We have some Web Apps running in IIS 6. They are running in the Default AppPool which identitiy is Network Service.
The Apps connect to a local SQL Server 2005 Express Instance (SP2) and use a trusted connection. SQL Server runs also with Network Service identity.
Without granting explicit permissions, our webapps are able to query the DB.
How can this happen and which permissions does our app effectively have?