Anonymous permissions to CMD.EXE

[Freddy2]

Ping graphs are empty if I don't give permission for IUSR_xxx to CMD.EXE. On the other hand, it's a security risk 1a. - Is there a way to make it run without this setting? Which element needs access to CMD.EXE ? I think the pings I'm using run fine without CMD.EXE (Advanced ping 1.3, TPing).

Thank you for suggestions!
[Cacti 0.8.6.i unpatched, win2003, php 5.0.5.5, iis6, cygwin1.dll ]

[Freddy2]

Additional info:
Auditing cmd.exe, I found that for my particular installation (ping graphs), it's only the web access that calls cmd.exe. Neither the scheduler nor RRDTool make use of IUSR_xxx calling cmd.exe. Note my SchTask runs under system account. Maybe, this helps to answer my question.
-fk
[Cacti 0.8.6.i unpatched, win2003, php 5.0.5.5, iis6, cygwin1.dll (1005.21.0.0)]