Hi,
I checked the problem a bit. Probably you do not have enabled anonymous authorisation in OpenREM IIS website. Please open IIS, find Website on left pane and click twice, then click Authorization twice and check whether Anonymous authorization is enabled. If not, just enable it on right pane and I think that's it.
I checked the problem if we change something in local_settings.py in Database field- we have got Error 500. If we not set "allowed host" we have error 400. Just for my and your curiosity ;)
I am not sure Ed, but deleting IIS_IUSR users from allowed users in folder mentioned in installation guide haven't changed anything in OpenREM work. Or I haven't get it yet.
Best regards,
Mateusz Mirowski
Lodz Poland