I finally got this fixed.

The problem was that the IUSR and IWAM accounts on the web server needed access to the data folder on the file server (a different box).

This problem was complicated by the fact that the file server has its own IUSR and IWAM accounts.

Because I did not want to take the risk of changing the system-given password for IUSR on the web server, I created a new user called "webuser" on both the web server and the file server with the same password on both boxes. I assigned this user as the anonymous account to the website in IIS Manager on the web server. I then gave this user the required permissions to the data directory on the file server. This allowed the website to access the data required.

Pain in the butt!