I have a fresh install of Windows 2008 Standard in a Godaddy dedicated hosting account. I upgraded the installation to SP2.
Several apps are running in IIS, in application pools using "NetworkService" as the pool identity. I am accessing the apps anonymously over the internet.
Unlike in Windows 2003, this seems to be a highly privileged account. I find that my applications have read access to every directory on the disk. I verified this by creating a simple app in IIS that read the contents of an arbitrary directory and printed the contents of the first text file it encountered. This worked for every folder I tried it on, including C:\Windows\System32. Attempts to write failed, however.
My gut is telling me this can't possibly be the correct behavior, but my Win2k8-fu is not strong.
Is what I'm seeing normal? Should I be running the application pools using a different identity?