This is what I have had on my FAQ section for quite a long time and if you did a search on these forums you will find a lot of threads regarding this subject.
Security
If using .NET Framework 1.0
- the {Server}/ASPNET user account must have Full Control of the root application directory ( this allows the application to create files/folders )
If using .NET Framework 1.1
- the {Server}/NetworkService user account must have Full Control of the root application directory ( this allows the application to create files/folders )
For more secure options do a search, I believe there has been more said on this but I can't chase it down right now.
Hope this helps a little...
Tom
http://www.dnnfaq.com
http://www.websplus.net
http://www.sdarchery.com