Suppose I am using Windows authentication for an IIS 7 website.
I do not want anybody on intranet (including the network administrator to access the website yet). Anybody will obviously be prompted for username/password, but my concern is somebody who is monitoring the network with administrative powers can just see what authorized users are entering as username/password and log-in. Apart from SSL, is there any other way?
I will host the IIS on a regular computer on the network and pass around IP of that computer to some intranet people.