We are hosting a number of DotNetNuke domains on a single server.  All sites are being hosted on a single instance of DotNetNuke.  Whenever we create a new domain, we use the following procedure:

(1) Create a child portal for development (i.e. www.ourdomain.com/ourclient)

(2) Develop the site, get appropriate approvals, etc

(3) Add the URL for the site to IIS (we use the HELM control panel to do this part)

(4) Update the Home Directory in IIS to point to the single instance of DotNetNuke installed on the server (i.e. c:\inetpub\wwwroot\ourcomain\wwwroot\dnnprod).

(5) Ensure that the website is using .NET 2.0

(6) Using Windows Explorer, we add the user that is dynamically generated (either by HELM or IIS, I'm not sure which) to the permissions for DNN folder (again: c:\inetpub\wwwroot\ourcomain\wwwroot\dnnprod).

At this point, our website is up and running.  But it's step #6 that is the problem - we did not find this in any documentation for DNN anywhere.  Is there something on our server that is causing a problem here?  Is this a "best practice"?  Should we be concerned about security?

Any other general comments on how the above process can be tweaked to follow "best practices" (i.e. easier setup, sites that are more secure, sites that load faster) would be very much appreciated.