I have a intranet site running on IIS 7.5 with Windows Auth. If I don't share that folder with "everyone" then users are prompted with many login requests and it ultimately doesn't work at all. If the web directory must be shared, then that's fine. I'd just like to know. But it seems wrong to give everyone the ability to browse that directory. They can see all the content in windows explorer.
IUSR and IIS_USRS are already granted read permission to the web dir. Giving them write doesn't help. I'm using application user pass- through authentication for the site and Windows Authentication is the only auth method enabled.
So, is that just the way it is or is there another account that needs something there?