Here's a pretty comprehensive set of instructions on hardening Windows Server 2003 and IIS 6.0. Now that I've recently installed Windows 2003 and have it running on my home network (semi-exposed), this is important to me.
It looks like it'll take a while to get through the whole list - there's 27 steps there, and I'm not sure I'll do all of them.