title: Remove NEGOTIATE from WindowsAuthentication in IIS
body: <p>I have a site running in IIS 7.5 that is accessed using a DNS alias different from the actual server name. In IE 8, integrated authentication is failing, but in Firefox and Chrome everything works fine. (IE presents a credential challenge a few times, then displays a 401.1 error page.)</p>
  
  <p>I have figured out that this is due to IE using Kerberos (aka "Negotiate") over NTLM, and Kerberos requires registering a Service Principal Name (using SETSPN) so that the mismatch between the DNS name and the server name is properly handled.</p>
  
  <p>My web site, however, doesn't need impersonation--it is enough to have delegation. So instead of messing with SetSPN, I would just like to remove "Negotiate" from the list of WindowsAuthentication methods in IIS.</p>
  
  <p>I have searched for quite some time to find out how to do this in IIS. I have played with many <code>appcmd</code> commands--but I just can't find online examples, or figure out how by reading MSDN documentation or using <code>appcmd /?</code> to make <code>appcmd</code> commands apply only to a particular application within a site rather than to the entire web server. A few search-hours later over two days, and at least 3 dozen web pages visited, I am still coming up fruitless.</p>
  
  <p>How in tarnation do I get this done--it seems like it should be so easy!</p>