Access denied while activating publishing features

Not so long ago I encountered a strange error on a sharepoint configuration: a site collection administrator was getting "Access Denied" errors while trying to activate the publishing site collection features.
As his account had nearly every security right available in that company (way too much) this error was very strange to get.
After some research I tried switching the application pool account of the portal to that of the central administration and apparantly this did the trick.

So the access denied was not received from the actual users account, but from the account the user was elevated to: the identity of the application pool (found in ISS > Application Pools > Your Pool > Properties > Identity).
My guess is that this account did not have enough access to the content databases to perform this action.

Note: This sharepoint configuration was installed by the book of the Microsoft configuration and I've heard other reports of configuration problems when doing this.
I'm no configuration expert so I don't know what right exactly was missing or where in this guide it is going wrong.

Problems assigning AD groups to sharepoint sites

While doing a project this week we got a really bizar issue that users couldn't acces their sites anymore.
The situation was as followed:

• User user1 was in group group1
• Web web1 had unique security (not inherited from its parent) and group1 had Read rights to that web

There was one problem though: every night there was as batch job that recreated all the AD groups for our company, instead of updating it.
This resulted in the groups still being added on the web, but the internal SID they referred to did not exist anymore.. thus blocking all the users from their sites.

Possible solutions:

• Update the AD groups instead of deleting and recreating it prevents the problems from ever occuring
• Update your security on the sharepoint webs through a timerjob after the AD creation batch has complete (not recommended!)