The audit shows an anonymous 401 for every connection

Before the accesses of a person signed in with Windows, the service's audit shows an entry anonym … UNAUTHENTICATED (401) each time.

AuthMode with Windows; clients that sign in with HTTP Negotiate (driver with AUTH=WINDOWS, Power Query with “Windows”).

Not an error. Without sign-in, the service responds with 401 and WWW-Authenticate: Negotiate; only then does a client sign in with Windows. Every new connection therefore starts with a request without sign-in. After that, the sign-in applies to the whole connection.

None needed. Frequent occurrences only show that clients open many new connections.

Every anonymous entry is followed by an access with the Windows account from the same origin.

• HTTP: sign-in with the Windows account