Why not give ASPNET write permission? Many of the admin pages let you modify the Connection Strings and other settings, so you'd need write access to save it.

I don't like to have the ability to edit the ConnectionStrings because it's too risky in case a hacker might get access to it.

I think we'd be better off to just remove all the references to code that tries to write to the config files, and pull out the edit options for these items in the pages.

Eric