IIS security and Basic Authentication

[guyute]

<<previously posted in exchange forum, but I thought this is more of an IIS question>>

Ok, the previous admins on our network restricted access to the OWA by creating a OWA group and giving that group access to log on local. While this works fine for Outlook only access, I want to add a link on my logon.asp page that directs to a employee only page which would be authenticated by checking the employee group.

I thought it would be easy, I gave the employee group log on locally access and restricted access on the logonfrm.asp page to the OWA group. This way I can authenticate Only OWA users for Outlook, and set up a different authentication for the employee page. However, now when someone wants to check their mail Via OWA, they are prompted to enter their logon information twice. I kind of see why it does that, but I would think that Since OWA users are also employees the validation should pass?

I am using Basic Authentication.
Am I not doing something right? Any insight would be great.

Thanks,

Jim

 

[guyute]

I think I figured it out sort of. I set the anonymous user with read/execute access to the web files. This should cover the local login problem. Now I only have 1 prompt to login and I can change who can log in for which pages I want.

Can Anyone tell me if putting the Internet guest Account access on my web files could be any sort of security risk? I wouldnt think so, but I want to make sure before I put this into effect.