I'm running a server with 60+ sites on it. Right now all those sites are running under the IUSR account. Looking at the folder security the IIS_IUSRS group has access to all the site's folders. This presents a problem in that, if one site is compromised, all sites are compromised as the one user can reach all the files.
Is it possible to setup each site to run under its own user and if so, how do I set up the sites in such a fashion?
I'm running Windows server 2008 R2 Service pack 1 (build 7601) with IIS version 7.5.