In IIS you set the Authentication to windows and in your web.config you can set it to Forms and use a login page to get rid of that popup. This is how I have my local intranet apps setup. You can leave that as a log in page to allow them to provide alternate login credentials to gain access to the page or just leave it an access denied page if you want access granted only from their credentials of being logged onto the computer.