401 error

In a given change, there is equivalent change. The question is what changed?

Try to ask the security guy?

Do you have any logs that can help EE people assist you?
At first glance, you seem to have an auto-rejection connection problem.

from IIS:

GET /default.aspx +OnBeginRequest:06/28/2013-10:17:00.572+LogEntries:0+SqlCalls:0+SqlCallsMs:0+GC:2+OnEndRequest:10:17:00.572 80 - 192.168.64.71 Mozilla/5.0+(compatible;+MSIE+10.0;+Windows+NT+6.1;+Trident/6.0) 401 5 0 78

The problem is not browser dependant. It is just on remote PCs that require user to login to website. This is also for users that are logged into their remote PC using cached domain credentials that would work locally.

What happens if the user use IE?

I would guess this is an IE zoning problem.  When on the internal network, the site is correctly being detected in the local intranet zone, but while connecting via vpn it's being detected as an Internet site.  IIRC, IE only pushes domain credentials if a site is in the intranet zone.  You can start by manually adding the site to the intranet zone and see if that fixes that one computer.  If this is the issue, then you can start looking at it globally.  When we have problems like this, it's typically a proxy configuration issue.  Either a proxy was not configured or the domain was not included in the proxy bypass list (which automatically adds the site to the local intranet zone: http://msdn.microsoft.com/en-us/library/bb250483%28v=vs.85%29.aspx.

There are other issues, such as lack of connectivity to the domain controller, but the zoning and the proxy config is where I'd start.  Do internal and VPN users access the site in the same manner (same URL?).

Hello,

As far as CRM is working fine locally there should not be any major issue. Make sure that the DNS record is pointing appropriate IP address while accessing website through VPN.

Also, try accessing using with alternate web browser.

Regards,
Sanjay Santoki

Sorry, misinformation. Problem occurs on some PCs only and is with IE not Firefox. Possibly it is IE9 problem. Site is local intranet zone

Login to other local web servers (e.g. SharePoint) is OK.

Hello,

It could be browser specific issue. You can compare browser setting between the computers where it is working.

Regards,
Sanjay Santoki

If kerberos is the problem, you could configure the server to use NTLM instead.  I see this all the time when sites are upgraded from windows 2003 to windows 2008, but I'm surprised it suddenly happened here.

provides a workaround but does not resolve root cause