I am not sure what you mean by migrating users. The IUser account, being local only, would not need to be pushed into a remote server. If your applications crash while running in the low protection level, your entire web server will stop. If they crash while running in the other protection levels, the application should be restarted on the next request and static content will continue to be served without problem. Now the authentication for restricted viewing keeps prompting and won't let users in.
Users do exist on the local box.
Many times, the permission problem is on include or image files. You can also try enabling Basic Authentication and logging on as different users. You could also implement your own security filter. You've asked some great questions. Unfortunately, it's time to go.