Where to set username/password for BASIC authentication in IIS7

Troubleshooting permissions problems can be a challenge but at the end of the day here's what I think:

The users are able to access the directories regardless of their membership in the groups you've created because the users are members of the local users group, which has access to the directories. For the most part, permissions are cumulative and the least restrictive permissions apply except in cases of explicitly defined permissions (Allow or Deny). In order to achieve your desired restrictions you have two choices:

1. Do what you've already done and define an explicit Deny on the directories to the groups that you don't want to have access.

2. Remove permissions inheritance from the directories, remove the local users group from the permissions on the directories and define an explicit Allow on the directories to the groups that you do want to have access.

Sounds like something has configured IIS to map the .jpg file type to an executable (could be .NET, CGI, ISAPI, ...).

Check, for the root of the IIS Web App, the Handler Mappings for a path that will match the URL of the file you are requesting.

(The error is about IIS being configured to not allow code to run to satisfy the HTTP request. One could create a handler for *jpg to allow the images to be generated dynamically or loaded from a database rather just serving static files.)