Lots of 401 status codes in IIS logs using Windows authentication

Question

I'm seeing a lot of 401s in the IIS status logs. I know this is normal for windows authentication, but it seems like the authentication should be cached.

For example, a user will get a 401 when accessing a the home page default.aspx file for a site. They will authenticate and get a 200. Two minutes later, the same user loading the same default.aspx file on the same site will get another 401 error. Why is is trying to authenticate so frequently?

We are using Windows authentication with NTLM. We're running IIS 6. The client is accsesing the site using IE8.

Answer 1

This behaviour is by design.

NTLM is a connection oriented protocol that relies on HTTP keep alives to maintain a connection from client to server. The symptom you describe (having to establish a new connection after 2 minutes) is consistent with the default IIS connection timeout - two minutes or 120 seconds.

You can modify the connection timeout setting but keep in mind that increasing the session duration will put more burden on your Web servers.

I wrote a blog on this if you are interested: NTLM's dependency on HTTP keep-alives

Answer 2

Read this : http://msdeveloper.wordpress.com/2007/12/20/sharepoint-and-kerberos-lots-of-401s/

I faced the similar issue with kerberos, but in the end we couldn't resolve and left it bydesign :(