Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is it possible to disable windows authentication on one or more subfolders of an application using windows authentication?

For example:

A website contains several other folders that contain parts of the overall application: /frontend, /backend, /login

The bin folder is on the same level as these subfolder, i.e. the root of the website.

All of these subfolders contain pages that use binaries that reside in the bin folder of the root of the website.

The user must input windows credentials when visiting a page in the backend folder, but not when visiting a page in the login or frontend folder.

I'm using IIS7

Any ideas?

share|improve this question

Found a solution:

  • Adjusted the applicationHost.config file and changed the "overrideModeDefault" to "Allow" for the anonymousAuthentication en windowsAuthentication section entries

       <section name="anonymousAuthentication" overrideModeDefault="Allow" />
       <section name="windowsAuthentication" overrideModeDefault="Allow" />
  • Added location tags in the web.config for every folder / file that needed to be excluded from windows authentication

       <location path="pathToDirOrFile">
             <anonymousAuthentication enabled="true" />
             <windowsAuthentication enabled="false" />
  • Made sure each one of those folders contained a separate web.config file that disables identity impersonation

         <identity impersonate="false" />
share|improve this answer

You can control authentication using the location tag in the web.config, or, put another web.config in to the relevant subfolder specifying the settings you need applying.

You can also control access to resources (folders or individual files) within IIS hence you'll need to make sure you don't have conflicting rules in place.

share|improve this answer
I've tried adding location tags to the web.config and using seperate web.config files), but both do no seem to work. <location path="login"> <system.web> <authorization> <allow users="*" /> </authorization> <identity impersonate="false" /> </system.web> </location> – Bert Vandamme Apr 27 '10 at 14:45
Thx for your help, found a solution using location tags – Bert Vandamme Apr 28 '10 at 9:20

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.