As someone who has to keep tabs on several Windows servers, the best way to make sure everything is in order is through consistency and methodology. Basically, what you do to one, do to all (unless, of course, the needs are different for each machine).

One tool I have found to be very valuable is the Microsoft Baseline Security Analyzer. In a nutshell, this tool scans your computer for common security problems (settings) and checks installations of data applications (SQL, MDAC, etc.) for updates and vulnerabilities. From the article “How To: Use the Microsoft Baseline Security Analyzer“:

Microsoft Baseline Security Analyzer (MBSA) checks for available updates to the operating system, Microsoft Data Access Components (MDAC), MSXML (Microsoft XML Parser), .NET Framework, and SQL Server. MBSA also scans a computer for insecure configuration settings. When MBSA checks for Windows service packs and patches, it includes in its scan Windows components, such as Internet Information Services (IIS) and COM+. MBSA uses Microsoft Update and Windows Server Update Services (WSUS) technologies to determine needed updates. This Microsoft Update data source is obtained either directly from the Microsoft Update Web site or, if offline or in a secure environment, from an offline catalog file named Wsusscn2.cab.

It is not feasible for me to be an expert on all things Windows security, so this tool is very helpful in making sure servers are reasonably secured. The utility works on all versions of Windows Server and Windows Vista and is recommended for any Windows system administrators.