Didn't realize you can make machine.config settings per web site, and also prevent web.config's from various web sites/dirs from overriding those settings.

815174 - How To Make Application and Directory-Specific Configuration Settings in an ASP.NET Application