restrict access to a website using Windows Server 2008

Question

What do I need to do in Windows Server 2008 to restrict access to a website (or directory in the website) to only certain users?

Answer 1

NTFS permissions will take precedence over the site/virtual directory's permissions if they're more restrictive: http://technet.microsoft.com/en-us/library/cc739391(WS.10).aspx

Answer 2

IIS can restrict websites to an IP address or range of addresses, this is useful for making a website visible to an entire office (eg, a development website restricted to your own, and your clients office IP ranges)

http://technet.microsoft.com/en-us/library/cc730889%28WS.10%29.aspx

This isn't really authentication as such, but is often quicker and easier to setup, but it's less secure (IP's can be spoofed).

Answer 3

I enabled Basic Authentication and disabled Anonymous Authentication. I created a user with read and write permissions on the folder. The created user's credentials are what I use to view the website.