LocalHost denied with IIS_IUSRS set correctly

Using a WIndows Server 2016 VM

If I select Edit Permissions / Security from right mouse click on Default Web Site  - I seeIIS_IUSRS (MYVMNAME\IIS_IUSRS ) with

these 3  allow(checked) on Read & Execute, List folder contents & List folder

When I select Default web Site from the IIS manager and then browse *:80 (http)  or localhost

I get Access is denied.Description:An error occurred while accessing the resources required to serve this request. You might not have permission to view the requested resources.

Error message 401.3: You do not have permission to view this directory or page using the credentials you supplied (access denied due to Access Control Lists). Ask the Web server's administrator to give you access to 'C:\inetpub\wwwroot'.

I changed the web.config at wwroot to   <identity impersonate="false" />

but still nothing.

How can this be - that the  IIS_IUSRS can have permission and yet be denied. What other user can it be ??

Help please !!!  Thanks