Windows Authentication - custom role provider, how to handle if user doesnt exist, or no roles

 I have an app with Windows Authentication and a customer sql role prvovider. I check if a usrs windows account exists in my database and populate a list of roles.
Issue is how do I handle if user has no roles and I should deny access. I thought my 401 catch all in the errors section on my config would redirect to an error page. But my code goes in a constant loop.
How do I redirect a user to an access denied page when I have a role provider setup in the web.config?

...