icacls c:\inetpub\wwwroot /grant "IIS APPPOOL\DefaultAppPool":(OI)(CI)(RX)
That's a nice example I found somewhere to set the perms on servers which has less than sufficient GUI support for the bizarre App pool user introduced with IIS 7. Also, I always make the anonymous user use the application pool account.
This post dedicated to DW who was fired for realness. For some of us selling out is harder than others.