There were a number of problems with the Transition to IIS 7. Considerable debugging was required.

FIRST ISSUE RESOLVED:
Directory permissions for the IIS 7 application pool identity (the default was Network Service)
needed to be added so that the IIS application pool could have access to the physical path of the Website directory.

SECOND ISSUSE RESOLVED:
A line needed to be added to the ASP.Net application web.config file.
Child of <configuration>
After <system.web>

Added:
<system.webServer>
<validation validateIntegratedModeConfiguration=”false” />
</system.webServer>

Introduction

IIS 7 introduces many new security improvements from IIS 6.0. This document overviews these improvements with respect to Authentication, Authorization, SSL, Web Service Extension Restriction List and IP restrictions.

This article contains:

• Authentication
• How IIS 7 Determines the Authenticated Identity
• Authorization
• SSL
• Web Service Extension Restriction List
• IP Restrictions

Authentication

For ASP.NET application developers there had been, before IIS 7, two authentication models you needed to program against. These models were the IIS and ASP.NET pipelines. First, IIS would examine the request and perform its authentication routines and then afterwards pass it to ASP.NET so it could do a similar task.