Securing iis 8 nt permissions

view story

http://serverfault.com – I have an win2012/IIS 8 webserver which I am trying to secure. I want to isolate each site/user to their own folder as best as possible. I have moved the websites to "c:\sites\mysiteA\", "c:\sites\mysiteB\" and so on. I have setup separate user accounts for each website and set minimum permissions for the folder (including removing the "Users" group.) removed non essential users from other data folders like the MSSQL database folders. However "c:\" and all system folders have by default read/execute access for the "Users" group. I have read that recent editions of IIS are secure out of t (HowTos)