I wanted to test Windows 7, a website with Windows Authentication.

Normally it is sufficient, Windows Authentication in "Programs and Features" / "Windows Features" to activate



and then in the IIS Manager to enable:



When you call the page, however, to my astonishment, I received a popup to enter the user data:



After I entered the credentials three times, I received the following error:



The reason for this is that I've given the site its own host header.

Produces the result that the loopback check, which was introduced with Windows XP SP2 (and apparently also in Windows 7 is used), fails, and the above error message with the Error Code 0xc000006d.

The behavior and the remedy is in KB896861 described.

Windows Server 2012 R2 comes with IIS 8.5, and in this release an issue has been found in relation to the Dynamic Compression module.  The module sets the “Vary” header which is used to specify caching properties that the browser uses to determine whether the response should be cached or not. 

In IIS 8.0 and earlier, the Dynamic Compression module was overwriting the Vary header with the value “Accept-Encoding”, and as it happens this is the correct value to ensure that dynamic content is correctly cached – but – according to IIS it should be appending this value to the existing value and not overwriting it.

As it happens, this was supposed to be fixed in IIS 8.5 but the fix appears to be broken.  In IIS 8.5 (which ships with Windows Server 2012 R2) the Vary header is being set to “*” and the “Accept-Encoding” from the Dynamic Compression module is not appended.  The result of this is that no dynamic content is being cached by the browser.

Workaround

Thankfully there is an easy workaround in IIS 8.5 for this:

1. Select an IIS site, and go to Configuration Editor

2. Select system.web/caching/outputCache section, then set the omitVaryStar property to true

Setting this value results in the Vary header being returned with a value of “Accept-Encoding” and the browser then caches the dynamic content.