Iis – How to protect certain files from being downloaded

I would recommend either saving the files to a non-web-accessible directory, or creating a random name before saving to disk.

First off, make sure you have the authentication role features installed - basic authentication sounds like what you want. In server manager, right-click IIS, add role features, and install Basic Authentication (under security) if it's not installed already.

In the IIS manager, select a location, open the "Authentication" module, and configure as desired. Disabling Anonymous and enabling Basic is probably where you want to be - it'll be using Windows users, and access to the resources will be controlled by the NTFS permissions on those resources.