How to close those ports

Port 21 is FTP, 25 is SMTP (for email), 80 is HTTP and 443 is HTTPS, you need to have these ports open in order to send/receive mail, browse the web etc.

Thanks. So nothing to worry about? In the past when I worked with ISA-server grc-reported that I operated entirely in stealth modus.

What else is running on the server? I'd guess Exchange and IIS?

Yes, the standard package.

You should close port 21 (FTP) incoming unless you need to allow incoming FTP traffic.  FTP is very insecure and vulnerable to hacking. Unless you don't have a hardware firewall in place, that would be preferable and more secure than using the Internet connection sharing capabilities of your SBS server.  However, if you don't have a hardware firewall, then you can close the ports you need to close by editing the firewall configuration.

Thanks TheoRichel.
Cheers !
--Rob