I understand the difference between the IUSR account and the Application Pool Identity, but what I'm not 100% on is what the implications are of switching Anonymous Authentication from IUSR to the Applicaton Pool Identity.
The accepted answer to Is it possible to configure IIS to always default Anonymous authentication to use application pool identity?, amongst others, suggests that changing this by default will result in no issues, and I'm unable to find any documentation that suggests doing so is a 'bad thing.' (Hopefully that doesn't mean this is a dumb question.)
What the security implications of doing this? Or, What are the cases where one wouldn't want to do this?
(In my particular case each Web site has a separate application pool identity. Some sites have particular sections locked down via the built-in Forms Authentication or Windows Authentication. Shared hosting is not being used in any case. Almost entirely ASP.NET, but some sites may have Classic ASP or PHP.)
