If you can go with RS 2008 they totally do away with using IIS. Precisely
because IIS is such a huge support burden.

One mistake I think you are making is touching IIS directly. I never, ever
touch IIS. I installed RS which added its websites to IIS. I then use RS
role based security for all security and I let RS handle everything. You
should not ever have to touch IIS directly. I have used RS since the Beta
for RS 2000 and I never have had to do anything with IIS other than stop and
restart it (some problems with RS 2000 when it came out). With RS 2005 I
never ever deal with IIS at all. It just works.

You say folder permissions in the IIS site and the SQL Servers C drive.
Again, do not touch this. The only time any folder permissions I have seen
need to be touched is when dealing with Oracle data providers. Otherwise,
again, no need to do so. Use Report Manager to control permissions.