I want to create a web application tied to a domain name within my server. Following are the steps I followed:

  • Modified the server host file for www.xyz.com to resolve to localhost
  • I am able to ping www.xyz.com which does resolve to localhost
  • Create a web application with host header www.xyz.com
  • Created a site collection

But I can't login to that site for reason. When I visit http://www.xyz.com through the browser, I get prompted for credentials but it doesn't accept my credentials even though I assigned myself as the site collection admin. Did I miss a step above? With 2007, I followed the same steps and it works.

Any help will be appreciated.


1 Answer 1


Are you now running on Windows Server 2008 or 2008 R2? In Windows Server 2008 they implemented a security check called the "Loopback Check" to restrict doing just what you are trying to do :)

Check out the following KB article for a registry work-around. This will only happen when you try to browse to the host header from the server that hosts the site. If you browse to the site from another computer, this should not be a problem.

If you are on a non-production server, the easiest option is the #2, add "DisableLoopbackCheck" to the appropriate registry key.


  • 1
    It would be also usefull to just try accessing the site from another PC. May 24, 2011 at 22:26
  • It is also possible it is an Kerberos issue, but only if Kerberos is the selected auth schema. May 25, 2011 at 6:05
  • The loopback check was introduced in windows server 2003 (a service pack), although it does ship with 2008. May 25, 2011 at 7:17
  • Yes it is windows 2008 R2.
    – Emon
    May 25, 2011 at 16:21
  • 3
    The linked KB article gives you both answers. For non-production, Method #2 is easiest "DisableLoopbackCheck". For production servers, use Method #1 and the BackConnectionHostNames option with the specific host headers to allow. Method #1 is more secure. May 25, 2011 at 18:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.