Hw to use Failed Request Log & Advanced Log to fix a 401

I have a particular web API application that works 100 % in localhost , including a /help page.  When I transfer it to our UAT box .  most of it works , but the /help url returns a 401.     I have traced it in fiddler, & have activated advanced logging & failed request logging.  They all give the same lack of info.  Its a 401 with 0 substatus or windows errorcode.    Logs are set to Verbose, Windows event log returns no error.  

How do I  get a debugging log, which tells me exactly what ( userid x cant read file y)  is being objected to.  I know its vaguely a permissions thing,  & I have globally set permissions to be as broad as possible.  My web config includes the following details .  The intention is to allow all users through ( including Anonymous) 

<authentication mode="Windows" />
<allow users="*" />
<customErrors mode="Off" />

<httpErrors errorMode="Detailed" existingResponse="PassThrough" />

Thanks Richard