IIS 7 and later support a web.config file that works the same as .htaccess does for apache.
1. Just as .htaccess_root is provided, a web.config_root should be provided with eZ
2. the setup wizard should take current webserver in use when giving its security recommendation

Please find attached sample web.config file (same rules as .htaccess from 4.5 version)