If you have access to your server you can simply remove the user account permissions from the folder(s) for the Anonymous Web User (usually the IUSR_computername account)
IIS will then force a user authentication. There are some IIS settings you may need to change to allow browsers other than IE to log on successfully, notably you need to disable challenge-response authentication and enable plain-text authentication. This is done with the IIS service manager.
After authentication, IIS will then impersonate the logged-on user for subsequent permissions.