Understanding Security in IIS
Because of the seamless integration with IIS Express, you may not realize what happens under the
hood, and what security settings are in effect when you browse pages in your site. To use resources
in your site, such as ASPX files, Code Behind files, the database in the App_Data folder, and the
images in your site, your web server needs permissions from Windows to access those resources.
This means that you need to configure Windows and grant access to those resources to the account
that the web server uses. But what exactly is that account? The specific account that needs permission
depends on a number of factors, including the version of Windows, whether you run your site
under IIS or IIS Express, and on a number of settings within IIS.
In most cases, however, you have only two scenarios to consider: using IIS Express or the full version
of IIS as your web server.