Windows User Directory Security bypassed?

[rrzzy]

:confused;Using IIS6 under Windows 2003 with CFMX 6.1 When a cfm script file is
located in a windows security restricted directory, the user is prompted for a
login (user/password) prior to access. However, any user/password combination
for that computer is accepted even when the directory is restricted to a
specific user or usergroup. A html file in the same restricted directory works
correctly, only allowing the specific user or group access and denying all
others. If the url is just a directory reference (i.e. relies on the IIS
default filename to resolve to a cfm script file), then user security works
correctly. This seems like a rather large hole in CF security. Is there a way
to implement user based security so different users have access to specific
directories?

[Adam Cameron]

But it's IIS handling the security (ie: the user login screen). What SHOULDN'T
be happening is that IIS shouldn't be handing the request off to CF if the
authentication isn't validated.

It's not CF's job to handle website security: if it receives a request from
the webserver, it'll fulfil the request.

Adam

[Unregistered]

I have the same problem with windows authentification not securing coldfusion docs. It apears to work on all other objects in a directory but not on the cfm pages. Has anyone come up with a soltuion?