George Bonney's SharePoint Blog

Microsoft have just released a bunch of security fixes for IE in an update – 963027 – which stops you being able to connect to local websites on your server.  You will be prompted to enter a username and password but will receive the standard 401 error after entering credentials 3 times.  There may well be a way to work around this more appropriately, but for now I have removed this update. (see update below).

N.B. This update only applies after reboot and equally only removes after reboot.

To do this go to “Add/Remove Programs”, select the “Updates” checkbox if necessary and find “Windows Internet Explorer 7″.  If you find an entry in here for “963027″ then remove it and reboot (remember, the update is still in effect until you have rebooted).

 

UPDATE:

Thanks to Matt Tate for pointing out that this is related to a loopback security update.  It turns out that security fix 963027 extends an existing change with regards to the use of the loopback address (127.0.0.1) to include any local web server access (actually – I have only tested this with CNAME DNS entries, it might not happen with A pointers).

See this article for further information:

http://support.microsoft.com/kb/896861

 

N.B. This also affects indexing – http://www.toddklindt.com/blog/Lists/Posts/Post.aspx?ID=107

 

SOLUTION:

I am using Method 2 for all personal development and test machines.

********************** FROM MICROSOFT KB ARTICLE ABOVE **********************

To work around this issue, use one of the following methods.

Method 1: Specify host names

Note We recommend that you use this method.

To specify the host names that are mapped to the loopback address and can connect to Web sites on your computer, follow these steps:

1. Click Start, click Run, type regedit, and then click OK.
2. In Registry Editor, locate and then click the following registry key:
   HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlLsaMSV1_0
3. Right-click MSV1_0, point to New, and then click Multi-String Value.
4. Type BackConnectionHostNames, and then press ENTER.
5. Right-click BackConnectionHostNames, and then click Modify.
6. In the Value data box, type the host name or the host names for the sites that are on the local computer, and then click OK.
7. Quit Registry Editor, and then restart the IISAdmin service.

Method 2: Disable the loopback check

Follow these steps:

1. Click Start, click Run, type regedit, and then click OK.
2. In Registry Editor, locate and then click the following registry key:
   HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlLsa
3. Right-click Lsa, point to New, and then click DWORD Value.
4. Type DisableLoopbackCheck, and then press ENTER.
5. Right-click DisableLoopbackCheck, and then click Modify.
6. In the Value data box, type 1, and then click OK.
7. Quit Registry Editor, and then restart your computer.

This entry was posted on Wednesday, April 15th, 2009 at 9:36 pm and is filed under Uncategorized. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.