where do i put overrideMode="Deny" in mt config

I have got this error below

HTTP Error 500.19 - Internal Server Error The requested page cannot be accessed because the related configuration data for the page is invalid.

Detailed Error Information

Module Authentication

Notification AuthenticateRequest

Handler ExtensionlessUrl

Handler-Integrated-4.0

Error Code 0x80070021

Config Error This configuration section cannot be used at this path. This happens when the section is locked at a parent level. Locking is either by default (overrideModeDefault="Deny"), or set explicitly by a location tag with overrideMode="Deny" or the legacy allowOverride="false".

this is my config file

<configuration>
<connectionStrings>
    <add name="DBConnection" connectionString="data source=12.12.16.117;Initial Catalog=web_prof_global; User ID=1111;Password=1111;persist security info=True;packet size=4096" providerName="System.Data.SqlClient" />
    <add name="DBConnectionSf" connectionString="data source=12.12.16.117;Initial Catalog=webCommon; User ID=1111;Password=1111;persist security info=True;packet size=4096" providerName="System.Data.SqlClient" />
</connectionStrings>
<system.web>
    <compilation debug="false" targetFramework="4.0" />
</system.web>
   <system.webServer>
    <security>
        <authentication>
            <basicAuthentication enabled="true" />
        </authentication>
    </security>
<modules runAllManagedModulesForAllRequests="true"  />

    <defaultDocument>
        <files>
            <add value="s-f.aspx" />
        </files>
    </defaultDocument>

</system.webServer>


</configuration>

can you please help