configure admin zone with permission deny