I am running IIS 8.5 with PHP (various versions) via FastCGI. Impersonation is on in the PHP config for FastCGI. The app pool is set to use the App Pool Identity. In fact, if I actually specifically deny access to write to a file, it behaves accordingly, however, by default it seems that all files are writable to my site.
Viewing effective permissions says that my Application Pool Identity (IIS AppPool\PoolName) should have no permissions at all assigned. Is there some default account that the App Pool Identity inherits from that I need to adjust to prevent write access by default. Everything I read seemed to indicate that the App Pool Identity should default to read only access to the virtual folder that the application is assigned to, but this doesn't match observed behavior (specifically, PHPBB3 complains that the config file is writable and without specifically setting write access, I can upload files via the forum).
What could be interfering with the permissions or is my understanding of the intended default behavior incorrect?