How to set up failure auditing in Windows 2008 for 401.1 Troubleshooting in IIS 7.x



search for, find, and open the Local Security Policy snap-in





Drill down into Local Policy > Audit Policy



Add checkmarks beside Failure for...
audit account logon events
audit logon events
audit system events

Run gpupdate /force


Restart IIS if possible with IISRESET

Reproduce the 401.1 (or just the prompt for credentials in the browser)

Visit the security event log

Look for failures.  Filter if needed.