KB Issue
When assigning a new identity to an AppPool, you may encounter the insufficient permissions error if the user assigned does not have the right to read from the wwwroot folder.
Issue Details
When assigning domain users the right to interact with a web server, you have to make sure they have the appropriate permission to access specific top-level folders. In this case, we are working with the wwwroot.
Assigning a domain user to an application pool (or AppPool Identity is not enough. Depending on what the web application needs to do, the required rights will vary.
In this article, we will go over how to recreate the subject error and then how to resolve it.
Recreate Issue
  1. In IIS - Application Pools
  2. Choose an AppPool and click on [Advance Settings]
  3. Choose [Identity] = Click on the ellipse button beside the [ApplicationPoolIdentity][...]
  4. Click on [Custom account] then click [Set...]
  5. Type in the: domainname\domainuser
  6. Type the password, then confirm it.
  7. Click [OK], then [OK], and then [OK] to close out of the [Advance Settings] dialog box.
    8. Go to the IIS Server you want to use to connect to this server, and choose Connect to a Server.
  8. Right Click on the [Start Page]
  9. Choose [Connect to a Server...]
  10. Type in the [Server Name]
  11. Click [Next]
  12. Type in user name: domainname\domainuser
  13. Then the password.
  14. Click on [Next]
    15. You should see the following message.
  15. Failed to connect
    There was an error when trying to connect. Do you want to retype your credentials and try again?
    Details:
    Filename: MACHINE/WEBROOT
    Error: Cannot read configuration file due to insufficient permissions.
    16. [Yes][No]
Resolve Issue
Make sure you assign the appropriate roles to the user inside of [Active Directory Users and Computers] on the DC (Domain Controller)
The list below is what we use in our Domain for all our users.
Copy these, and paste into the [Select Groups] dialog under: [Enter the object names to select] field
[CMD/Linux - ]
CFFCS | CarrzSynEdit: | CMD (Windows Command Prompt) | L (Linux) 
Administrators; DnsAdmins; Domain Admins; Domain Computers; Domain Controllers; Enterprise Admins; Remote Desktop Users; Schema Admins; Server Operators; IIS IUSRS

Click OK, [Apply], then [OK] to close out of the dialog.
Next, go into the web server's Web drive.
Example of mine:
G:\Inetpub\
  1. Right Click on [wwwroot]
  2. Choose [Properties]
  3. Click on the [Security] tab
  4. Click on the [Advanced] button on the bottom right.
  5. On the top of the dialog box, click on [Change] for the owner.
  6. Type in the domain user you set up with the permissions above.
  7. Click on [OK]
  8. Then click on [Apply]
  9. (Click OK on the question asked)
  10. Then click [OK], then [OK] again to close out of the wwwroot properties dialog.
    11. Go to the IIS Server you want to use to connect to this server, and choose Connect to a Server.
  11. Right Click on the [Start Page]
  12. Choose [Connect to a Server...]
  13. Type in the [Server Name]
  14. Click [Next]
  15. Type in user name: domainname\domainuser
  16. Then the password.
  17. Click on [Next]
  18. Click [OK] on the 'Certificate not the correct one for this server' message.
  19. Click on [Finish]
You should now be able to administer your web server from this server.