Hi,

Well this is usually quite simple. Remove Anonymous access on IIS for this
website or folder (if you haven't done so yet). Now what you need to do is
set up NTFS permissions on the folder where your files are stored that only
user 1, 2 and 3 can access (and e.g. administrators). If you remove everyone
else (e.g. everyone group, domain users group, .) from permission list,
users will get prompted for username and password (is you select basic
authentication) before they are granted access to the files.

Note: if you select basic authentication in IIS and you don't set up SSL
username and password are transferred in clear text from client to server.

Thanks for your reply.

For some reason, this does not work.

I have the website pointing to a network share on another server.

The network share only allows users 1, 2, 3.

If I login as one of the users who should not have access to this share and
try to access the share, I am denied.  So I know the permissions are working.

However, if I am logged in as a user who should not have access to the site
and type in the server's name in IE, I can access the webpage, no problem.

I have also tried moving the files to a folder on the IIS server.  Same
thing happens.

I do have anonymous access disabled.

For authenticated access, I have tried every combination of access, Windows
Integrated, Digest Authentication, and one of two things happen.  One, I am
prompted for a username and password.  But no matter what username and
password I enter, I am denied access.  Two, I can access the site using any
AD user.

Any other thoughts?