I have moved my portal to W2003 and discovered that despite giving modify permissions to NETWORK SERVICE and ASPNET , users could not upload images. To make this work, I have had to allow read/write on the directory in IIS and allow write permissions for INTERNET GUEST in Windows Explorer - this seems very insecure-surely I must have missed something?