I ran into a similar error on IIS4
Turns out that even if you are using NT authentication to protect the directory, you have to give "Everyone" read access to the FILES within the directory, or you'll get that error. This is easy to goof, because by default, the "Replace Permissions on Existing Files" is checked.
I hope this helps you... or anyone else!