my issue is for normal domain users can not access k2 site (designer workspace and etc), only if add them into local administrator of K2 web server(IIS server), then the users can access the K2 site.

I have checked on IIS of the k2 site, windows authenticate is now enabled for K2 site, workspace
untimedesinger and etc has been enable the anonymous and for identity application -> windows, has enabled windows authenticate only provide NTLM method.

for normal user, after 3 attemps, HTTP 401 will be happened and indicates do not have permissions to access the site.

how to resolve this issue, why only the users who has the local admin rights  of K2 web server can login to K2 site?(my k2 web and app are hosted in different server)