by      
Security settings for files and folders for IIS servers. 401 - Unauthorized: Access is denied due to invalid credentials I have listed one of the most common issues when you create your own folders or link to outside content from within your own network folders.

Access is denied due to invalid credentials

IIS 7.0 Windows Server 2008 R2 IIS Web.

401 - Unauthorized: Access is denied due to invalid credentials

If you have searched the support.microsoft.com and other sites without figuring out the issue check the following to see if it's a match. 

 

I always custom install my IIS servers. The drives are not standard so this means I have to apply settings and users to each folder I setup. 

One possible fix: 

  1. Check the IUSR account and make sure it's listed in your Security and Permissions to access the directory you are using to store your website.
  2. Check to be sure  the IUSR is assigned to this website from within IIS. 
  3. Go to Authentication from your website. 
  4. Click on "Anonymous Authentication" and then click the Edit in the Actions column.
  5. You should be set to the default "Specific user: IUSR".
  6. Now go to the folder and be sure you have IUSR listed from within the security tab. 

How do you get there?

  1. Open explorer or click "Explore" from the IIS controls.
  2. Right click the main folder under the inetpub folder.
  3. Left click on Properties.
  4. Click on the Security Tab.
  5. Look in the Group or User names box. 

If you are not showing the same user then add it. IUSR

Now, one word that might help. 

IUSR is assigned to the Anonymous Authentication group so be sure you only allow this to folders you would like to give anonymous access to. 

In my case I never give IUSR access to included pages or app_data. 

But, I will give it to images, uploads, etc. This part all depends on how you setup your website and how much interaction you offer. 

Just be sure to review folder security settings from time to time so you are up on the best practices for your website. 

Remember, not all websites are the same and all websites will be accessed sooner from security mistakes than later without the mistakes.

 

 

 

Security settings for files and folders for IIS servers. 401 - Unauthorized: Access is denied due to invalid credentials I have listed one of the most common issues when you create your own folders or link to outside content from within your own network folders.