We had couple of dedicated servers rented on 1and1 hosting. In past we had situation where our server has got compromised and intruders were able to hack into the Windows 2003 standard edition and been able to manipulate the server for malicious purposes.
Once it was compromised for sending out mass spam emails. (this has happened multiple times and after that we changed RDP port to other than default we did not have any other port than smtp, 80 and 443 + rdp, but even after change of our RDP port we have got hacked once)
Another Windows 2003 Ent edition was hacked which was hosted in our unmanaged co-location and was hacked by some Palestine hacker group just to show that server had been compromised and replace website/portal with their logo.
Now in both cases we have noticed that hackers were able to create windows user on the server and their login events were recorded in the security even log.
Now we have limited users and removed all old or unused users from the server but can anyone tell me that how can we stop and make Windows Server OS secure enough that some hacker could not remotely create new user and gain access to Windows system.