Setting NTAuthenticationProviders at an Application level in IIS 6 - iis

Question

I have the following structure in IIS.
Internet Information Services
(local computer)
Web Sites
Default Web Site
MyApplication
MyApplication is a Application in IIS.
Integrated Windows authentication is NOT set on the Default Web Site.
However I want to set Integrated Windows authentication on MyApplication. (Its an intranet app).
This can be done via the GUI: Right click on the Default Web Site and choose Properties. Select the Directory Security tab, and click Edit on the Anonymous access and authentication control.
I want to include this in a setup script. I have other setup commands, using adsutil.vbs but I'm struggling to set up the Integrated windows authentication.
Running:
cscript //nologo c:\Inetpub\AdminScripts\adsutil.vbs GET /W3SVC/1/NTAuthenticationProviders
Returns
NTAuthenticationProviders : (STRING) "NTLM"
However, i exepcted to be able to run
cscript //nologo c:\Inetpub\AdminScripts\adsutil.vbs GET /W3SVC/1/ROOT/MyApplication/NTAuthenticationProviders
But this returns
Error Trying To GET the property: (Get Method Failed)
NTAuthenticationProviders (This property is probably not allowed at this node)
Is it not possible to set NTAuthenticationProviders Metabase property on an appliction level?

Answer 1

The metabase property that controls the Authenticated Access property values on the IIS Directory Security -> Authentication Methods dialogue is actually called AuthFlags.
The value is a flag and is documented here:
AuthFlags Metabase Property (IIS 6.0) (TechNet)
To set this value to Integrated Windows Authentication (AuthNTLM) use the following command (take care because this command operates on the Default Website, IISNumber:1) -
adsutil.vbs SET /W3SVC/1/ROOT/MyApplication/AuthFlags 4
If you want to set, say, both NTLM and Basic authentication then you would boolean OR the values together, e.g. MD_AUTH_BASIC | AuthNTLM. This would product an integer result of 6:
:: Set both NTLM and Basic authentication
adsutil.vbs SET /W3SVC/1/ROOT/MyApplication/AuthFlags 6
If you inspect the metabase file (C:\WINDOWS\system32\inetsrv\MetaBase.xml) and search for:
Location="/LM/W3SVC/1/ROOT/MyApplication"
...you will see the attribute that controls this setting (after setting to 6 as above):
AuthFlags="AuthBasic | AuthNTLM"
It may take some time before this value updates in the metabase because changes such as this aren't immediately flushed to the file (although IISRESET will cause it to update immediately).