The two methods that restrict access to an IIS web server are on a user-by-user basis or by IP addresses.