Microsoft Knowledge Base Article
This article contents is Microsoft Copyrighted material.
©2005-©2007 Microsoft Corporation. All rights reserved.
Terms
of Use |
Trademarks
Article ID: 935943 - Last Review: November 2, 2007 - Revision: 1.3
You cannot use Internet Explorer to connect to a Microsoft Virtual Server 2005 Administration Web site and then connect to another Virtual Server
Important This article contains information that shows you how to help lower security settings or how to turn off security features on a computer. You can make these changes to work around a specific problem. Before you make these changes, we recommend that you evaluate the risks that are associated with implementing this workaround in your particular environment. If you implement this workaround, take any appropriate additional steps to help protect the computer.
You use Microsoft Internet Explorer 6 or Windows Internet Explorer 7 to connect to a Microsoft Virtual Server (VS) 2005 Administration Web site. Then, you click
Switch Virtual Server to connect to another Virtual Server that does not have constrained delegation enabled. However, you receive an error message that resembles the following:
Could not connect to the Virtual Server on <computer>. Access was denied.
This problem occurs when the
Prompt for user name and password security setting is enabled in Internet Explorer when you try to connect to the VS Administration Web site.
Warning This workaround may make a computer or a network more vulnerable to attack by malicious users or by malicious software such as viruses. We do not recommend this workaround but are providing this information so that you can implement this workaround at your own discretion. Use this workaround at your own risk.
To work around this problem, change the Internet Explorer security settings on the client computer. To do this, follow these steps:
- In Internet Explorer, click Tools, and then click Internet Options.
- On the Security tab, select the zone that the client computer uses to connect to the Virtual Server Administration Web site, and then click Custom level.
- In the Security Settings dialog box, scroll to the bottom of the Settings list.
- Under User Authentication, select Automatic logon only in Intranet zone, and then click OK.
- Click Yes in the Warning dialog box.
- Click OK, and then exit Internet Explorer.
- Open Internet Explorer, and then open the Virtual Server Administration Web site.
- Under the Navigation menu, point to Virtual Server Manager, and then click Switch Virtual Server.
- Enter the name or the IP address of a computer that is running Virtual Server, and then click Connect.
Microsoft has confirmed that this is a problem in the Microsoft products that are listed in the "Applies to" section.
When you connect to the VS Administration Web site, Internet Explorer passes the authentication credentials or the token to the VS service (vssrvc.exe). Then, the VS service impersonates the user. However, another level of impersonation is performed if Internet Explorer is configured to prompt for a username and for a password. Because two levels of impersonation are not possible unless you set up constrained delegation, access to the VS Web Application fails.
For more information about constrained delegation in Virtual Server 2005, visit the following Microsoft Web site:
APPLIES TO
- Microsoft Virtual Server 2005 Standard Edition
- Microsoft Internet Explorer 6.0
- Windows Internet Explorer 7
| kbexpertiseinter kbtshoot kbprb KB935943 |
Community Feedback System
Very often, it takes hours to solve a problem. Very often, you've looked high
and low, and have tried a lot of solutions. When you finally found it, chances
are, it was because someone else helped you. Here's your chance to give back.
Use our community feedback tool to let others know what worked for you and what
didn't.
Please also understand that the community feedback system is not warranted to be
correct, it's simply a system that we've built to let people try and help each
other. If something in a feedback response doesn't make sense to you, or you're
not comfortable making changes that the feedback talks about (like registry
edits), please consult a professional.
Thank you for using kbAlertz.com Feedback System.
-- Scott Cate