Follow those links below and your iis server will be almost 100% secure.

http://ccso-staff-nts.cso.uiuc.edu/s...20security.htm

http://windows.stanford.edu/docs/IISsecchecklist.htm

http://www.iisfaq.com/default.aspx?View=P207&P=134

http://www.microsoft.com/windows2000...wn/default.asp