In Windows 2003, Microsoft has eliminated this part of the attack surface by locking down IIS. Although Windows 2003 comes with IIS, IIS isn't part of the default installation. If you don't need to run IIS on your servers, you don't need to do anything different with Windows 2003—you can just enjoy the extra disk space and memory you'll have in IIS's absence.
If you need a dedicated Web server, you can install IIS as an option. (You can also use Windows Server 2003, Web Edition, which installs and enables IIS by default.) After you install IIS, you'll find that its functions are initially restricted to foil exploit attempts. Under Windows 2003, the IIS Lockdown Wizard, which Microsoft released for Internet Information Services (IIS) 6.0, is applied. The wizard's default configurations aggressively limit connection timeouts and other configurable settings—a dramatic change from earlier IIS releases. In addition, IIS 6.0 can serve only static Web pages by default. You must reconfigure IIS if you want to support dynamic content. During an upgrade from Win2K to Windows 2003, Windows 2003 disables all aspects of IIS. . . .
)
)
Ben Meijer June 17, 2004