IIS complains about a locked section - how can I find out where it's locked?

I have this section in my web.config:

<system.webServer>
    <modules runAllManagedModulesForAllRequests="true" />
    <security>
        <authentication>
            <anonymousAuthentication enabled="true" />
            <windowsAuthentication enabled="true" />
        </authentication>
    </security>
</system.webServer>

IIS7 crashes and complains about the autientication section:

Module AnonymousAuthenticationModule
Notification AuthenticateRequest
Handler StaticFile
Error Code 0x80070021
Config Error This configuration section cannot be used at this path. This happens when the section is locked at a parent level. Locking is either by default (overrideModeDefault="Deny"), or set explicitly by a location tag with overrideMode="Deny" or the legacy allowOverride="false".

Config Source  
   69:  <authentication>
   70:    <anonymousAuthentication enabled="true" />

So the usual way to solve this is to go into %windir%\system32\inetsrv\config\applicationHost.config and unlock the section:

    <sectionGroup name="system.webServer">
        <sectionGroup name="security">
            <section name="access" overrideModeDefault="Deny" />
            <section name="applicationDependencies" overrideModeDefault="Deny" />
            <sectionGroup name="authentication">
                <section name="anonymousAuthentication" overrideModeDefault="Allow" />
                <section name="basicAuthentication" overrideModeDefault="Allow" />
                <section name="clientCertificateMappingAuthentication" overrideModeDefault="Allow" />
                <section name="digestAuthentication" overrideModeDefault="Allow" />
                <section name="iisClientCertificateMappingAuthentication" overrideModeDefault="Allow" />
                <section name="windowsAuthentication" overrideModeDefault="Allow" />
            </sectionGroup>

(alternatively, appcmd unlock config).

The weird thing: I've done that and it still complains.

I looked for Locations (MVC is the name of my website that's the root of all sites I'm using):

<location path="MVC" overrideMode="Allow">
    <system.webServer overrideMode="Allow">
        <security overrideMode="Allow">
            <authentication overrideMode="Allow">
                <windowsAuthentication enabled="true" />
                <anonymousAuthentication enabled="true" />
            </authentication>
        </security>
    </system.webServer>
</location>

Still it blows up. I'm puzzled as to why this happens. I cannot remove it from the web.config, I want to find the root problem.

Is there a way to get specific information from IIS which rule is eventually denying me?

Edit: I was able to fix this using the IIS7 management console by going to the very root (my machine) and clicking "Edit Configuration" and unlocking the section there. Still I'd like to know if there is a better way since I can't find the file it actually modifies.

Worked out these steps which fix the issue for me:

1. Open IIS Manager
2. Click the server name in the tree on the left
3. Right hand pane, Management section, double click Configuration Editor
4. At the top, choose the section system.webServer/security/authentication/anonymousAuthentication
5. Right hand pane, click Unlock Section
6. At the top, choose the section system.webServer/security/authentication/windowsAuthentication
7. Right hand pane, click Unlock Section