A: Important security measure: be sure that the users who have anonymous web access do *not* have remote logon permission, nor belongs to a group that does... "Everyone" should have no permissions on the server, period. "Guests" should have local logon, read to public html, read/execute on scripts (with execute only set in IIS), and write where absolutely necessary (with major file auditing turned on).
