Server 2008:
Use dcomcnfg.exe to add group IIS_IUSRS and permit local activation and local launch. Adding IUSR won't work!! (Or possibly some more detailed IIS7 configuration is necessary, what I didn't want to find out)

Server 2008 Core:
use "dcomperm -al {5EDEC473-39E0-43F6-A234-1947071721C8} set IIS_IUSRS permit level:ll,la". Dcomperm is included as sample in "Windows SDK for Windows Server 2008". You'll have to build the executable yourself.