I said to post here because this is where discussions are held. Not by posting your problem as a bug (it isn't). I did also tell you what the problem was before I closed your post but I'll reiterate it here. The reason your users get the pop-up is because the site isn't in there Trusted Sites or Intranet sites list under internet options on their computer. So, you user hits the site, gets the popup that's generated by IIS and enters just their username and password and it fails so it goes to the 401.1 error because they didn't enter their credentials properly (note: if they'd entered them as DOMAIN\username or username@domain it should've logged them in). This is all a by-product of how IIS handles any site needing Windows Authentication. When the site is part of the Trusted or Intranet sites list it knows it's safe to pass in the user's information and does it automatically.