[Bush2000]

You mean like the one you don't have to apply if there's physical security for the system, as is for most server farms? I don't know enough about these particular bugs, do you have to reboot after applying the patches?

Most hacks occur by insiders -- not external users. I'm not surprised that you wouldn't know this -- or care.

Then from the point of any user except for places where a Windows expert has taken hours to create a new group, it's a flaw.

Again, you show your ignorance. There are widely available tools which make creating a user with a custom rights mask no more difficult than point and click.

[antiRepublicrat]

Most hacks occur by insiders -- not external users.

Do you count ILoveYou, SQL Slammer and Sobig in those statistics, or do you treat each as one instance?

There are widely available tools which make creating a user with a custom rights mask no more difficult than point and click.

I didn't know that, but I'm not surprised at others making up for Microsoft's laxity. Same with the IIS wrappers we use. We always made our own accounts.