Recommend steps to improve Windows server security and performance

Give me a quote for hardening 2 Windows 2008 servers. What I want is to look them over and make recommendations for improved security and performance. I am not convinced that they are configured them the way I requested. We occasionally get attacked (for example a Morpheus attack) and the server does not go down, but it becomes very sluggish for a while, then recovers. The services we offer are currently only available in the US, so one thing we might do is only allow access to US IP addresses. Increasing RAM might help also, as might a hardware or software firewall. I am looking for a list of recommendations, starting with lowest cost/best return and going up from there. You would have full access via Team Viewer ## Deliverables 1) Complete and fully-functional working program(s) in executable form as well as complete source code of all work done. 2) Deliverables must be in ready-to-run condition, as follows (depending on the nature of the deliverables): a) For web sites or other server-side deliverables intended to only ever exist in one place in the Buyer's environment--Deliverables must be installed by the Seller in ready-to-run condition in the Buyer's environment. b) For all others including desktop software or software the buyer intends to distribute: A software installation package that will install the software in ready-to-run condition on the platform(s) specified in this bid request. 3) All deliverables will be considered "work made for hire" under U.S. Copyright law. Buyer will receive exclusive and complete copyrights to all work purchased. (No GPL, GNU, 3rd party components, etc. unless all copyright ramifications are explained AND AGREED TO by the buyer on the site per the coder's Seller Legal Agreement). ## Platform Windows 2008