3

The "Users" group has read access to my entire website so the public can browse my site. Now, I have created an "admin" subfolder which I do not want the public to have access to.

So in the security settings for the folder I specifically denied everything to the "Users" group, and so now when I browse to www.mysite.com/admin I get a "401 Unauthorized" error.

I guess this is kinda good, except how do I get it to prompt me for credentials so I can login and actually see the pages in that folder?

In Server 2003 this used to work automatically, but in 2012 something has changed. What's the trick?

  • I do not know IIS anymore. I wish I could help you. This site has been quiet on the weekends since the holidays. Please be patient, and I suspect that you will get an answer soon. – closetnoc Feb 1 '15 at 19:05
  • Is this your own dedicated server or a hosted shared server? – Kev Feb 5 '15 at 8:14
  • This is a dedicated server. I have full access. – Vincent Feb 5 '15 at 15:25
  • Does this help? It seems that authentication is a little more complex in IIS 7 than it used to be. stackoverflow.com/questions/17828974/… – Jen R Mar 6 '15 at 2:16
  • It set me on the right path Jen. Thanks so much! There was one other step I had to complete to make it all work and that was to install Basic Authentication on my server, and then enable it in IIS. – Vincent Mar 7 '15 at 5:06
0

In IIS, enable Basic Authentication.

If it's not listed, then go to Server Manager and install Basic Authentication through "Add Roles and Features". (it's listed under "Web Server (IIS) / Web Server / Security / Basic Authentication").

Windows Server 2012

Then create a web.config file inside the folder you want to secure with the following code:

<configuration>    
  <system.webServer>
    <security>
        <authentication>
            <anonymousAuthentication enabled="false" />
            <basicAuthentication enabled="true" />
        </authentication>
    </security>
  </system.webServer>
</configuration>

Windows Server 2016

I just want to add, for the benefit of those using Server 2016. It works differently in Windows Server 2016 (heaven forbid they keep things the same across versions).

In Server 2016 you want to actually remove those two authentication settings from the web.config inside the folder.

<configuration>
     <system.webServer>
        <security>
        <authentication>

        </authentication>
        </security>
    </system.webServer>
</configuration>

And also remove the "Users" user from the security tab on that folder. This will result in a credentials prompt.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.