Deny access to folder

I have several users on my 2003 server that hosts our website (which is a
corporate private website that requires user authentication, no anonymous
access) I need to deny access to the website to 3 or 4 users but still allow
them to use the FTP service, which also requires authenticatiion. After
removing these users from the "wwwroot" folder they still have access to any
web page once logged in. It looks like I am missing something but what? Ani
idea would be greatly appreciated


--
SGS1983