If you're planning on having a separate application pool per site then this is pretty straight forward to lock down using Application Pool identities.
When you create an application pool for a site set the worker process Identity (Advanced Settings -> Process Model) to
Create your website and specify its dedicated application pool.
Navigate to the site's Features View and open the Authentication applet. Make sure Anonymous Authentication is enabled then select and edit this property (or right click on Anonymous Authentication). Change the Anonymous user identity to "Application Pool Identity".
In explorer browse to the site's web folders and open the Security tab for the folder properties. Add the application pool identity by specifying
IIS AppPool\[ApplicationPoolName] e.g.
IIS AppPool\BobsBlogSite. Set the permissions you want to grant to the site i.e. Read/Write/Execute etc.
One thing to watch is that wherever you locate each site's website folders e.g.
C:\Websites where you might have
C:\Websites\site2 etc, remember to break any ACL inheritance so that you don't accidentally leak access via group membership such as
IIS_IUSRS if they've been added to
We usually remove all rights at the
C:\Websites folder with the exception of
For further reading see the following articles:
Application Pool Identities (IIS.NET)
New in IIS 7 - App Pool Isolation