IIS 6.0 - PHP write access without IUSER write access

Question

We are using an IIS 6.0 server on a Windows 2003 machine. We need to allow PHP to upload Word documents to a folder on our website that can then be read by visitors to the site. We do not want to grant the anonymous IUSER write access. So, what is the best way to do this without compromising security?

Answer 1

You should make a service user and run the application pool for that site as the user. Then grant that user the permission to write to whatever folder you want. One way or another, someone is going to have to get write access, whether is the anonymous account or the service account.