Home
%3CLINGO-SUB%20id%3D%22lingo-sub-1006370%22%20slang%3D%22en-US%22%3EIIS%20binding%20limit%20(401.2%20error)%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1006370%22%20slang%3D%22en-US%22%3E%3CP%3EWindows%20authentication%20process%20can%20take%20place%20on%20the%20user-mode%20(IIS%20worker%20process)%20or%20kernel-mode%20(HTTP.SYS).%20For%20the%20kernel-mode%2C%20there%20is%20a%20limitation%3A%20You%20can%20add%26nbsp%3B%3CSTRONG%3Emaximum%2064%20bindings%3C%2FSTRONG%3E%26nbsp%3Bto%20your%20site.%20If%20you%20add%2065%20or%20more%20bindings%2C%20IIS%20displays%20%E2%80%9C%3CEM%3E401.2%20Unauthorized%3A%20Logon%20Failed%20Due%20to%20Server%3C%2FEM%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CEM%3EConfiguration%20with%20No%20Authentication%3C%2FEM%3E%E2%80%9D%20error%20even%20though%20the%20credentials%20are%20correct.%3C%2FP%3E%0A%3CP%3EA%20change%20for%20Windows%20Server%202008%20R2%20or%20Windows%20Server%202012%20R2%20is%20not%20expected%20for%20this%20limitation.%3C%2FP%3E%0A%3CH2%20id%3D%22toc-hId--1444913682%22%20id%3D%22toc-hId--1444913682%22%3E%26nbsp%3B%3C%2FH2%3E%0A%3CH2%20id%3D%22toc-hId-1042599151%22%20id%3D%22toc-hId-1042599151%22%3EWorkaround%3C%2FH2%3E%0A%3CP%3EUse%26nbsp%3B%3CSTRONG%3Euser-mode%3C%2FSTRONG%3E%26nbsp%3Bauthentication%20for%20your%20application%20to%20get%20around%20binding%20limitation%20of%20kernel-mode.%3C%2FP%3E%0A%3CP%3ESteps%20to%20use%20user-mode%20authentication%20instead%20of%20kernel-mode%3A%3C%2FP%3E%0A%3COL%3E%0A%3CLI%3EOpen%20IIS%20Manager%3C%2FLI%3E%0A%3CLI%3EClick%20on%20the%20website%3C%2FLI%3E%0A%3CLI%3EGo%20to%20%E2%80%9C%3CSTRONG%3EAuthentication%3C%2FSTRONG%3E%E2%80%9C%3C%2FLI%3E%0A%3CLI%3ESelect%20%E2%80%9C%3CSTRONG%3EAdvanced%20Settings%3C%2FSTRONG%3E%E2%80%9D%3C%2FLI%3E%0A%3CLI%3EUncheck%20%E2%80%9C%3CSTRONG%3EEnable%20Kernel-mode%20authentication%3C%2FSTRONG%3E%E2%80%9C%3C%2FLI%3E%0A%3C%2FOL%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20400px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F156922iE90CC331A535AFF7%2Fimage-size%2Fmedium%3Fv%3D1.0%26amp%3Bpx%3D400%22%20alt%3D%22clipboard_image_0.jpeg%22%20title%3D%22clipboard_image_0.jpeg%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3EContinue%20with%20these%20steps%3A%3C%2FP%3E%0A%3COL%3E%0A%3CLI%3EOpen%20IIS%20Manager%3C%2FLI%3E%0A%3CLI%3EClick%20the%20website%20name%3C%2FLI%3E%0A%3CLI%3EGo%20to%20%E2%80%9C%3CSTRONG%3EConfiguration%20Editor%3C%2FSTRONG%3E%E2%80%9C%3C%2FLI%3E%0A%3CLI%3ESelect%20%E2%80%9C%3CSTRONG%3Esystem.webServer%2Fsecurity%2F%20authentcation%2FwindowsAuthentication%3C%2FSTRONG%3E%E2%80%9D%3C%2FLI%3E%0A%3CLI%3ESet%20%E2%80%9CTrue%E2%80%9D%20for%20%E2%80%9C%3CSTRONG%3EuseAppPoolCredentials%3C%2FSTRONG%3E%E2%80%9C%3C%2FLI%3E%0A%3CLI%3ESet%20%E2%80%9CFalse%E2%80%9D%20for%20%E2%80%9C%3CSTRONG%3EuseKernelMode%3C%2FSTRONG%3E%E2%80%9C%3C%2FLI%3E%0A%3CLI%3EClick%20%E2%80%9C%3CSTRONG%3EApply%3C%2FSTRONG%3E%E2%80%9C%3C%2FLI%3E%0A%3C%2FOL%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20400px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F156923iA1504C9106FF5F2A%2Fimage-size%2Fmedium%3Fv%3D1.0%26amp%3Bpx%3D400%22%20alt%3D%22clipboard_image_1.jpeg%22%20title%3D%22clipboard_image_1.jpeg%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3EA%20discussion%20about%20the%20binding%20limit%20on%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Fnam06.safelinks.protection.outlook.com%2F%3Furl%3Dhttps%253A%252F%252Fforums.iis.net%252Ft%252F1155912.aspx%253Fiis%252B7%252Bconfiguration%252Bmanager%252Bcan%252Bt%252Bhandle%252B1000%252Bbindings%252Bwithin%252B1%252Bwebsite%26amp%3Bdata%3D02%257C01%257CNedim.Sahin%2540microsoft.com%257C441a7bd160cc466e772008d767b815cd%257C72f988bf86f141af91ab2d7cd011db47%257C1%257C0%257C637091912642441649%26amp%3Bsdata%3DSaroKLAFtAu036coi5qsZHYI8XgX%252BQ8NASoDgxVgm8c%253D%26amp%3Breserved%3D0%22%20target%3D%22_self%22%20rel%3D%22nofollow%20noopener%20noreferrer%20noopener%20noreferrer%22%3EIIS%20forum%3C%2FA%3E.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-TEASER%20id%3D%22lingo-teaser-1006370%22%20slang%3D%22en-US%22%3E%3CP%20style%3D%22margin%3A%200cm%200cm%207.5pt%200cm%3B%22%3E%3CSPAN%20style%3D%22font-size%3A%2013.5pt%3B%20font-family%3A%20'Arial'%2Csans-serif%3B%20color%3A%20%236b6b6b%3B%22%3EWindows%20authentication%20process%20can%20take%20place%20on%20the%20user-mode%20(IIS%20worker%20process)%20or%20kernel-mode%20(HTTP.SYS).%20For%20the%20kernel-mode%2C%20there%20is%20a%20limitation%3A%20You%20can%20add%26nbsp%3Bmaximum%2064%20bindings%26nbsp%3Bto%20your%20site.%20If%20you%20add%2065%20or%20more%20bindings%2C%20IIS%20displays%20%E2%80%9C%3CEM%3E%3CSPAN%20style%3D%22font-family%3A%20'Arial'%2Csans-serif%3B%22%3E401.2%20Unauthorized%3A%20Logon%20Failed%20Due%20to%20Server%20Configuration%20with%20No%20Authentication%3C%2FSPAN%3E%3C%2FEM%3E%E2%80%9D%20error%20even%20though%20the%20credentials%20are%20correct.%3C%2FSPAN%3E%3C%2FP%3E%3C%2FLINGO-TEASER%3E
Microsoft

Windows authentication process can take place on the user-mode (IIS worker process) or kernel-mode (HTTP.SYS). For the kernel-mode, there is a limitation: You can add maximum 64 bindings to your site. If you add 65 or more bindings, IIS displays “401.2 Unauthorized: Logon Failed Due to Server

 

Configuration with No Authentication” error even though the credentials are correct.

A change for Windows Server 2008 R2 or Windows Server 2012 R2 is not expected for this limitation.

 

Workaround

Use user-mode authentication for your application to get around binding limitation of kernel-mode.

Steps to use user-mode authentication instead of kernel-mode:

  1. Open IIS Manager
  2. Click on the website
  3. Go to “Authentication
  4. Select “Advanced Settings
  5. Uncheck “Enable Kernel-mode authentication

clipboard_image_0.jpeg

Continue with these steps:

  1. Open IIS Manager
  2. Click the website name
  3. Go to “Configuration Editor
  4. Select “system.webServer/security/ authentcation/windowsAuthentication
  5. Set “True” for “useAppPoolCredentials
  6. Set “False” for “useKernelMode
  7. Click “Apply

clipboard_image_1.jpeg

A discussion about the binding limit on IIS forum.