Running a fairly large host here in the UK I am well aware of .NET security in the shared hosting environment. The real problem is that .NET code in the Application_Start event is running before .NET enables impersonation of the IIS website user as per our .NET configuration, thus meaning the code in Application_Start runs as the Application Pool user.

Now whilst you and Microsoft say the "recommended solution" is to run each web site in its own Application Pool - its not a recommendation made very well as it is pretty generic. There is no way that a low cost budget host can afford to give every single website its own Application Pool - I have spoken to the Microsoft UK Hosting Manager about this and he agrees.

Now, there are two ways forward:

1) Have Microsoft fix the problem in .NET so that impersonation is applied on all executed code.

2) Implement a simple fix in DNN so that the code in Application_Start is actually executed later in the main application code. This would be the better option, would suit everybody and doesnt rely on us having to wait months for a Microsoft fix.