Google Groups no longer supports new Usenet posts or subscriptions. Historical content remains viewable.
Dismiss

CRM 4.0 - IFD- HTTP Error 401.1 - Unauthorized: Access is denied

391 views
Skip to first unread message

Mark Smyth

unread,
Aug 8, 2008, 5:58:00 AM8/8/08
to
We have a CRM 4.0 multi-tenanted environment that was deployed using an xml
file. External access to the CRM works correctly but when trying to access
CRM from the LAN where the CRM server is contained we are prompted for a
username and password 3 times before this 401.1 error.

What this also means is that the CRM Email router cannot connect to the
deployment.

Checking the settings of CRM with the IFD tool shows all to be correct. We
have another live environment and a test environment that works, both were
installed normally and then used the IFD to change the settings.

We used the xml file to deploy CRM as the IFD was not the recommended
solution at the time.

Has anyone else seen this and got a solution. (Please do not recommend any
hotfixes unless you know they will work as we are very current on what
hotfixes their are).

Yes, all the group memberships are correct as far as PrivUsers etc.

Richard Riddle

unread,
Aug 8, 2008, 11:56:01 AM8/8/08
to
It sounds like the directory security settings in iis are not correct. On
the web site properties for Microsoft CRM, make sure that Windows Integrated
Authentication is enabled, along with Anonymous access.
--
Richard Riddle
CRM Developer
Autonomix

Mark Smyth

unread,
Aug 12, 2008, 3:42:15 AM8/12/08
to
Hello Richard
From what I can see this is not a permissions problem either with settings
in IIS or the physical permissions on the files and folders. I have compared
them with a working environment.

Mark Smyth

Richard Riddle

unread,
Aug 12, 2008, 1:25:01 PM8/12/08
to
If it's not iis then it has to be the client then. Is the behavior the same
whether user credentials are entered or not? Is the 401.1 error the "page
cannot be displayed" error with the number at the bottom, or is it only one
line of text at the top of the page? Are there any other sites on that
server that use Windows authentication? Does this happen when you are on the
CRM server and use localhost?

Mark Bernardinis

unread,
Aug 15, 2008, 12:57:01 AM8/15/08
to
I received this error as well in an IFD installation and only recently
resolved it. It had to do with the IP address range that I entered was
incorrect in the IFD tool. Once I corrected the IP address range of the
"private / internal" CRM address range it started to work. Give that a go and
let me know if it works.

Mark Bernardinis

Mark Smyth

unread,
Aug 15, 2008, 8:46:01 AM8/15/08
to
Sorry, not that either

lluisgi...@gmail.com

unread,
Aug 18, 2008, 2:17:21 AM8/18/08
to
On 15 ago, 14:46, Mark Smyth <MarkSm...@discussions.microsoft.com>
wrote:
> > > > > > Yes, all the group memberships are correct as far as PrivUsers etc.- Ocultar texto de la cita -
>
> - Mostrar texto de la cita -

Hei Richard

We have the same problem, but in our case is it only one line of text
at the top of the page.

Lluis Giner

Mark Smyth

unread,
Sep 16, 2008, 10:49:02 AM9/16/08
to
In our case we added the CRMSQLService account to the Pre-Windows 2000
Compatible Access group and this resolved the error.

Mark Smyth
"lluisgi...@gmail.com" wrote:

> > > > > > > installed normally and then used the IFD to change the settings..

contact2milind

unread,
Oct 20, 2008, 8:35:03 PM10/20/08
to
Hi
i am having the same problem but in simple text msg. like this " HTTP Error
401.1 - Unauthorized: Access is denied" but before it ask for username and
password and i enter the domain/username and password

Can any one solve this problem.

Satish

unread,
Dec 8, 2008, 9:14:57 AM12/8/08
to
The cause of the error is due to anonymous access.

Go to IIS Manager -----> go to website -----> Microsoft Dynamics CRM
-----> Right click properties ---------> go to "Directory Services
Tab" ------->go to Authentication and Access Control section click
on the edit button and disable the "Enable anonymous access" check
box.

Regards
Satish Kandukuri
www.mtccrm.com

On Oct 21, 5:35 am, contact2milind


<contact2mil...@discussions.microsoft.com> wrote:
> Hi
> i am having the same problem but in simple text msg. like this " HTTP Error
> 401.1 - Unauthorized: Access is denied" but before it ask for username and
> password and i enter the domain/username and password
>
> Can any one solve this problem.
>
> "Mark Smyth" wrote:
> > In our case we added the CRMSQLService account to the Pre-Windows 2000
> > Compatible Access group and this resolved the error.
>
> > Mark Smyth

Bogdan

unread,
Jan 6, 2009, 9:16:05 AM1/6/09
to
Hi,

I'm also getting this error. Although I tick the "remember my password" in
the login window it keeps asking for the password like 20 times before
displaying the error. Sometimes some components are displaye, like the
toolbar, while the rest are replaced witht the error message.

I only get this error when trying to access over the internet from a pc that
is on another domain. I modified the IE settings to ask for username/password
every time but this didn't fix the problem.

I think it's a client problem, can anyone help please.

Thanks,

Bogdan

Dan Blake

unread,
Jan 8, 2009, 2:35:05 PM1/8/09
to
Mark,

If setting Anonymous access doesn't work, I'd recommend that you try
installing and running the IIS Diagnostics utility
(http://www.microsoft.com/downloads/details.aspx?familyid=9bfa49bc-376b-4a54-95aa-73c9156706e7&displaylang=en)
on the CRM Server. If the diagnostics results for authentication shows that
keepalives are disabled on the site, install a copy of the IIS Resource Kit
on the server and use the Metabase Explorer to check the "AllowKeepAlive"
setting on the CRM website. That needs to be set to 1 or Kerberos/NTLM
integrated authentication won't work (Remember, IE always tries anonymous
first before it tries to authenticate . Without a keepalive, IE will create
a new HTTP/TCP session and use anonymous again and again until it times out.)
While you are in the Metabase Explorer, also look and make sure that
"NTAuthenticationProviders" is set to "Negotiate,NTLM". If the Negotiate
part isn't there, IIS won't accept Kerberos. Make sure you configure the web
site to allow editing of the metabase before you use Metabase Explorer to
change anything.

I had literally tried everything before I came across the IIS Diagnostics
Toolkit (down to packet tracing which clued me into the problem). This is a
great tool for troubleshooting authentication and IIS configuration problems.

-Dan

bellasolutions

unread,
Nov 21, 2009, 1:17:16 AM11/21/09
to
You need to enable CRM for Internet Facing Deployment (IFD).Search for CRM 4.0 IFD Tool
<a href="http://www.bellasolutions.com">Field Service Software</a>.

MarkSmyt wrote:

CRM 4.0 - IFD- HTTP Error 401.1 - Unauthorized: Access is denied
08-Aug-08

Previous Posts In This Thread:

On Friday, August 08, 2008 5:58 AM
MarkSmyt wrote:

CRM 4.0 - IFD- HTTP Error 401.1 - Unauthorized: Access is denied

On Friday, August 08, 2008 11:56 AM
RichardRiddl wrote:

It sounds like the directory security settings in iis are not correct.
It sounds like the directory security settings in iis are not correct. On
the web site properties for Microsoft CRM, make sure that Windows Integrated
Authentication is enabled, along with Anonymous access.
--
Richard Riddle
CRM Developer
Autonomix


"Mark Smyth" wrote:

On Tuesday, August 12, 2008 3:42 AM
MarkSmyt wrote:

Hello RichardFrom what I can see this is not a permissions problem either with


Hello Richard
From what I can see this is not a permissions problem either with settings
in IIS or the physical permissions on the files and folders. I have compared
them with a working environment.

Mark Smyth

"Richard Riddle" wrote:

On Tuesday, August 12, 2008 1:25 PM
RichardRiddl wrote:

If it's not iis then it has to be the client then.
If it's not iis then it has to be the client then. Is the behavior the same
whether user credentials are entered or not? Is the 401.1 error the "page
cannot be displayed" error with the number at the bottom, or is it only one
line of text at the top of the page? Are there any other sites on that
server that use Windows authentication? Does this happen when you are on the
CRM server and use localhost?

--
Richard Riddle
CRM Developer
Autonomix


"Mark Smyth" wrote:

On Friday, August 15, 2008 12:57 AM
MarkBernardini wrote:

I received this error as well in an IFD installation and only recently
I received this error as well in an IFD installation and only recently
resolved it. It had to do with the IP address range that I entered was
incorrect in the IFD tool. Once I corrected the IP address range of the
"private / internal" CRM address range it started to work. Give that a go and
let me know if it works.

Mark Bernardinis

"Richard Riddle" wrote:

On Friday, August 15, 2008 8:46 AM
MarkSmyt wrote:

RE: CRM 4.0 - IFD- HTTP Error 401.1 - Unauthorized: Access is deni
Sorry, not that either

"Mark Bernardinis" wrote:

On Tuesday, August 19, 2008 7:05 AM
lluisginerpere wrote:

Re: CRM 4.0 - IFD- HTTP Error 401.1 - Unauthorized: Access is deni


On 15 ago, 14:46, Mark Smyth <MarkSm...@discussions.microsoft.com>
wrote:

go and
the same
e "page
ly one
that
are on the
ettings
compared
rect. =A0On
Integrated
using an xml
g to access
ted for a
t to the
correct. We
, both were
..
mended
commend any
on what


etc.- Ocultar texto de la cita -

Hei Richard

We have the same problem, but in our case is it only one line of text
at the top of the page.

Lluis Giner

On Tuesday, September 16, 2008 10:49 AM
MarkSmyt wrote:

In our case we added the CRMSQLService account to the Pre-Windows 2000
In our case we added the CRMSQLService account to the Pre-Windows 2000
Compatible Access group and this resolved the error.

Mark Smyth

On Monday, October 20, 2008 8:35 PM
contact2milin wrote:

Hii am having the same problem but in simple text msg.


Hi
i am having the same problem but in simple text msg. like this " HTTP Error
401.1 - Unauthorized: Access is denied" but before it ask for username and
password and i enter the domain/username and password

Can any one solve this problem.

"Mark Smyth" wrote:

On Tuesday, December 09, 2008 10:22 PM
Satish wrote:

The cause of the error is due to anonymous access.
The cause of the error is due to anonymous access.

Go to IIS Manager -----> go to website -----> Microsoft Dynamics CRM
-----> Right click properties ---------> go to "Directory Services
Tab" ------->go to Authentication and Access Control section click
on the edit button and disable the "Enable anonymous access" check
box.

Regards
Satish Kandukuri
www.mtccrm.com

On Oct 21, 5:35=A0am, contact2milind
<contact2mil...@discussions.microsoft.com> wrote:
or
d
ently
d was
of the
hat a go and
havior the same
ror the "page
it only one
es on that
n you are on the
with settings
I have compared
ot correct. =A0On
indows Integrated
loyed using an xml
trying to access
prompted for a
connect to the
to be correct. We
works, both were
ttings..
recommended
not recommend any
rrent on what


Users etc.- Ocultar texto de la cita -

On Tuesday, January 06, 2009 9:16 AM
Bogda wrote:

Hi,I'm also getting this error.
Hi,

I'm also getting this error. Although I tick the "remember my password" in
the login window it keeps asking for the password like 20 times before
displaying the error. Sometimes some components are displaye, like the
toolbar, while the rest are replaced witht the error message.

I only get this error when trying to access over the internet from a pc that
is on another domain. I modified the IE settings to ask for username/password
every time but this didn't fix the problem.

I think it's a client problem, can anyone help please.

Thanks,

Bogdan

"Mark Smyth" wrote:

On Thursday, January 08, 2009 2:35 PM
DanBlak wrote:

Mark,If setting Anonymous access doesn't work, I'd recommend that you try
Mark,

If setting Anonymous access doesn't work, I'd recommend that you try
installing and running the IIS Diagnostics utility
(http://www.microsoft.com/downloads/details.aspx?familyid=9bfa49bc-376b-4a54-95aa-73c9156706e7&displaylang=en)
on the CRM Server. If the diagnostics results for authentication shows that
keepalives are disabled on the site, install a copy of the IIS Resource Kit
on the server and use the Metabase Explorer to check the "AllowKeepAlive"
setting on the CRM website. That needs to be set to 1 or Kerberos/NTLM
integrated authentication won't work (Remember, IE always tries anonymous
first before it tries to authenticate . Without a keepalive, IE will create
a new HTTP/TCP session and use anonymous again and again until it times out.)
While you are in the Metabase Explorer, also look and make sure that
"NTAuthenticationProviders" is set to "Negotiate,NTLM". If the Negotiate
part isn't there, IIS won't accept Kerberos. Make sure you configure the web
site to allow editing of the metabase before you use Metabase Explorer to
change anything.

I had literally tried everything before I came across the IIS Diagnostics
Toolkit (down to packet tracing which clued me into the problem). This is a
great tool for troubleshooting authentication and IIS configuration problems.

-Dan

"Satish" wrote:

EggHeadCafe - Software Developer Portal of Choice
Animating Mandelbrot fractals with Silverlight 3 WriteableBitmap
http://www.eggheadcafe.com/tutorials/aspnet/05748429-75a4-449a-9aab-82758cfb13df/animating-mandelbrot-frac.aspx

0 new messages