I'm trying to create a custom 401 error page for my site. The setup is a SharePoint 2010 enterprise site with subwebs. The entire solution requires authentication (no anonymous access). I've tried both of these:

[1] http://www.ngpixel.com/2010/12/23/sharepoint-2010-custom-error-pages/

[2] http://sharepointlearningcurve.blogspot.com/2010/06/sharepoint-2010-custom-error-messages.html#comment-form

  1. Gets me very close, but I'm unable to redirect to my own custom html page. I can modify the default 401 page though.
  2. Doesn't really explain how to do it with an authenticated site as it requires access to the _layouts folder.

I've updated my web config like this:

<!-- inside <system.web> -->
<customErrors defaultRedirect="404.htm" mode="On">
    <error redirect="401-c.htm" statusCode="401" />
    <error redirect="403.htm" statusCode="403" />
    <error redirect="404.htm" statusCode="404" />
    <error redirect="500.htm" statusCode="500" />

<!--inside <system.webServer> -->
<httpErrors errorMode="Custom" existingResponse="Auto"/>

This setup allows me to redirect to the default 401.htm page (found in inetpub/custerr/), but I'm unable to redirect it. Even with the xml above (401-c.htm is found in the same directory) it only directs me to the default 401 page.

I don't have a clue what's going on here. Can anyone help?

Edit: An alternative web.config setup I've tried that also did not work:

<!-- inside <system.web> -->
<customErrors mode="On"/>

<!-- inside <system.webServer> -->
<httpErrors errorMode="Custom" existingResponse="Auto">
    <remove statusCode="401" subStatusCode="-1" />
    <error statusCode="401" prefixLanguageFilePath=""
                   path="/Pages/AccessDenied.aspx" responseMode="ExecuteURL" />

The system kept asking me for credentials even though I entered them correctly. When I closed the login box it did not give me my custom error page. Only a blank page with absolutely no content.

Edit2: I've concluded that none of the above solutions actually work as they intercept the 401 error BEFORE it reaches SharePoint. I need a solution like the one @GavinB and @Amit Kumawat suggests though for some reason this does not work either. It seems I need a way to rewrite the actual data that SharePoint sends back with the 401 error. I've tried this: http://www.sharepointblues.com/2010/02/12/custom-error-page-adapter/ but cannot seem to find the correct assembly for the "controlType" attribute.

  • I'm sorry, but I cannot set any answer as correct since none of the proposed solutions have worked for me. I get either a blank page or the default 401.
    – Thomas
    Commented Dec 13, 2011 at 6:55
  • Myself, with method 2, I have found that it does work for a 404, but not for a 401 - something to do with the login process. You can do this via the IIS GUI - I've a question here on the difference: serverfault.com/questions/466387/…
    – bgmCoder
    Commented Jan 12, 2013 at 21:35

6 Answers 6


Ok, there are APIs to support everything you're tyring to do, NEVER DIRECTLY EDIT THE web.config!!!!!!!

Follow these easy steps:

Package your custom error pages into a solution. Hey, if you're doing the 401 you might want to add a couple of others to support access requests too ;)

Deploy the pages to {SP_Root}\Tempates\Layouts\MyErrorPages\ using a mapped folder so that you don't overwrite the exisitng ones.

Create a WebApplictaion scoped feature. Create an event receiver for the feature and use a adaption of the following code to set the error page for your web appliation.

    const string customAccessDeniedPage = "/_layouts/MyErrorPages/AccessDenied.aspx";
    const string customRequestAccessPage = "/_layouts/MyErrorPages/ReqAccess.aspx";
    const string customConfirmationPage = "/_layouts/MyErrorPages/Confirmation.aspx";

    public override void FeatureActivated(SPFeatureReceiverProperties properties)
        SPWebApplication webApp = properties.Feature.Parent as SPWebApplication;
        if (null != webApp)
            if (webApp.UpdateMappedPage(SPWebApplication.SPCustomPage.AccessDenied, customAccessDeniedPage) &&
                webApp.UpdateMappedPage(SPWebApplication.SPCustomPage.RequestAccess, customRequestAccessPage) &&
                webApp.UpdateMappedPage(SPWebApplication.SPCustomPage.Confirmation, customConfirmationPage))

    //On deactivate set default access denied page
    public override void FeatureDeactivating(SPFeatureReceiverProperties properties)
        SPWebApplication webApp = properties.Feature.Parent as SPWebApplication;
        if (null != webApp)
            if (webApp.UpdateMappedPage(SPWebApplication.SPCustomPage.AccessDenied, null) &&
                webApp.UpdateMappedPage(SPWebApplication.SPCustomPage.RequestAccess, null) &&
                webApp.UpdateMappedPage(SPWebApplication.SPCustomPage.Confirmation, null))

Now deploy your solution, given this is scoped to the WebApplication ensure that you only deploy it to the web app you want your custom error pages on.

Edit: it's worth noting that there is a known issue with UpdateMappedPage in SharePoint 2013 in that it doesn't work. This may be resolved in SP1 but I've not yet tested it.

  • I've tried this. It doesn't give me my custom aspx page only a blank one (no content at all). I'm using UnsecuredLayoutsPageBase and explicitly overriding AllowAnonymousAccess and AllowNullWeb.
    – Thomas
    Commented Dec 7, 2011 at 9:34
  • Ok, the problem isn't the redirection then but your page. Start with baby steps, copy the OOTB page and use that in your solution with some small edits to the HTML to verify that the re-direction is working. Then slowly change the page to add branding or remove functionality. I have the above approach & code working perfectly
    – GavinB
    Commented Dec 7, 2011 at 20:10
  • Oh also, the URL you see is the OOTB 401 page URL but it does load the custom page.
    – GavinB
    Commented Dec 7, 2011 at 20:11
  • Do you have anonymous access enabled?
    – Thomas
    Commented Dec 12, 2011 at 6:32
  • I just tried this again using the built in accessdenied.aspx page and I still get nothing.
    – Thomas
    Commented Dec 12, 2011 at 12:21

Error 401 is for Unauthorized Access (or Access Denied). In a SharePoint site, "Access Denied" is managed at two levels - IIS and SharePoint.

The web.config changes you did are meant for IIS. As "access denied" inside SharePoint site is managed by SharePoint, for IIS there is no 401 and hence no redirection.

To set custom 401 page for a SharePoint site, you have to use SharePoint API only. Also, Your custom 401 page should be accessible to a user even if he is unauthorized on the site. It means your custom 401 page should not throw a 401 itself to unauthorized user!

By the way, you may loose "Sign in as different user" functionality if you change default access denied page in SharePoint .

  • So this means I have to set up anonymous access on my SharePoint installation right? I was hoping there was a way to avoid that. Thanks for the answer though. I'm pretty sure this is the best solution now.
    – Thomas
    Commented Dec 7, 2011 at 14:32
  • I think no need for SharePoint site (or library) to be anonymous, if the custom 401 page is in file system. You can assign anonymous access just to the virtual directory(custerr) where your 401 page is placed Commented Dec 7, 2011 at 15:16
  • Ok, so I tried this: /_layouts/ErrorPages/ is a folder that I've explicitly given anonymous access through IIS manager. It can now (verified) be reached by users not logged in. Then I tried to redirect using the solution proposed by GavinB below. Problem is I still get a blank page when the user aborts the authentication. Why, oh why is this so hard?
    – Thomas
    Commented Dec 13, 2011 at 7:05
  • Use httpwatch in IE and see how web requests and response are working. This will give you better idea what is happening. Let me know your observation. If you don't have httpwatch, download it from here httpwatch.com/download. Commented Dec 13, 2011 at 8:09

Sounds like #1 should work fine. I am thinking that the Browser File Handling of the web application might be preventing you from seeing the HTM file. You can update that setting to Permissive, and I believe HTM files should start to work fine.

  1. Go to Central Administration
  2. Go to Application Management
  3. Go to Manage Web Applications
  4. Click on the web application you would like to modify
  5. In the ribbon click on General Settings
  6. Change Browser File Handling to Permissive
  7. Press OK

Give it a shot.

  • Thanks for the tip. I had a look at my settings and this seems to already be on.
    – Thomas
    Commented Dec 7, 2011 at 6:01

Maybe this works for you: Implementing SharePoint 2010 Custom Error Pages


  • I looked at this, but all it gives me is a blank page and not my 401.htm
    – Thomas
    Commented Dec 6, 2011 at 12:09
  • Did u try to use aspx instead of htm ?
    – Ben
    Commented Dec 6, 2011 at 12:22
  • url works fine for me Commented Dec 6, 2011 at 21:56
  • Tried this as well. Suddenly IE constantly asks for login and password even though I know what I enter is correct. As soon as I remove <httpErrors> the problem disappears.
    – Thomas
    Commented Dec 7, 2011 at 10:13
  • I, too, followed the linked post. The customization works with a 404, but not with a 401. The 401 will cause an infinite loop in the login process.
    – bgmCoder
    Commented Jan 12, 2013 at 21:38

I agree with GavinB, it is best to use SPWebApplication.SPCustomPage enumeration to add the custom error pages.

You can run the following PowerShell to see if you have already set some custom layouts pages:

Get-SPCustomLayoutsPage -WebApplication http://mySharePointWebapp.dev.int

Output:Page RelativePath

  • AccessDenied
  • Confirmation
  • Error
  • Login
  • RequestAccess
  • Signout
  • WebDeleted

See more about How to set Custom 404, Access Denied, Request Access and Custom Error pages in SharePoint


Perhaps this link helps: http://blog.staticvoid.co.nz/2011/6/14/custom_errors_and_sharepoint_2010

Maybe you are missing the callStack="true"?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.