title: Classic ASP Impersonation problem on IIS7 Windows 2008 server
body: <p>I am trying to write to a file on a server (web05) from a classic asp site running on Windows 2008 serer on IIS7 (webadmin). This fails and web05 logs an anonymous logon attempt during the course of the save operation. </p>
  
  <p>Webadmin's site is running on an app pool in classic mode with a domain user as the process account. The process account has rights to "Trust this user for delegation to any service (Kerberos only)". The same applies for the web05 and webadmin servers. </p>
  
  <p>The site is using Windows Authentication and the idea is that when I log on the site with my domain user, the rights of my user should define what I am allowed to do in the context of the IIS site. If I turn on Basic Authentication, everything works fine. </p>
  
  <p>I have also used setspn.exe to add an SPN for the URL. If I type setspn.exe -L webadmin, I get: </p>
  
  <pre><code>HTTP/webadmin.companyname.com
  TERMSRV/webadmin
  TERMSRV/webadmin.companypub.local
  HOST/webadmin
  HOST/webadmin.companypub.local
  </code></pre>
  
  <p>So from what I understand the SPNs are set up correctly. </p>
  
  <p>If I run processmonitor on webadmin while the save operation is executed, it says that the process is indeed impersonating my domain user - but getting "Access denied" (and as I said before, web05 logs an anonymous logon attempt).</p>
  
  <p>Any idea what causes this?</p>
  
  <p>Kind regards,
  Simon</p>