<p><a href="http://blogs.msdn.com/drnick/archive/2007/03/23/preventing-anonymous-access.aspx" rel="noreferrer">http://blogs.msdn.com/drnick/archive/2007/03/23/preventing-anonymous-access.aspx</a> </p>

<p>Can someone clarify whether it is possible to use wsHttpBinding in WCF and disable anonymous access in IIS without transport (ssl) or message security being required?</p>

we want to use windows integrated security. If you disable anonymous access in IIS and allow just windows, you cannot seem to use wsHttpBinding with WCF without using some security mode (e.g. transprot security which requires ssl).
We only want to use windows authentication we don't necessarily want to use ssl for transport security.
I was a little amazed this wasn't possible out of the box (as seemed to be confirmed by my link) as it would seem quite a common scenario for intern applications.
We don't want to downgrade to basicHttpBinding which would support windows authentication only.