I think the best option is to get a security script written soecifically for his site. Could be an investment if there really isnt a solution out there for windows based servers.