I'm training some high school students interested in OS security (specifically, Windows Server 2003/2008), and though I've gone over a lot of the "in-theory" stuff, some hands on would be great. They're interested in learning about common security points in the OS (autorun, BHO's, Windows hooks, email, IIS/web sites, and the like).
What types of harmless applications can I install that they can find? (Stuff that won't actually harm our network, but auto-runs, embeds itself into browsers, pops up messages, anything else you can think of).