It seems to me that your web server (at the root level) is not configured to allow anonymous access. Check the directory security in IIS Manager to see if Anonymous Authentication is allowed. If not, allowing it might resolve your problem.
Warning: If this is a production server, or a dev server used by other developers, don't change the authentication before you consult the right people, or someone might get mad. 😉 And make sure you don't ovewrite this setting for the subfolders (websites), because this might be the intended setting for them. Just be careful.