Path access in web.config without using Forms authentication

Question

Guys, as the title suggests, I am required to control access to a specific file on our server. I suggested, for the time being (rather than affording time for other routes until we can), that we simply use the web.config to lock this file down to everyone by means of a location/system.web/authorization setting.

This soon failed to protect the resource and I quickly became aware why (I think). It is a public site and is not using Forms authentication (currently just defaulting to Windows).

So, for clarity, here are the relevant parts the config file...

<?xml version="1.0"?>
<configuration>
  <system.web>
    <authentication mode="Windows"/>
  </system.web>
  <location path="thefile.extension">
    <system.web>
      <authorization>
        <deny users="*"/>
      </authorization>
    </system.web>
  </location>
</configuration>

Can I secure this resource without turning on Forms authentication? Or can I turn authentication on but never actually require authentication to occur, by allowing all resources but the ones explicitly stated, or by explicitly stating all allowed and denied resources?

Basically, any suggestions on getting around this.

Thanks,

Mr. D

EDIT: The file is an xml file.