When deploying new web apps from Central Admin, I am finding that the permissions given to the IIS folders (under \Inetpub\wwwroot\wss\Virtual Directories\web-site-name) only allow accounts with Local Admin rights on the Web Front End server to access the site. Other users get a 403 error.
After a lot of investigation I discovered that newly created Web Applications do not give the Everyone group permissions for Read & Execute, List Folder Contents and Read on the _app_bin folder. All the working Web Application folders have this permission. Adding this permission makes the sites work.
Is my SharePoint installation somehow broken, or is this normal behaviour? We don't frequently set up new web applications in Sharepoint - I do not recall ever having to make this setting change in the past. I also can't find any documentation saying this is a normal step when setting up a new Web Application.
We are running Office Sharepoint Server 2007 Enterprise 64 bit updated to Service Pack 2 and June 2010 Cumulative Update (both WSS and OSS updates applied last June), on Windows 2003 (so IIS6) - could this be a bug introduced by one of the Sharepoint updates?
Does anyone know what the correct permissions are for Virtual Directory folders? Do I need to make any additional changes to make everything work?