Turns out IIS asp.net features not installed on a clean server.

Module AnonymousAuthenticationModule
Notification AuthenticateRequest
Handler StaticFile
Error Code 0x80070021
Config Error This configuration section cannot be used at this path. This happens when the section is locked at a parent level. Locking is either by default (overrideModeDefault="Deny"), or set explicitly by a location tag with overrideMode="Deny" or the legacy allowOverride="false".

https://serverfault.com/a/685544

This solved my error on Windows Server 2012, IIS 8.5. Should work for other versions too.

1. Go to Server Manager, click add Roles and Features
2. In the roles section choose: Web Server
3. Under Security sub-section choose everything (I excluded digest, IP restrictions and URL authorization as we don’t use them)
4. Under Application Development choose .NET Extensibility 4.5 and ASP>NET 4.5, both ISAPI entries
5. In the Features section choose: NET 3.5, .NET 4.5, ASP.NET 4.5
6. In the Web server section choose: Web Server (all), Management Tools (IIS Management Console and Management Service), Windows