[eluser]vambavan[/eluser]
Thanks for the response. Couple of things to mention:
1. Its an internal website so please ignore where its placed for now i.e. web root.
2. the htaccess in the subdirectory works when files are accessed directly. It does prompt a password so there is nothing wrong with the file or the syntax in there.
3. I saw several posts in the forums that used to get 404 error but I dont. I am not sure why. They used this line: RewriteCond $1 !^(401.shtml) in their root htaccess to force the password prompt, but I dont get the 404 error they had and the line did ot work for me.