Mmm, wait, what version of apache are you using?
I just noticed you're using Order allow,deny. The new directive is the require, but I don't know exactly what version released it. Try this for the directory block:
Alias /sources "D:/5"
Options Indexes FollowSymLinks Includes ExecCGI
Require all granted