After reading this helpful thread on the same subject, I still haven't quite got it.
I want these rules:
Allow Admin to everything
Deny all none authenticated users from everything
Allow User to everything exept one page 'UserAdmin.aspx'
Here is my attempt at the last item
<location path="~/UserAdmin.aspx">
<system.web>
<authorization>
<allow roles="Admin"/>
<deny roles="User"/>
<deny users="*"/>
</authorization>
</system.web>
</location>
The problem is the account with the user role is either getting all access or no access.
...
Go to the complete details ...