We had a .NET (1.1) application installed on a webserver by a third party on a Windows Server 2003 SP2 server. What I've discovered is that in order to get their application to work properly, instead of tracking down all the permissions errors for their application, they made the ASPNET and IUSR account...