You'll need to apply IIS_IUSRS group read access to wwwroot, project, virtual but not base. The trick is to only apply to the current folder, i.e. don't apply to subfolders and files. src - https://stackoverflow.com/a/34797333
