At home, I have a small server running on Windows Server 2012 and IIS8 (no AD). I want some of the users on my server to be able to access a shared file directory so they can download it via https.

I created a website in the IIS manager, set the base directory to the shared folder, enabled directory browsing for this website, disabled Anonymous Authentication and enabled Windows Authentication. Access from the internet and https with signed certificate are also configured and working.

So far so good. When I browse to my server, I'm asked for my credentials (good). Unfortunately, all of the local server users are allowed to access the folder, even the built-in guest account (bad). Now I want to restrict the access to some of the users who I put in a group called WebFiles Users. So I tried something I know from web programming - I added an authorization tag to the web.config which now looks like this:

            <allow roles="MyServer\WebFiles Users" />
            <deny users="*" />

    <!-- this was created by the IIS manager: -->
        <directoryBrowse enabled="true" />

But it doesn't work. I can still access the website with the guest user. Can anyone tell me what I've done wrong?


system.web is something that applies to managed asp.net content, not to static files.

You want to use system.webserver instead. The node:


should cover this.

In IIS Manager, rather than the ASP.NET section, use the IIS section and then the 'Authorization Rules' icon.

  • Your last sentence was the clue that I needed. Stupid me forgot to install the URL authorization feature for IIS so there was no Authorization Rules icon. Installing the feature and setting up the rules via the IIS console finally solved my problem (remove inherited rules, add allow rule for my group). – fero Oct 19 '13 at 11:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.