had a site that had originally had Anonymous Access enabled. We turned it off at the site collection and IIS levels, but anyone could access the site still. It looked like SharePoint was just ignoring the AD permissions set on the site and subsites.

Thanks to the article here: http://www.sharepointblogs.com/johnwpowell/archive/2007/07/10/how-to-ena… the solution was to manually turn off Anonymous access for each site by going to _layouts/setanon.aspx. The option for “Entire site” was still set, even though it was greyed out. I set everything to Nothing and things are working now.