This has come up so many times in the last couple of days I just HAVE to blog about it. I was originally going to call this post "the best registry setting ever" but I realize that would make it tough for search engines to point people here when they need it. Here's the general problem description, you've got a SharePoint environment and you're getting an "access denied" trying to access something you KNOW you should have access to. In the cases I've seen this has been trying to crawl a web app, or trying to create a My Site. In both cases the App Pool ID has the correct permissions, and in the case of search the default content account has been given "Read only" permission to the web app via a web app policy. I was getting this error in the context of the My Site problem. No one could create a My Site. A user couldn't. A Farm Admin couldn't. A Domain Administrator couldn't. This really kicked my butt for a couple of days. Yesterday a friend of mine contacted me. She had the search issue. I walked her through some stuff and she had it all configured correctly. Despite all that, when she ran a crawl, she got a permissions error. I bounced this off of my side-kick, and search aficionado Shane Young. He asked if I'd tried the "loopback fix." Before yesterday to me loopback was only a network thing. It was a 127 address, or it was a phony network adapter I added. He pointed me to my favorite KB ever (or at least since yesterday) and told me to try Method #1. Without further ado, here is the greatest KB article ever.
You receive error 401.1 when you browse a Web site that uses Integrated Authentication and is hosted on IIS 5.1 or IIS 6
Let's all take a moment to absorb the greatness.
Okay, now that we've got that out of our systems let's dig into this a little. While the KB references Windows 2003 all four of the issues I've fixed with it have been on Windows 2008, so don't let the "applies to" fool you. Both 2003 and 2008 have a security measure that disallows loopback communications in case your machine has any errant processes on it that are trying to attack it. That's good from a security standpoint, but it can break SharePoint if you have multiple things running on the same box. Using Method 1 in that KB and disabling the Loopback Check restores order to your SharePoint environment. Since I learned about it yesterday it has fixed problems in four different environments. Go KB 896861!
If you're getting weird permissions errors on your SharePoint farm this is worth trying. It's easily reversible if it doesn't fix your issue. If you have security folks in your environment you should probably run it past them too, just in case. J