David Wang writes about troubleshooting 400.x “Access Denied” errors in IIS. The first step is to pull the substatus code out of the logs, which will give you more information on what’s going wrong and narrow down the list of causes.