title: Windows Authentication not working for classic ASP pages (but does work for ASP.Net pages w/in same site)
body: <p>We have an IIS7 intranet site running under integrated pipeline that is mostly ASP.Net with a few legacy classic ASP pages. The site allows anonymous access to most areas, but uses Windows Authentication to protect certain folders. Requests to ASP.Net pages in the protected folders behave as expected (authorized users can see them, others are denied), but any user can see any classic ASP page in the protected folders, regardless of permissions. </p>
  
  <p>I suspect the windows authentication module is not being invoked for requests to classic ASP pages. We're running in integrated pipeline mode, and I found this article (<a href="http://learn.iis.net/page.aspx/244/how-to-take-advantage-of-the-iis7-integrated-pipeline/" rel="noreferrer">http://learn.iis.net/page.aspx/244/how-to-take-advantage-of-the-iis7-integrated-pipeline/</a>) which indicates that you need to explicitly remove and re-add modules if you want to take advantage of the integrated pipeline for non-ASP.Net requests. I tried to copy the article's example only replacing FormsAuthenticationModule with WindowsAuthenticationModule by adding the following to the web.config at the application root: </p>
  
  <pre><code>&lt;system.webServer&gt;
  &lt;modules&gt;
          &lt;remove name="WindowsAuthentication" /&gt;
          &lt;add name="WindowsAuthentication" type="System.Web.Security.WindowsAuthenticationModule" preCondition="" /&gt;
  &lt;/modules&gt;
  &lt;/system.webServer&gt;
  </code></pre>
  
  <p>However, classic ASP pages are still being served regardless of permission.</p>