title: IIS_IUSRS and IUSR permissions in IIS8
body: <p>I've just moved away from IIS6 on Win2003 to IIS8 on Win2012 for hosting ASP.NET applications.</p>
  
  <p>Within one particular folder in my application I need to Create &amp; Delete files.  After copying the files to the new server, I kept seeing the following errors when I tried to delete files:</p>
  
  <blockquote>
    <p>Access to the path 'D:\WebSites\myapp.co.uk\companydata\filename.pdf' is denied.</p>
  </blockquote>
  
  <p>When I check IIS I see that the application is running under the DefaultAppPool account, however, I never set up Windows permissions on this folder to include <strong>IIS AppPool\DefaultAppPool</strong></p>
  
  <p>Instead, to stop screaming customers I granted the following permissions on the folder:</p>
  
  <p><strong>IUSR</strong></p>
  
  <ul>
  <li>Read &amp; Execute</li>
  <li>List Folder Contents</li>
  <li>Read</li>
  <li>Write</li>
  </ul>
  
  <p><strong>IIS_IUSRS</strong></p>
  
  <ul>
  <li>Modify</li>
  <li>Read &amp; Execute</li>
  <li>List Folder Contents</li>
  <li>Read</li>
  <li>Write</li>
  </ul>
  
  <p>This seems to have worked, but I am concerned that too many privileges have been set.  I've read conflicting information online about whether <strong>IUSR</strong> is actually needed at all here.  Can anyone clarify which users/permissions would suffice to Create and Delete documents on this folder please?  Also, is IUSR part of the IIS_IUSRS group?</p>
  
  <h2>Update &amp; Solution</h2>
  
  <p>Please see <a href="https://stackoverflow.com/a/36597241/792888">my answer below</a>.  I've had to do this sadly as some recent suggestions were not well thought out, or even safe (IMO).</p>