I have a site hosted using IIS on a Windows Server 2012 R2 server. The application is configured to use an application pool that uses the NetworkService account as the application pool identity. The site is also configured to use the pass-through authentication and both basic and Windows authentication (as per the developers specification).
This application is supposed to be deployed so that the end-users account is used to verify that they can access the application (a user list is kept in the applications database), and all files in the WWW root directory are accessed using the NetworkService account. However, it appears that the end-users account is being used to access files in the WWW directory. This only works for users who have access to the server: granting a specific user access to the WWW directory allows them to run the application. All other users receive a 401.5 error originating from the IsapiModule.
How do I configure this server so that it will access the files on disk using the application user identity and not the passed-through account used for authentication?