I have an ASP.NET MVC4 website deployed on IIS with Windows Authentication enabled. My config file has this setting:

<authentication mode="Windows" /> <authorization> <deny users="?" /> </authorization> 

My understanding is that this will allow me to authenticate without having to type in credentials; i.e. an intranet site.

This works as intended, except for the first page load. When I first access the website, I am directed to the following URL:

http://localhost/SandboxWebsite/login.aspx?ReturnUrl=%2fSandboxWebsite

This is obviously a page that asks for credentials. When I then navigate again to http://localhost/SandboxWebsite/, I am automatically authenticated without having to enter any credentials.

Why is this occurring and how can I prevent it?