web.config for authorization

[wallaceoc80]

I have a web application and I want only a members of a certain group on a company intranet to have access to the web app.

In my web.config file I have authentication set to "Windows". In the authorization section I have it set to this:

<authorization>
    <allow users="group\subgroup" /> <!-- Allow all users in this group -->
</authorization>

However, it seems to let everybody on the network have access to the site even if they are not members of the group. Any ideas why?

Could it be something to do with me having:

<identity impersonate="true" />

in the web.config file aswell?

Thanks,

Wallace

 

[adamroof]

set IIS directory security to Integrated Windows and uncheck anonymous