You cannot use IE to connect to a Microsoft Virtual Server 2005 Administration web site and then connect to another Virtual Server

When you use IE6 or IE7 to connect to a Microsoft Virtual Server (VS) 2005 Administration Web site and click Switch Virtual Server to connect to another Virtual Server that does not have constrained delegation enabled you receive an error message that resembles the following:

Could not connect to the Virtual Server on <computer>. Access was denied.

This problem occurs when the Prompt for user name and password security setting is enabled in Internet Explorer when you try to connect to the VS Administration Web site.

When you connect to the VS Administration Web site, Internet Explorer passes the authentication credentials or the token to the VS service (vssrvc.exe) which then impersonates the user. However, another level of impersonation is performed if Internet Explorer is configured to prompt for a username and for a password. Because two levels of impersonation are not possible unless you set up constrained delegation, access to the VS Web Application fails.

Warning: This workaround may make a computer or a network more vulnerable to attack by malicious users or by malicious software such as viruses. We do not recommend this workaround but are providing this information so that you can implement this workaround at your own discretion. Use this workaround at your own risk.

  1. In Internet Explorer, click Tools, and then click Internet Options.

     
  2. On the Security tab, select the zone that the client computer uses to connect to the Virtual Server Administration Web site, and then click Custom level. 

  3. In the Security Settings dialog box, scroll to the bottom of the Settings list.

  4. Under User Authentication, select Automatic logon only in Intranet zone, and then click OK.

  5. Click Yes in the Warning dialog box.

  6. Click OK, and then exit Internet Explorer.

  7. Open Internet Explorer, and then open the Virtual Server Administration Web site.

  8. Under the Navigation menu, point to Virtual Server Manager, and then click Switch Virtual Server.

  9. Enter the name or the IP address of a computer that is running Virtual Server, and then click Connect.

http://support.microsoft.com/default.aspx/kb/935943

 

Published Thu, Aug 2 2007 9:05 by sandi
Filed under: ,