Thank you for the input;

Actually, no we aren't; this is nothing to do with access to files (although
we are using the identity to provide access to the database, but that's a
few steps past the "Service Unavailable" failure).

All we are doing here is assigning identity to the app-pool to achieve a:
true application-isolation, b: allow for trusted access to the database, and
c: move the credentials outside of the visibility of the web application
(specifically, outside of web.config; even encrypted, the details are
transparent to anything inside the application).

Note that this should (by all accounts) work just fine; it has worked on
every server we have tried, and now it is failing as we attempt to implement
on the live system (d'oh!). Obviously something is breaking it, but we don't
know what (yet); a vanilla install with all patches, changes etc works fine.

Marc