I created a IIS website, the application pool name is testAppPool.

Then I run the following code in the website, obtain current user group permissions:

 WindowsIdentity winIdentity = WindowsIdentity.GetCurrent();

 if (winIdentity == null)
 {
     str += "Cannot get current user identity. Exiting...";
 }
 else
 {
     str += "<br/>Current machine name:t" + Environment.MachineName;

     str += "<br/>Current user name:t" + winIdentity.Name;
     str += "<br/>Current user authentication type:t" + winIdentity.AuthenticationType;
     str += "<br/>Current user SID:t" + winIdentity.User;
     str += "<br/>Current user token:t" + winIdentity.Token;
     str += "<br/>Token owner SID:t" + winIdentity.Owner;
     str += $"<br/>Current user has {winIdentity.Groups.Count} group memberships.";

     foreach (IdentityReference group in winIdentity.Groups)
     {
         try
         {
             NTAccount ntAcc = (NTAccount)group.Translate(typeof(NTAccount));
             str += $"<br/>    Group :  {ntAcc.Value}    【SID: {group.Value}】";
         }
         catch (Exception ex)
         {
             str += $"<br/>    Group :  【SID: {group.Value}】";
         }
     }
 }

I got this result like this:

Current machine name: SERVER-CAT
Current user name: IIS APPPOOLtest
Current user authentication type: Negotiate
Current user SID: S-1-5-82-2089961697-3881266625-4281627516-662015669-518872240
Current user token: 2080
Token owner SID: S-1-5-82-2089961697-3881266625-4281627516-662015669-518872240
Current user has 9 group memberships.
    Group :  Everyone    【SID: S-1-1-0】
    Group :  BUILTINUsers    【SID: S-1-5-32-545】
    Group :  NT AUTHORITYSERVICE    【SID: S-1-5-6】
    Group :  CONSOLE LOGON    【SID: S-1-2-1】
    Group :  NT AUTHORITYAuthenticated Users    【SID: S-1-5-11】
    Group :  NT AUTHORITYThis Organization    【SID: S-1-5-15】
    Group :  BUILTINIIS_IUSRS    【SID: S-1-5-32-568】
    Group :  LOCAL    【SID: S-1-2-0】
    Group :  【SID: S-1-5-82-0】

It contains the user group BUILTINUsers, and I found that IIS APPPOOLtest can access all disks, read and modify.

How can I remove the IIS APPPOOLtest account from BUILTINUsers group.

thanks very much.