IISLock is not needed with Win2003 becuase all of the feautures a built into Win2003.  I am pretty sure URLScan is not needed unless you just want to have an extra layer of protection.  Both of these utilities were written to make Win2000 more secure and are not needed on a Win2003 server if you know what you are doing.  And the comment about Win2003 being more secure out of the box is an accurate statement, but just like anything else if you choose to install/enable certain features on installation you can make it less secure but that is the choice of the installer.  When we install Win2003 we use the default install where very little is enabled so out of the box it is very secure.  The more you enable the less secure it will be.

Jason,

Okay, you got me there, but is does state that you should change the password for these 2 accounts.  Although some users do not change default passwords like they should (eveident by the number of blank sa passwords for SQL Server that still exist).  Catch 22, since even if it was not on the first page of the installation, it is easy to find the default passwords for these accounts in the forums.

I got a good laugh from your response..........

Good suggestion, can you please enter it as a feature request in our Issue/Feature DB at http://support.dotnetnuke.us.