web.config - 拒绝所有用户到特定文件夹和子目录，但已验证的角色除外

I am having an issue trying to prevent all users/connections from accessing a download folder "files" and all subs and files therein. I only want to allow authenticated users in specific Roles to have access to the files. The files folder is under root. ./web.config ./files/subfolder1/files in hereI am having an issue trying to prevent all user