What security precautions and configurations are needed for a production web server?

I am standing up a win server 2008R2 x64 and will be hosting a few public facing websites with IIS 7.5. I am relatively new to administering a production web server and am curious as to what precautions I need to take to prevent my server from being compromised. Is MSE sufficient for antivirus? Any other configurations I should look at? I realize this is somewhat of an open ended question because it can depend on my specific situation, basically I'm looking for beginner advice.

From serverfault Tone

• I don't think you can run MSE on a server.

  Once you've got the required roles installed, configured, and tested, run the SCW.

  Tone : SCW looks like what I need. I went ahead and ran it. And I did not choose to allow RDP connections I think and now I'm locked out of my server (whoops). Not a huge deal as it is a new/learning server and I can rebuild if needed, but I would like to not have to. I should have console access to the machine - is there any run the SCW from CLI? Or perhaps change the RDP setting via CLI?

  joeqwerty : That I don't know but a nice thing about the SCW (if you have console access to the server) is that it allows you to roll back the previous operation, so you could undo the changes that SCW made.

  Tone : doh! too late. not a big deal though, only took me an hour to rebuild (loving me some rackspace). This is good reference for later though. thanks.
  From joeqwerty

• I'm from the linux world. However these rules are kind of universal:

  • Close all port besides those really needed with a firewall (80 and 443 are the only ones that should be visible to the public)
  • Keep the number of server roles to the minimum (try not to convert a WEB server into a web+AD+DNS+...+Database server)
  • Keep the software up to date
  • Backup (and test backups from time to time)
  • Document
  From facha