title: Why do I need to add my application pool identity to the IIS_IUSRS group?
body: <p>I'm setting up a .NET v4.0 web application on a Windows 2008 R2/IIS 7.5 server that uses a domain account for the application pool identity.  When I access the site, I get the following error:</p>
  
  <p>The current identity () does not have write access to 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\Temporary ASP.NET Files'</p>
  
  <p>According to this: <a href="http://learn.iis.net/page.aspx/140/understanding-built-in-user-and-group-accounts-in-iis/" rel="nofollow">http://learn.iis.net/page.aspx/140/understanding-built-in-user-and-group-accounts-in-iis/</a> the identity of the worker process is added to the IIS_IUSRS group when the process starts.  This seems to work fine for the existing .NET v2.0 applications I have running on the same server (I have not had to add their domain account application pool identities to IIS_IUSRS group).  This does not seem to be the case for the first .NET v4.0 web application I'm setting up.</p>
  
  <p>Once I add the identity to the group, everything works fine.  I suspect something is not configured correctly that is forcing me to do this.  I would like to understand this before rolling out more sites/servers.</p>
  
  <p>Thanks in advance for your help...</p>