My heart, it breaks!
It doesn't take much to lock down IIS.
Security Operations Guide for Windows 2000 Server
Of course, UNIX systems are also vulnerable as Bush2000 has pointed out numerous times but that doesn't seem to get the press about Microsoft.
Companies that hire incompetent web managers get hacked no matter what.