iis 8.5, how to set visitor permission only on current site?

Question

the www_root folder, i set the full access permission with these user / user group:

• administrators
• system
• iis AppPool\DefaultAppPool

the site in iis, basic settings, connect as -> 'iis AppPool\DefaultAppPool'

the site in iis, authentication, Anonymous authentication, enable, edit -> 'Application pool identity'

the AppPool of site using: DefaultAppPool, Advanced Settings, Identity -> 'ApplicationPoolIdentity'

now the site can not launch with error: '500 Internal Server Error'

all i want is when user visit site, the visitor can only reach the contents of current site, but can not reach the contents of other folder (by the script funciton in site), thank you.

---------------------update------------------ here is the screenshot of error screen.

Answer 1

After many attempts, i fixed the problem by change:

the site in iis, basic settings, connect as -> 'iis AppPool\DefaultAppPool'

to

the site in iis, basic settings, connect as -> Application user (pass-through authentication)

then the site works, and fso.FileExists(Server.MapPath("../test.txt")) return false in below folder structure (which means the visitor can only reach the contents of current site):

d:\
  |_www_root
      |_ default.asp (contains function of fso.FileExists(Server.MapPath("../test.txt")))
  |_test.txt

----------------- for site with access database-----------------

you have to set 'iis AppPool\DefaultAppPool' account to 'c:\windows\temp' folder with read AND write permission, otherwise it will occur error of 'Microsoft Access Database Engine 80004005'

---------------------------for iis+php site-------------------------

you have to set same full access permission with below user / users group as site folder for the folder contain php.exe:

- administrators
- system
- iis AppPool\DefaultAppPool

Answer 2

User (regular Windows User) must belong to IIS_USRS and only to this group.

Run AppPool (stored under Application Pools node), by using this user Run your Website (stored under "Sites" node), by using this user Set Read/Execute permission to wwwroot folder

That should be enough.

----------------- for site with access database-----------------

you have to set 'iis AppPool\DefaultAppPool' account to 'c:\windows\temp' folder with read AND write permission, otherwise it will occur error of 'Microsoft Access Database Engine 80004005'

That is wrong statement.