We have SharePoint 2013 public faced web site.
IIS site settings:
Anonymous and authenticated users have ability to visit site. But if anonymous users try to visit layouts pages, for example - https://xxx/_layouts/15/settings.aspx?Source=xxx authentication window appears.
How to prevent authentication prompt and show standard 401 error?
You can go to site settings->Site collection features->deactivate "Limited-access user permission lockdown mode" feature.
Of course, for other pages, the users need permission to access. If the user wants to access the relevant page, I suggest you give relevant permission to a user account and login with this account.
If you have set up Deny All access at the web app level, Authenticated users will be prompted to validate if they should be denied (brilliant).
SharePoint: Anonymous users are prompted for credentials on an anonymous site.
I haven't tried this, because I have a 2010 environment, but it looks like it might work. In site permissions under Anonymous Access, select Lists and Libraries. This should block access to all assets unless you grant them specifically. Grant Anonymous read access to your Site Pages, Site Assets, etc. that are needed to view the site. Hopefully this will block/hide access to the layouts content. Source
Otherwise, YOU will not be able to edit the site. If you block the ability to be prompted for access to anonymous users, you as an anonymous user when you first visit will not be able to find a login prompt to authenticate with.
Do you have the pulishing features turned on? Apparently they activate a hidden feature called ViewFormPagesLockdown. If not, use powershell to activate this feature. Try this.
You can display a custom, static 401 page like For access denied error, you can customize it with SharePoint PowerShell commands:
$webApp = Get-SPWebApplication http://sharepoint2013
$webApp.UpdateMappedPage([Microsoft.SharePoint.Administration.SPWebApplication+SPCustomPage]::AccessDenied,"_layouts/15/Error/AccessDenied.html")
$webApp.UpdateMappedPage([Microsoft.SharePoint.Administration.SPWebApplication+SPCustomPage]::Login,"_layouts/15/Error/AccessDenied.html")
$webApp.Update()
Note:
The folder “Error” and file "Error/AccessDenied.html" has to be under "_layouts/15" (i.e. C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\15\template\layouts) on all servers in the farm.
To revert back to default configuration, use:
$webApp = Get-SPWebApplication http://sharepoint2013; $webApp.UpdateMappedPage([Microsoft.SharePoint.Administration.SPWebApplication+SPCustomPage]::AccessDenied,$null); $webApp.UpdateMappedPage([Microsoft.SharePoint.Administration.SPWebApplication+SPCustomPage]::Login,$null); $webApp.Update()
Were you able to find a solution? I have tried disabling the windows authentication for the default and internet zones and the prompt stopped appearing at these urls but then the search did not crawl and gave Access denied error. I cannot use the Intranet zone url for search content source as when crawling a not default zone the search results urls for the rest of the zones are like the content source url. I do not want to change the default zone as site is mainly used by anonymous users and I want this zone to be default.
I've tried request blocking rules in the rewrite module of IIS like /_layouts/.aspx* and this hide the login prompt and showed 404 instead but then some of the search webparts were not retrieving data as some of their requests were also blocked...
I'm still searching for a solution but if you do not use search or search webparts for your site or you do not mind making your editors site a default zone you might consider disallowing the windows authentication either in the extended site settings or in IIS
