Basically, I'm wondering if it's ever possible to get Windows servers secure enough to hold sensitive information. For example, if I had a firewall, web server, and MSSQL database server (used to serve up and store data entered through the website) - could i ever secure the system enough to host sensitive information?

Or would it have to be a UNIX/Oracle box?

Sorry for the terrible vagueness of the question, coffee hasn't kicked in yet

Maybe i am wrong but doesn't the Uk Government have a contract with Microsoft and only use's window's machine.
If you secure you network and keep up to date with all current threat's, patche's, and regulary perform audit's surely its the admin and user practice's that govern how good security is and not the O/S.Anyway that's my opinion.

Well the short answer is it all depends on the admin.

I agree. It depends on the admin (human) rather than the technology. Conversely, many unsecure Unix boxes litter the 'net. Does that mean Unix isn't secure? Nope.