Anyone knows why some of the the IIS log records of the SharePoint 2013 WFEs contain client computers' names in the cs-username field?

Aren't all connections supposed to be established together with user name information?

1 Answer 1


Please check the field sc-status. IIS can only log the username if users are authenticated. You should see a username, if you have sc-status 200. You will very often see sc-status 401 which means "unauthenticated". This line will only have an IP-Address or the hostname in cs-username. Please note that 401 lines do not indicate any kind of error, they are a normal behavior in NTLM/Kerberos authentication.

You could also have anonymous access enabled on your WebApplication. You can check this in Central Administration -> Application Management -> Manage web applications -> mark your WebApplication -> Authentication Providers -> Default (normally) -> "Enable anonymous access".

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.