There are two ways to do authentication with IIS.

First, is to use HTTP basic (or NTLM) authentication against the Windows user database. This can tied into the NTFS file permissions. This doesn't work well when you want to store the users in the database and not have them exist outside the database.

Second, is to serve the content through a dynamic script. The script checks whatever mechanism you use to authenticate the users (ie cookie), and servers up the file. The URL can hide somewhat that there is a script: /files.cgi/some/dir/image.gif

Apache gives other ways to do authentication. There are Apache modules that can do authentication in many different ways including basic against database, and with cookies. Also, you can write mod_perl auth handlers that run Perl code. Apache::AuthCookie uses cookies. Apache runs quite well on Windows but the mod_perl support is not production quality.