Many IIS administrators have encountered this common error "403-forbidden access. this encoding information may mislead many people and think it is a problem related to the NTFS permission, but it is not actually related to authentication and access control, which should be divided into 401 status groups.
The first step in tracking this 403 error is to find the entry location of these requests in the relevant IIS log file. You need to find out the substate encoding associated with this 403 error.ArticleTroubleshoot a 404 is described in the same article. once you find the sub-status code, you can match your sub-status code with the content in the article in the Microsoft Knowledge Base. the Knowledge Base Article contains these HTTP status codes and possible error causes.
IIS 7:
Http://support.microsoft.com/kb/943891
IIS 5 & 6:
Http://support.microsoft.com/kb/318380
Have fun debugging!
Original article: http://blogs.iis.net/tomkmvp/archive/2009/12/10/troubleshoot-a-403.aspx