Wordpress on Windows 2008 IIS requires that you grant read permissons to the IUSR account and the IIS_IUSR account on the root folder. If you want to add attachments with your posts then you need to add write access to IUSR on the wp-content/upload folder.
If you want to be able to dynamic updates to plugins and such then you need to grant write access to the wp-content folder. I would recommend only granting write permissions to the wp-content folder when you are performing upgrades, and then remove the permission when you have finished.
I wrote an article about this on my blog after working through the same questions.