I'd configured the settings below but I was still getting the same error when trying to change the identity of the new application pool using the UI:
'The specified password is invalid. Type a new password.'
- Local Users and Groups
- Added the Domain Service Account to the local group 'IIS_IUSRS'.
- Local Security Policy
- Added the domain service account to the policies:
- Access this computer from the network
- Deny log on locally
- Log on as a batch job
- Log on as a service
The method that worked for me was to ditch the UI and do it via the command line using appcmd.exe.
%windir%\system32\inetsrv\appcmd.exe set config /section:applicationPools /[name='APP_POOL_NAME'].processModel.identityType:SpecificUser /[name='APP_POOL_NAME'].processModel.userName:DOMAIN\USER_NAME /[name='APP_POOL_NAME'].processModel.password:PASSWORD
This method is described in the article:
http://technet.microsoft.com/en-us/library/cc771170(v=ws.10).aspx