How do I get Windows Server 2012 to prompt me for credentials when I go to a restricted subfolder of my site?

Question

The "Users" group has read access to my entire website so the public can browse my site. Now, I have created an "admin" subfolder which I do not want the public to have access to.

So in the security settings for the folder I specifically denied everything to the "Users" group, and so now when I browse to www.mysite.com/admin I get a "401 Unauthorized" error.

I guess this is kinda good, except how do I get it to prompt me for credentials so I can login and actually see the pages in that folder?

In Server 2003 this used to work automatically, but in 2012 something has changed. What's the trick?

Answer 1

In IIS, enable Basic Authentication.

If it's not listed, then go to Server Manager and install Basic Authentication through "Add Roles and Features". (it's listed under "Web Server (IIS) / Web Server / Security / Basic Authentication").

Windows Server 2012

Then create a web.config file inside the folder you want to secure with the following code:

<configuration>    
  <system.webServer>
    <security>
        <authentication>
            <anonymousAuthentication enabled="false" />
            <basicAuthentication enabled="true" />
        </authentication>
    </security>
  </system.webServer>
</configuration>

Windows Server 2016

I just want to add, for the benefit of those using Server 2016. It works differently in Windows Server 2016 (heaven forbid they keep things the same across versions).

In Server 2016 you want to actually remove those two authentication settings from the web.config inside the folder.

<configuration>
     <system.webServer>
        <security>
        <authentication>

        </authentication>
        </security>
    </system.webServer>
</configuration>

And also remove the "Users" user from the security tab on that folder. This will result in a credentials prompt.