You need to enable parent paths. Go to your IIS website or virtual directory properties and "Enable parent paths".

By default in Windows 2003, Enable parent paths is set to no. When Enable parent paths is set to no, IIS #include function and FileSystemObject object instantiated by an ASP application is limited to that application’s defined directory. This is the most secure setting and is appropriate for most shared Web hosting environments.

When Enable parent paths is set to yes, the IIS #include function and FileSystemObject object can access files outside the ASP application directory. In this scenario, ASP developers can use the "../" syntax in #include statements to access any file outside of the Web directory when browsing directories and MapPaths etc.

To Enable parent paths in IIS, follow the instruction:

Start the Internet Services Manager (Start - Programs - Administrative Tools - Internet Services Manager)
Right click on the web site and select properties
Select the 'Home Directory' tab
Click the 'Configuration' button under the Application Settings
Select the 'Options' tab
Check the 'Enable parent paths' box and click Apply
If there are any child nodes affected they will be listed, select and click OK
Click OK to all other dialog boxes
You don't need to restart the service for the change to take effect.