One of our web servers just failed PCI-DSS compliance because the vulnerability scan detected the OS was Windows Server 2003 Service Pack 1 (obviously very outdated!).
My question is how did the vuln scan detect this as I can't seem to find a way to source the same information without having AD access to that box (it's on a service providers network). Even with nmap, it only provides guesses to the OS version:
Aggressive OS guesses: Microsoft Windows Server 2003 SP1 or SP2 (99%)
So how do I verify this before sending a very, very angry email to our provider? If this is accurate, then I'd say this is negligence and my email tone to them won't be very good.
I have no login access to this box.