Administrators who want to measure how well their Windows 2000 servers are secured will find a free security scanner from the not-for-profit Center for Internet Security a real help.
The Windows 2000 Level 1 Benchmark and Scoring Tool (at www.cisecurity.org/bench_ win2000.html) contains a security scanner (see screen), instructions on its use and detailed descriptions of how to fix any security problems it finds.
The tool scans the operating system in multiple ways: It checks for installed service packs and security hotfixes and inspects password and audit policies and other security settings.
Unfortunately, the tool runs only locally, and although it does scan for IIS patches, it doesnt scan for insecure IIS settings.
A Solaris Level 1 Benchmark and Scoring Tool was released in July and is also available at the Center for Internet Security Web site.