Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am using windows server 2008 R2 and IIS 7.5

I deployed my app to that server for the first time and I got the following error;

403 - Forbidden: Access is denied.

You do not have permission to view this directory or page using the credentials that you supplied.

so I make a little search on that and I figured that I should configure Anonymous Authentication <anonymousAuthentication> but I don't know how to do that. It is clearly explained on the following link but not sure if this is the right solution to my problem;

if this is the problem, I guess, I should put a similar code block as follows;

      password="[enc:AesProvider:57686f6120447564652c2049495320526f636b73:enc]" />

if this is the case, how should I provide this code?

should I use AppCmd.exe with powershell?

EDIT ok, I continue to explore and new questions pops up on my head;

  1. As far as I got, I need to set machine username and password there. but what kind of user should I set there? where should user have access (which folders)?
  2. can I add that configuration inside my web.config file or should I provide this inside applicationHost.config?
share|improve this question
up vote 1 down vote accepted

Replace <security> </security> in your applicationHost.config with

            <anonymousAuthentication enabled="true" />

You should be able to configure the same from IIS Manager as well using link

share|improve this answer
then, our website will be reachable right? is there any downsides of this. I talked to our server guy and he couldn't figure out this problem either. but it looks not so much complex. am I right? thanks for the answer btw. – tugberk May 24 '11 at 20:51

I got this problem because I was using SSL certificate as my user authentication and it was not able to check the revocation. I figured this out being use the under given link. There is a simple registry tweak which saved my lot of time. I hope someone will get some help from this.

share|improve this answer
Welcome to Server Fault! Whilst this may theoretically answer the question, please provide context around links so others will have some idea what it is and why it’s there. If possible summarise or quote the most relevant part of an important link, in case the target site is unreachable or goes permanently offline. – HBruijn Aug 15 '15 at 9:39

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.