We are running a 2016 server with shared websites, the sites location is in a folder c:\domains\ each acct has its own folder with its subfolder wwwroot where they run their webs from, installing node on this seems to require that the iusr group has full permissions to the domains folder. Surely this is a security risk which could allow other sites to then traverse the folder structures ? What rights or setup would be needed in a case like this.   If I dump the users folder into the root and set the website up to use this user1 folder and give iusr grp full permission it works fine. But this is not how our folder structures work in the cp.
Plse advise