OK, i lookd through here and google, but to no avail.

 the web.config in the root folder works great, but when i add a web.config to any subdirectories or use <location> in the root one, i am still able to access the directories directly in the address bar i.e. http://www.website.com/admin/ lists the files in that folder. it wont redirect to a login page.  i went as far as makein a new trimed down site to test only this problem, still wont work.

 here are the web.config files

root:

<configuration xmlns="http://schemas.microsoft.com/.NetConfiguration/v2.0">
  <appSettings/>
  <connectionStrings>
    <!--
    <remove name="LocalSqlServer"/>
    <add name="LocalSqlServer" connectionString="server=xxxxxxxx;initial catalog=xxxxxxx; uid=xxxxxx; Pwd=xxxxxx"/>
   -->
  </connectionStrings>
  <system.web>
    <roleManager enabled="true" />
    <compilation debug="true" strict="false" explicit="true" />
    <customErrors mode="Off"/>
    <pages>
      <namespaces>
        <clear/>
        <add namespace="System"/>
        <add namespace="System.Collections"/>
        <add namespace="System.Collections.Specialized"/>
        <add namespace="System.Configuration"/>
        <add namespace="System.Text"/>
        <add namespace="System.Text.RegularExpressions"/>
        <add namespace="System.Web"/>
        <add namespace="System.Web.Caching"/>
        <add namespace="System.Web.SessionState"/>
        <add namespace="System.Web.Security"/>
        <add namespace="System.Web.Profile"/>
        <add namespace="System.Web.UI"/>
        <add namespace="System.Web.UI.WebControls"/>
        <add namespace="System.Web.UI.WebControls.WebParts"/>
        <add namespace="System.Web.UI.HtmlControls"/>
      </namespaces>
    </pages>
    <authentication mode="Forms">
      <forms name="xxxxxxx" loginUrl="index.aspx" />
    </authentication>
    <siteMap defaultProvider="secureProvider">
      <providers>
        <add name="secureProvider" type="System.Web.XmlSiteMapProvider"
             siteMapFile="web.sitemap" securityTrimmingEnabled="true"/>
      </providers>
    </siteMap>
    <urlMappings enabled="true">
    </urlMappings>
  </system.web>
  <system.net>
    <mailSettings>
      <smtp from="admin@xxxxxxxx.com">
        <network host="xxxxx.xxxx.net" password="xxxxxxx" userName="admin" />
      </smtp>
    </mailSettings>
  </system.net>
</configuration>

 admin dir:

<configuration xmlns="http://schemas.microsoft.com/.NetConfiguration/v2.0">
    <system.web>
        <authorization>
            <allow roles="admin" />
            <deny users="*" />
        </authorization>
    </system.web>
</configuration>

 <authentication mode="Forms">
    <forms loginUrl="login.aspx" />
  </authentication>
  <authorization>
    <deny users="?" />
  </authorization>

/Kadji