I have a photo album on my website on which I want restrict access to certain
personal albums.  In order to do this I opend up IIS manager and disabled
anonymous access for the specific folder and created a user account, say
"User" and made it part of the Guests user group.  I disabled logon locally
for this account in the local security settings and i set it so that the
password cannot be changed and it never expires.  Is this secure enough or is
there a way to further limit access.  What's weird is that I am still able to
access the private virtual directory with the "User" account even though the
"User" account is not part of the ACL of the physical folder.  Is this
normal?  Should I add it to the ACL and limit write access?  Furthermore, I'm
confused as to why the internet guest account is not included in the "deny
logon locally" policy in local security settings.  Is there something else
that prevents this account from logging in locally or is it just not an
issue?  Thanks in advance.