It is not a permissions problem. Since IE hangs while trying to access the CGI file, it is clear that the system call to notepad.exe is indeed working. If you check the list of programs running under the 'Processes' tab of the Windows Task Manager while accessing the CGI, I'm confident you will see notepad.exe listed. Since notepad does not exit until the user exits it intentionally, the 'hanging' you are experiencing is notepad waiting for the user to exit notepad.
External programs you execute while within a CGI script are run hidden -- you will not see the graphical interface for the program; in this case, the notepad window. I'm wondering whether you are expecting the notepad window to appear on the server computer that is running the CGI process, or if you're wanting notepad to run on the client's computer.
If you are looking to have the notepad program run on the server side, then the best method I can think of is to have the CGI script add a command to a database to execute (such as 'notepad.exe'), and then write a separate server-type script that will execute these commands outisde the CGI server process. If you're expecting notepad to run on the client's side, you'd have to have the client download the program first.