This is typically an issue with the Anonymous Authentication configuration on the site. Open IIS Manager, go to the site and open the "Authentication" item under the IIS section. Click on the "Anonymous Authentication" item and then click the Edit link under Actions on the right. Set the identity to Application pool identity. If you don't want to use Application pool identity, ensure the user listed under Specific user is on the ACL for the website directory, with read permissions.