title: How do I force to not use impersonation in IIS 7+?
body: <p>I am trying to force my web application to run completely as the AppPool User (Domain\UserForApp) and I correctly set the setting in IIS and everything runs fine and "System.Security.Principal.WindowsIdentity.GetCurrent().Name" returns the correct "Domain\UserForApp".</p>
  
  <p>However, when I tried to restrict the permissions of my web app directory to the bare bones needed:</p>
  
  <ul>
  <li>SYSTEM (full Access)</li>
  <li>Me (Full Access)</li>
  <li>Admininstrators (Full Access)</li>
  <li>UserForApp (Read)</li>
  </ul>
  
  <p>I could no longer load any static files.  So I downloaded Process Monitor to find out why and whenever it tries to access a static file, I get the following error:</p>
  
  <pre><code>ACCESS DENIED:
  Desired Access:     Generic Read
  Disposition:        Open
  Options:            Sequential Access, No Buffering
  Attributes:         RE
  ShareMode:          Read, Write, Delete
  AllocationSize:     n/a
  Impersonating:      NT AUTHORITY\IUSR
  </code></pre>
  
  <p>And as you see from the above IUSR doesn't have permissions so that is correct, but I just don't understand why its trying to impersonate anyway.  In my web.config file I have:</p>
  
  <pre><code>&lt;location path="" overrideMode="Deny"&gt;
      &lt;system.web&gt;
          &lt;identity impersonate="false" /&gt;
      &lt;/system.web&gt;
  &lt;/location&gt;
  </code></pre>
  
  <p>just to ensure that no one turns on impersonation, but it had no effect.</p>
  
  <p>It doesn't work in both Classic and Pipelined mode, but the error is slightly different.  In classic when viewing the images it just shows a <code>HTTP Error 401.3 - Unauthorized</code> page, and when using Pipelined it redirects to the login site.</p>