Windows WebDAV Credentials Prompt: Streamline Access to FQDN Sites

Table of Contents

Accessing resources over Web Distributed Authoring and Versioning (WebDAV) can sometimes lead to unexpected prompts for credentials, especially when dealing with Fully Qualified Domain Name (FQDN) sites in a Windows environment. This situation, while seemingly straightforward, can disrupt workflow and hinder seamless access to necessary files and folders. Imagine attempting to open a document stored on a WebDAV server, only to be repeatedly challenged for your username and password, even though you possess the correct permissions. This article delves into the intricacies of this issue and provides a clear, effective solution to streamline your access to WebDAV-based FQDN sites.

Symptoms¶

Encountering persistent credential prompts when accessing WebDAV FQDN sites through Windows Explorer is a primary indicator of this issue. Specifically, observe the following symptoms:

• Repeated Credential Requests: Every attempt to access the WebDAV site, or even navigate within it, triggers a prompt for your username and password. This occurs despite using an account with valid access rights and previously saved credentials.
• Access Denied Errors: In some cases, instead of a prompt, you might be outright denied access to the WebDAV site. This can manifest as error messages within Windows Explorer or when attempting to open files directly from the WebDAV location.
• “Your client does not support opening this list with Windows Explorer” Error: This specific error message can appear when working with moved folders within the WebDAV site through the Explorer view. It signals a deeper issue with the client’s ability to interact with the WebDAV resource.

These symptoms point towards a fundamental problem in how Windows handles authentication for WebDAV connections to FQDN sites, requiring a configuration adjustment to resolve.

Cause¶

The root cause of these credential prompts lies within the architecture of Windows and how it manages WebDAV connections. In Windows Vista and later versions, the WebClient service is the component responsible for enabling Windows Explorer to interact with WebDAV resources. This service, in turn, relies on Windows HTTP Services (WinHTTP) to handle the network communication with the remote WebDAV server.

WinHTTP is designed with security in mind and employs a mechanism to determine whether to automatically send user credentials. By default, WinHTTP is configured to transmit credentials automatically only for requests directed to sites within the local intranet zone. This determination is made based on the URL of the site being accessed.

The crucial point is how WinHTTP interprets URLs. If a URL contains periods (dots), WinHTTP assumes the server is located on the internet, outside the local intranet. FQDNs, by their nature, contain periods (e.g., server.domain.com). Consequently, when you access a WebDAV site using an FQDN, WinHTTP, by default, classifies it as an internet site.

This classification has a significant consequence: WinHTTP does not automatically send credentials to internet sites unless specific configurations are in place. It disregards the Internet Explorer security zone settings, which might otherwise classify the FQDN site as trusted. Furthermore, even if a proxy server is configured for your network, credentials will only be sent automatically if the WebDAV server is explicitly listed for proxy bypass.

Therefore, when accessing a WebDAV site using an FQDN, Windows, through WinHTTP and the WebClient service, fails to automatically provide your credentials. This results in the observed behavior: repeated credential prompts or access denial, even when your account has the necessary permissions. The system is essentially treating the FQDN WebDAV server as an untrusted internet site, preventing automatic authentication.

Resolution¶

To address this issue and enable seamless access to your WebDAV FQDN sites, you need to configure Windows to explicitly trust these sites for credential forwarding. This is achieved through a modification in the Windows Registry. By adding a specific registry entry, you can instruct the WebClient service to automatically send credentials to the designated FQDN sites, resolving the persistent prompt problem.

Registry Information¶

Caution: Modifying the registry incorrectly can cause serious problems that may require you to reinstall your operating system. Therefore, follow these steps carefully and ensure you back up your registry before making any changes.

To implement the solution, follow these steps to create and configure the necessary registry entry:

1. Open Registry Editor:

   • Click the Start button.
   • Type regedit in the search bar.
   • Press Enter.
   • If prompted by User Account Control, click Yes to allow Registry Editor to make changes to your device.

2. Navigate to the WebClient Parameters Subkey:

   • In the Registry Editor window, use the navigation pane on the left to locate the following registry subkey:
     HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WebClient\Parameters
   • Expand HKEY_LOCAL_MACHINE, then SYSTEM, then CurrentControlSet, then Services, and finally select WebClient. Then, select the Parameters subkey.

3. Create a New Multi-String Value:

   • Right-click in the right-hand pane (the pane showing the values within the Parameters subkey).
   • Hover over New.
   • Click on Multi-String Value.

4. Name the New Value:

   • A new value will be created with the default name “New Value #1”.
   • Rename this value to AuthForwardServerList.
   • Press Enter to confirm the name change.

5. Modify the AuthForwardServerList Value:

   • Double-click on the newly created AuthForwardServerList value to open the “Edit Multi-String” dialog box.

6. Enter the URL(s) of your WebDAV Server(s):

   • In the Value data box, type the URL of your WebDAV server. For example, if your WebDAV site is https://webdav.example.com, enter https://webdav.example.com.
   • If you have multiple WebDAV servers, you can list each URL on a new line in the Value data box.
   • Click OK to save the changes.

   Note: Refer to the “Sample URL list” section below for examples of how to specify URLs and use wildcards.

7. Exit Registry Editor:

   • Close the Registry Editor window.

After completing these steps, you will likely need to restart your computer or the WebClient service for the changes to take effect. Once restarted, Windows should now automatically forward credentials to the WebDAV FQDN sites you have added to the AuthForwardServerList, eliminating the persistent credential prompts.

Sample URL list¶

The AuthForwardServerList registry value allows for flexible URL specifications, including the use of wildcards to cover multiple servers within a domain. Here are some examples to illustrate how to construct your URL list:

• https://*.Contoso.com : This entry configures the WebClient service to send credentials over any encrypted (HTTPS) channel to any server within a child domain of Contoso.com. For example, this would apply to https://server1.Contoso.com, https://files.Contoso.com, and so on.

• http://*.dns.live.com : This entry enables credential forwarding over non-secure (HTTP) channels to any server within a child domain of dns.live.com. Use caution when enabling HTTP credential forwarding, as it is less secure than HTTPS.

• *.microsoft.com : This entry applies to any channel (both HTTP and HTTPS) to any server whose name ends in .microsoft.com. This is a broader wildcard and should be used judiciously, understanding that it covers both secure and non-secure connections.

By combining these examples, you can create a tailored URL list that precisely matches the WebDAV FQDN sites you need to access, ensuring both functionality and security.

Things to avoid in the URL list¶

While the AuthForwardServerList provides a powerful way to manage credential forwarding, it’s crucial to adhere to certain guidelines to prevent unintended security risks and ensure proper functionality. Avoid the following practices when constructing your URL list:

• Trailing Asterisk: Do not include an asterisk (*) character at the end of a URL. This can introduce a significant security vulnerability by potentially forwarding credentials to a much wider range of servers than intended. For example, avoid using http://*.dns.live.*. The trailing asterisk in this example could inadvertently include domains beyond dns.live.com.

• Leading or Embedded Asterisk: Do not place an asterisk (*) character before or within a string in the URL, except as the leading character for wildcard subdomain matching as shown in the “Sample URL list”. Using asterisks in other positions can cause the WebClient service to send user credentials to unexpected and potentially malicious servers. For example, avoid:

  • http://*Contoso.com : This could unintentionally send credentials to servers like http://extra_charactersContoso.com.
  • http://Contoso*.com : This could unintentionally send credentials to servers like http://Contosoextra_characters.com.

• UNC Names: Do not use Universal Naming Convention (UNC) paths in the URL list. UNC paths are typically used for network file shares and are not compatible with the URL format expected by AuthForwardServerList. For example, avoid http://*.contoso.com@SSL.

• Trailing Slash, Share Name, or Port Number: Do not end URLs in the list with a backslash (/), and do not include the WebDAV share name or port number. The AuthForwardServerList is designed to match at the domain level, not specific paths or ports within a domain. For example, avoid:

  • http://*.dns.live.com/
  • http://*.dns.live.com/DavShare
  • http://*dns.live.com:80

• IPv6 Addresses: Do not use IPv6 addresses in the URL list. While IPv6 is increasingly common, the AuthForwardServerList is primarily designed to work with domain names and may not correctly process IPv6 addresses. Use domain names instead of IPv6 addresses whenever possible.

By carefully adhering to these guidelines and constructing your URL list with precision, you can effectively resolve the WebDAV credential prompt issue while maintaining a secure and well-configured Windows environment.

Status¶

Microsoft has officially confirmed that the persistent credential prompt issue when accessing WebDAV FQDN sites is a known problem in the Microsoft products listed at the beginning of the original knowledge base article. The registry solution outlined in this article is the recommended method to resolve this issue and streamline access to your WebDAV resources.

---

Do you have any questions or further insights regarding WebDAV credential prompts in Windows? Share your experiences and thoughts in the comments below!