Windows Auth directory in IIS - web.config Permission problem

We've created a windows authenticated sub directory on our web server, however, intermittently when we go there (once logge开发者_开发知识库d in as an authenticated user - member of a authenticated group) we get the following error:

Module IIS Web Core
Notification BeginRequest
Handler Not yet determined 
Error Code 0x80070005 
Config Error Cannot read configuration file due to insufficient permissions  
Config File \\?\C:\Inetpub\wwwroot\admin\web.config 
Requested URL http://testsite.dev:80/admin
Physical Path C:\Inetpub\wwwroot\testsite\admin 
Logon Method Not yet determined 
Logon User Not yet determined 

The odd thing is once we see this error, hit F5 or refresh and the error goes away, only to reappear a short time later. Very frustrating!!

I have done extensive searches online, but can find nothing. We may also create other sub dirs allowing the same "group" to have access, so this needs to work across all these subs without having to relog in.

We are using IIS7. I've found guides that state for IIS7 ( http://kenno.wordpress.com/2008/10/23/iis7-cannot-read-configuration-file-due-to-insufficient-permissions/ ) but when I do this it seems to then make the directory accessible to all which is clearly not required.

---

Following my own advice and knowing nothing about the problem, I give you an answer to be accepted or improved upon:

1. Set IIS_IUSRS to have read access on your windows authenticated directory.—user901820

2. Configure access in IIS Manager | Your Site | Authentication. Make sure you have disabled "Anonymous Auth" for that folder—this should close it for everyone. If you now enable another Auth method for that folder ... then user should only access it if he provides proper login details.—LazyOne

See Configuring Security at IIS.net.