We help IT Professionals succeed at work.

User redirected to /iisadmpwd/aexp.htr?http:://server/directory/

capaul1977
capaul1977 asked
on
1,167 Views
Last Modified: 2010-05-18
I have a link which takes users to a secured (no annonymous access) directory on our intranet.  The directory requires either an NT username and password, or automatic login, & validates. The default page is then displayed and all is good.  Pretty standard stuff.  However, a couple of our users can't get to this page because they are being redirected to /iisadmpwd/aexp.htr?http:://server/directory/
The page then simply returns nothing, with "Done" in the status bar.

We are running IIS 5 on a Windows 2000 Server.

Any suggestions as to what might be causing this or how it might be resolved?

Comment
Watch Question

Commented:
Check to see if their passwords have expired or are set to expire in the usermanagement

Author

Commented:
fz2hqs,
I have to appologize for my potential lack of knowledge here.  Their NT accounts passwords are not expired, as they are able to log in to their computers.  We don't do anything user specific in IIS.  If this is not the response you were expecting, I probably didn't understand your post.

Commented:
Given the page that they were being redirected to I was expecting that the NT Domain / Active Directory accounts had the accounts passwords expired - maybe I was thinking of the wrong page ? What page is it ?

Author

Commented:
They are attempting to access a simple menu page "http://server/directory/default.htm"  No matter if they enter "http://server/directory/default.htm" or "http://server/directory" they are redirected to
"/iisadmpwd/aexp.htr?http:://server/directory/default.htm".
I don't work with the NT Domain or Active Directory, just the web stuf, which is why I'm somewhat lost on this one probably.  These particular employees are crossing domains to get to this server.  I don't know enough about this to know if that effects what is going on here.  
Commented:
This one is on us!
(Get your first solution completely free - no credit card required)
UNLOCK SOLUTION

Author

Commented:
Yes, we did solve it.  Our server administrator was following Microsoft's advice concerning security and changed the name of our server so that it would not respond that it is IIS6.  So instead, it said "Good Day".  Now the domain server didn't recognize it either and EXACTLY the same thing happenned.  When a user updated their NT password, they could no longer access the IIS server.  
   Thanks Microsoft... :|

I hope this helps.
Chris

Author

Commented:
I don't know that this is entirely appropriate, but I give Clutch the points for feeling my pain! :)

Commented:
Capaul1977,

     I'm not quite sure I follow you in your above post.  What exactly did you do?  You changed the name of your server and that kicked everything back in order?  Can you explain in a bit more detail?

Author

Commented:
Clutch,

We used URLScan to change the HTTP header information provided by IIS so that hackers would not recognize the server type.  This is per Microsofts advice in article: http://support.microsoft.com/?id=317741 "HOW TO: Mask IIS Version Information from Network Trace and Telnet".
You can use URLScan to remove or replace the header information.  We replaced it with "good day".

This lead us to the issue you are having.  We had to user URLScan to set it back to
Microsoft-IIS/5.0 and the the redirection stopped.

Chris

Author

Commented:
Bad Microsoft!  Sit.

Author

Commented:
We eventually started using a thrird party application called "ServerMask" to accomplish the same goal without causing this security re-direct issue.  I don't know how this works differently, but we don't have the issue with this software.

Chris

Gain unlimited access to on-demand training courses with an Experts Exchange subscription.

Get Access
Why Experts Exchange?

Experts Exchange always has the answer, or at the least points me in the correct direction! It is like having another employee that is extremely experienced.

Jim Murphy
Programmer at Smart IT Solutions

When asked, what has been your best career decision?

Deciding to stick with EE.

Mohamed Asif
Technical Department Head

Being involved with EE helped me to grow personally and professionally.

Carl Webster
CTP, Sr Infrastructure Consultant
Empower Your Career
Did You Know?

We've partnered with two important charities to provide clean water and computer science education to those who need it most. READ MORE

Ask ANY Question

Connect with Certified Experts to gain insight and support on specific technology challenges including:

  • Troubleshooting
  • Research
  • Professional Opinions
Unlock the solution to this question.
Join our community and discover your potential

Experts Exchange is the only place where you can interact directly with leading experts in the technology field. Become a member today and access the collective knowledge of thousands of technology experts.

*This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

OR

Please enter a first name

Please enter a last name

8+ characters (letters, numbers, and a symbol)

By clicking, you agree to the Terms of Use and Privacy Policy.