Why does Internet Information Server (IIS) want a password?

Key words: IIS | Prompt for a password | Firefox | IE | Internet Explorer
Most users who follow the steps in my article how do I host my web site at home? have no trouble setting up Internet Information Server. But a few discover that Internet Information Server demands a username and password whenever someone else tries to access the web site. Usually the administrator can get in just fine - if they use Internet Explorer on the same computer that is running the web server. But Firefox displays the password prompt, and users on other computers see it too. Nothing users do will get them into the site. What's the problem?

99% of the time, this is because Internet Information Server comes with a set of complicated ASP pages by default, pages that are supposed to be for the administrator only. If the webmaster deletes these before installing their own content in the web site home directory, there's no problem. But if these files are left in place, no one else can access the web site.

The simplest way to remove Microsoft's less-than-helpful default files from your web site is to delete the current contents of your web site's home directory, then copy your own content into place.
If you have already created pages of your own, and they only exist in your web site's home directory, don't delete your own work! Obviously, you'll want to remove only the files you don't recognize - Microsoft's files. Hopefully you have another copy of your own work elsewhere and you can just purge the contents of the directory.
Finding And Cleaning Your Web Site's Home Directory
More than likely, your new web site's home directory is C:\Inetpub\wwwroot. But you can check this in the control panel of Internet Information Server:

1. Start -> Settings -> Control Panel -> Administrative Tools

2. Double-click "Internet Information Services"

3. In the tree at left, right-click your web site or "Default Web Site," and pick "Properties"

4. Click on the "Home Directory" tab

5. Note the path in the "Local Path:" setting.

6. Double-click "My Computer" and navigate to your web site's home directory, as found in step 5.

7. Make absolutely sure you are looking at the contents of your web site's home directory, not its parent (C:\Inetpub\wwwroot, NOT C:\Inetpub). Also make sure that you have other copies of files that are important to you, or copy them to safety elsewhere at this time.

8. Use "Select All" to select all of the files in your web site's home directory. You may see warnings that hidden files were not selected. This is OK.

9. Right-click over any of the selected files and select "Delete" to remove all of them.

10. Copy your own content into place. Make sure you have a home page called index.htm (if your pages are in HTML) or default.asp (if your pages are ASP pages). Other names, such as index.html, might not be recognized as a home page for your site.

11. Try accessing the site again with Firefox, or from another computer. You should gain access to your home page.

"Directory Listing Denied" errors
If you see the error message "Directory Listing Denied" when you attempt to visit the home page of your site, you probably haven't created an "index pge." You need to create an HTML page called index.htm, or an ASP page called default.asp, to serve as your site's home page. A freshly installed copy of IIS is smart enough to recognize either of these names as the home page for the entire folder. so that's what you see if you access http://localhost from a web browser running on the server itself.
Granting Anonymous Access To Your Web Site
In rare cases, you may find that user are still denied access or shown password prompts even after you replace Microsoft's content with your own. This is usually a file permissions problem. Or you might not have anonymous access to your web site turned on. Either way, we can fix it!
Turning On Anonymous Access
Turning on anonymous access to your web site is easy. Just follow these steps:

1. Start -> Settings -> Control Panel -> Administrative Tools

2. Double-click "Internet Information Services"

3. In the tree at left, right-click your web site or "Default Web Site," and pick "Properties"

4. Select the "Directory Security" tab

5. Click "Enable anonymous access and edit the authentication methods for this resource"

6. Make sure the "Anonymous access" box is checked. The "User name:" field will be sent to IUSR_COMPUTERNAME, where "computername" will be the name of your computer. The "Allow IIS to control password" box should also be checked. If these settings are correct, don't change them.

When you're satisfied with your settings, click "OK." Other users should be able to access your site now. If not, read on for one more possibility.

Fixing Your Home Directory's Permissions
Now that you know where your web site's home directory is, it's time to fix the permissions so that the files can be accessed anonymously (that is, by users who are not logged in). Normally this happens by default in a web site home directory, but there are occasional exceptions. Just follow these steps.

1. Double-click "My Computer" on your desktop

2. Browse down to the level just above your web site's home directory, right-click your web site's home directory, and select "Properties"

3. Select the "Security" tab. If you do not see the "Security" tab, follow the steps in the box that follows.
If You Do Not See The Security Tab

Windows XP computers that are not part of a domain do not show the security tab by default. This is easy to fix:

A. Go to "My Computer."

B. Select "Folder Options" from the "Tools" menu.

C. Scroll to the bottom of "Advanced settings."

D. UN-check the "Use simple file sharing" box.

E. Click "OK."

Now you're ready to continue following the instructions for making your web site's home directory accessible to anonymous users.
4. You should be looking at the "Security" tab for your web site home directory at this point.

5. Select "Internet Guest Account" from the list of users.

6. Check the "Read & Execute" box. This should grant sufficient access for future files created in your home directory. But we still have some work to do for existing files.

7. Click "OK" to close the Properties dialog box.

If You Still Have Problems
This article addresses the most common causes of password prompts and other unwanted behavior from a newly configured Internet Information Server. Of course, there are other possibilities. For further reading, I recommend the article Troubleshooting IIS Access Problems at the 15seconds web site.