Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm seeing some strange behavior from a Server 2008 R2 box running .net 4 and IIS 7.5 in an integrated app pool.

The root web.config is pretty clear that I want to use windows authentication.

<authentication mode="Windows"/>

no surprises there.

I have a directory that I would like to secure, so I've added the following web.config to that directory:

            <allow users="MYDOMAIN\MYUSER" />
            <deny users="*" />

Windows Authentication is enabled in IIS, and specified by the root web.config, so I expected the usual Challenge/Response dialog to pop up and ask for a password. Instead I got redirected to a non-existent URL

Which seems to be the default login directory for Forms Authentication, which I'm not using so the request returns a 404 error.

ACLs on the underlying directories allow the intended user to access the file.

Anybody seen IIS behave in this manner?

share|improve this question

I think I found the answer on this one, but it is truly bizarre. I put up a simple .chstml page up on the site. Even though that was just a test page, it appears to have cast an evil spell on IIS somehow.

Razor syntax is really nice, but it appears dangerous to mix with a standard web forms site.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.