Asking for Credentials, when requesting shared folders on the server, regularly for domain users

We faced a very similar problem. We eventually concluded that while integrated NTLM logon support in Internet Explorer and Firefox is convenient, there are so many exception cases which result in failure that we changed our approach.

The problem with integrated authentication is that it works only when the currently logged on username and password are still correct and properly authorized to access the resource.

There are more circumstances where it doesn't work however:

• If the username and/or password are incorrect, there's no way to use alternate credentials as you stated above
• If the account and/or password have expired or if the password is wrong, the browser will return an "unauthorized" message with no clue as to which of the problems it is

The approach we standardized on was to put up a username/password logon web page (in front of the application) which accepts the credentials. When the credentials are submitted, the application would in turn validate those credentials against the directory and then respond accordingly (in a .NET world you could use Forms Authentication http://msdn.microsoft.com/en-us/library/aa480476.aspx to force access to the application via this login page). Since the application is doing the credential validation, you get rich information as to the nature of the login failure. In addition, even if the login succeeds but there's relevant information to display to the user, e.g. their password will expire shortly, etc., this provides an opportunity to do so.

UPDATE: I forgot to mention that if you adopt this approach, you'll need to allow anonymous access to the IIS application root. This will allow access to the login web page without first attempting the automatic NTLM authentication. It's up to you whether you leave NTLM authentication enabled; perhaps you do want some clients to still automatically log in.

There are two types of permissions on shared folders, and you haven't explained which set you're looking at - and you haven't explained if the non-domain users can actually read files, or if they can just see the share names.

I'm guessing that you've examined the NTFS permissions on the files and folders, and those don't allow "everyone". But I bet that your share permissions (which are set in a different place) are set to allow "Full Control" to "Everyone". That's not a big issue - the more-restrictive set of permissions will mean that these anonymous users can't do anything else besides read the names of the share.

That's my guess, based on what you've said.

However, if they can access and read the actual files, then either you're missing something in the NTFS permissions, or they are successfully authenticating to the server. If their local username on the non-domain machine is the same as their domain username, and the password is the same, the client may be attempting (and succeeding) at passing NTLM authentication.

From the server, why don't you bring up Sessions under Shared Folders in Server Management and see what's going on from that perspective?