Yeah, I agree with not using iis, we all know the security issues. But I think he was just going to use it internally, so in that case it would be fine.