title: web.config - deny all users to specific folder and subdirectories except for authenicated roles
body: <p>I am having an issue trying to prevent all users/connections from accessing a download folder "files" and all subs and files therein. I only want to allow authenticated users in specific Roles to have access to the files. The files folder is under root.
  ./web.config
  ./files/subfolder1/files in here</p>
  
  <p>my web.config I have this</p>
  
  <pre><code>&lt;location path="files" allowOverride="false"&gt;
  &lt;system.web&gt;
    &lt;authorization&gt;
  
      &lt;allow roles="Admin, Fieldworker, Supervisor, Accounting" /&gt;
       &lt;deny users="*" /&gt;
  
    &lt;/authorization&gt;  
  &lt;/system.web&gt;
  </code></pre>
  
  <p></p>
  
  <p><strong>The problem is not only are all users blocked, but also my authenticated users in the Admin and other roles are blocked.</strong> 
  If I add  above  then my "admin" user can access the files, but then so can any unauthenticated user... which I do not get why   would allow other users access?</p>
  
  <p>My web server is IIS7.
  Other related entries in web.config</p>
  
  <pre><code>&lt;modules runAllManagedModulesForAllRequests="false"&gt;
    &lt;remove name="ScriptModule" /&gt;
    &lt;add name="ScriptModule" preCondition="managedHandler"   type="System.Web.Handlers.ScriptModule, System.Web.Extensions, Version=3.5.0.0,   Culture=neutral, PublicKeyToken=31BF3856AD364E35" /&gt;  
  
      &lt;add  name="FormsAuthenticationModule"    type="System.Web.Security.FormsAuthenticationModule" /&gt;
      &lt;remove  name="UrlAuthorization" /&gt;
      &lt;add  name="UrlAuthorization"   type="System.Web.Security.UrlAuthorizationModule"  /&gt;
      &lt;remove  name="DefaultAuthentication" /&gt;  
      &lt;add  name="DefaultAuthentication"  type="System.Web.Security.DefaultAuthenticationModule" /&gt;
  
  
  &lt;/modules&gt;
  </code></pre>
  
  <p>Thanks in advance for help on this!</p>