There you go again: Attributing flaws in IIS to Windows. You do realize that IIS is a server-based web server, right? You might as well talk about Apache, if you're going to talk about IIS.
You don't want to do that. If you take a W2K server with IIS and compare it to basic GNU/Linux with Apache, set up to be only a Web server, the Windows installation will have far more vulnerabilities.