'How many of you are using Internet Explorer 11 on your PC? Do you know how to repair IE browser when it crashes in Windows 10?
I'm now having this issue that the browser keeps crashing when I tried to open it again and again. Internet Explorer reinstallation cannot even solve this problem.
What can I do? Help!'
When Internet Explorer crashes, freezes or stops responding in your PC, don't worry. Download chrome 40 offline installer. This article will provide you 5 effective methods to help you effectively fix Internet Explorer not working, crashing issue and just follow to repair IE browser in Windows 10/8/7 with ease now.
Method 1. Run Internet Explorer Performance troubleshooter
Why cant internet explorer open facebook video calling I am running windows 8.1 I keep getting the message that internet explorer cant open face book but I have to use google chrome which I don't like to use on my p.c Original title: internet explorer. Internet explorer (IE) can be opened from Run command by executing iexplore. If you want to open a website or web page directly from Run window, you can just specify the URL of the site/page with the iexplore command. For example, to open ‘ www.windows-commandline.com', you can execute the below command from Run window.
Calling a function on your core has the potential to have side effects, where reading a variable is more like asking for a resource, etc. The downside of this is it's a bit trickier to play with unless you're using a web development tool that lets you specify the http request method. Internet Explorer is most likely installed on your computer in case it was upgraded to Windows 10 from an earlier version of Windows. In such a case, you just need to search for Internet Explorer in Windows 10 search bar and pin IE to the taskbar. Start typing Internet Explorer in the Windows 10 search bar (next to the start button). The free plug-in supports modern versions of Chrome and Firefox on both Mac and Windows computers, as well as Internet Explorer 8 and higher. To make calls with Skype on the Web, visit Outlook.com.
1. Press Windows key on the keyboard > Type: troubleshooting and select the topmost search result.
2. Click View all > Select Internet Explorer Performance > Advanced > Apply repairs automatically.
3. Follow the onscreen instructions and wait for the process to complete.
Then you can check whether the crashed IE browser can work or not.
Method 2. Scan and repair bad sectors
Option 1. Repair bad sectors with partition manager software
EaseUS partition manager software allows you to effectively repair bad sectors in Windows system that stops IE from working:
Step 1: Open EaseUS Partition Master on your computer. Then locate the disk, right-click the partition you want to check, and choose 'Check File System'.
Step 2: In the Check File System window, keep the 'Try to fix errors if found' option selected and click 'Start'.
Step 3: The software will begin checking your partition file system on your disk. When it has completed, click 'Finish'.
Option 2. Run SFC command to repair corrupted system files to make IE work
1. Right-click Start > Select Command Prompt (Admin);
2. Type:sfc /scannow and hit Enter.
Method 3. Disable Add-ons in Internet Explorer
1. Run Internet Explorer > Click Manage Add-ons on Tool menu;
2. Click the name of add-on and click Disable to disable all add-ons and close the Internet Explorer;
3. Restart IE browser to see if the problem has been fixed or not;
If not, continue below steps:
4. Click Manage Add-ons in Internet Explorer tool menu > Click and disable one add-on at a time;
5. Restart the Internet Explorer to check if the problem has been fixed;
6. Next time, enable the previously disabled add-on and disable another different add-on till IE browser crashing problem gets fixed.
Method 4. Reset Internet Explorer to default settings
1. Open Internet Explorer > Tool > Click Internet Options to open Internet Options box;
2. Go to Advanced > Click Reset to open Reset Internet Explorer Settings dialog;
3. Click Reset and wait for the system to change IE browser to default settings.
4. Close the dialog and restart Internet Explorer browser to apply all changes.
Method 5. Update Internet Explorer to the latest version
When Internet Explorer is outdated, you may not be able to continue using it to search wanted answers online. Therefore, update Internet Explorer to the latest version can also repair and fix IE browser crashing, not responding or freezing issue in your IE browser:
For Windows 10/8 users:
1. Open Start by pressing Windows key > Type: check for updates and press Enter.
2. On Windows Update or Update status screen> Click Check for updates to look for available updates for Internet Explorer.
For Windows 7 users:
1. Click on Start to open Start menu > Type: windows update and hit Enter.
2. On Windows Update screen, click Check for updates to find the available update for IE browser by then.
This article can help you to isolate and fix the causes of various errors that you may experience when you access websites that are configured to use Kerberos authentication in Internet Explorer. The number of potential issues that may occur is almost as large as the number of tools that are available to solve them.
Common symptom when Kerberos fails
You try to access a website for which Windows Integrated Authenticated has been configured and for which you expect to be using the Kerberos authentication protocol. When you access the website, your browser immediately prompts you for credentials, as follows:
Although you enter a valid user name and password, you're prompted again (three prompts total). Then, you're shown a screen that indicates that you aren't allowed to access the desired resource. The screen displays a HTTP 401 status code that resembles the following error:
On the Microsoft Internet Information Services (IIS) server, the website logs contains requests that end in a 401.2 status code, such as the following log:
Alternatively, the screen displays a 401.1 status codes, such as the following:
Determine whether Kerberos is used
When you troubleshoot Kerberos authentication failure, we recommend that you simplify the configuration to the minimum (one client, one server, one IIS site that's running on the default port). Additionally, you can follow some basic troubleshooting steps. For example, use a test page to verify the authentication method that's used. If you use ASP.NET, you can create this ASP.net authentication test page.
If you're using classic ASP, you can use the following Testkerb.asp page:
You can also use tools such as Fiddler, HttpWatch, Network Monitor, or the developer tools in your browser to determine whether Kerberos is used. For more information about how such traces can be generated, see client-side tracing.
When Kerberos is used, the request that's sent by the client is large (more than 2,000 bytes). This is because the HTTP_AUTHORIZATION header includes the Kerberos ticket. The following request is for a page that uses Kerberos-based Windows Authentication to authenticate incoming users. The size of the GET request is more than 4,000 bytes.
If the NTLM handshake is used, the request will be much smaller. The following client-side capture shows an NTLM authentication request. The GET request is much smaller (less than 1,400 bytes).
After you determine that Kerberos authentication is failing, check each of the following items in the given order.
Things to check if Kerberos authentication fails
The following sections describes the things that you can use to check if Kerberos authentication fails.
Are the client and server in the same domain
Using Kerberos requires a domain because a Kerberos ticket is delivered by the domain controller (DC). Advanced scenarios are also possible in which the client and server aren't in the same domain but in two domains of the same forest, or in two different forests. These possible scenarios are discussed in the Why does Kerberos delegation fail between my two forests although it used to work section of this article.
Is IIS configured to use integrated authentication
Is integrated authentication enabled in Internet Explorer
Does the URL that's used resolve to a security zone for which credentials can be sent
You should always run this check for sites that are matched to the Local Intranet zone of the browser or for sites in the Trusted Sites zone. You can check in which zone your browser decides to include the site. To do this, open to the File menu of Internet Explorer, and then select Properties. The Properties window will display the zone in which the browser has decided to include the site that you're browsing to.
You can check whether the zone in which the site is included allows Automatic logon by opening the Internet options menu of Internet Explorer, and selecting the Security tab. After you select the desired zone, select the Custom level button to display the settings and make sure that Automatic logon is selected. (Typically, this feature is turned on by default for the Intranet and Trusted Sites zones).
Note
Even through this configuration is not common (because it requires the client to have access to a DC), Kerberos can be used for a URL in the Internet Zone. In this case, unless default settings are changed, the browser will always prompt the user for credentials. Kerberos delegation won't work in the Internet Zone. This is because Internet Explorer allows Kerberos delegation only for a URL in the Intranet and Trusted sites zones.
Is the IIS server configured to send the WWW-Authenticate: Negotiate header
If IIS doesn't send this header, you will have to use the IIS Manager console to set the Negotiate header though the NTAuthenticationProviders configuration property (see Windows Authentication Providers ). You can access the console through the Providers setting of the Windows Authentication details in the IIS manager.
Note
By default, the NTAuthenticationProviders property is not set. This causes IIS to send both Negotiate and Windows NT LAN Manager (NTLM) headers.
Are the client and server installed on the same computer
By default, Kerberos isn't enabled in this configuration. To change this behavior, you have to set the DisableLoopBackCheck registry key. For more information, see KB 926642.
Can the client get a Kerberos ticket
You can use the Kerberos List (KLIST) tool to verify that the client computer can obtain a Kerberos ticket for a given service principal name (SPN). In this example, the SPN is http/web-server.
Note
KLIST is a native Windows tool since Windows Server 2008 for server-side operating systems and Windows 7 Service Pack 1 for client-side operating systems.
If the Kerberos ticket request fails, Kerberos authentication isn't used. NTLM fallback may occur if the Kerberos ticket request fails. This is because the SPN requested is unknown to the DC. If the DC is unreachable, no NTLM fallback occurs.
In order to declare an SPN, see How to use SPNs when you configure Web applications that are hosted on Internet Information Services.
Does the web server use a port other than default (80)
By default, Internet Explorer doesn't include the port number information in the SPN that's used to request a Kerberos ticket. This can be a problem if you use IIS to host multiple sites under different ports and identities. In this configuration, Kerberos authentication may work only for specific sites even if all SPNs have been correctly declared in Active Directory. To fix this issue, you must set the FEATURE_INCLUDE_PORT_IN_SPN_KB908209 registry value. (See the Internet Explorer feature keys section for information about how to declare the key.) This setting forces Internet Explorer to include the port number in the SPN that's used to request the Kerberos ticket.
Does Internet Explorer use the expected SPN
If a website is accessed by using an alias name (CNAME), Internet Explorer first uses DNS resolution to resolve the alias name to a computer name (ANAME). The computer name is then used to build the SPN and request a Kerberos ticket. Therefore, even if the URL that is entered in the Internet Explorer address bar is http://MYWEBSITE, Internet Explorer requests an SPN for HTTP/MYSERVER if MYWEBSITE is an alias (CNAME) of MYSERVER (ANAME). You can change this behavior by using the FEATURE_USE_CNAME_FOR_SPN_KB911149 registry key. (See the Internet Explorer feature keys for information about how to declare the key.)
A Network Monitor trace is a good method to check the SPN that's associated with the Kerberos ticket, as in the following example:
Does the application pool identity match the account associated with SPN
When a Kerberos ticket is sent from Internet Explorer to an IIS server, the ticket is encrypted by using a private key. The private key is a hash of the password that's used for the user account that's associated with the SPN. Therefore, only an application that's running under this account will be able to decode the ticket.
The following procedure is a summary of the Kerberos authentication algorithm:
Internet Explorer determines an SPN by using the URL that's entered into the address bar.
The SPN is passed through a Security Support Provider Interface (SSPI) API (InitializeSecurityContext) to the system component that's in charge of Windows security (the Local Security Authority Subsystem Service (LSASS) process). At this stage, you can see that the Internet Explorer code doesn't implement any code to construct the Kerberos ticket. Internet Explorer calls only SSPI APIs.
LSASS uses the SPN that's passed in to request a Kerberos ticket to a DC. If the DC can serve the request (known SPN), it creates a Kerberos ticket, and then encrypts the ticket by using a key that's constructed from the hash of the user account password for the account that's associated with the SPN. LSASS then sends the ticket to the client. As far as Internet Explorer is concerned, the ticket is an opaque blob.
Internet Explorer encapsulates the Kerberos ticket that's provided by LSASS in the
Authorization: Negotiateheader, and then it sends the ticket to the IIS server.IIS handles the request and routes it to the correct application pool (by using the host header that's specified).
The application pool tries to decrypt the ticket by using SSPI/LSASS APIs and by following these conditions:
If the ticket can be decrypted, Kerberos authentication succeeds, and all services that are associated with the ticket (impersonation, delegation if ticket allows it, and so on) are available.
If the ticket can't be decrypted, a Kerberos error (KRB_AP_ERR_MODIFIED) is returned. This error is a generic error that indicates that the ticket was altered in some manner during its transport. Therefore, the ticket cannot be decrypted. This error is also logged in the Windows event logs.
If you don't explicitly declare an SPN, Kerberos authentication works only if the application pool identity is one of the following:
- Network Service
- ApplicationPoolIdentity
- Another system account such as LOCALSYSTEM or LOCALSERVICE
However, these identities are not recommended because they are a security risk. In this case, the Kerberos ticket is built by using a default SPN that's created in Active Directory when a computer (in this case, the server that IIS is running on) is added to the domain. This default SPN is associated with the computer account. Under IIS, the computer account maps to Network Service or ApplicationPoolIdentity.
If your application pool has to use an identity other than the listed identities, you'll have to declare an SPN (using SETSPN), and then associate it with the account that's used for your application pool identity. A common mistake is to create similar SPNs that have different accounts. For example:
What Do You Call Internet Explorer And Firefox
- SETSPN http/mywebsite UserAppPool1
- SETSPN http/mywebsite UserAppPool2
This configuration won't work because there is no deterministic way to know whether the Kerberos ticket for the http/mywebsite SPN will be encrypted by using the UserAppPool1 or UserAppPool2 password. This configuration typically generates KRB_AP_ERR_MODIFIED errors. To determine whether you are in this (bad) duplicate SPNs scenario, you can use the tools that are documented in Why you can still have duplicate SPNs in AD 2012 R2 and AD 2016. From Windows Server 2008 onwards, you can also use an updated version of SETSPN for Windows that allows the detection of duplicate SPNs by using the setspn –X command when you declare a new SPN for your target account. For more information, see Setspn.
We also recommended that you review the following articles:
Does Kerberos authentication fail in IIS 7 and later versions even though it works in IIS 6
Kernel mode authentication is a feature that was introduced in IIS 7. It provides the following advantages:
- Performance is increased because kernel-mode-to-user-mode transitions are no longer made.
- Kerberos ticket decoding is made by using the machine account (not by using application pool identity). This lets you have multiple applications pools running under different identities without having to declare SPNs.
Warning
'How many of you are using Internet Explorer 11 on your PC? Do you know how to repair IE browser when it crashes in Windows 10?
I'm now having this issue that the browser keeps crashing when I tried to open it again and again. Internet Explorer reinstallation cannot even solve this problem.
What can I do? Help!'
When Internet Explorer crashes, freezes or stops responding in your PC, don't worry. Download chrome 40 offline installer. This article will provide you 5 effective methods to help you effectively fix Internet Explorer not working, crashing issue and just follow to repair IE browser in Windows 10/8/7 with ease now.
Method 1. Run Internet Explorer Performance troubleshooter
Why cant internet explorer open facebook video calling I am running windows 8.1 I keep getting the message that internet explorer cant open face book but I have to use google chrome which I don't like to use on my p.c Original title: internet explorer. Internet explorer (IE) can be opened from Run command by executing iexplore. If you want to open a website or web page directly from Run window, you can just specify the URL of the site/page with the iexplore command. For example, to open ‘ www.windows-commandline.com', you can execute the below command from Run window.
Calling a function on your core has the potential to have side effects, where reading a variable is more like asking for a resource, etc. The downside of this is it's a bit trickier to play with unless you're using a web development tool that lets you specify the http request method. Internet Explorer is most likely installed on your computer in case it was upgraded to Windows 10 from an earlier version of Windows. In such a case, you just need to search for Internet Explorer in Windows 10 search bar and pin IE to the taskbar. Start typing Internet Explorer in the Windows 10 search bar (next to the start button). The free plug-in supports modern versions of Chrome and Firefox on both Mac and Windows computers, as well as Internet Explorer 8 and higher. To make calls with Skype on the Web, visit Outlook.com.
1. Press Windows key on the keyboard > Type: troubleshooting and select the topmost search result.
2. Click View all > Select Internet Explorer Performance > Advanced > Apply repairs automatically.
3. Follow the onscreen instructions and wait for the process to complete.
Then you can check whether the crashed IE browser can work or not.
Method 2. Scan and repair bad sectors
Option 1. Repair bad sectors with partition manager software
EaseUS partition manager software allows you to effectively repair bad sectors in Windows system that stops IE from working:
Step 1: Open EaseUS Partition Master on your computer. Then locate the disk, right-click the partition you want to check, and choose 'Check File System'.
Step 2: In the Check File System window, keep the 'Try to fix errors if found' option selected and click 'Start'.
Step 3: The software will begin checking your partition file system on your disk. When it has completed, click 'Finish'.
Option 2. Run SFC command to repair corrupted system files to make IE work
1. Right-click Start > Select Command Prompt (Admin);
2. Type:sfc /scannow and hit Enter.
Method 3. Disable Add-ons in Internet Explorer
1. Run Internet Explorer > Click Manage Add-ons on Tool menu;
2. Click the name of add-on and click Disable to disable all add-ons and close the Internet Explorer;
3. Restart IE browser to see if the problem has been fixed or not;
If not, continue below steps:
4. Click Manage Add-ons in Internet Explorer tool menu > Click and disable one add-on at a time;
5. Restart the Internet Explorer to check if the problem has been fixed;
6. Next time, enable the previously disabled add-on and disable another different add-on till IE browser crashing problem gets fixed.
Method 4. Reset Internet Explorer to default settings
1. Open Internet Explorer > Tool > Click Internet Options to open Internet Options box;
2. Go to Advanced > Click Reset to open Reset Internet Explorer Settings dialog;
3. Click Reset and wait for the system to change IE browser to default settings.
4. Close the dialog and restart Internet Explorer browser to apply all changes.
Method 5. Update Internet Explorer to the latest version
When Internet Explorer is outdated, you may not be able to continue using it to search wanted answers online. Therefore, update Internet Explorer to the latest version can also repair and fix IE browser crashing, not responding or freezing issue in your IE browser:
For Windows 10/8 users:
1. Open Start by pressing Windows key > Type: check for updates and press Enter.
2. On Windows Update or Update status screen> Click Check for updates to look for available updates for Internet Explorer.
For Windows 7 users:
1. Click on Start to open Start menu > Type: windows update and hit Enter.
2. On Windows Update screen, click Check for updates to find the available update for IE browser by then.
This article can help you to isolate and fix the causes of various errors that you may experience when you access websites that are configured to use Kerberos authentication in Internet Explorer. The number of potential issues that may occur is almost as large as the number of tools that are available to solve them.
Common symptom when Kerberos fails
You try to access a website for which Windows Integrated Authenticated has been configured and for which you expect to be using the Kerberos authentication protocol. When you access the website, your browser immediately prompts you for credentials, as follows:
Although you enter a valid user name and password, you're prompted again (three prompts total). Then, you're shown a screen that indicates that you aren't allowed to access the desired resource. The screen displays a HTTP 401 status code that resembles the following error:
On the Microsoft Internet Information Services (IIS) server, the website logs contains requests that end in a 401.2 status code, such as the following log:
Alternatively, the screen displays a 401.1 status codes, such as the following:
Determine whether Kerberos is used
When you troubleshoot Kerberos authentication failure, we recommend that you simplify the configuration to the minimum (one client, one server, one IIS site that's running on the default port). Additionally, you can follow some basic troubleshooting steps. For example, use a test page to verify the authentication method that's used. If you use ASP.NET, you can create this ASP.net authentication test page.
If you're using classic ASP, you can use the following Testkerb.asp page:
You can also use tools such as Fiddler, HttpWatch, Network Monitor, or the developer tools in your browser to determine whether Kerberos is used. For more information about how such traces can be generated, see client-side tracing.
When Kerberos is used, the request that's sent by the client is large (more than 2,000 bytes). This is because the HTTP_AUTHORIZATION header includes the Kerberos ticket. The following request is for a page that uses Kerberos-based Windows Authentication to authenticate incoming users. The size of the GET request is more than 4,000 bytes.
If the NTLM handshake is used, the request will be much smaller. The following client-side capture shows an NTLM authentication request. The GET request is much smaller (less than 1,400 bytes).
After you determine that Kerberos authentication is failing, check each of the following items in the given order.
Things to check if Kerberos authentication fails
The following sections describes the things that you can use to check if Kerberos authentication fails.
Are the client and server in the same domain
Using Kerberos requires a domain because a Kerberos ticket is delivered by the domain controller (DC). Advanced scenarios are also possible in which the client and server aren't in the same domain but in two domains of the same forest, or in two different forests. These possible scenarios are discussed in the Why does Kerberos delegation fail between my two forests although it used to work section of this article.
Is IIS configured to use integrated authentication
Is integrated authentication enabled in Internet Explorer
Does the URL that's used resolve to a security zone for which credentials can be sent
You should always run this check for sites that are matched to the Local Intranet zone of the browser or for sites in the Trusted Sites zone. You can check in which zone your browser decides to include the site. To do this, open to the File menu of Internet Explorer, and then select Properties. The Properties window will display the zone in which the browser has decided to include the site that you're browsing to.
You can check whether the zone in which the site is included allows Automatic logon by opening the Internet options menu of Internet Explorer, and selecting the Security tab. After you select the desired zone, select the Custom level button to display the settings and make sure that Automatic logon is selected. (Typically, this feature is turned on by default for the Intranet and Trusted Sites zones).
Note
Even through this configuration is not common (because it requires the client to have access to a DC), Kerberos can be used for a URL in the Internet Zone. In this case, unless default settings are changed, the browser will always prompt the user for credentials. Kerberos delegation won't work in the Internet Zone. This is because Internet Explorer allows Kerberos delegation only for a URL in the Intranet and Trusted sites zones.
Is the IIS server configured to send the WWW-Authenticate: Negotiate header
If IIS doesn't send this header, you will have to use the IIS Manager console to set the Negotiate header though the NTAuthenticationProviders configuration property (see Windows Authentication Providers ). You can access the console through the Providers setting of the Windows Authentication details in the IIS manager.
Note
By default, the NTAuthenticationProviders property is not set. This causes IIS to send both Negotiate and Windows NT LAN Manager (NTLM) headers.
Are the client and server installed on the same computer
By default, Kerberos isn't enabled in this configuration. To change this behavior, you have to set the DisableLoopBackCheck registry key. For more information, see KB 926642.
Can the client get a Kerberos ticket
You can use the Kerberos List (KLIST) tool to verify that the client computer can obtain a Kerberos ticket for a given service principal name (SPN). In this example, the SPN is http/web-server.
Note
KLIST is a native Windows tool since Windows Server 2008 for server-side operating systems and Windows 7 Service Pack 1 for client-side operating systems.
If the Kerberos ticket request fails, Kerberos authentication isn't used. NTLM fallback may occur if the Kerberos ticket request fails. This is because the SPN requested is unknown to the DC. If the DC is unreachable, no NTLM fallback occurs.
In order to declare an SPN, see How to use SPNs when you configure Web applications that are hosted on Internet Information Services.
Does the web server use a port other than default (80)
By default, Internet Explorer doesn't include the port number information in the SPN that's used to request a Kerberos ticket. This can be a problem if you use IIS to host multiple sites under different ports and identities. In this configuration, Kerberos authentication may work only for specific sites even if all SPNs have been correctly declared in Active Directory. To fix this issue, you must set the FEATURE_INCLUDE_PORT_IN_SPN_KB908209 registry value. (See the Internet Explorer feature keys section for information about how to declare the key.) This setting forces Internet Explorer to include the port number in the SPN that's used to request the Kerberos ticket.
Does Internet Explorer use the expected SPN
If a website is accessed by using an alias name (CNAME), Internet Explorer first uses DNS resolution to resolve the alias name to a computer name (ANAME). The computer name is then used to build the SPN and request a Kerberos ticket. Therefore, even if the URL that is entered in the Internet Explorer address bar is http://MYWEBSITE, Internet Explorer requests an SPN for HTTP/MYSERVER if MYWEBSITE is an alias (CNAME) of MYSERVER (ANAME). You can change this behavior by using the FEATURE_USE_CNAME_FOR_SPN_KB911149 registry key. (See the Internet Explorer feature keys for information about how to declare the key.)
A Network Monitor trace is a good method to check the SPN that's associated with the Kerberos ticket, as in the following example:
Does the application pool identity match the account associated with SPN
When a Kerberos ticket is sent from Internet Explorer to an IIS server, the ticket is encrypted by using a private key. The private key is a hash of the password that's used for the user account that's associated with the SPN. Therefore, only an application that's running under this account will be able to decode the ticket.
The following procedure is a summary of the Kerberos authentication algorithm:
Internet Explorer determines an SPN by using the URL that's entered into the address bar.
The SPN is passed through a Security Support Provider Interface (SSPI) API (InitializeSecurityContext) to the system component that's in charge of Windows security (the Local Security Authority Subsystem Service (LSASS) process). At this stage, you can see that the Internet Explorer code doesn't implement any code to construct the Kerberos ticket. Internet Explorer calls only SSPI APIs.
LSASS uses the SPN that's passed in to request a Kerberos ticket to a DC. If the DC can serve the request (known SPN), it creates a Kerberos ticket, and then encrypts the ticket by using a key that's constructed from the hash of the user account password for the account that's associated with the SPN. LSASS then sends the ticket to the client. As far as Internet Explorer is concerned, the ticket is an opaque blob.
Internet Explorer encapsulates the Kerberos ticket that's provided by LSASS in the
Authorization: Negotiateheader, and then it sends the ticket to the IIS server.IIS handles the request and routes it to the correct application pool (by using the host header that's specified).
The application pool tries to decrypt the ticket by using SSPI/LSASS APIs and by following these conditions:
If the ticket can be decrypted, Kerberos authentication succeeds, and all services that are associated with the ticket (impersonation, delegation if ticket allows it, and so on) are available.
If the ticket can't be decrypted, a Kerberos error (KRB_AP_ERR_MODIFIED) is returned. This error is a generic error that indicates that the ticket was altered in some manner during its transport. Therefore, the ticket cannot be decrypted. This error is also logged in the Windows event logs.
If you don't explicitly declare an SPN, Kerberos authentication works only if the application pool identity is one of the following:
- Network Service
- ApplicationPoolIdentity
- Another system account such as LOCALSYSTEM or LOCALSERVICE
However, these identities are not recommended because they are a security risk. In this case, the Kerberos ticket is built by using a default SPN that's created in Active Directory when a computer (in this case, the server that IIS is running on) is added to the domain. This default SPN is associated with the computer account. Under IIS, the computer account maps to Network Service or ApplicationPoolIdentity.
If your application pool has to use an identity other than the listed identities, you'll have to declare an SPN (using SETSPN), and then associate it with the account that's used for your application pool identity. A common mistake is to create similar SPNs that have different accounts. For example:
What Do You Call Internet Explorer And Firefox
- SETSPN http/mywebsite UserAppPool1
- SETSPN http/mywebsite UserAppPool2
This configuration won't work because there is no deterministic way to know whether the Kerberos ticket for the http/mywebsite SPN will be encrypted by using the UserAppPool1 or UserAppPool2 password. This configuration typically generates KRB_AP_ERR_MODIFIED errors. To determine whether you are in this (bad) duplicate SPNs scenario, you can use the tools that are documented in Why you can still have duplicate SPNs in AD 2012 R2 and AD 2016. From Windows Server 2008 onwards, you can also use an updated version of SETSPN for Windows that allows the detection of duplicate SPNs by using the setspn –X command when you declare a new SPN for your target account. For more information, see Setspn.
We also recommended that you review the following articles:
Does Kerberos authentication fail in IIS 7 and later versions even though it works in IIS 6
Kernel mode authentication is a feature that was introduced in IIS 7. It provides the following advantages:
- Performance is increased because kernel-mode-to-user-mode transitions are no longer made.
- Kerberos ticket decoding is made by using the machine account (not by using application pool identity). This lets you have multiple applications pools running under different identities without having to declare SPNs.
Warning
If an SPN has been declared for a specific user account (also used as application pool identity), kernel mode authentication can't decrypt the Kerberos ticket because it uses the machine account. This problem is typical in web farm scenarios. This is because this scenario usually declares an SPN for the (virtual) NLB hostname. To prevent this from occurring, you can do either of the following:
- Disable Kernel mode authentication. (Not recommended from a performance standpoint.)
- Set useAppPoolCredentials to true. (Doing this retains the performance benefit of kernel mode authentication while allowing the Kerberos ticket to be decoded under the application pool identity). For more information, see New in IIS 7 - Kernel Mode Authentication.
Why does delegation fail although Kerberos authentication works
In this scenario, check the following items:
The Internet Explorer Zone that's used for the URL. Kerberos delegation is allowed only for the Intranet and Trusted Sites zones. (In other words, Internet Explorer sets the
ISC_REQ_DELEGATEflag when it calls InitializeSecurityContext only if the zone that is determined is either Intranet or Trusted Sites.)The user account for the IIS application pool hosting your site must have the Trusted for delegation flag set within Active Directory.
If delegation still fails, consider using the Kerberos Configuration Manager for IIS. This tool lets you diagnose and fix IIS configurations for Kerberos authentication and for the associated SPNs on the target accounts. For more information, see the README.md. You can download the tool from here.
Why do I get bad performance when I use Kerberos authentication
In older versions of Windows Server, such as Windows Server 2008 SP2 and Windows Server 2008 R2, Kerberos is a request-based authentication protocol. This means that the client must send the Kerberos ticket (that can be quite a large blob) with each request that's made to the server. This is contrary to authentication methods that rely on NTLM. By default, NTLM is session-based. This means that the browser will authenticate only one request when it opens the TCP connection to the server. Each subsequent request on the same TCP connection will no longer require authentication for the request to be accepted. In newer versions of IIS, from Windows 2012 R2 onwards, Kerberos is also session-based. This means that only the first request on a new TCP connection has to be authenticated by the server. Subsequent requests do not have to include a Kerberos ticket.
You can change this behavior by using the authPersistNonNTLM property if you are running under IIS 7 and later versions. If the property is set to true, Kerberos will become session based. If the property is set to false, it will be session-based. Therefore, it will have worse performance because we have to include a larger amount of data to send to the server each time. For more information, see Request based versus Session based Kerberos Authentication (or the AuthPersistNonNTLM parameter).
Note
Download Internet Explorer 12
It may not be a good idea to blindly use Kerberos authentication on all objects. Using Kerberos authentication to fetch hundreds of images by using conditional GET requests that are likely generate 304 not modified responses is like trying to kill a fly by using a hammer. Such a method will also not provide obvious security gains.
Why does Kerberos delegation fail between my two forests although it used to work
Assume that you have a scenario in which the users of your application are located in a domain inside forest A, your application is located in a domain inside forest B, and you have a trust relationship between the forests. You may find the Kerberos delegation stops working even though it used to work previously and you have not made any changes to either forests or domains. Notice that Kerberos authentication still works in this scenario. It is only delegation that fails. This problem might occur because of security updates to Windows Server that were released by Microsoft in March 2019 and July 2019. These updates disabled unconstrained Kerberos delegation (the ability to delegate a Kerberos token from an application to a back-end service) across forest boundaries for all trusts (new and existing). For more information, see Updates to TGT delegation across incoming trusts in Windows Server.
Internet Explorer feature keys
These are registry keys that turn some features of the browser on or off. The keys are located in the following registry locations:
HKEY_USERSSoftwareMicrosoftInternet ExplorerMainFeatureControl– if defined at the user levelHKEY_LOCAL_MACHINESOFTWAREMicrosoftInternet ExplorerMainFeatureControl- if defined at the machine level
Feature keys should be created in one of these locations, depending on whether you want to turn the feature on or off for all users on the computer or for only a specific account. These keys should be created under the respective path. Inside the key, a DWORD value that's named iexplorer.exe should be declared. The default value of each key should be set to either true or false, depending on the desired setting of the feature. By default, the value of both feature keys, FEATURE_INCLUDE_PORT_IN_SPN_KB908209 and FEATURE_USE_CNAME_FOR_SPN_KB911149, is false. For completeness, here is an example export of the registry by turning the feature key to include port numbers in the Kerberos ticket to true:
