Warning: The retired, out-of-support Internet Explorer 11 desktop application has been permanently disabled through a Microsoft Edge update on certain versions of Windows 10. For more information, see Internet Explorer 11 desktop app retirement FAQ.
Symptoms
Assume that you have access to a web server that requires Kerberos authentication. When you try to access the web server in Internet Explorer 11 through a proxy server, the authentication fails, and you cannot access the website.
Cause
This issue occurs when the web server is accessed through a CNAME. This is defined in DNS for the server. In addition, the web server uses the Service Principal Name (SPN) of an A record in order to process the Kerberos authentication. When Internet Explorer accesses the web server through a proxy server, it tries to request the Kerberos ticket based on the CNAME of the web server, instead of the A record. As this SPN was not registered in Kerberos protocol, the ticket cannot be obtained, and the authentication fails.
Update information
To resolve this issue, install the most recent cumulative security update for Internet Explorer. To do this, go to Microsoft Update. Additionally, see the technical information about the most recent cumulative security update for Internet Explorer.
Note This update was first included in the July 2015 security update for Internet Explorer (MS15-065).
Registry information
After you apply this update, you must change the registry. To do this, follow these steps:
Important Follow the steps in this section carefully. Serious problems might occur if you modify the registry incorrectly. Before you modify it, back up the registry for restorationin case problems occur.
For 32-bit (x86-based) computers
-
In Registry Editor, locate and then click the following registry subkey:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl -
Right-click FeatureControl, point to New, and then click Key.
-
Type FEATURE_ALWAYS_USE_DNS_FOR_SPN_KB3022771, and then press Enter to name the new subkey.
-
Right-click FEATURE_ALWAYS_USE_DNS_FOR_SPN_KB3022771, point to New, and then click DWORD Value.
-
Type *, and then press Enter to name the new entry.
-
Right-click *, and then click Modify.
-
In the Value data box, type 00000001, and then click OK.
-
Exit Registry Editor.
For 64-bit (x64-based) computers
-
In Registry Editor, locate and then click the following registry subkey:
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Main\FeatureControl -
Right-click FeatureControl, point to New, and then click Key.
-
Type FEATURE_ALWAYS_USE_DNS_FOR_SPN_KB3022771, and then press Enter to name the new subkey.
-
Right-click FEATURE_ALWAYS_USE_DNS_FOR_SPN_KB3022771, point to New, and then click DWORD Value.
-
Type *, and then press Enter to name the new entry.
-
Right-click *, and then click Modify.
-
In the Value data box, type 00000001, and then click OK.
-
Expand the following subkey:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl -
Right-click FeatureControl, point to New, and then click Key.
-
Type FEATURE_ALWAYS_USE_DNS_FOR_SPN_KB3022771, and then press Enter to name the new subkey.
-
Right-click FEATURE_ALWAYS_USE_DNS_FOR_SPN_KB3022771, point to New, and then click DWORD Value.
-
Type *, and then press Enter to name the new entry.
-
Right-click *, and then click Modify.
-
In the Value data box, type 00000001, and then click OK.
-
Exit Registry Editor.
Status
Microsoft has confirmed that this is a problem in the Microsoft products that are listed in the "Applies to" section.
References
See the terminology that Microsoft uses to describe software updates.
