>Opposite of what you're asking but see:
>http://support.microsoft.com/default.aspx?scid=kb;EN-US;815152

I added this in my web.config and this has absolutely no effect:

    <httpHandlers>
      <add verb="*" path="*.config" type="System.Web.HttpForbiddenHandler" />
      <add verb="*" path="*.ini" type="System.Web.HttpForbiddenHandler" />
    </httpHandlers>

Could it be that this approach is no longer supported in 2.0?