Why does a new application pool identity have write access?

Question

I am running IIS 8.5 with PHP (various versions) via FastCGI. Impersonation is on in the PHP config for FastCGI. The app pool is set to use the App Pool Identity. In fact, if I actually specifically deny access to write to a file, it behaves accordingly, however, by default it seems that all files are writable to my site.

Viewing effective permissions says that my Application Pool Identity (IIS AppPool\PoolName) should have no permissions at all assigned. Is there some default account that the App Pool Identity inherits from that I need to adjust to prevent write access by default. Everything I read seemed to indicate that the App Pool Identity should default to read only access to the virtual folder that the application is assigned to, but this doesn't match observed behavior (specifically, PHPBB3 complains that the config file is writable and without specifically setting write access, I can upload files via the forum).

What could be interfering with the permissions or is my understanding of the intended default behavior incorrect?

Answer 1

I did some more digging and was finally able to come up with an answer for this. It appears that there is a setting that got applied that made files modifiable to "Authenticated Users". Breaking inheritance and removing this permission solved the issue.

Apparently it is included in the Users group as well as the Authenticated Users group to ensure it has access to load dlls and such. I found this answer on SO that was very helpful in understanding this.