rahul f I remember correctly, IIS7 provides that functionality out of the box (the ability to secure folders with just a text file). Therefore, there should not be a need to configure IISPassword in the IIS7 module/provider as it probably does not use it.