http://us.php.net/manual/en/features.http-auth.php

One thing is that .htaccess does not really work with Windows servers. This could be a solution to those can't use htaccess and wants to protect the ACP. The username and password could be stored in conf_global.php or some other file or in the database.

That isn't necessary under windows with IIS. With windows you can use windows authentication to perform the same action as htaccess requirements simply by giving the users privileges to those files but not the anonymous user used in IIS. I wouldn't be surprised to find similar options under apache.

only problem is you have to store your username and password in a file or the conf which was a feature that was removed because its a security risk in itself.