Office 2010 files are prompted for credentials when opening from SharePoint 2013



When opening an Office 2010 file from a SharePoint 2013 site, users are prompted for credentials even though client integration is disabled in SharePoint Central Administration.




There is an additional HEAD request which returns a 403 Forbidden response. 


For example, if you take a network trace, you may see something like this:



Connection: Keep-Alive

Cookie:; ASP.NET_SessionId=whcr4m0unufc483493jf4f0hn; s_vi=[CS]v1|2A0851ED051D1A84-4000013540001FFC[CE]; s_fid=241D25D30F5546C1-15779EB616A64E07; s_nr=1411663880736-Repeat; s_vnum=1411704000263%26vn%3D4; s_invisit=true; gpv_pageName=Login%20to%20SharePoint%20Portal; s_cc=true; SC_LINKS=%5B%5BB%5D%5D; s_sq=%5B%5BB%5D%5D

User-Agent: Microsoft Office Word 2013 (15.0.4615) Windows NT 6.1





Content-Length: 13

Content-Type: text/plain; charset=utf-8

Server: Microsoft-IIS/7.5

X-SharePointHealthScore: 0

SPRequestGuid: 64febb9c-f42f-90b8-4c8d-a753439264e3

request-id: 64febb9c-f42f-90b8-4c8d- a753439264e3



X-MSDAVEXT_Error: 917656; Access denied. Before opening files in this location, you must first browse to the web site and select the option to login automatically.




-  For IE 8 and 9 block the verbs OPTIONS, PROPFIND and if necessary HEAD in the Request Filtering section in IIS.

If you are using Windows Server 2008 or Windows Server 2008 R2:

            On the taskbar, click Start, point to Administrative Tools, and then click Internet Information Services (IIS) Manager

    If you are using Windows Vista or Windows 7:

          On the taskbar, click Start, and then click Control Panel Double-click Administrative Tools, and then double-click Internet Information Services (IIS) Manager.

    In the Connections pane,

         Go to the connection, site, application, or directory for which you want to modify your request filtering settings.

         Home pane, double-click Request Filtering.In the Request Filtering pane, click the HTTP verbs tab, and then click Deny Verb... in the Actions pane.  

NOTE:  Office 2010 may issue a HEAD request in addition to the OPTIONS request. It is not recommended to suppress the HEAD request because it may be used by other applications for other purposes.


-  For IE 10+ remove the X-MS-InvokeApp header from each web application.


Comments (1)

  1. della says:

    nice one…

Skip to main content