Online reference for ASP.NET security?

Is there a good online reference for setting up ASP.NET security?

I've modified the web.config file of my application like so:

Code:

---

<authentication mode="Windows" />
<authorization>
    <deny users="?" />  <!-- deny anonymous -->
    <allow users="my_domain\my_username" />
</authorization>

---

This seems to have no effect because other users besides me can still access the application.

This works.

PHP Code:

---

<authentication mode="Windows" />
<authorization>
    <allow users="my_domain\\my_username" />
    <deny users="*" />
</authorization> 


---

I thought the <deny users="*" /> would override the rest but if <allow users="whoever" /> is listed first it overrides the next.

I've found the best thing to do is put <deny users="*" /> in machine.config then allow whatever permissions in the web.config of each individual app.

Hope this helps.