Листинг web.config:

<configuration>
<system.web>
<authorization>
<allow users="*" />
</authorization>
<authentication mode="Forms">
<forms name="AuthCookie" loginUrl="admin/login.aspx" />
</authentication>
</system.web>
<location path="admin/">
<system.web>
<authorization>
<deny users="?" />
</authorization>
</system.web>
</location>
</configuration>

<location path="admin">

(без слэшей)

либо в каталоге admin разместить web.config

<configuration>
<system.web>
<authorization>
<deny users="?" />
</authorization>
</system.web>
</configuration>