This built-in account does not need a password and will be the default
identity that is used when anonymous authentication is enabled. If you
look in the applicationHost.config file you will see the following
<anonymousAuthentication enabled="true" userName="IUSR" defaultLogonDomain="" />
This tells IIS to use the new built-in account for all anonymous
authentication requests. The biggest advantages are that you can:
•Set file system permissions for the IUSR account by using Windows
Explorer or any of the many command line tools.
•No longer need to worry about passwords expiring for this account.
•Use xcopy /o to copy files along with their ownership and ACL information to different
looks like your code changed it to app pool account identity which i presume was for maintanance? which is an old method, this account in iis7 replaces it as confirmed here:
The IIS_IUSRS group replaces the IIS_WPG group. This built-in group
has access to all the necessary file and system resources so that an
account, when added to this group, can seamlessly act as an
application pool identity.
IIS 7 and above also makes the process of configuring an application
pool identity and making all necessary changes easier. When IIS starts
a worker process, it needs to create a token that the process will
use. When this token is created, IIS automatically adds the IIS_IUSRS
membership to the worker processes token at runtime. The accounts that
run as 'application pool identities' no longer need to be an explicit
part of the IIS_IUSRS group. This change helps you to set up your
systems with fewer obstacles and makes your overall experience more
a very indepth and detailed explanation here: