So, I'll assume that the Web browser is prompting the user for a password. This happens because IIS returned an "access denied" message to the Web browser. IIS will return this message when 1) anonymous access has not been selected, or 2) the anonymous Web user does not have file permissions to the page you are attempting to view.
Let's start by checking whether anonymous access is allowed. Launch the Internet Services Manager. Right-click your Web site (probably Default Web Site), and then click Properties. Click the Directory Security tab. In the Anonymous Access And Authentication Control box, click the Edit button.
The Authentication Methods dialog appears. Make sure the Anonymous Access checkbox is selected, and then click the Edit button. The Username field probably shows IUSR_Computername, and the Allow IIS To Control Password checkbox should normally be checked. Click OK 3 times and close Internet Services Manager.
The IUSR account is the account IIS is going to use to access files on behalf of anonymous users, and it must have access to the files and folders you're using for Web content. Let's check those file permissions next. Launch Windows Explorer, and navigate to the folder you're using for Web content (C:inetpubwwwroot by default). Right-click the folder, and then click Properties. Click the Security tab. Make sure the Internet Guest Account, Web Anonymous Users, and/or Web Applications groups have at least Read access to the Web content.
This was first published in November 2003