Assuming that you want the uploaded files to be served as static read-only content:

Inside your root web.config (which can't be overwritten by users), use this (as suggested by Javier G., but with allowOverride=false):

  <location path="upload" allowOverride="false">
    <system.webServer>
      <handlers accessPolicy="Read" />
    </system.webServer>
  </location>

Or this (as suggesteed by LazyOne, but with allowOverride=false):

  <location path="upload" allowOverride="false">
    <system.webServer>
      <handlers accessPolicy="Read">
        <clear />
        <add name="StaticFile" path="*" verb="*" modules="StaticFileModule,DefaultDocumentModule,DirectoryListingModule" resourceType="Either" requireAccess="Read" />
      </handlers>
    </system.webServer>
  </location>

If you don't use allowOverride=false, anyone can upload a web.config in your open folder, and override your handlers configuration, so that they will be able to run scripts again. See this link for exploit example.

Assuming that you want the uploaded files to be served as static content (or else you could just save the uploads outside the root folder of your application):

Inside your root web.config (which can't be overwritten by users), use this (as suggested by Javier G., but with allowOverride=false):

  <location path="upload" allowOverride="false">
    <system.webServer>
      <handlers accessPolicy="Read" />
    </system.webServer>
  </location>

Or this (as suggesteed by LazyOne, but with allowOverride=false):

  <location path="upload" allowOverride="false">
    <system.webServer>
      <handlers accessPolicy="Read">
        <clear />
        <add name="StaticFile" path="*" verb="*" modules="StaticFileModule,DefaultDocumentModule,DirectoryListingModule" resourceType="Either" requireAccess="Read" />
      </handlers>
    </system.webServer>
  </location>

If you don't use allowOverride=false, anyone can upload a web.config in your open folder, and override your handlers configuration, so that they will be able to run scripts again. See this link for exploit example.