WSUS 3.0 - are you using this? And what else are you doing to SBS 2003 R2 as best practices?

thanks!  That's 2 things to do to a new server (actually 3?).  anything else that's standard?!

upgrade wsus to 3.0
Configure WSUS (that's not on to do list)
Disable TCP offloading and RSS

and some other things I've been building:
Enable larger exchange store
Enable IMF
Create abuse mailbox (this was something that dnsstuff.com points out is a requirement for proper compliance with RFC 2142, although I rarely hear it mentioned: http://www.ietf.org/rfc/rfc2142.txt?number=2142)
Rename the administrator account and give it a long, complx password (since the administrator account doesn't get locked out, hackers try that one?  If the name administrator doesn't exist, that slows them down even more?'

what else!?  I know I am only scratching the surface!

Dont remove the administrator account. Just create a strong lock out policy. I set mine to 10 passwords and then a lockout for an hour. Your going to need the windows 2003 support tools. The rest of the install is group policy, DNS if it is a domain controller, DHCP if needed, etc and then setting it up as a file server or whatever your going to use it for. The SBS servers are really easy to configure and pretty much have a wizard for anything you want to do.

no, not remove the administrator account, just change it's name.  and I thought administrator account was exempt from any lockout

You can use Passprop.exe to set a lockout for administrator. I think it is in the windows support tools.

You can use Windows Small Business Server 2003 Best Practices Analyzer tool. http://support.microsoft.com/default.aspx?scid=kb;en-us;940439

If you have any other questions I will be happy to help, if else please close the thread.

I still feel there's loads of things that the BPA doesn't touch on (like increasing the size of the exchange store).  I have to make a new question for that though - that wasn't the intent of the question, which you did answer right away!  THANKS!

Great!