Apologies for the lame question, IIS isn't my long suit. I'm having trouble getting a new IIS 10 install on a new Windows Server 2019 box to serve even basic html pages. Everything I've tried gives the same error, "401 - Unauthorized: Access is denied due to invalid credentials". I've created the site in Application pools. The site itself has its identity set to ApplicationPoolIdentity, and its security tab shows the site itself in the list of users and groups, with all permissions checked except "special permissions". I see the same on the security tab of that directory in Windows Explorer. What am I missing?

check Authentication - do you have anonymous authentication disabled?

Thanks @foundeo yes it's enabled for the site.

the ApplicationPoolIdentity needs to have read permissions to the web root, and the web.config files, etc… each app pool identity has its own identity you can apply permissions with, or you can grab all IIS app pools with the IIS_IUSRS group - that could be the problem… you could also enable request tracing in IIS which will generate a really detailed file hopefully pointing you in a direction

Got it working. Right click Authentication > Anonymous Authentication, set that to Application pool identity, no more 401. Just to be clear, I haven't gotten to CF setup yet, just getting IIS itself going and right side up.