Why am I getting a 403?

I've published a 

ClickOnce

 application.

The application downloads and installs properly from 

MyApplication/MyApplication.application

.

However, if they access 

MyApplication/setup.exe

 to automatically install the prerequisites and then run the application, they get a 

403

.

403 - Forbidden: Access is denied. You do not have permission to view this directory or page using the credentials that you supplied.

In Handler Mappings, 

cgi-exe

 is disabled. I've added a module mapping as follows:

Name: setup.exePath: setup.exeState:EnabledPath type: unspecifiedHandler:StaticFileModuleEntry type:LocalAccess required by the handler:ScriptSpecify verbs to be handled: all verbs[Unchecked]Invoke handler only if request is mapped to...

The application pool has 

Full Control

 on the folder and runs on the 

Application Pool Identity

.

What am I missing?