title: Restrict access to file/folder in web.config
body: <p>I've tried all manner of variations in trying to restrict access to a folder, from the simplest of denying access to all users and just granting access to myself to trying a combination of roles/users etc.  In particular, the folder has a mix of aspx and html files.</p>
  
  <p>Can anyone assist?  Here's pretty much what I have based on other similar questions:  </p>
  
  <pre><code>&lt;configuration&gt;
      &lt;system.web&gt;
         &lt;!-- mode=[Windows|Forms|Passport|None] --&gt;
         &lt;authentication mode="Windows" /&gt;
      &lt;/system.web&gt;
    &lt;system.webServer&gt;
      &lt;handlers&gt;
          &lt;add name="HTMLHandler" type="System.Web.StaticFileHandler" path="*.html" verb="GET" /&gt;
      &lt;/handlers&gt;
    &lt;/system.webServer&gt;
      &lt;location path="AdminOnly"&gt;
          &lt;system.web&gt;
              &lt;authorization&gt;
              &lt;deny users="*" /&gt;
              &lt;allow users="domain\user1, domain\user2, domain\user3" /&gt;
              &lt;allow roles="domain\role1, domain\role2" /&gt;
              &lt;/authorization&gt;
          &lt;/system.web&gt;
      &lt;/location&gt;
  &lt;/configuration&gt;
  </code></pre>
  
  <p><strong>EDIT</strong>
  The solution has presented at last.  </p>
  
  <p>It was a combination of understanding the authorization segment (thanks to Tetsuya for the helpful tip in relation to ordering authorization rules), including the handler segment and also configuring the application pool for managed code.  </p>