iis security: An application has been purchased that requires the IUSR_ and IWAM_ accounts
be placed in the local administrators group in order for the application to
work.

It means that if someone can get your web application to something
unintended (e.g. there is a bug in the application), then the attacker can
take control of your entire server.

Alternatively, if an attacker can get your IWAM or IUSR users to run some
code (e.g. by uploading a webpage, and then requesting it) then they have
full control over your server as well.

Cheers
Ken

[quoted text, click to view]