Windows – Access denied after adding Active Directory group to shared folder

Presumably you're not playing around with "Deny" entries and you're just adding permissive "XXX Group / Read and Execute" type permissions (or something similar). If you are playing around with "Deny" permissions, stop doing so. Concentrate on granting permission to the resource. Anyone not named in the permission is implicitly denied access, so you don't need to put in any "Deny" entries (except in corner-cases which, typically, aries because of bad folder hierarchy and permission design).

After you've added the user to the group you'll need them to logoff and logon again for the updated group membership to take effect. Have you had the affected do that?

It's not necessary to have them logoff and logon again when you change the permissions, but the user's group membership list is only built at logon.

IIS's default operational mode is quite locked down. IIS doesn't use <computername>\NETWORK SERVICE. It uses <computername>\IUSR_<computername>, which is a member of the <computername>\Guests group. If the web page you're trying to access on the IIS server instead is requesting authentication, it will instead attempt to use those credentials to authenticate. If the files it's accessing are executable scripts, then instead it uses IWAM_<computername>. I don't remember offhand the group membership of that.

What you want to do here isn't very easy to configure over a workgroup. You'd have to set up an account on the remote machine with the same username and password that the IIS system is using. You can use a script to hopefully determine the IIS user account's password, but I don't know if IIS changes that periodically or if the script doesn't function on newer versions.