>Thanks for the response. I found that 2 subdirectories that are accessed for images, etc. did not have the NTFS permissions set properly so I changed that ( to Read & Execute ). But other than that everything looks correct. The web site folder and all the virtual directories have NTCR set and the NTFS permissions for them are set to Read & Execute for the Everyone account. Nevertheless, as soon as I hit the main web page, IIS challenges me. It does not "seem" to be identifying me. At least, that's what it looks like. It may be something else and I am misinterpreting it. At any rate IIS challenges me as soon as the web page is hit. I'm missing something here but I have no idea what. And unfortunately, I am not an IIS/NT Security expert ... and if I didn't have to mess with it, I'm not sure I'd want to be. :-)
>
>Bill

Without more information, it is hard to tell what the problem might be. I suggest you setup auditing for Object Access and LogOn/LogOff Failures (don't use Success, as it will clutter your event log) on all the website's directories (if they are large it may take a few minutes to apply), or at least the obvious directories being accessed. Then try to access the site via the browser, and after that check the Security Event Log on the web server machine. Hopefully, it will show you where the access is being challenged and you can check permissions on the resource(s) indicated. If you don't see any events resulting from your access attempt, you can always set auditing on the WINNT directory. If you are using any sort of dynamic content (as WC produces), you might be trying to access DLLs or other system files that might not be too obvious, and might not have correct permissions set for them. Usually these are stored in the WINNT folder/sub-folders. Finally, audit the installation directory of WC to see if there's anything there that's being accessed. If you are not familiar with setting up auditing on NT, contact me offline and I can help you with that.

Good luck!