That's strange, but it sounds like request filtering, WebDav, or some other security feature (outside of ProGet)... ProGet doesn't restrict anything by extension or anything like that. There's a few places to look, but i'd start here: https://stackoverflow.com/questions/12828476/what-file-extensions-are-blocked-by-default-in-iis Is that helpful?