请求因 HTTP 状态 401 失败：Unauthorized

How to Disable Anonymous Access
In this procedure, you will configure IIS to require Windows-integrated authentication for the WindowsSite site.
Minimize Visual Studio, and then start Internet Services Manager from the Administrative Tools program group.
Expand your server and its default Web site, right-click the WindowsSite site, and then click Properties.
On the Directory Security tab in the WindowsSite Properties dialog box, click the Edit button in the "Anonymous access and authentication control" section.
Click to clear the Anonymous access check box, verify that the Integrated Windows authentication check box is selected, and then click OK.
Click OK to close the WindowsSite Properties dialog box.
Switch back to Visual Studio, and then run the project. Confirm that the page is displayed with the following message:

In Windows 2000
You are: Your Windows user name
This page runs as: DomainOrServer/ASPNET

In Windows Server 2003

You are: Your Windows user name
This page runs as: DomainOrServer/NETWORK SERVICE

Note: You have been authenticated through your Windows account. If you had not been logged on to Windows, you would have been prompted for a Windows user name and password.
Quit Internet Explorer to stop the project.

启用匿名反之上面的动作。

Authorization
In ASP.NET, it is possible to allow authorization to the application when you make additional settings available within the Web.config file. You can allow certain users or certain groups access to these additional settings. The following examples describe this capability. To allow access to all users found in the Windows NT Group that is called "Managers," use the following code: <configuration>
     <system.web>
       <authorization>
         <allow roles="domainname/Managers" />
         <deny users="*" />
       </authorization>
     </system.web>
   </configuration>
           
To allow access to only certain users, use the following code: <configuration>
     <system.web>
       <authorization>
         <allow users="domainname/user1,domainname/user2,domainname/user3" />
         <deny users="*" />
       </authorization>
     </system.web>
   </configuration>