By default, the anonymous user account that IIS is using will only have read access, which is pretty much what one wants. There are 2 places where one can modify this
in the windows filesystem properties accessed through Windows Explorer->right click->Properties->Security->Advanced Here you can modify the folder properties for the IIS user account on the specific folder and it's contents
Through the IIS Internet Services Manager widget ->Directory Security
Basic security ideal would be to leave the anonymous user settings as found and create a seperate user account for your script to use. Set the website to require authentication and supply username password with your script.
Ultimately you'll have to buy a book as the whole issue is far too complex to answer here.