1.The IUSR_computername account is added to the Guests group on the computer.
2.When a page request is received, IIS will imitate the IUSR_computername account before executing any code or accessing any files. IIS is able to imitate the IUSR_computername account because the user name and password for this account are known by IIS.
3.Before returning a page to the browser, IIS checks NTFS file and directory permissions to see if the IUSR_computername account is allowed access to the file.
4.If access is allowed, authentication completes and the resources are made available to the user.
5.If access is not allowed, IIS will attempt to use another authentication method. If none is selected, IIS returns an "HTTP 403 Access Denied" error message to the browser.