To hardening IIS on windows 2003

1. Start IIS Manager or open the IIS snap-in.
2. Expand Server_name, where Server_name is the name of the server, and then expand Web Sites.
3. In the console tree, right-click the Web site, virtual directory, or file for which you want to configure authentication, and then click Properties.
4. Click the Directory Security or File Security tab, and then under Anonymous and access
control, click Edit.
5. Click to select the check box next to the authentication method or methods that you want to use, and then click OK.

Another type of hardening is based on the requesting host instead of on user credentials. You can limit access based on source IP address, source network ID, or source domain name. To configure this :

1. Under IP Address and Domain Name Restrictions, click Edit.
2. Do one of the following:
a) To deny access, click Granted Access, and then click Add. In the Deny Access On dialog box that appears, specify the option that u want, and then click OK.

The computer, group of computers, or domain that you specified is added to the list.
b) To grant access, click Denied Access, and then click Add. In the Grant Access On dialog box that appears, select the option that u want, and then click OK.

The computer, group of computers, or domain that u selected is added to the list.
3. Click OK.

Now quit IIS Manager or close the IIS snap-in.