I can not limit access to the IUSR user nor the IIS_IUSRS group at all....not even a different user that I tried for anonymous access.
When I say IUSR below, I also mean I've tried adding the group IIS_IUSRS with the same result.
Things I've tried: 1) Removing the anonymous access user from the NTFS permissions (security tab) in windows explorer - user can still browse anything in the folder. 2) specifically denying IUSR read access (this works but I can't do this on all of my sites) - user can't browse anything in the folder 3) changing the anonymous user to a local account and removing their permissions on the folder - user can still browse anything in the folder 4) changing the Application Pool user identity to a local account that does not have permission to the folder - user can still browse anything in the folder 5) allowing IUSR read access to the folder but specifically denying write access - user can still upload files to the folder. 6) setting the site to use Windows Authentication and giving IUSR read permission to the folder - prompts for a UN/PW combo...that won't work 7) setting the site to use Windows Authentication AND anonymous access and removing IUSR from the security tab - user can still browse anything in the folder.
I'm pulling my hair out here!!!! I've checked and tried everything I can think of, but nothing seems to allow me to restrict access to anonymous users.
