We had every website on one machine suddenly start returning 401.3 errors this morning. After much poking around we fixed the problem by changing the IIS Anonymous Authentication to use the application pool identity.
From the IIS logs, we know exactly when the website switched from 200 to 401.3 responses, and there was a vendor in the machine at the time. I have good reason to believe that the websites were using the IUSR previously, and that somehow, the vendor did something to remove IUSR from the IIS_IUSRS group, OR removed IUSR permissions. However, when I try to replicate on a sister box, I see that the website on the sister box is running under IUSR but 1) None of the directories have IUSR permission (just IIS_IUSRS) 2) The IIS_IUSRS group only has a SID as a member + the Default Application Pool Yet the website on the sister box is humming along just fine! How could someone remove IUSR permissions from the directory when they are not listed, or from IIS_IUSRS when the user is not listed?