Preventing IIS Integrated Windows Authentication from prompting authenticated users for a new username/password when permission to a URL is denied.

Global.asax

<Script language="C#" runat="server">
     void Application_EndRequest() {
  		// rewrite HTTP 401s to HTTP 403s if the user is authenticated using 
			// integrated Windows auth with impersonation, but, 
			// the user lacks permissions to the requested URL
			if (Context.User != null && 
					Context.User.Identity != null &&
						Context.User.Identity.IsAuthenticated &&
							Context.User is System.Security.Principal.WindowsPrincipal && 
								Context.Response.StatusCode == 401) 
			{
				Context.Response.Clear();
				Context.Response.StatusCode = 403;
			}
		}
</script>

web.config

<?xml version="1.0" encoding="UTF-8"?>
<configuration>
    <system.webServer>
        <security>
            <authorization>
                <remove users="*" roles="" verbs="" />
                <add accessType="Allow" roles="Domain Users" />
            </authorization>
        </security>
  	<modules runAllManagedModulesForAllRequests="true" />
	</system.webServer>
</configuration>