guenavan

I cannot understand why editing of web.config files of subdirectories could have possibly be engaged for this

You can have individual authorization sections in sub-folders by putting web.configs in them and listing the access levels inside the .config.

A technical user could edit a file and enable them to block off access to a folder but what Tatworth is saying is that he needs a solution that doesn't involve that because the websites admins are not that technical.