Permissions on IIS

[The_KiD]

we have a server hosted, which has a database in a sub folder on the site.

I need to set the permissions so people on the website can read and write to the db using the site, but not so they have full access to the db file.

At the moment they can read/write to it, but if they browse to the folder itself they are able to download the whole database.

I am not a web admin and have limited knowledge of IIS and cannot for the life of me work it out.

 

[riddlermarc]

The most secure solution would surely be to move the db out of inetpub\?? to somewhere else, then give IUSR_machinename permissions to access it?