The script is run under a certain username, which I've logged in as and been able to create the file manually, with all the permisions created automatically.

Can an ID be set up in someway so as to not be allowed to create permission for a second ID through IIS?