rights for application pool Identity account

I have to change my web apps that use Sql Server 2005 to use Windows authentication instead of Sql Server auth.

On my test server, for the asp app (Giving) I'm using the domain\giving account (a special domain account which has access to the sql server db) as the anonymous user (under Directoy Security, Edit, Enable anonymous access).

 For the asp.net app (Processing) I created an application pool, assigned domain\giving as the Identity. Granted domain\giving rights to %SystemRoot%\Microsoft.NET\Framework\versionNumber\Temporary ASP.NET Files; %SystermRoot%\system32; $SystemRoot%\Temp; the default user profile directory; the web application directory; and %SystemRoot%\Mecrosoft.NET\Framework\verson. (The required ACL list I found also had %SystemRoot%\assembly, but it has no Security tab.) And configured the web app to use the custom pool.

This works fine on the test server. In production, when Giving redirects to Processing, I get an access d ...