1

Over past few months, I have often ran into issues which end up with DisableLoopbackCheck and DisableStrictNameChecking being candidate root causes. However, I never really become able to understand the security requirements for them and how disabling them is required for development environments.

What I would like to understand is:

  • What are these configurations meant for?

  • How would it impact my sites or development environment if they are misconfigured or incorrectly configured?

  • Why are the same configurations not required on production environment?

2

MSKB896861: You receive error 401.1 when you browse a Web site that uses Integrated Authentication and is hosted on IIS 5.1 or a later version

  • Q: What are these configurations meant for?

    • A: They were a security feature that first reared its ugly head in Windows 2003, but was carried into later versions of Windows Server. It's to prevent traffic from WFEs to logon to SharePoint using the FQDN or host header.
  • Q: How would it impact my sites or development environment if they are misconfigured or incorrectly configured?

    • A: DisableLoopBackCheck disables the security feature altogether, and BackConnectionHostNames tells the server "Don't use loopback check these specific host headers, but execute on all others."
  • Q: Why are the same configurations not required on production environment?

    • A: Disabling loopback check is somewhat accepted as the norm in development environments because essentially the development environments change so much, and host headers can be changed and created at will.

      Production rarely changes, and the traffic requests aren't coming from from the WFEs, but on development environments you will usually be developing ON the server. Plus, it's not open to the public, so it's like a little playground, so most devs just disableloopbackcheck and forget about it. It is not required for development environments, just preferred.

EDIT:

  • DisableStrictNameChecking is meant for SQL and file system aliases, and turning on this feature will allow connections with aliases without it being the machine name

  • DisableLoopBackCheck, when ON, allows all browsing to IIS FROM the server on which its hosted by using any host-header.

  • BackConnectionHostNames. This is a list of all the host headers to ignore during the loopback check (see previous). This list is only relevant if DisableLoopBackCheck is OFF.

  • I understood the third points. Regarding point 2, now I am confused between DisableStrictNameChecking and BackConnectionHostNames. I think BackConnectionHostNames are used to give a list of names that aren't validated, and don't know the purpose of strict name checking. Regarding point 1, can you elaborate a little please? My purpose behind the question is to get an understanding of all the things that might go wrong with SharePoint if I don't configure these correctly. – Nisarg Apr 11 '16 at 14:39
  • I meant BackConnectionHostNames not DisableStrictNameChecking, my mistake. See my edit. – Mike Apr 11 '16 at 16:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.