WWW FAQs: Why does Internet Information Server want a password?


2006-09-21: Most users who follow the steps in my article how do I host my website at home? have no trouble setting up Internet Information Server. But a few discover that Internet Information Server demands a username and password whenever someone else tries to access the website. Usually the administrator can get in just fine— if they use Internet Explorer on the same computer that is running the web server. But Firefox displays the password prompt, and users on other computers see it too. Nothing users do will get them into the site. What's the problem?

99% of the time, this is because Internet Information Server comes with a set of complicated ASP pages by default, pages that are supposed to be for the administrator only. If the webmaster deletes these before installing their own content in the website home directory, there's no problem. But if these files are left in place, no one else can access the website.

The simplest way to remove Microsoft's less-than-helpful default files from your website is to delete the current contents of your website's home directory, then copy your own content into place.

If you have already created pages of your own, and they only exist in your website's home directory, don't delete your own work! Obviously, you'll want to remove only the files you don't recognize— Microsoft's files. Hopefully you have another copy of your own work elsewhere and you can just purge the contents of the directory.

Finding And Cleaning Your Website's Home Directory

More than likely, your new website's home directory is C:\Inetpub\wwwroot. But you can check this in the control panel of Internet Information Server:

1. Start -> Settings -> Control Panel -> Administrative Tools

These steps are correct for the Windows XP "Classic View." If you are using the standard view, the steps are slightly different:

Start -> Control Panel -> Performance and Maintenance -> Administrative Tools

We recommend the "Classic View" for those who are running websites on their PCs.

2. Double-click "Internet Information Services"

3. In the tree at left, right-click your website or "Default Website," and pick "Properties"

4. Click on the "Home Directory" tab

5. Note the path in the "Local Path:" setting.

6. Double-click "My Computer" and navigate to your website's home directory, as found in step 5.

7. Make absolutely sure you are looking at the contents of your website's home directory, not its parent (C:\Inetpub\wwwroot, NOT C:\Inetpub). Also make sure that you have other copies of files that are important to you, or copy them to safety elsewhere at this time.

8. Use "Select All" to select all of the files in your website's home directory. You may see warnings that hidden files were not selected. This is OK.

9. Right-click over any of the selected files and select "Delete" to remove all of them.

10. Copy your own content into place. Make sure you have a home page called index.htm (if your pages are in HTML) or default.asp (if your pages are ASP pages). Other names, such as index.html, might not be recognized as a home page for your site.

11. Try accessing the site again with Firefox, or from another computer. You should gain access to your home page.

"Directory Listing Denied" errors

If you see the error message "Directory Listing Denied" when you attempt to visit the home page of your site, you probably haven't created an "index pge." You need to create an HTML page called index.htm, or an ASP page called default.asp, to serve as your site's home page. A freshly installed copy of IIS is smart enough to recognize either of these names as the home page for the entire folder. so that's what you see if you access http://localhost from a web browser running on the server itself.

Granting Anonymous Access To Your Website

In rare cases, you may find that user are still denied access or shown password prompts even after you replace Microsoft's content with your own. This is usually a file permissions problem. Or you might not have anonymous access to your website turned on. Either way, we can fix it!

Turning On Anonymous Access

Turning on anonymous access to your website is easy. Just follow these steps:

1. Start -> Settings -> Control Panel -> Administrative Tools

These steps are correct for the Windows XP "Classic View." If you are using the standard view, the steps are slightly different:

Start -> Control Panel -> Performance and Maintenance -> Administrative Tools ->

We recommend the "Classic View" for those who are running websites on their PCs.

2. Double-click "Internet Information Services"

3. In the tree at left, right-click your website or "Default Website," and pick "Properties"

4. Select the "Directory Security" tab

5. Click "Enable anonymous access and edit the authentication methods for this resource"

6. Make sure the "Anonymous access" box is checked. The "User name:" field will be sent to IUSR_COMPUTERNAME, where "computername" will be the name of your computer. The "Allow IIS to control password" box should also be checked. If these settings are correct, don't change them.

When you're satisfied with your settings, click "OK." Other users should be able to access your site now. If not, read on for one more possibility.

Fixing Your Home Directory's Permissions

Now that you know where your website's home directory is, it's time to fix the permissions so that the files can be accessed anonymously (that is, by users who are not logged in). Normally this happens by default in a website home directory, but there are occasional exceptions. Just follow these steps.

1. Double-click "My Computer" on your desktop

2. Browse down to the level just above your website's home directory, right-click your website's home directory, and select "Properties"

3. Select the "Security" tab. If you do not see the "Security" tab, follow the steps in the box that follows.

If You Do Not See The Security Tab

Windows XP computers that are not part of a domain do not show the security tab by default. This is easy to fix:

A. Go to "My Computer."

B. Select "Folder Options" from the "Tools" menu.

C. Scroll to the bottom of "Advanced settings."

D. UN-check the "Use simple file sharing" box.

E. Click "OK."

Now you're ready to continue following the instructions for making your website's home directory accessible to anonymous users.

4. You should be looking at the "Security" tab for your website home directory at this point.

5. Select "Internet Guest Account" from the list of users.

6. Check the "Read & Execute" box. This should grant sufficient access for future files created in your home directory. But we still have some work to do for existing files.

7. Click "OK" to close the Properties dialog box.

If You Still Have Problems

This article addresses the most common causes of password prompts and other unwanted behavior from a newly configured Internet Information Server. Of course, there are other possibilities. For further reading, I recommend the article Troubleshooting IIS Access Problems at the 15seconds website.

Legal Note: yes, you may use sample HTML, Javascript, PHP and other code presented above in your own projects. You may not reproduce large portions of the text of the article without our express permission.

Got a LiveJournal account? Keep up with the latest articles in this FAQ by adding our syndicated feed to your friends list!