CF and IIS, Windows Groups Restrictions

How do people restrict requests to CF files when using IIS 7 or 8 ? We can use URL Authorization, which works for all files except CF files. CF file requests bypass the IIS restrictions.

We've worked with Adobe technical support and tried using Windows file/folder permissions to restrict CF access. But IIS needs anonymous access to check read web.config.

Seems like I must be missing something basic here ...

Any ideas?

thank you,

Chris