NETWORK SERVICE or ASPNET.
I created a new user account for the asp.net impersonation, added necessary rights to the protected folder but was still receiving the same "Access denied" exception. Adding the permission "Log on as a batch job" for the user account solved the problem. It seems that Windows uses the batch-queue to perform I/O operations while accessing encrypted files. This only holds if files are accessed under asp.net. Win-Forms applications don't require this permission to access encrypted files.
*Steps* to solve the problem:
- Open Control Panel
- Administrative Tools -> Local Security Settings -> User Rights Assignments
- Find the policy Log on as a batch
- Add your user account/group into it