IIS finds the list of users from NT Server. Ideally, create a global group called Internet Guests, give that group the required permissions
to your web directories that you wish to protect (ie remove the Everyone Full Control permissions and add Internet Users Read Only)... Anyone you wish to give permission to, add then as a user and make them a member of Internet Guests.
Then when people access the web, if a page doesn't have Everyone access, it will ask for a username and password from the user. This username and password should be stored on the web browser untill it is closed, so you will not get asked every time you access a restricted page. (Dean Cleaver
