Home/ Questions/Q 406333
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-12T17:29:10+00:00

I have the following structure in IIS. Internet Information Services (local computer) Web Sites

  • 0

I have the following structure in IIS.

Internet Information Services  
 (local computer)
  Web Sites  
   Default Web Site  
    MyApplication

MyApplication is a Application in IIS.

Integrated Windows authentication is NOT set on the Default Web Site.
However I want to set Integrated Windows authentication on MyApplication. (Its an intranet app).

This can be done via the GUI: Right click on the Default Web Site and choose Properties. Select the Directory Security tab, and click Edit on the Anonymous access and authentication control.

I want to include this in a setup script. I have other setup commands, using adsutil.vbs but I’m struggling to set up the Integrated windows authentication.

Running:

cscript //nologo c:\Inetpub\AdminScripts\adsutil.vbs GET /W3SVC/1/NTAuthenticationProviders

Returns

NTAuthenticationProviders       : (STRING) "NTLM"

However, i exepcted to be able to run

cscript //nologo c:\Inetpub\AdminScripts\adsutil.vbs GET /W3SVC/1/ROOT/MyApplication/NTAuthenticationProviders

But this returns

Error Trying To GET the property: (Get Method Failed)
NTAuthenticationProviders (This property is probably not allowed at this node)

Is it not possible to set NTAuthenticationProviders Metabase property on an appliction level?

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    The metabase property that controls the Authenticated Access property values on the IIS Directory Security -> Authentication Methods dialogue is actually called AuthFlags.

    The value is a flag and is documented here:

    AuthFlags Metabase Property (IIS 6.0) (TechNet)

    To set this value to Integrated Windows Authentication (AuthNTLM) use the following command (take care because this command operates on the Default Website, IISNumber:1) –

    adsutil.vbs SET /W3SVC/1/ROOT/MyApplication/AuthFlags 4

    If you want to set, say, both NTLM and Basic authentication then you would boolean OR the values together, e.g. MD_AUTH_BASIC | AuthNTLM. This would product an integer result of 6:

    :: Set both NTLM and Basic authentication
    adsutil.vbs SET /W3SVC/1/ROOT/MyApplication/AuthFlags 6

    If you inspect the metabase file (C:\WINDOWS\system32\inetsrv\MetaBase.xml) and search for:

    Location="/LM/W3SVC/1/ROOT/MyApplication"

    …you will see the attribute that controls this setting (after setting to 6 as above):

    AuthFlags="AuthBasic | AuthNTLM"

    It may take some time before this value updates in the metabase because changes such as this aren’t immediately flushed to the file (although IISRESET will cause it to update immediately).

    • 0