I have inherited an application in which the Developer created a bunch of application pages (ASPX) which get deployed to the _layouts folder. The user is directed to these pages throughout the application like so:
http://<siteurl>/_layouts/15/ApplicationName/EditForm.aspx
However, not all users can access this. When we moved to UAT, users receive the following
403 forbidden
The only fix I have found is to give Everyone 'Full Control' on the Site in IIS. I don't think this is acceptable change for our Production environment.Is this an issue I can fix during deployment instead of making a manual change to Permissions? If not, will converting these Application pages to Visual Web Parts (ASCX) resolve the issue?