That being the case, every website on a server that wishes to run its own DNN, will also require it's own separate folder for the code. This renders the default "C:\DotnetNuke" a moot point and probably not even a good idea. Installing the DNN code within the folder structure for the respective website(s) probably makes more sense, especially if website admins already have appropriate permissions set for those folders.

The tricky bit is that DNN seems to require Write permissions for the Network Service account. I'm not sure that's a very good idea, but maybe I'm worried about a non-issue.

I'm guessing that it is probably a bad security pratice to make the DNN folders browseable and readable, although I don't know for certain how IIs handles that if the folder is also a virtual directory target.

This suggests that integrated windows authentication might be the best choice of security, handling DNN changes and SQL connection. That should minimize server/user administration. Potentially, on a large DNN installation, a user group might be justified, if there are multiple administrators.

Lots of things to consider here! Is there a document (or good book) that delves into the security best practices peculiar to DNN, or would a generic dotnet security guide be good enough?