A common issue in various IIS forums is how to diagnose or troubleshoot HTTP 401 or 403 status issues (obviously 500 Internal Server Error is another issue, but I'll deal with IIS debugging in another post). I've done up a diagram illustrating the request processing pipeline, indicating the order in which IIS 6.0 processes incoming requests, and the various HTTP substatus codes you'll receive for either 401 and 403 status. By examining the HTTP substatus code, you can then determine the point at which the incoming request is being "rejected".

IIS 6.0 Request Processing Pipeline