How do I assign limited console program access to IIS 6?

Let's say I have a simple console program to fetch a list of files given the folder name. I want to call the console program using PHP code on a site that is running on a unique Windows user account (ie not the default web user account). Is there a way I can allow the Windows account access to the console program without giving it blanket access to cmd.exe? I'm working with IIS 6 on Windows 2003 Server.

Update:

Here's some code I've tried using popen()

$reg_cmd = '"C:\WINDOWS\system32\notepad.exe"' ;
$error = '';
$handle = popen($reg_cmd, 'r');

if (!$handle){
    $last_error = error_get_last开发者_开发问答();
    $error = $last_error['message'];
}
else{
    while (!feof($handle)) {
        $result .= fread($handle, 2096);
    }
}
pclose($handle);

$error ends up containing either:

popen("C:\WINDOWS\system32\notepad.exe",r) [function.popen]: Result too large

OR

popen("C:\WINDOWS\system32\notepad.exe",r) [function.popen]: No such file or directory

I've no idea why the error message is inconsistent. The results were even less promising using proc_open().

---

Can you use proc_open() instead of exec()?

From version 5.2.1 proc_open() no longer requires you to give access to cmd.exe.