Lots of 401.x errors on the IIS log

Substatus=2 and win32-status=2148074254 along with Substatus=1 and win32-status=0 means the packet exchange corresponds to normal NTLM authentication (Windows Integrated Authentication). If there are a lot of these, there is probably some configuration causing connections to close too soon.