This is a problem with the security mode of IIS. This is a problem that all CGI scripts will encounter when running under IIS. It first creates a complete HTML file (not parsed by PHP) and then enters the page through the user authentication path. When redirecting a PHP page using the META tag, or connecting to a PHP page, PHP will confirm the correct authentication. When the ISAPI module is available, this is no longer a problem. This problem does not affect other NT WEB servers. For more information, please refer to:
http://support.microsoft.com/support/kb/articles/q160/4/22.asp.