Windows Server folders losing IIS permissions after reboot / .NET Framework upgrade?

Question

We recently have had issues with a few Windows Servers losing file/folder permissions.

Invariably this happens to be a website folder used by IIS, and it is ApplicationPoolIdentity, Network Service, or a domain-wide service account.

One of the times was after we upgraded .NET Framework from 4.5.x to 4.7.1, which then caused a reboot.

The other times there may have been a reboot, but no .NET Framework upgrade.

I'm not much of a Windows Server guru myself, but looking for things our Ops team could investigate, as I'd quite like to go to them with suggestions.

So far I've got:

1. Finding out which account lost permissions on the second server failure.
2. Finding out whether that server had rebooted.
3. Checking the website logs to see how soon after a reboot or other work we started to get HTTP 500 errors.
4. Whether any registry changes have been made (these are all VMs which I'm aware we were going to apply for Meltdown performance fix to in the registry).

I've run .NET Framework upgrades dozens of times, including to 4.7.1, without this occurring, however currently this is facing the blame.