title: IIS Windows Authentication Rejecting Some Users
body: <p>We have a very basic SOAP web service setup using Windows Authentication, open for all users:</p>
  
  <pre><code>&lt;authentication mode="Windows" /&gt;
  &lt;authorization&gt;
    &lt;allow users="*" /&gt;
  &lt;/authorization&gt;
  </code></pre>
  
  <p><strong>The Issue</strong></p>
  
  <p>However, some Windows accounts are getting <code>401 Forbidden</code> errors.</p>
  
  <p><strong>What works</strong></p>
  
  <ul>
  <li>A select list of accounts always work (regardless of NTLM/Kerberos, local/external server)</li>
  <li>All accounts seem to work when accessing locally on the web server</li>
  <li>All accounts seem to work when using IE (which seems to use Kerberos)</li>
  </ul>
  
  <p><strong>What doesnt work</strong></p>
  
  <ul>
  <li>Most (but not all) accounts from an external server (which seems to use NTLM)</li>
  </ul>
  
  <p><strong>Other Facts</strong></p>
  
  <ul>
  <li>There is no obvious pattern to which accounts work and which don't (it seems arbitrary).</li>
  <li>A new account identical to an existing working account does not work.</li>
  <li>Which accounts work seems to be consistent (i.e. it will either always work or never work)</li>
  <li>The accounts which work seem consistent across environments (i.e. all IIS servers accept and reject the same set of accounts).</li>
  <li>There's no differences in the captured traffic between the servers, beyond different NTLM tokens and a 401 instead of 200/202 response.</li>
  </ul>
  
  <p><strong>What Happens Technically</strong></p>
  
  <p>Specifically, when an issue occurs it as though the password credentials cannot be verified (I can guarantee they are correct), as per the <code>4625 Audit Failure</code> error in the Security log:</p>
  
  <pre><code>Account For Which Logon Failed:
  Security ID:        NULL SID
  Account Name:       FAILING_ACCOUNT_NAME_ALLCAPS
  Account Domain:     MYDOMAIN
  
  Failure Information:
  Failure Reason:     Unknown user name or bad password.
  Status:         0xc000006d
  Sub Status:     0xc000006a
  </code></pre>
  
  <p>This seems to lead to the account being locked out in AD (which would makes sense as the <code>0x000006a</code> code usually reflects an invalid password attempt), although this behaviour seems inconsistent.</p>
  
  <p>With failed request tracing, IIS shows the unknown user name/bad password error, as well as a <code>401.2</code> error with the error code <code>3221225581</code>.</p>
  
  <p>I can also force "genuine" <code>401</code> errors for working accounts (by denying them in the <code>authorization</code> tag) and the behaviour differs (i.e. it does not flag these as <code>Unknown user name or bad password</code> but gives a different access denied error).</p>
  
  <p><strong>What Next</strong></p>
  
  <p>You tell me - does anyone have experience with where I should look next to help diagnose this issue?</p>