IIS 7 requires the following user accounts to have read access to your webroot: IIS_IUSRS and IUSR. For a typical ASP.NET application IIS_IUSRS may also be granted write permissions for specific directories or files. However, if impersonation is used (e.g. fastcgi.impersonate is recommended for PHP), then the IUSR account must also be granted write permissions to the resources.

The following command-line actions will set the permissions correctly (note: replace C:\inetpub\wwroot with your webroot):

ICACLS "C:\inetpub\wwwroot" /Grant "IIS_IUSRS":(OI)(CI)M
ICACLS "C:\inetpub\wwwroot" /Grant "IUSR":(OI)(CI)M