what is the iusr account used for
IIS is able to impersonate the IUSR_<computername> account because the user name and password for this account are known by IIS. Before returning a page to the client, IIS checks NTFS file and directory permissions to see if the IUSR_<computername> account is allowed access to the file.