According to the result monitored by fiddler, there are totally 3 handshakes for integrated windows authentication for IE. GET /home - 401 Unauthorized WWW-Authenticate: Negotiate, NTLM GET /home Authorization: Negotiate UYTYGHGYKHKJPPP-=== - 401 Unauthorized WWW-Authenticate: Negotiate UYUGKJKJKJ+++766== Get /home Authorization: Negotiate HJGKJLJLJ+++=== - 200 OK WWW-Authenticate: Negotiate UHLKJKJKJJLK=== Who knows what concrete things are done for the three, especially the 2nd one. P.S. The network environment is work group mode, other than domain mode, and the server is a website hosted on my local PC. In other words, the client (IE) & the server are both in the same machine.