401.1 Access Denied on Web Management Console, Automatic Web Client login not working.

We’ve recently come across a few cases involving our new Identity Management features in Microsoft Dynamics GP 2013 R2. As you may know, the new features all you to link a set of Windows Credentials to a GP credential. Doing this enables you to log into the Web Client using only your Windows credentials, and the link will log you directly into GP automatically.

In the back end, the actual SQL login takes place by a Web Client Proxy user. During installation, you are prompted for a username and password for this user. If for some reason, you need to change or reset the proxy account’s password, you can do so by following these steps:

1. Launch GP Utilities, click through to the Additional Tasks window.

2. Select “Manage Web Client SQL Server login,” and click Process.

3. Enter the Login Name, and then the Password twice.

4. If you’re changing the password, check the box.

5. Click Save, then close Utilities.

**IMPORTANT**

After doing this, you must run a repair on Dynamics GP Web Client, or else the automatic login will stop working. The credentials are encrypted and cached locally in the installation directory, and the local credentials won’t be updated until you run the repair.

After running a repair, you will be able to automatically log into GP using just your Windows Credentials again.

Another issue that has come up occasionally is a 401.1 authentication error when logging into Web Management Console (WMC) on the same server that it is installed on. If you hit WMC from anywhere else in the environment, it works fine. Upon hitting the site directly from the server, you will be prompted for credentials three times, and then you will get a 401.1 error.

We are currently still investigating the cause for this issue, but in the meantime we have found that making the following registry tweak will resolve the issue. See the KB referenced below for more information.

1. Open up a new Notepad document, and paste in the following text:

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa]

"DisableLoopbackCheck"=dword:00000001

1. Save the .txt file to your desktop.

2. Change the file extension to .reg instead of .txt.

3. If you can’t see the file extensions, you’ll need to disable the “Hide Extensions” option in Windows Explorer.

   1. http://windows.microsoft.com/en-us/windows/show-hide-file-name-extensions#show-hide-file-name-extensions=windows-7

4. Run an IISRESET, and then attempt to log into WMC again.

To set the value back to what it was previously, you can change the DWORD value from 00000001 to 00000000.

(This workaround involves making a change to the System Registry. If you are not comfortable making changes, consult with your system Administrator before making any changes, and make sure that you have a full disaster recovery solution in place before modifying the Registry. Make this change at your own risk!)

Dan Peltier