You are prompted unexpectedly to enter your credentials when you access a SharePoint Server site from a Windows Vista-based or Windows Server 2008-based client computer that has a proxy server configured

Consider the following scenario:

• On a Windows Vista-based or Windows Server 2008-based computer, you configure a proxy server in Windows Internet Explorer.
• You use the Web Distributed Authoring and Versioning (WebDav) protocol to access a Microsoft Office SharePoint Server site.

In this scenario, you are prompted unexpectedly to enter your credentials three times. However, you expect that you can access the site directly.

For example, you are prompted to enter your credentials three times when the following conditions are true:

• You open a Microsoft Office file from a SharePoint Server site.
• To open the file, you use a 2007 Microsoft Office system program on a Windows Vista-based client computer that has a proxy server configured.

Note This problem does not occur on a Windows XP-based computer.

In Windows Vista, Internet Explorer uses the Web Client service when you use Internet Explorer to access a WebDAV resource. The Web Client service uses Windows HTTP Services (WinHTTP) to perform network I/O operations with the remote host. However, WinHTTP does not send user credentials to the SharePoint Server site when the client accesses the SharePoint Server site through a proxy. Therefore, the SharePoint Server site prompts for user credentials.

A hotfix is available to resolve this issue. After you apply this hotfix, you have to create a registry entry that is named "AuthForwardServerList." For more information, see the "Registry information" section.

Hotfix information

A supported hotfix is available from Microsoft. However, this hotfix is intended to correct only the problem that is described in this article. Apply this hotfix only to systems that are experiencing this specific problem. This hotfix might receive additional testing. Therefore, if you are not severely affected by this problem, we recommend that you wait for the next software update that contains this hotfix.

If the hotfix is available for download, there is a "Hotfix download available" section at the top of this Knowledge Base article. If this section does not appear, contact Microsoft Customer Service and Support to obtain the hotfix.

Note If additional issues occur or if any troubleshooting is required, you might have to create a separate service request. The usual support costs will apply to additional support questions and issues that do not qualify for this specific hotfix. For a complete list of Microsoft Customer Service and Support telephone numbers or to create a separate service request, visit the following Microsoft Web site: Note The "Hotfix download available" form displays the languages for which the hotfix is available. If you do not see your language, it is because a hotfix is not available for that language.

Important Windows Vista and Windows Server 2008 hotfixes are included in the same packages. However, only one of these products may be listed on the “Hotfix Request” page. To request the hotfix package that applies to both Windows Vista and Windows Server 2008, just select the product that is listed on the page.

Prerequisites

To apply this hotfix, the computer must run one of the following:

• Windows Vista
• Windows Vista Service Pack 1
• Windows Server 2008

Restart requirement

You have to restart the computer after you apply this hotfix.

Hotfix replacement information

This hotfix does not replace any other previously released hotfixes.

Registry information

Important This section, method, or task contains steps that tell you how to modify the registry. However, serious problems might occur if you modify the registry incorrectly. Therefore, make sure that you follow these steps carefully. For added protection, back up the registry before you modify it. Then, you can restore the registry if a problem occurs. For more information about how to back up and restore the registry, click the following article number to view the article in the Microsoft Knowledge Base: To enable this hotfix, follow these steps:

1. Click Start, type regedit in the Start Search box, and then press ENTER.
2. Locate and then click the following registry subkey:
   HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WebClient\Parameters
3. On the Edit menu, point to New, and then click Multi-String Value.
4. Type AuthForwardServerList, and then press ENTER.
5. On the Edit menu, click Modify.
6. In the Value data box, type the URL of the SharePoint Server site, and then click OK.
   Note You can also type a list of URLs in the Value data box. For more information, see the "Sample URL list" section in this article.
7. Exit Registry Editor.

After this registry entry is created, the Web Client service reads the entry value. If the client computer tries to access a URL that matches any of the expressions in the list, the user credentials are sent to authenticate the user, and the user is not prompted for the credentials.

Note You must restart the Web Client service after you modify the registry.

Sample URL list

The following is a sample URL list: This URL list enables the Web Client service to send credentials through the following channels:

• Any encrypted channel to a child domain of a domain whose name is Contoso.com
• Any nonsecure channel to a child domain of a domain whose name is dns.live.com
• Any channel to a server whose name ends with ".microsoft.com"
• Any encrypted channel to a host whose IP address is 172.169.4.6

Note After you configure this URL list, the credentials will automatically authenticate to the WebDAV servers, even if these servers are on the Internet.

Things to avoid in the URL list

• Do not add an asterisk (*) character at the end of a URL. When you do this, a security risk may result. For example, do not use the following URL:
  http://*.dns.live.*
• Do not add an asterisk (*) character before or after a string. When you do this, the Web Client service can send user credentials to more servers. For example, see the following examples:
  • You add the following URL to the list:
    http://*Contoso.com
    In this example, the service also sends user credentials to http://any_extra_charactersContoso.com
  • You add the following URL to the list:
    http://Contoso*.com
    In this example, the service also sends user credentials to http://Contosoany_extra_characters.com
• In the URL list, do not use the UNC name of a host. For example, do not use the following name:
  *.contoso.com@SSL
• In the URL list, do not include the share name or the port number to be used. For example, do not use the following:
  • http://*.dns.live.com/DavShare
  • http://*dns.live.com:80
• Do not use IPv6 in the URL list.

Important This URL list does not affect the security zone settings. This URL list is used only for the specific purpose of forwarding the credentials to WebDAV servers. The list should be created as restrictively as possible to avoid any security issues. Also, because there is no specific deny list, the credentials are forwarded to all the servers that match this list.

The English version of this hotfix has the file attributes (or later file attributes) that are listed in the following table. The dates and times for these files are listed in Coordinated Universal Time (UTC). When you view the file information, it is converted to local time. To find the difference between UTC and local time, use the Time Zone tab in the Date and Time item in Control Panel.

Windows Vista and Windows Server 2008 file information notes

• The files that apply to a specific product, milestone (RTM, SPn) can be identified by examining the file version numbers as shown in the following table.
  Collapse this tableExpand this table

  Version	Product	Milestone	Service branch
  6.0.6000.20xxx	Windows	RTM	LDR
  6.0.6001.22xxx	Windows Vista SP1 and Windows Server 2008 SP1	SP1	LDR

• Service Pack 1 is integrated into Windows Server 2008. Therefore, RTM milestone files apply only to Windows Vista. RTM milestone files have a 6.0.0000.xxxxxx version number.
• The MANIFEST files (.manifest) and MUM files (.mum) installed for each environment are listed separately . MUM and MANIFEST files, and the associated security catalog (.cat) files, are critical to maintaining the state of the updated component. The security catalog files (attributes not listed) are signed with a Microsoft digital signature.

For all supported 32-bit versions of Windows Vista and of Windows Server 2008

For all supported 64-bit versions of Windows Vista and of Windows Server 2008

Microsoft has confirmed that this is a problem in the Microsoft products that are listed in the "Applies to" section.

For more information, click the following article number to view the article in the Microsoft Knowledge Base:

Additional file information for Windows Vista and for Windows Server 2008

Additional files for all supported 32-bit versions of Windows Vista and of Windows Server 2008

Additional files for all supported 64-bit versions of Windows Vista and of Windows Server 2008