IIS Server hardening

[Xenocide]

I was wondering if anyone had any experience of hardening IIS servers. Currently everyone on our box just has a directory in the inetpub directory called their domain name. We use filezilla server as FTP, everyone has their own user in there. Databases are just made up, each has their own user though.

It's when a site get's compromised (stty PHP code mainly) and the hacker (script kiddie :/) uses the script to add loads of index.html/default.html/.asp/.cfm/.php files all over the place.

What I was thinking is; each site gets a user on the windows box, that user is selected in IIS as the user in which anonymous connections are ran under. Their inetpub/sitename.com directory has write permissions for admins/system/siteuser and nothing else then hopefully it should limit damage a bit.

Anything else anyone can think of. Obviously use unix .

Boxes are mainly 2k3 with IIS6 although we'll be moving to 2k8 with IIS7. Is that any better? Any comments on that?

Cheers in advance.

[Xenocide]

Internal sites - we don't charge ourselves

[Xenocide]

Thing is we need to run PHP under CGI which sometimes requires write permissions :/.

Stupid stupid stupid setup really. It's what you get sometimes though.

Have you used urlscan before?

[Xenocide]

Some great pointers. Thanks everyone