Hmm - Xampp isn't using IIS
It's a typical Apache + MySQL combo so playing with IIS won't help at all. When using a Windows Server anyways you may change your setup to just use MySQL and as Webserver IIS + PHP as Isapi module.
Then setup IIS with directory permissions - like IP protection for "config.php" that only 127.0.0.1 can access it.
But - maybe thought about a managed server ? Just remember the worst case someone will abuse your server for sharing warez or even more bad things ?