Why is prompting for ID/PW random?

Server: Windows 2000, SP4, IIS 5.0, teamshare and SQL 2000. 
sub-site (Default web/cr) has Basic Authentication Checked, only.
NTFS security for /cr folder allows Authenticated Users, Administrators,
System and denys Anonymous 

Most of the time a user is prompted for an ID and password. 
The ID is pulled from Request.ServerVariables("Auth_User") and displayed on
the page. 
Sometimes the user is not prompted for an ID/PW and
the ID displayed on the page is the name of the last person to logon. 
The user would then click several links and eventually they will be prompted
for an ID/PW. 

Each asp page has the following coded at the top:
Response.Expires = 0
Response.Expiresabsolute = Now() - 1
Response.AddHeader "pragma","no-cache"
Response.AddHeader "cache-control","private"
Response.CacheControl = "no-cache"
response.buffer=true

Between the DSL modem and server is a firewall and switch.


The IIS log shows the following:
#Software: Microsoft Internet Information Services 5.0
#Version: 1.0
#Date: 2005-05-19 12:38:13
#Fields: date time c-ip cs-username s-ip s-port cs-method cs-uri-stem
cs-uri-query sc-status sc-win32-status sc-bytes cs-bytes time-taken
cs-version cs-host cs(User-Agent) cs(Referer)
(Note: Server is 127.0.0.0 401.5=id/pw prompt)
2005-05-19 12:38:13 127.0.0.1 - 127.0.0.1 80 GET /ucr/ - 401 5 4634 606 100
HTTP/1.1 127.0.0.1 ...
2005-05-19 12:38:24 127.0.0.1 - 127.0.0.1 80 GET /cr - 401 5 4634 748 10
HTTP/1.1 127.0.0.1 ...
2005-05-19 12:38:33 127.0.0.1 templateuser 127.0.0.1 80 GET /cr/ - 302 0 277
429 60 HTTP/1.1 127.0.0.1 ...
2005-05-19 12:38:37 127.0.0.1 templateuser 127.0.0.1 80 GET /cr/Default.asp
- 200 0 0 430 3876 HTTP/1.1 127.0.0.1 ...
2005-05-19 12:38:37 127.0.0.1 templateuser 127.0.0.1 80 GET
/cr/images/pic.gif - 304 0 265 400 60 HTTP/1.1 127.0.0.1 ...
2005-05-19 12:38:46 127.0.0.1 templateuser 127.0.0.1 80 GET
/cr/report_summary.asp - 200 0 0 479 400 HTTP/1.1 127.0.0.1 ...
2005-05-19 12:39:30 127.0.0.1 - 127.0.0.1 80 GET /ucr/ - 401 5 4634 606 10
HTTP/1.1 127.0.0.1 ...
(Note: Machine #1 401.5=id/pw prompt)
2005-05-19 12:41:24 192.85.47.1 - 192.168.0.11 80 GET /cr/ - 401 5 4618 476
0 HTTP/1.0 64.51.99.119 ...
2005-05-19 12:41:29 192.85.47.1 dave 192.168.0.11 80 GET /cr/Default.asp -
200 0 0 281 60 HTTP/1.0 64.51.99.119 ...
2005-05-19 12:41:29 192.85.47.1 dave 192.168.0.11 80 GET /cr/images/pic.gif
- 200 0 3927 276 130 HTTP/1.0 64.51.99.119 ...
(Note: Machine #2 no prompt AND ID=Machine #1)
2005-05-19 12:41:52 192.85.47.1 dave 192.168.0.11 80 GET /cr/ - 302 0 307
237 0 HTTP/1.0 64.51.99.119 ...
2005-05-19 12:41:52 192.85.47.1 dave 192.168.0.11 80 GET /cr/Default.asp -
200 0 0 238 20 HTTP/1.0 64.51.99.119 ...
2005-05-19 12:41:52 192.85.47.1 dave 192.168.0.11 80 GET /cr/images/pic.gif
- 200 0 3927 233 100 HTTP/1.0 64.51.99.119 ...
2005-05-19 12:41:56 192.85.47.1 dave 192.168.0.11 80 GET /cr/SelectTable.asp
- 200 0 0 287 20 HTTP/1.0 64.51.99.119 ...
2005-05-19 12:41:56 192.85.47.1 dave 192.168.0.11 80 GET
/cr/images/background.gif - 404 2 4184 255 60 HTTP/1.0 64.51.99.119 ...
2005-05-19 12:41:56 192.85.47.1 dave 192.168.0.11 80 GET /cr/images/pic.gif
- 200 0 3927 248 80 HTTP/1.0 64.51.99.119 ...
(Note: Machine #2 401.5 prompt after clicking link)
2005-05-19 12:41:58 192.85.47.1 - 192.168.0.11 80 GET /cr/SelectTable.asp
action=ServerVariables 401 5 4618 650 10 HTTP/1.0 64.51.99.119 ...
2005-05-19 12:42:06 192.85.47.1 templateuser 192.168.0.11 80 GET
/cr/SelectTable.asp action=ServerVariables 200 0 0 380 20 HTTP/1.0
64.51.99.119 ...
2005-05-19 12:42:06 192.85.47.1 templateuser 192.168.0.11 80 GET
/cr/images/background.gif - 404 2 4184 333 0 HTTP/1.0 64.51.99.119 ...
2005-05-19 12:42:06 192.85.47.1 templateuser 192.168.0.11 80 GET
/cr/images/pic.gif - 200 0 3927 326 130 HTTP/1.0 64.51.99.119 ...
2005-05-19 12:42:10 192.85.47.1 templateuser 192.168.0.11 80 GET
/cr/default.asp - 200 0 0 376 40 HTTP/1.0 64.51.99.119 ...
2005-05-19 12:42:10 192.85.47.1 templateuser 192.168.0.11 80 GET
/cr/images/pic.gif - 200 0 3927 299 90 HTTP/1.0 64.51.99.119 ...

The only non-server initiated requests appear to be from: 192.85.47.1. In
which case, what IP addresses are Machine1 and Machine2 supposed to have?

Cheers
Ken

Show quoteHide quote/cr/Default.asp
/cr/images/pic.gif
/cr/images/pic.gif
/cr/SelectTable.asp
/cr/images/pic.gif
Show quoteHide quote

AD Custom App Pool identity, Custom IUSR identity, and a lot more.
IIS 6 on Win2003 with SP1
RE: Virtual Directory mapped to Netware server in IIS6 fails
Problem with the "Too many users logged"
IIS 6.0 Resource Kit
New SSL Certificate not showing on browsers?
does w2k3 server automatically change user's settings based on time?
IIS / OWA
ASPUSER account problem?
Integrated Windows Authentication on a member server