Allow network-only lockout for the Administrator account Normally, the Administrator account cannot be locked out if an attacker attempts to guess the password. Make sure the admin account has a very difficult to guess password and change it frequently. Prevent unauthenticated access to the registry The Registry Editor supports remote access to the Windows NT registry. This only allows users having an account in the domain or on the machine to access shares on the server. Logging enabled Logging is paramount when you want to see if your server is being attacked.
Samples are just that, samples.
They are not installed by default and should never be installed on a production server. This directory allows you to reset Windows NT passwords, it is designed primarily for intranet scenarios. It should be removed if this feature is not required or if the server is on the Web. Some COM components are not required for most applications and should be removed. Most notably consider disabling the File System Object component, however, this will also remove the Dictionary object.