You can attempt to customise the page (and IIS will send the customised
page - you can check using network sniffer), but it is up to the browser to
decide what to display. Most (if not all) browsers will *not* display custom
content when the HTTP status from the server is 401 - they will either
display a logon dialogue box -or- they will display an "access denied" error
message (after three, or whatever, failed attempts). This is a security
measure on the part of the browser.

What you would need to do is intercept the 401.2 HTTP status, and change it
to something else (eg 200 OK), and then you can server whatever content you
want.

Cheers
Ken