1. Separate Files, Databases and Web Process
    1. Files
      1. Basic Model: place them in an own virtual drive. But never on drive C:\
        This improves your security in scenarios where security issues related to relative paths can't switch drives. 
      2. Advanced Model: Here it should be on a dedicated, shared file server (Windows Share).
        This gives you flexibility to scale up and out, and you can easily build File-Server Farms or IIS-Farmsor. You can also easily migrate to newer Windows Web-Servers when needed.
        We recommend a dedicated Window File Server for file services, since it allows you to also run standard anti-virus and makes permission management easier. 
        Avoid using Linux based NAS solutions, as it will make security, operations, backups and anti-virus much more difficult.
    2. Databases should be on a dedicated shared DB Server. 
      This also allows scalling in all directions and simplifies backup management. 
    3. Web Services (IIS) should be on dedicated Web Servers which only do Web Services. 
  2. Service Identities: All should be best-practice Application Pool Accounts 
  3. Run everything in Virtual Machines
    the AD, DBs, File and Web Servers. This gives you maximum flexibility and is state of the art in 2020