title: Configure IIS Windows Authentication to return HTTP 403 instead of HTTP 401 for permission denied with an authenticated user
body: <p>A colleague asked me today how to configure IIS 7.5 to use integrated Windows authentication with impersonation for a simple intranet website with just static content that is restricted to a specific group in Active Directory (e.g., "Administrators").</p>
  
  <p>Turns out that IIS sends a HTTP 401 response when the authenticated user does not have permission to the request resource.  The permission denied could be the result of a NTFS file ACL, or a <code>system.webServer/security/authorization</code> ACL defined in the IIS config.</p>
  
  <p>All the major browsers seem to interpret this 401 to mean that the end user provided invalid Windows username/password credentials, and thus prompts the user to enter their username/password.  IE seems to prompt up to 3 times before showing the 401 response body/content.  Chrome and Safari seems to repeatedly prompt the user.</p>
  
  <p>This can be confusing to end users, who keep repeatedly entering a valid Windows username/password, only to be prompted again.</p>
  
  <p>The better way would be for IIS to return a HTTP 403 instead of a HTTP 401:</p>
  
  <blockquote>
    <p>403 Forbidden</p>
    
    <p>The server understood the request, but is refusing to fulfill it. Authorization will not
    help and the request <em>SHOULD NOT</em> be repeated.</p>
    
    <p>Source: <a href="http://www.w3.org/Protocols/rfc2616/rfc2616-sec10.html#sec10.4.4" rel="noreferrer">http://www.w3.org/Protocols/rfc2616/rfc2616-sec10.html#sec10.4.4</a></p>
  </blockquote>
  
  <p>How do you configure IIS integrated Windows Authentication to send HTTP 401 for logon failures and HTTP 403 for permission denied?</p>