Gotta’ love Windows. The default user account of most Desktop OS’s will let anyone do almost anything.
The wordpress page where it walks you through setting up multisites is very vague on a couple of key issues. That would be one of them.
It clearly states “Create a blogs.dir directory under /wp-content/”