Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am runing a standalone IIS 6 server on top of a Server 2003 (Standard x64) installation. The IIS server is hosting 1 site that requires basic authentication over HTTPS to grant access. The site's structure is as follows:

  • Site Root
    • index.html
    • Public
      • A bunch of help documents
    • Downloads
      • A bunch of tech documents/installers/etc
    • web_svc (A virtual folder called REST points here)
      • ASP.NET MVC application

I'd like to restrict the downloads folder so that only users belonging to a particular group can access it, but I'm having some problems.

I created a group in Computer Management called "Downloaders" and added several users to it. Then I removed the inherited permissions on the downloads folder (through NTFS folder properties) and added read permissions on the "Downloaders" group (I gave system and Administrators full control.)

Problem is, when an administrator or a user who is part of the "Downloaders" group authenticates and tries to grab a file in the downloads folder they get an access denied error. It's not a standard 403, an "Error in / application" shows up and says that they not authorized by web.config.

I guess I'm a little confused because the root site is just flat HTML, there's no ASP.NET stuff going on until they drill inside the REST virtual site (or the web_svc dir).

Any suggestions? I could write an ASP.NET application and put it at the root, and use that as a "gatekeeper" -- but I think IIS should be able to do this natively.

Thanks in advance!


I can move the web_svc thing outside the site root if I have to. Haven't actually tried that...

share|improve this question
by web.config, or to read web.config? Try giving the App Pool Identity permission to read the web.config file in that folder. – TristanK May 29 '11 at 23:37
up vote 0 down vote accepted

Your idea is logical except IIS does not impersonate your user. It runs as either the W3C service account or as the application pool identity (if your site is configured as an application). So the service account or application pool identity must have access to the folder or the user will get a runtime error.

My advice is to configure the site as an application and then use the web.config file to restrict access to the download folder.

This article should give you the information you need to get started.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.