We have Windows authentication "wrapping" our Sitecore site to prevent access to a development server. We have Visual Studio and TDS installed on this server for pushing changes.

After I set up Windows auth (and turned off anonymous authentication), I got the following error: "The HTTP request is unauthorized with client authentication scheme 'Anonymous'. The authentication header received from the server was 'Negotiate,NTLM'.

I found the following TDS article referring to this with a suggested config change: https://www.teamdevelopmentforsitecore.com/Blog/setting-authenticated-access-tds. After making this change, I still get the error, but now it says "Negotiate" instead of "Anonymous". So it's closer, but not correct still.

Does anyone have experience with this and the correct setup?

  • Do you have any proxies on this server. At times, proxies would return error even if it's authenticated. Commented Feb 27, 2017 at 3:37
  • Not that I'm aware of, it's a pretty straightforward setup, and this is on the local box, not remotely done. Commented Feb 27, 2017 at 14:03
  • We've been going through a similar issue. Our answer was to turn anonymous on for the whole site but have our "login" page in a folder with Windows auth on. The login page doesn't do much because authentication actually happens at the IIS level. By doing this, we have Windows Auth but also have TDS working.
    – sestocker
    Commented Feb 27, 2017 at 14:30
  • The issue with that is we're trying to keep random folks from seeing the website at all, which it seems like this would allow them to do. I'm guessing yours requires authentication to see at all, whereas mine has authentication to only certain areas. Windows auth is great in that it doesn't interfere with site or Sitecore login, but this seems to be an issue with TDS. Commented Feb 27, 2017 at 15:08

1 Answer 1


I ended up engaging with Hedgehog Support on this and they provided two resolutions.

One is to modify your registry. Back up your Windows Registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0, and edit it by adding inside the MSV1_0 folder a Multi-String Value called ‘BackConnectionHostNames’. Modify that Multi-String Value by adding the host name that you chose for your local site. Close the registry and restart IIS and Visual Studio, then retry the TDS connection.

The other is a bit simpler...set anonymous authentication to be on for only the _DEV folder, and it works as well. Also, if you do this, you don't need to do any other config changes from the earlier blog.

  • I use to set anonymous authentication for _DEV, keepalive.aspx (sitecore\service) and Publish.aspx (Sitecore modules\PublicPages) and works like a charm! Commented Mar 2, 2017 at 18:16
  • I am getting same issue of "The HTTP request was forbidden with client authentication scheme .." when trying to access Azure wep app from my local Visual studio system . test is passing but sync is giving error. I used following sitecore.stackexchange.com/questions/10681/….
    – FHN
    Commented Sep 10, 2018 at 22:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.