Where are the SMTP settings saved in IIS7/Win2008?

There are a couple solutions. If you explicitly set the pickup folder in code then it doesn't need to be gotten from the metabase and you don't need to worry about the permissions. If you control the code, that's the easiest solution.

However, if you have a lot of users that may want to get the pickup folder automatically, then you'll need to grant the extra permission.

Since it's safe to expose read-only access to the pickup folder path property, the easy solution is to grant the IIS_WPG group access. cscript Metaacl.vbs “IIS://localhost/SMTPsvc” IIS_WPG RE

To answer your question on where it is, SMTP wasn't ported to the new system in IIS7. It still uses the old metabase settings in c:\windows\system32\inetsrv\metabase.xml. You manage it with IIS 6 manager.