Irrespective of where the application is installed, if it is not configured properly, then it is of now use where or how you install the web-app. The recommended suggestion is to configure your application on a non-system drive, so that in case if there is a compromise, it doesn???t have access to system drive.