anonymous access with IIS7 and checking AD groups of user

Can someone please help me with this?  I have a web page in IIS7.  I am trying to set up anonymous access so it doesn't challenge the user for login, but validates that they belong to a certain AD group.  If they don't belong, I want to block them from the page.  Here is my setup.

Application pool uses framework v4.0, Manged Pipeline Mode is Classic, Identity is NetworkService.

Web page uses Windows Authentication and Anonymous Authentication.

My web.config looks like:

<?xmlversion="1.0"encoding="UTF-8"?>

<configuration>

<locationpath="Account">

     <system.web>

     <authorization>

     <allowusers="yadayada\jfranken" />

     <allowroles="yadayada\ag_CRDBRpt_Admins" />

     <denyusers="*" />

     </authorization>

     </system.web>

</location>

<system.web>

     <compilationdebug="true"targetFramework="4.0" />

     <identityimpersonate="true" />

     <authenticationmode="Windows" />

     <authorization>

          <allowusers="?"/>

     </authorization>

     <membership>

          <providers>

          <clear/>

          <addname="AspNetSqlMembershipProvider"type="System.Web.Security.SqlMembershipProvider"   connectionStringName="ApplicationServices"

     enablePasswordRetrieval="false"enablePasswordReset="true"requiresQuestionAndAnswer="false"requiresUniqueEmail="false"

     maxInvalidPasswordAttempts="5"minRequiredPasswordLength="6"minRequiredNonalphanumericCharacters="0"passwordAttemptWindow="10"

     applicationName="/" />

         </providers>

     </membership>

    <profile>

         <providers>

              <clear/>

              <addname="AspNetSqlProfileProvider"type="System.Web.Profile.SqlProfileProvider"connectionStringName="ApplicationServices"applicationName="/"/>

         </providers>

        </profile>

        <roleManagerenabled="false">

        <providers>

        <clear/>

        <addname="AspNetSqlRoleProvider"type="System.Web.Security.SqlRoleProvider"connectionStringName="ApplicationServices"applicationName="/" />

        <addname="AspNetWindowsTokenRoleProvider"type="System.Web.Security.WindowsTokenRoleProvider"applicationName="/" />

        </providers>

</roleManager>

</system.web>

</configuration>

What am I missing here?