Hi Martyn,
VSS read/write user rights are applied per folder, not per file, so that
cannot be used.
But, you can open the VSS's History dialog for web.config and pin the file
to the latest version, and users will not be able to checkout the file, so
they won't accidentally checkin a modified version. (Of course, they can
unpin, checkout, modify, checkin, re-pin if they really want to update it)

Signature
Alin Constantin
This posting is provided "AS IS" with no warranties, and confers no rights.
> Hello
>
[quoted text clipped - 4 lines]
> Thank you in advance
> Martin