IIS or IIS_IUSRS permisions so that PHP can write

Question

I'm running IIS 8 on a virtual machine (Windows Server 2012 Datacenter) in Azure. I have installed WordPress and its dependencies using the Web Platform Installer 4.6

I have trouble when WordPress needs to write files from its admin console. I've added the ftp details to the file C:\inetpub\wwwroot\blog\wp-config.php and that works fine. But whenever WordPress tries to write a file from its management web page, for example to create a child theme or to upload media I got an error (e.g. 'failed to upload due to an error' or 'Target child theme directory cannot be created. This is probably a permission error'.)

I can fix this using EvilDr's idea of adding permissions to the IUSR account. But I am nervous about this since it seems that IUSR and should only have access to precisely what it needs; it should never be given access to anything else.

Is giving IUSR read Modify, Read & execute, List folder contents, Read, and Write permissions for the WordPress directory C:\inetpub\wwwroot\blog and its subfolders the correct and safest way to get WordPress working on IIS 8?

Answer 1

Giving NETWORK SERVICE write permission to the folders that WordPress needs to write to should do the trick.

UPDATE: NETWORK SERVICE will also need Read & execute, List folder contents and Read permissions.

EDIT: Thought I'd add the file/folders etc.. for completeness:

/wp-config.php
/wp-content/       (recursively)