db connection uses an anonymous logon instead of the domain user
Reading the manual I found something relevant:


  For example IIS 7, in its default configuration, has anonymous
  authentication enabled with built-in user account IUSR used as a
  default identity. This means that in order for IIS to execute PHP
  scripts, it is necessary to grant IUSR account read permission on
  those scripts. If PHP applications need to perform write operations on
  certain files or write files into some folders then IUSR account
  should have write permission to those.


And iis.net has the following relevant information:


  This built-in account does not need a password and will be the default
  identity that is used when anonymous authentication is enabled. If you
  look in the applicationHost.config file you will see the following
  definition:
  
  &lt;anonymousAuthentication enabled="true" userName="IUSR" defaultLogonDomain="" /&gt;
  
  This tells IIS to use the new built-in
  account for all anonymous authentication requests.


Hope it helps