Miniimum Permissions for IUSR Account

By default, IIS 6 puts the special IUSR_ account into the
local Guests group. Unfortunately our standard installation environment
for Windows 2003 has a number of settings that are hostile to guest
accounts. Does anyone have a list of which of the following the special
IUSR account needs?

- Windows user privileges
- registry key access
- file system object access

If I could enumerate these I could make sure that the Guests group has
access to just the minimum set of objects and privileges needed for IIS to
use this account to run a web site, or alternately I could create a new
local group, assign it the required permissions, and move IUSR over to that
local group.

--
Will