OK so in IIS8 on Server 8, the application pool identity is now recommended.

QUOTE "Worker processes in IIS 6.0 and IIS 7 run as NETWORKSERVICE by default,..However, a problem arose over time as more and more Windows system services started to run as NETWORKSERVICE.
This is because services running as NETWORKSERVICE can tamper with other services that run under the same identity."

I resolved this web.config access issue (creating sub-portals or upgrading on a site moved to IIS8). 

So in IIS8 observe that in the applications pool, the DefaultAppPool identity is ApplicationPoolIdentity
Your site is routinely configured to allow control by the application through networkservice, this is in the dnn install docs.
So to modify this for your dnn site, in IIS do: site/properties/advanced/app pool and then update to (for example) DefaultAppPool

Then in (your dnn site) folder, properties, security, edit.
assign (for example)
IIS AppPool\DefaultAppPool
OK and give it full control, apply, OK

==
ref1 = http://learn.iis.net/page.aspx/624/application-pool-identities/
ref2 = http://technet.microsoft.com/en-us/li... 

=

QUESTION : All the foregoing is OK so far, but I haven't worked out how to find an IIS CUSTOM identity in the sitefolder/..security/ dialogue.

I tried with creating a  "Managed service account in the format domainname\accountname.
Important : leave the password blank, and ensure that the account name has a dollar sign ($) at the end.
5.Under Application Pool Tasks, click Stop, and then click Start."

But then I couldn't find it in the assign security properties dialogue.

 Hi Chris,

And what happen when you are hosting multiple sites under the same DNN installation, should we create one Application Pool per site and assign their rights to all these application pool users to the same DNN installation folder like C:\DNNSites\ ?