Trying to configure for windows authentication

I have an intranet site that I'm trying to configure for windows authentication.  I've done this 100 times before, but's been a while. 
In IIS:
- Anonymous Authentication Enabled
- Windows Authentication Enabled
- ASP.NET Impersonation Enabled
In my web.config:
<identity impersonate="true" userName="XXX\YYY" password="xxxxx" />
    <authentication mode="Windows" />
    <authorization>
        <allow roles="XXX\ZZZ"/>
        <deny users="?" />
     </authorization>
If I remove the <deny users="?" />, then everyone can access the site (logically).  As soon as I add the deny users I get prompted for credentials, and even if I enter valid credentials eventually I get "401 - Unauthorized: Access is denied due to invalid credentials.
You do ...