SP2 did little to improve our system's practical security, leaving too many services and networking components enabled, bungling permissions, leaving IE and OE vulnerable to malicious scripts, and installing a packet filter that lacks a capacity for egress filtering....

The default security settings for Internet Explorer are hardly changed from the risky and confusing ones Microsoft has been urging on users for years. Here's what we found:

ActiveX Controls: run and script functions are enabled by default if the control is "marked as safe". Downloading signed ActiveX Controls is enabled (no prompt), and unsigned ones are disabled (no prompt). Binary and script functions are enabled. This is far too confusing: ActiveX should have a simple on/off toggle, and should be kept off unless needed for something useful like Windows Update.....

The home user is the one most in need of good security configurations and tools, yet the one least served by SP2. Windows may be easy to use, but it is extremely complicated and difficult to administer, especially for security, with a tremendous number of hidden functions and many complex configuration interfaces. It should be left to the professional admin to enable services and understand their dependencies, not left to the home user to figure out which ones are risky, and which ones can safely be disabled.