Home/ Questions/Q 102907
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-11T01:02:23+00:00

Please note: In each step I describe below I’m logged in as the same

  • 0

Please note: In each step I describe below I’m logged in as the same domain user account.

I have a web application that controls a service on a remote machine (via ServiceController). When I connect to the website remotely and attempt to control the service, I get an InvalidOperationException: Access is denied.

I know it CAN work, because when I connect to the website from the web server (remote desktop in, login as my domain user, then open the webpage), it works as expected.

I have configured IIS and ASP.NET to require windows authentication and impersonation. I log the current thread’s principal when this fails, and I see that the thread is running under my identity whether I’m connecting remotely or from the server itself.

I have tried forcing IIS to use Kerberos authentication, NTLM authentication and both at the same time; whether my principal reports its AuthenticationType as ‘Negotiate’ or ‘NTLM’ it doesn’t matter. None of them work when I connect remotely (from my local machine)

ANOTHER weird thing about this is that if I’m debugging from my local machine/connecting to the remote server, it works every time! But I’m NOT debugging, it fails every time!

What in the heck could be going on here?

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Your scenario is delegation and not impersonation. Delegation is hard to achieve and it depends on many thing that are done right.

    A place to start would be Kerberos authentication and troubleshooting delegation issues

    David Wang blog is a very useful resource on thous issues.

    • 0