Secure SQL Server + IIS 6.0 Setup - System DSN Problem

Greetings all,

Please allow me to describe my setup briefly and then I will jump into my problem/questions. I am trying to setup a shared hosting/DB type environment in a secure manner. I have two Windows Server 2003 boxes where Machine 1 is the DB server (MS SQL Server 2005) and Machine 2 is the web server (IIS 6.0). The web server may ultimately have 5-6 different customers (web applications/domains) on it.

In order to keep an exploit/poor code in one customer's application from accessing the files of another, the server is being setup so each website instance runs with a different low-privileged domain account (in Domain Guests). For example, for Website 1, the Directory Security will be setup so it runs with DOMAINIUSR_website1 and for Website 2, the Directory Security will be setup so it runs as DOMAINIUSR_website2. Both of these accounts are in the Domain Guests group and no other groups. This was chosen so that the DB used by each websites on the SQL Server could have read/write permissions granted to the appropriate user. On the web server the SYSTEM DSN is setup to access each database. This way if there is a DB setup with permissions for IUSR_website1 and it gets called by IUSR_website2, access will be denied. If I ran each website instance as the same user, they could in theory still called this DSN and access someone else's database.

Now here is the problem I get. First, the website access works just fine with it setup as the Domain Guest user account. However, when I go to the called the System DSN for DB access I get this error:

---------

Microsoft OLE DB Provider for ODBC Drivers error '80040e4d'

[Microsoft][SQL Native Client][SQL Server]Login failed for user ''. The user is not associated with a trusted SQL Server connection.

/login.asp, line 7

--------

Line 7 of login.asp is as follows:

objConn.Open "DSN=DSN_CTO_SQL"

--------

So it appears there is something that is failing here. For troubleshooting purposes I have taken that IUSR_website1 account and placed them into the Domain Users group instead of Domain Guests. This fixes the problem. However, it's not the most secure setup to run the web/SQL stuff as a Domain User. Any ideas on why it works fine if the account is in Domain Users but not with Domain Guests? I even went to the registry key for HKLMSoftwareODBC and gave DOMAINIUSER_website1 specific read permissions. This did not fix the problem.

Can anyone make a suggestion or know what the issue is? How are people running secure IIS 6.0 + SQL Server setups for shared environments?

Thanks

Steven