Just saw that version 3.0 of the Microsoft Security Assessment Tool (MSAT) was released. The prior version was released back in 2004.
MSAT is a risk-assessment application designed to provide information and recommendations about best practices for security within an information technology (IT) infrastructure.
It walks you through a long series of multiple choice questions in the areas of Infrastructure, Applications, Operations and People. It generated a 43 page report for me when I completed it – complete with best practices, findings and recommendations.