Install Subauthentication

To use Digest authentication in Internet Information Services (IIS) 6.0 when the domain controller is running Microsoft Windows  2000, you must enable subauthentication, which is not in 16416g64q stalled by default on IIS 6.0. There are three requirements for enabling subauthentication:

u·     Install the subauthentication component, iissuba.dll.

u·     Set the UseDigestSSP metabase property to False.

u·     Set the identity of the application pool to Local System. For more information about setting application pool identity, see "Ensuring Application Availability" in this book.

Consider the following guidelines for enabling subauthentication:

u·     The requirement to use subauthentication applies to Digest authentication only. Using Advanced Digest authentication does not require subauthentication.

u·     When you no longer want to use subauthentication, unregister the sub-authentication component and set the identity of the application pool to Local System.

Requirements

u·     Credentials: Membership in the Administrators group on the local computer.

u·     Tools: Iis.msc.

Recommendation

As a security best practice, log on to your computer using an account that is not in the Administrators group, and then use the Run as command to run IIS Manager as an administrator. At the command prompt, type runas /user:administrative_accountname "mmc %systemroot%\system32\inetsrv\iis.msc".

To install and register the subauthentication component

In the Run dialog box, type cmd, and click OK.

At the command prompt, type:

rundll32 systemroot\system32\iissuba.dll,RegisterIISSUBA.

Press ENTER.

For any application pools that use Digest authentication, set the application pool identity to Local System.

For more information about Digest authentication, see "Configure Web Server Authentication" earlier in this appendix.

For more information on configuring application pool identity, see "Configure Application Pool Identity" earlier in this appendix.

To unregister the subauthentication component

In the Run dialog box, type cmd, and click OK.

At the command prompt, type:

rundll32 systemroot\system32\iissuba.dll,UnregisterIISSUBA

Press ENTER.