icacls C:\inetpub\wwwroot\mysite\ /grant:r "IIS APPPOOL\mywebsitepool":(OI)(CI)(RX) guarantees that new files & directories put into this folder inherit the permissions that were set for the parent folder. More details on IIS7 Application pool isolation
Read More...