I have a client trying to access our hosted SP 2010 instance, an she can log in, but once she starts clicking, gets prompted to login again and again.

She is accessing from the outside, not inside of the network.

Is this the very first time this has ever happened to anyone with Sharepoint :) ?

Cheers, Daniel

  • We found a solution - it turns out that the problem does NOT happen with FireFox, just IE7. We changed the authentication from Windows to Basic and now it works fine. Less secure perhaps, but it works. Sad that IE is at fault here, since it should be the one to work seamlessly with SP. Commented Apr 26, 2011 at 16:48
  • Bad idea, it sounds more like you're having this problem: social.msdn.microsoft.com/forums/en-US/iewebdevelopment/thread/… Configure for a trusted zone and you should be good to go. At a minimum if you insist on using Basic Authentication, configure for SSL so the authentication is still encrypted
    – tekiegreg
    Commented Apr 26, 2011 at 19:29
  • That link has about a dozen different solutions, some which work for some people others that do not. I really don't want to spend more time on this, so SSL may be the best route to patch up security. Commented Apr 26, 2011 at 20:24

5 Answers 5


In my experience its 99% a resource that the user can’t access, it might be an image, a .css file or anything else.
When she logs from inside the network, is everything working as it should?

  • I will check this immediately. Commented Apr 25, 2011 at 19:53
  • Verdict is - nope, from the server itself I can log in with my credentials, but not with hers. So going to check for account locks. Commented Apr 25, 2011 at 20:19
  • Drat, the account lock was a wild goose chase. Account is fine, I just need to use the address "localhost" to do anything on the machine itself, rather than the external name Commented Apr 25, 2011 at 21:18


It can be a loopback check that is being done to prevent reflection attacks against your system. The theory is that if a request comes from your machine to a DNS name that doesn’t match the machine name, the check will block the authentication.

Try this:

  1. Click Start, click Run, type regedit, and then click OK.
  2. In Registry Editor, locate and then click the following registry key:

HKEY_LOCAL_MACHINE \SYSTEM \ CurrentControlSet \ Control \ Lsa

  1. Right-click Lsa, point to New, and then click DWORD Value.

  2. Type DisableLoopbackCheck, and then press ENTER.

  3. Right-click DisableLoopbackCheck, and then click Modify.

  4. In the Value data box, type 1, and then click OK.

  5. Quit Registry Editor, and then restart your computer.


My typical experience with this is it's an account delegation problem. Are you running Kerberos? Check if SPN's are correctly configured and if the application accounts have the proper configurations. This especially applies if she's not the only non-admin user having issues.

Next possibility is Browser related, check security zones, cookies, etc...

Also check your site for external dependencies outside of the SharePoint environment, especially if you've done some heavy customizing. Maybe an image or stylesheet loaded externally she may not have access to?

  • not sure what you mean by Kerberos and SPN Commented Apr 25, 2011 at 22:12
  • Kerberos and SPN are a topic unto themselves, the first question to ask before going this route, are multiple non-admin users having the same problem? Administrators would be ok, but non-admins would have issues.
    – tekiegreg
    Commented Apr 25, 2011 at 22:20

Elaborating on JohnnyT's suggestion: Using fiddler (www.fidder2.com) is a great help in detecting if a page load contains request to items that are not published or are not available. Note that it may also simply be a page referenced from another site, eg. A users My site, that the browser by default cannot reuse authentication from. This can be solved my adding both sites to intranet zone in browser (preferably using GPO) or to safe sites with advanced setting to reuse authentication across trusted sites.

  • fiddler shows all access is via the same site, no requests anywhere else. Commented Apr 25, 2011 at 21:18
  • But are all 200's? No 403's? Commented Apr 26, 2011 at 6:01
  • right, but from my computer. the client is located in a poorly serviced but locked-down environment. so I cannot have her even install fiddler2. our hosting sharepoint was supposed to get around the poor quality of their network. Commented Apr 26, 2011 at 14:26

Something quick that is worth checking is that your site URL is in her browser Intranet zone rather than Trusted Sites or Internet zone.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.