShell Gallery (opens in a new tab)A public repository for PowerShell modules and scripts. Review package provenance before use.
- Microsoft Learn: SQL Server documentation (opens in a new tab)Official reference material for database engine configuration, performance and recovery.