What's the proper way to setup this account in SQL Server?

We're using Windows authentication on our network and to give any user permission in the database I have to grant it to the ASPNET account. This seems to defeat the purpose of using Windows authentication because anyone that opens the ASP.NET page will have those rights in the database even if they aren't listed as a user in the DB.

For example, I give read-only rights to the ASPNET account and even if I give an individual user db_datawriter rights, they still cannot write to the DB unless I grant the ASPNET account db_datawriter rights. Then anyone can save/modify the data.