I hesitate trusting anything "out of the box," even OpenBSD. Do a google.com search for articles on locking down Apache. Most of the articles will be Linux based, but a lot of the information transfers to Windows. Check out SANs reading room (free reg required :/), there are probably articles there, even for Windows.