Lock down a group to a folder

Hi everyone,

I am trying to lock down a group to a single folder called "Media" in C:\inetpub\wwwroot So far I have created a group called "LockedDown", created a local user called "IIS_IUSR", removed user from "User" group and added user to "LockedDown" group. I gave LockedDown read and execute permissions in the inetpub folder but I want to explicitly deny the LockedDown group permissions everywhere else. I keep getting an error when trying to deny access to the system32 file and then does not apply the permissions.

Is the fact that I have removed the IIS_USER user from the "Users" group enough or is it better to explicitly deny access everywhere I do not want the user to go? If it is better to deny the access then what is best way to accomplish this or am I on the right track?

I appreciate everyone's time.

Thanks

Well, actually, no guide. But, the idea was inspired by this guide: Lockdown by group using Local Computer Policy without Active Directory

That is why I figured I would come and ask all of you very helpful folks if I am doing the right thing. I know that after XP permissions had changed a bit. I know that IIS is installed and "works" because I can type my dyndns address and see my index of files. I just want to make sure that is all that everyone else can see/access.

With Patwhatsthat's information, I guess my approach is at least partially incorrect because I do not want to break inheritance from it's parent folder. That would be a nightmare or impossible to correct. So, is there an easier way to lock users into only accessing only one folder? I guess I am wanting to do the same thing that chroot does in Linux. I just thought this was the best way in Windows to get this accomplished.