IIS 8.5 – Disable PHP Upload

To restrict PHP files execution in your upload folder when using IIS on windows server, you just need to upload a web.config file in your “upload” folder with below mentioned content:

<?xml version="1.0" encoding="UTF-8"?>
<configuration>
    <system.webServer>
        <handlers>
            <clear />
            <add name="StaticFile" path="*" verb="*" modules="StaticFileModule,DefaultDocumentModule,DirectoryListingModule" resourceType="Either" requireAccess="Read" />
        </handlers>
    </system.webServer>
</configuration>

For more detailed explanation, just check here: http://www.wptricks24.com/disable-php-files-upload-folder-wordpress-iis

This is a very nice article for same situation you are facing.