As a learning experience I'm setting up (and trying to harden) a Windows 2008R2 web server.
My web sites are stored on a separate partition and are organized as below:
/domains /somedomain.com /logs /wwwroot /anotherdomain.com /logs /wwwroot
I've removed the default permissions for the "Users" group from the "domains" directory.
Here are the permissions for /domains
D:\Domains NT AUTHORITY\SYSTEM:(OI)(CI)F BUILTIN\Administrators:(OI)(CI)F CREATOR OWNER:(OI)(CI)(IO)F
Each web site is configured with a separate application pool running under AppPoolIdentity.
I've granted modify rights to the "wwwroot" for the appropriate application pool user and read permissions for the anonymous user:
D:\domains\somedomain.com\wwwroot IIS APPPOOL\somedomain.com:(OI)(CI)C NT AUTHORITY\IUSR:(OI)(CI)R NT AUTHORITY\SYSTEM:(OI)(CI)(ID)F BUILTIN\Administrators:(OI)(CI)(ID)F CREATOR OWNER:(OI)(CI)(IO)(ID)F
Is there anything else that I am missing regarding the directory permissions?