Question : IIS6 security/user permissions for multiple websites

I currently have an IIS6 server with just one website configured using the default iusr_machine account.  I now want to add a second website but I'm not sure if they should both be using the same iusr_ account, for example if someone managed to gain access one website would they then be able to access the other site as well?

If so how do I create separate accounts for each site?

Answer : IIS6 security/user permissions for multiple websites

Your best bet will be to set the application pool identities to seperate accounts, for each website.

The IUSR account will make the initial hit on the website, and when it calls the asp/asp.net page, a mixture of the ASPNET local account and the application pool identity are used to execute the script.

You can then restrict each website or location to where the scripts/files reside to the specific account you set the application pool to run under.

This should then prevent any possibility of website A accessing or executing any object in Website B's folder, as it won't have rights.