DNN requires the application pool user - or the network service user, depending on your server version to ALWAYS have full access to your root folder and all folders below that.

Depending on the life cycle of any single visit to your site any number of files in many different locations may be accessed by this user.

For example - say you login as the administrator/host and use the restart server option to restart your application pool, this is done by effectively re-saving your web.config file - an action which triggers asp.net to restart the currently running application - in this case dnn.

The same goes for actions like installing a new module, in which case dnn needs to be able to write to pretty much any folder that such an install could demand, from /bin/ to /app_code/  to /desktopmodules/ or the /Portal/ folder.

Also depending on the type of modules you have installed - any folder in your hosting may need to be accessed - though as a rule most modules stick to /portal/0/ or a sub folder of their own install inside /desktopmodules/  BUT thats not something that they MUST do.

Now with regard to the concept of security risk - the application pool user - is a permission that is specific to a given application pool - and as such granting that user full access rights - ONLY grant the DNN CORE and MODULES access rights - the end user does not get any rights that are not granted by the dnn registration system.

Westa