Issue with IIS application on premise joined to our domain alway ask user and password

Question

We have a server 2022 with IIS and an application hosted on it. The server is joined to our AD domain. Every time we start the application edge (chrome or mozilla) ask for user credentials to access. Windows authentication is enable and the URL is deployed via GPO as a trusted intranel local zone.

Need to solve this issue, someone can help?

Thank you in advance.

Stefano.

Answer 1

Hi @Stefano,

It looks like you have already added the required configuration. But it still doesn't work.

First, make sure that you've disabled the anonymous authentication.

Second, check your Group Policy configuration at Administrative Templates\Windows Components\ Internet Explorer\Internet Control Panel\Security Page, double click Site to Zone Assignments, and show contents. If you configured the site URL in Trusted Sites zone, try to move it into Intranet Zone.

If this still not resolve, please provide more details about your issue.

Best regards,

Xudong Peng

---

If the answer is the right solution, please click "Accept Answer" and kindly upvote. If you have extra questions about this answer, please click "Comment".

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 2

Hi Stefano,

I know this is a late response.

Based on your description, you're hosting an application on IIS running on Windows Server 2022, joined to your Active Directory domain. You've enabled Windows Authentication and deployed the site URL via Group Policy to be recognized as a trusted intranet site. However, users are still being prompted for credentials when accessing the application through browsers like Edge, Chrome, or Firefox.

Let's walk through a few steps together to make sure nothing is missing:

1. Since you are using Windows Authentication, please double-check Authentication Settings in IIS:

• Anonymous Authentication is disabled
• Windows Authentication is enabled

You can verify this in IIS Manager under:
Sites -> YourSite -> Authentication

Here's a Microsoft doc that walks you through it:

https://learn.microsoft.com/en-us/iis/configuration/system.webserver/security/authentication/windowsauthentication/

2. Browsers like Edge and Chrome (which inherit IE zone settings via the Internet Options API) rely on Intranet Zone to automatically pass credentials without prompting.

Please verify Group Policy Configuration for Intranet Zone:

• Open gpedit.msc
• Navigate to: Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page
• Open Site to Zone Assignment List
• Ensure your IIS app's URL is assigned to Zone 1 (Intranet Zone), not Trusted Sites.

  Trusted Sites (Zone 2) does not allow automatic login with current credentials by default.

More on that here:

https://techcommunity.microsoft.com/discussions/windowspowershell/site-to-zone-assignment-list---powershell/4084060

3. Different bowsers handle Windows Authentication differently:

• For Edge/Chrome: These browsers use Windows Security Zones.
• For Firefox: Configure network.automatic-ntlm-auth.trusted-uris in about:config to include your site.

For better understanding, you can check out this link:
https://helpdesk.thoughtfarmer.com/hc/en-us/articles/1500005844122-How-to-enable-Windows-SSO-login-on-browsers#:~:text=Edge%20%2F%20Google%20Chrome%201%20Open%20the%20Windows,name%20and%20password.%206%20Click%20OK.%20More%20items

4. If you are expecting Kerberos (rather than falling back to NTLM), ensure that:

• The server hosting the IIS app must have a valid Service Principal Name (SPN) registered.
• There are no duplicate SPNs that could be interfere with proper Kerberos authentication.

setspn -Q HTTP/yourservername

If the SPN is missing or duplicated, Kerberos may fail and fall back to NTLM, which can cause login prompts.

• If you're not using a custom domain name or load balancer, and your app pool runs under ApplicationPoolIdentity, you may not need to configure SPNs manually.

For more information:

https://learn.microsoft.com/en-us/troubleshoot/developer/webapps/iis/www-authentication-authorization/troubleshoot-kerberos-failures-ie