We are setting up our first Windows Server 2008 web server (previously we used Linux/Apache for all web servers), and I was hoping to get some helpful tips for setting it up and securing our installation.
We will have one web server and one database server (SQL Server 2008) to start, running IIS 7 (obviously I guess). All web pages will be SSL encrypted (i.e. https://).
You could check "Securing ..." articles from Microsoft. One example:
Securing IIS7 - Windows Server 2008 Security Guide
IIS.net contains MANY useful documents.
http://www.iis.net/search.aspx?q=security