Here's my web.config customErrors section (you'll notice I've switched the mode to 'On' so I can see the redirect on my localhost):

    <customErrors defaultRedirect="~/Application/ServerError.aspx" mode="On" redirectMode="ResponseRewrite">
        <error statusCode="403" redirect="~/Secure/AccessDenied.aspx" />
    </customErrors>

and here's the code that throws:

        Catch adEx As AccessDeniedException

              Throw New HttpException(DirectCast(HttpStatusCode.Forbidden, Integer), adEx.Message)

        End Try

and here's what I end up with:

Which is not my pretty AccessDenied.aspx page but it is a forbidden error page so at least I know my throw is working.

I've removed the entry for 403 in IIS (7.0) as a desperate last attempt and unsuprisingly that made no difference.

I've run out of ideas now so any suggestions will be gratefully appreciated!