Or you could run the M$ IIS lockdown tool.