Why is prompting for ID/PW random?

Server: Windows 2000, SP4, IIS 5.0, teamshare and SQL 2000.
sub-site (Default web/cr) has Basic Authentication Checked, only.
NTFS security for /cr folder allows Authenticated Users, Administrators,
System and denys Anonymous

Most of the time a user is prompted for an ID and password.
The ID is pulled from Request.ServerVariables("Auth_User") and displayed on
the page.
Sometimes the user is not prompted for an ID/PW and
the ID displayed on the page is the name of the last person to logon.
The user would then click several links and eventually they will be prompted
for an ID/PW.

Each asp page has the following coded at the top:
Response.Expires = 0
Response.Expiresabsolute = Now() - 1
Response.AddHeader "pragma","no-cache"
Response.AddHeader "cache-control","private"
Response.CacheControl = "no-cache"
response.buffer=true

Between the DSL modem and server is a firewall and switch.


The IIS log shows the following:
#Software: Microsoft Internet Information Services 5.0
#Version: 1.0
#Date: 2005-05-19 12:38:13
#Fields: date time c-ip cs-username s-ip s-port cs-method cs-uri-stem
cs-uri-query sc-status sc-win32-status sc-bytes cs-bytes time-taken
cs-version cs-host cs(User-Agent) cs(Referer)
(Note: Server is 127.0.0.0 401.5=id/pw prompt)
2005-05-19 12:38:13 127.0.0.1 - 127.0.0.1 80 GET /ucr/ - 401 5 4634 606 100
HTTP/1.1 127.0.0.1 ...
2005-05-19 12:38:24 127.0.0.1 - 127.0.0.1 80 GET /cr - 401 5 4634 748 10
HTTP/1.1 127.0.0.1 ...
2005-05-19 12:38:33 127.0.0.1 templateuser 127.0.0.1 80 GET /cr/ - 302 0 277
429 60 HTTP/1.1 127.0.0.1 ...
2005-05-19 12:38:37 127.0.0.1 templateuser 127.0.0.1 80 GET /cr/Default.asp
- 200 0 0 430 3876 HTTP/1.1 127.0.0.1 ...
2005-05-19 12:38:37 127.0.0.1 templateuser 127.0.0.1 80 GET
/cr/images/pic.gif - 304 0 265 400 60 HTTP/1.1 127.0.0.1 ...
2005-05-19 12:38:46 127.0.0.1 templateuser 127.0.0.1 80 GET
/cr/report_summary.asp - 200 0 0 479 400 HTTP/1.1 127.0.0.1 ...
2005-05-19 12:39:30 127.0.0.1 - 127.0.0.1 80 GET /ucr/ - 401 5 4634 606 10
HTTP/1.1 127.0.0.1 ...
(Note: Machine #1 401.5=id/pw prompt)
2005-05-19 12:41:24 192.85.47.1 - 192.168.0.11 80 GET /cr/ - 401 5 4618 476
0 HTTP/1.0 64.51.99.119 ...
2005-05-19 12:41:29 192.85.47.1 dave 192.168.0.11 80 GET /cr/Default.asp -
200 0 0 281 60 HTTP/1.0 64.51.99.119 ...
2005-05-19 12:41:29 192.85.47.1 dave 192.168.0.11 80 GET /cr/images/pic.gif
- 200 0 3927 276 130 HTTP/1.0 64.51.99.119 ...
(Note: Machine #2 no prompt AND ID=Machine #1)
2005-05-19 12:41:52 192.85.47.1 dave 192.168.0.11 80 GET /cr/ - 302 0 307
237 0 HTTP/1.0 64.51.99.119 ...
2005-05-19 12:41:52 192.85.47.1 dave 192.168.0.11 80 GET /cr/Default.asp -
200 0 0 238 20 HTTP/1.0 64.51.99.119 ...
2005-05-19 12:41:52 192.85.47.1 dave 192.168.0.11 80 GET /cr/images/pic.gif
- 200 0 3927 233 100 HTTP/1.0 64.51.99.119 ...
2005-05-19 12:41:56 192.85.47.1 dave 192.168.0.11 80 GET /cr/SelectTable.asp
- 200 0 0 287 20 HTTP/1.0 64.51.99.119 ...
2005-05-19 12:41:56 192.85.47.1 dave 192.168.0.11 80 GET
/cr/images/background.gif - 404 2 4184 255 60 HTTP/1.0 64.51.99.119 ...
2005-05-19 12:41:56 192.85.47.1 dave 192.168.0.11 80 GET /cr/images/pic.gif
- 200 0 3927 248 80 HTTP/1.0 64.51.99.119 ...
(Note: Machine #2 401.5 prompt after clicking link)
2005-05-19 12:41:58 192.85.47.1 - 192.168.0.11 80 GET /cr/SelectTable.asp
action=ServerVariables 401 5 4618 650 10 HTTP/1.0 64.51.99.119 ...
2005-05-19 12:42:06 192.85.47.1 templateuser 192.168.0.11 80 GET
/cr/SelectTable.asp action=ServerVariables 200 0 0 380 20 HTTP/1.0
64.51.99.119 ...
2005-05-19 12:42:06 192.85.47.1 templateuser 192.168.0.11 80 GET
/cr/images/background.gif - 404 2 4184 333 0 HTTP/1.0 64.51.99.119 ...
2005-05-19 12:42:06 192.85.47.1 templateuser 192.168.0.11 80 GET
/cr/images/pic.gif - 200 0 3927 326 130 HTTP/1.0 64.51.99.119 ...
2005-05-19 12:42:10 192.85.47.1 templateuser 192.168.0.11 80 GET
/cr/default.asp - 200 0 0 376 40 HTTP/1.0 64.51.99.119 ...
2005-05-19 12:42:10 192.85.47.1 templateuser 192.168.0.11 80 GET
/cr/images/pic.gif - 200 0 3927 299 90 HTTP/1.0 64.51.99.119 ...

The only non-server initiated requests appear to be from: 192.85.47.1. In
which case, what IP addresses are Machine1 and Machine2 supposed to have?

Cheers
Ken

--
Blog: www.adopenstatic.com/cs/blogs/ken/
Web: www.adopenstatic.com


[quoted text, click to view]
: Why is prompting for ID/PW random?
:
: Server: Windows 2000, SP4, IIS 5.0, teamshare and SQL 2000.
: sub-site (Default web/cr) has Basic Authentication Checked, only.
: NTFS security for /cr folder allows Authenticated Users, Administrators,
: System and denys Anonymous
:
: Most of the time a user is prompted for an ID and password.
: The ID is pulled from Request.ServerVariables("Auth_User") and displayed
on
: the page.
: Sometimes the user is not prompted for an ID/PW and
: the ID displayed on the page is the name of the last person to logon.
: The user would then click several links and eventually they will be
prompted
: for an ID/PW.
:
: Each asp page has the following coded at the top:
: Response.Expires = 0
: Response.Expiresabsolute = Now() - 1
: Response.AddHeader "pragma","no-cache"
: Response.AddHeader "cache-control","private"
: Response.CacheControl = "no-cache"
: response.buffer=true
:
: Between the DSL modem and server is a firewall and switch.
:
:
: The IIS log shows the following:
: #Software: Microsoft Internet Information Services 5.0
: #Version: 1.0
: #Date: 2005-05-19 12:38:13
: #Fields: date time c-ip cs-username s-ip s-port cs-method cs-uri-stem
: cs-uri-query sc-status sc-win32-status sc-bytes cs-bytes time-taken
: cs-version cs-host cs(User-Agent) cs(Referer)
: (Note: Server is 127.0.0.0 401.5=id/pw prompt)
: 2005-05-19 12:38:13 127.0.0.1 - 127.0.0.1 80 GET /ucr/ - 401 5 4634 606
100
: HTTP/1.1 127.0.0.1 ...
: 2005-05-19 12:38:24 127.0.0.1 - 127.0.0.1 80 GET /cr - 401 5 4634 748 10
: HTTP/1.1 127.0.0.1 ...
: 2005-05-19 12:38:33 127.0.0.1 templateuser 127.0.0.1 80 GET /cr/ - 302 0
277
: 429 60 HTTP/1.1 127.0.0.1 ...
: 2005-05-19 12:38:37 127.0.0.1 templateuser 127.0.0.1 80 GET
/cr/Default.asp
: - 200 0 0 430 3876 HTTP/1.1 127.0.0.1 ...
: 2005-05-19 12:38:37 127.0.0.1 templateuser 127.0.0.1 80 GET
: /cr/images/pic.gif - 304 0 265 400 60 HTTP/1.1 127.0.0.1 ...
: 2005-05-19 12:38:46 127.0.0.1 templateuser 127.0.0.1 80 GET
: /cr/report_summary.asp - 200 0 0 479 400 HTTP/1.1 127.0.0.1 ...
: 2005-05-19 12:39:30 127.0.0.1 - 127.0.0.1 80 GET /ucr/ - 401 5 4634 606 10
: HTTP/1.1 127.0.0.1 ...
: (Note: Machine #1 401.5=id/pw prompt)
: 2005-05-19 12:41:24 192.85.47.1 - 192.168.0.11 80 GET /cr/ - 401 5 4618
476
: 0 HTTP/1.0 64.51.99.119 ...
: 2005-05-19 12:41:29 192.85.47.1 dave 192.168.0.11 80 GET /cr/Default.asp -
: 200 0 0 281 60 HTTP/1.0 64.51.99.119 ...
: 2005-05-19 12:41:29 192.85.47.1 dave 192.168.0.11 80 GET
/cr/images/pic.gif
: - 200 0 3927 276 130 HTTP/1.0 64.51.99.119 ...
: (Note: Machine #2 no prompt AND ID=Machine #1)
: 2005-05-19 12:41:52 192.85.47.1 dave 192.168.0.11 80 GET /cr/ - 302 0 307
: 237 0 HTTP/1.0 64.51.99.119 ...
: 2005-05-19 12:41:52 192.85.47.1 dave 192.168.0.11 80 GET /cr/Default.asp -
: 200 0 0 238 20 HTTP/1.0 64.51.99.119 ...
: 2005-05-19 12:41:52 192.85.47.1 dave 192.168.0.11 80 GET
/cr/images/pic.gif
: - 200 0 3927 233 100 HTTP/1.0 64.51.99.119 ...
: 2005-05-19 12:41:56 192.85.47.1 dave 192.168.0.11 80 GET
/cr/SelectTable.asp
: - 200 0 0 287 20 HTTP/1.0 64.51.99.119 ...
: 2005-05-19 12:41:56 192.85.47.1 dave 192.168.0.11 80 GET
: /cr/images/background.gif - 404 2 4184 255 60 HTTP/1.0 64.51.99.119 ...
: 2005-05-19 12:41:56 192.85.47.1 dave 192.168.0.11 80 GET
/cr/images/pic.gif
: - 200 0 3927 248 80 HTTP/1.0 64.51.99.119 ...
: (Note: Machine #2 401.5 prompt after clicking link)
: 2005-05-19 12:41:58 192.85.47.1 - 192.168.0.11 80 GET /cr/SelectTable.asp
: action=ServerVariables 401 5 4618 650 10 HTTP/1.0 64.51.99.119 ...
: 2005-05-19 12:42:06 192.85.47.1 templateuser 192.168.0.11 80 GET
: /cr/SelectTable.asp action=ServerVariables 200 0 0 380 20 HTTP/1.0
: 64.51.99.119 ...
: 2005-05-19 12:42:06 192.85.47.1 templateuser 192.168.0.11 80 GET
: /cr/images/background.gif - 404 2 4184 333 0 HTTP/1.0 64.51.99.119 ...
: 2005-05-19 12:42:06 192.85.47.1 templateuser 192.168.0.11 80 GET
: /cr/images/pic.gif - 200 0 3927 326 130 HTTP/1.0 64.51.99.119 ...
: 2005-05-19 12:42:10 192.85.47.1 templateuser 192.168.0.11 80 GET
: /cr/default.asp - 200 0 0 376 40 HTTP/1.0 64.51.99.119 ...
: 2005-05-19 12:42:10 192.85.47.1 templateuser 192.168.0.11 80 GET
: /cr/images/pic.gif - 200 0 3927 299 90 HTTP/1.0 64.51.99.119 ...
: