I am runing a standalone IIS 6 server on top of a Server 2003 (Standard x64) installation. The IIS server is hosting 1 site that requires basic authentication over HTTPS to grant access. The site's structure is as follows:

  • Site Root
    • index.html
    • Public
      • A bunch of help documents
    • Downloads
      • A bunch of tech documents/installers/etc
    • web_svc (A virtual folder called REST points here)
      • ASP.NET MVC application

I'd like to restrict the downloads folder so that only users belonging to a particular group can access it, but I'm having some problems.

I created a group in Computer Management called "Downloaders" and added several users to it. Then I removed the inherited permissions on the downloads folder (through NTFS folder properties) and added read permissions on the "Downloaders" group (I gave system and Administrators full control.)

Problem is, when an administrator or a user who is part of the "Downloaders" group authenticates and tries to grab a file in the downloads folder they get an access denied error. It's not a standard 403, an "Error in / application" shows up and says that they not authorized by web.config.

I guess I'm a little confused because the root site is just flat HTML, there's no ASP.NET stuff going on until they drill inside the REST virtual site (or the web_svc dir).

Any suggestions? I could write an ASP.NET application and put it at the root, and use that as a "gatekeeper" -- but I think IIS should be able to do this natively.

Thanks in advance!


I can move the web_svc thing outside the site root if I have to. Haven't actually tried that...

  • by web.config, or to read web.config? Try giving the App Pool Identity permission to read the web.config file in that folder. – TristanK May 29 '11 at 23:37

Your idea is logical except IIS does not impersonate your user. It runs as either the W3C service account or as the application pool identity (if your site is configured as an application). So the service account or application pool identity must have access to the folder or the user will get a runtime error.

My advice is to configure the site as an application and then use the web.config file to restrict access to the download folder.

This article should give you the information you need to get started. http://support.microsoft.com/kb/815151

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.