I have an app that uploads files into a unc directory that everyone has permission to upload to.
 
The interface uses a proxy webservice that call another webservice. (this is done for security purposes and works fine in all otehr instances) he proxy webservice runs as a speciifc useraccoutn that gets verified on the end point webservice);
Once the file is their the application calls the proxy webservice(which calls the webservice that controls this upload direttory) and removes the inherited permissions and applies specific permission to the file so that it can no longer be accessed by a specific usergroup.
This second webservice also runs under a specific system acount that has full control to the directory in question.
The webservice webmethod  uses impersonation initially to verify that the call is coming from the parent webservice but once that occurs it stops impersonating so that it can run ...

Go to the complete details ...