Web Deploy IIS Authentication Troubleshooting – Fix ‘User Unauthenticated’ Errors

Problem: Web Deploy Fails on Production Server

A publish profile deploys correctly to a test IIS server. The same credentials cause an error on production. The error is “user unauthenticated” or ERROR_DESTINATION_INVALID.

This guide explains the cause and the solution.

How Web Deploy Authentication Works

Web Deploy uses the Web Management Service (WMSVC). The publish profile must set MSDeployPublishMethod=WMSVC.

The authentication process has three steps:

1. The client sends credentials to WMSVC on port 8172.
2. WMSVC authenticates the credentials. The “user unauthenticated” error occurs here.
3. WMSVC impersonates the authenticated user for all operations. These operations include file writes, configuration changes, and application pool modifications.

This is pass-through impersonation. The application pool identity has no effect on deployment. The application pool identity matters only when the site runs.

The “user unauthenticated” error means that authentication fails at step 2. WMSVC rejects the credentials. Impersonation does not begin.

Root Causes

The causes are listed by likelihood.

1. User Not in IIS Manager Permissions

This is the most common cause. IIS Manager Permissions are not the same as NTFS folder permissions.

NTFS folder permissions control file system access. IIS Manager Permissions control who can deploy through WMSVC. The user can have full write access to the site folder but still fail Web Deploy authentication. These are two separate permission systems.

The user account must have explicit permission on the site in IIS Manager, not only on the server.

To check:

1. Open IIS Manager.
2. Select the site.
3. Click IIS Manager Permissions.
4. If the user is not listed, click Allow User and add the account.

This is not on the folder properties Security tab. It is in IIS Manager only.

Test servers frequently have wider permissions than production servers. This is the primary mismatch.

2. Management Service Delegation Rules

Each deployment verb needs a delegation rule. These verbs include contentPath, iisApp, and setAcl. The rule must cover the user or the user’s group.

To check:

1. Open IIS Manager.
2. Select the server node.
3. Click Management Service Delegation.
4. Compare the rules with the test server.

If rules apply only to a specific AD group and the user is not in that group, authentication fails.

3. WMSVC Authentication Type Mismatch

WMSVC supports Basic authentication and Windows authentication. The publish profile must use the same type as the server.

To check:

1. Open IIS Manager.
2. Select the server node.
3. Click Management Service.
4. Examine the enabled authentication types.

Compare the authType setting in the pubxml file with the server configuration.

4. Account-Specific Restrictions

Production environments can have these restrictions:

• The account is in a different domain or OU with logon restrictions.
• The “Allow log on locally” right is not granted on the server.
• The account is disabled or the password is expired in Active Directory.
• IP restrictions apply to the WMSVC binding.

Diagnostic Checklist

Check WMSVC Logs

The log file is at C:\inetpub\logs\wmsvc\WMSvc.log.

Search for the username and HTTP status code:

• 401: Bad credentials or authentication type mismatch.
• 403: User authenticated but not authorized. Check IIS Manager Permissions and delegation rules.
• 500: Server-side error after authentication.

Check Windows Security Event Log

Run this PowerShell command:

Get-WinEvent -LogName Security -MaxEvents 20 | Where-Object { $_.Message -match "yourUsername" }

This command shows the exact reason for failed logon attempts.

Compare WMSVC Configuration

Run this command on both test and production servers:

Get-WebConfiguration -Filter "system.webServer/management" -PSPath "MACHINE/WEBROOT/APPHOST"

Compare the output. Look for differences in the authorization and authentication sections.

Test Connectivity with msdeploy.exe

Run this command from the client machine:

msdeploy.exe `
  -verb:dump `
  -source:contentPath="SiteName",computerName="https://SERVER:8172/MSDeploy.axd?site=SiteName",userName="DOMAIN\username",password="password",authType=basic `
  -whatif

If this command fails, run the same command on the server targeting localhost. This isolates network issues from authentication issues.

Quick Fix: IIS Manager Users

If domain authentication is the bottleneck, create a local IIS Manager user.

Run this PowerShell command as administrator on the production server:

[System.Reflection.Assembly]::LoadWithPartialName("Microsoft.Web.Management")
$auth = New-Object Microsoft.Web.Management.Server.ManagementAuthentication
$auth.CreateUser("deployuser", "StrongPassword123!")

Then complete these steps:

1. Open IIS Manager.
2. Select the site.
3. Click IIS Manager Permissions.
4. Click Allow User.
5. Add deployuser.
6. Update the pubxml file. Change the UserName value from DOMAIN\username to deployuser.
7. Enter the password when Visual Studio asks for it.

WARNING: This method bypasses domain authentication. The local IIS Manager user is managed by WMSVC. It is not managed by Windows or Active Directory.

Production-Ready Configuration

Use these settings for a properly configured production environment:

• Use a dedicated AD service account for deployments. Do not use personal accounts.
• Grant IIS Manager Permissions to the service account on all deployable sites.
• Configure delegation rules scoped to the service account.
• Enable only Windows authentication on WMSVC. Disable Basic authentication if possible.
• Use IP restrictions to limit WMSVC access to build server IP addresses.
• Keep WMSVC logging enabled for audit trails.

Quick Reference: pubxml Settings

<PropertyGroup>
  <WebPublishMethod>MSDeploy</WebPublishMethod>
  <MSDeployServiceURL>yourserver.domain.com</MSDeployServiceURL>
  <DeployIisAppPath>YourSiteName</DeployIisAppPath>
  <MSDeployPublishMethod>WMSVC</MSDeployPublishMethod>
  <UserName>DOMAIN\username</UserName>     <!-- or local IIS Manager user -->
  <_SavePWD>true</_SavePWD>               <!-- save encrypted password -->
  <EnableMSDeployBackup>true</EnableMSDeployBackup>
  <EnableMsDeployAppOffline>true</EnableMsDeployAppOffline>
</PropertyGroup>

Summary

If Web Deploy works on test but not on production with the same password:

1. Check IIS Manager Permissions on the production site first.
2. Compare delegation rules and WMSVC authentication configuration between servers.
3. Read the WMSVC log. It identifies the exact reason for the authentication failure.
4. If the problem continues, create a local IIS Manager user on production.

In most cases, the cause is a permissions gap. It is not a password problem.