When you create form authentication on a folder in your web application. Do you have to create a new virtual directory on that folder/directory? If I have a hosting company that I use, do I have to contact them to set up a virtual directory on the folder that will require authentication in order for it to work. I've done this on past web applications, but I just tested a new authenticated folder without creating a new virtual directory, added the web.config file in the subfolder, and it worked. If you need to create a virtual directory on a folder that you will be requiring form authentication, it shouldn't have worked right? I'm confused. Thanks