I have a new windows 2008 R2 configuration and I just published a web site to it. I set it to an application pool that uses this identity: ApplicationPoolIdentity and played around with the NTFS permissions giving IIS_IUSRS read access, and it still let the web site create files. So I tried removing even their read access, and they can still open pages on the site.
What am I missing here? How can I lock the permissions down in windows 2008 (IIS 7.5) to only allow users to write to specific folders and only read specific folders?
I really don't want to have to create a local account and give my app pool that account to use...