I am trying to fix a performance problem on a WSS 3.0 clustered site.

Each server has ca. 30000 requests per hour, but ca. 90% are of type:

2010-10-13 10:00:05 W3SVC14309999999 servername GET /sites/xxxx/_themes/Lacquer/viewheadergrad_lacquer.gif - 80 - HTTP/1.1 Mozilla/4.0+(compatible;+MSIE+6.0;+Windows+NT+5.1;+HO32602R;+.NET+CLR+1.1.4322;+.NET+CLR+2.0.50727) MSOWebPartPage_AnonymousAccessCookie=80;+WSS_KeepSessionAuthenticated=80 http://yyyy/sites/xxx/main.aspx ccccc 401 2 2148074254 291 521 15

Anyone know what could be generating these requests and why they are getting http 401.


We are trying to find out what authentication method is used, it is either NTLM or Kerberos in a Load Balanced environment.

Edit 2

There appears to be a pattern with 5 calls that return http 401.2, then 1 call that returns http 401.1, followed by a call that returns http 200.

Edit 3

We are using NTLM authentication

  • are users actually seeing an error? Looks like a problem with anonymous access, do they have access to the layouts folder? Commented Oct 15, 2010 at 19:44
  • They are not seeing any errors, just that it is going really slow. Commented Oct 15, 2010 at 19:46
  • 2
    Could you clarify what kind of authentication you are using on this web app? NTLM, Kerberos, Anonymouse, Forms-based, other?
    – Sam Yates
    Commented Oct 16, 2010 at 15:37

1 Answer 1


We fixed this by going over to kerberos authentication.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.