Windows 2012/IIS 8 + ASP.NET MVC Applicaiton 403.14 (Forbidden) - The Web server is configured to not list the contents

I have a very simple MVC 4 application I'm trying to deploy to a Windows 2012 server.

Inconsistently, when navigating to the root of the web application (http://localhost/app), it returns a 403.14-Forbidden:

Detailed Error Information:

Module:            DirectoryListingModule
Notification:      ExecuteRequestHandler
Handler:           StaticFile
Error Code:        0x00000000
Requested URL:     http://localhost:80/test1/
Physical Path:     c:\apps\test1\
Logon Method:      Negotiate

The web application is:

• Is a very vanilla VS2012 MVC4 Intranet template -- with only a tweak to a label to prove things were working.
• runs in an Integrated v4.0 application pool
• setup to use Windows authentication
• application pool has a custom AD Identity assigned (so it can gain access to a SQL server)
• application pool identity has read permissions in the c:\apps\test1 folder in which it is running
• It's an MVC4 application, targeting .NET 4.0 currently -There's no default document in an MVC4 application (like a default.aspx), as there shouldn't need to be one.
• I don't want to enable directory listings (as that's not the real error).
• Installed: Roles / Web Server (IIS) / Appliation Development / (.NET 4.5 Extensibility, Application Initialization, ASP.NET 4.5, ISAP Extensions, ISAPI Filters, WebSocket Protocol)
• Works locally on my machine in IISExpress on Windows 8
• Has configured in web.config: <modules runAllManagedModulesForAllRequests="true" />
• is set to precompiled during publish

When I change the precompiled option to false, the web application does not fail (in my testing at least, it seems to work consistently).

The reason I say it's inconsistent is that I've seen it work, then I've published, and the error returns. I can't find a pattern to the issue (and right now, I haven't been able to get it work again, at all).

The 403 is returned from a local or remote web browser.

I've had trouble finding a solution that isn't intended for older versions of Windows (like suggestions to reinstall ASP.NET which won't work on Windows 2012).

I really don't know what else to try.

Just spotted "custom AD Identity" in there.

1. make sure the new user actually has rights to read the file-system path even if there isn't anything in there.
2. make sure the new user is in the IIS app group so it can talk to the metabase
3. Check if kernel-mode auth is configured then depending on that:
   1. (if so) check that setspn doesn't have extra records
   2. (if not) consider bumping NTLM up above Kerberos in your auth negotiate list to see if that fixes the issue.

2012 is new enough that I don't know its error quirks but those are pretty all good places to start when getting 403 forbidden.