The IISADMPWD Directory; Toggling Kerberos in IIS 5.0

[Editor's Note: Email your IIS-related solutions (400 words or less) to R2R at [email protected]. We'll edit submissions for style, grammar, and length. If we print your contribution, you'll get $100.]

By default, the IIS installation creates the iisadmpwd directory in %systemroot%system32inetsrv. This directory contains nine .htr (really just Active Server Pages—ASP) files that let users change their Windows NT passwords. Users must access these files as a secure resource (using HTTP over Secure Sockets Layer—HTTPS) for them to work properly. (In July 1999, Microsoft released a security bulletin about malicious users possibly using .htr files to execute arbitrary code on a server. You can find information about this risk and a patch at http://www.microsoft.com/technet/security/ bulletin/ms99-019.asp.)

Here's a list of each of the nine files and their respective functions:

All these files are plaintext, and you can edit them to make them look cleaner or fit the feel of your intranet, extranet, or whatever they're running on. (Note: Be sure to back up the ASP files before you edit them.) Keep in mind that IIS requires the virtual directory iisadmpwd for this functionality to work. This functionality works well with both NT Challenge/Response authentication and Basic authentication, but if you use Basic authentication on an Internet-accessible server, you really should use Secure Sockets Layer (SSL).

For more information about the iisadmpwd directory and changing passwords, see the following Microsoft articles:

—Chris Lehr
[email protected]

Toggling Kerberos in IIS 5.0
In IIS 5.0, Microsoft changed the authentication methods available for your intranet or extranet. One change is that Windows NT Challenge/Response authentication now has a new name—Integrated Windows authentication. Instead of transmitting usernames or passwords, Integrated Windows authentication can use either Kerberos 5.0 authentication's Negotiate headers or its own challenge/response protocol.

You can configure a site's settings to communicate that it supports Kerberos as an alternative to traditional NTLM authentication. This setting is part of the NT Authentication Providers property, which exists in the IIS metabase. By default, when you upgrade a site from IIS 4.0 to IIS 5.0, that site won't support Kerberos. If you attempt to set Kerberos operation on a site residing on a server you've upgraded to IIS 5.0, the NT Authentication Providers property will prevent Kerberos from functioning.

Alternatively, if you perform a clean installation of a Windows 2000 (Win2K) server with IIS 5.0 and create a site on that server, that site automatically notifies you that Kerberos is an option. However, if your environment doesn't support Kerberos authentication, you can (for performance reasons) turn off the Kerberos negotiation for your server.

The metabase entry w3svcNTAuthenticationProviders controls what your site sends to clients for supported authentication methods under Integrated Windows authentication. When you set this key to Negotiate.NTLM, a Microsoft Internet Explorer (IE) 5.0 or later client assumes that your server supports Kerberos authentication. If the client's environment also supports Kerberos, the browser will attempt to use it to for authentication. If you enter NTLM, this informs clients that the server supports only NTLM for Integrated Windows authentication.

You can toggle the Negotiate value by using a command prompt window to edit the IIS metabase. In the command prompt window, change to the C:inetpubadminscripts directory. To check the value of the Authentication Provider key, enter

cscript adsutil.vbs get w3svc/NTAuthenticationProviders

To change the value of the key, enter

cscript adsutil.vbs set w3svc/NTAuthenticationProviders _ "key value"

In the preceding command, replace the string key value with either NTLM or Negotiate.NTLM. Include the quotation marks, but delete any embedded spaces in the value. The Microsoft article "Kerberos Authentication Fails After Upgrading from IIS 4.0 to IIS 5.0" (http://support.microsoft.com/support/kb/articles/q248/3/50.asp) explains changing this value in more detail.

—William Sheldon
[email protected]