Scanning is one piece of the pie. Products like nmap will do a port scan and products like Nessus and Qualys will tell you what they detect with respect to surface area. However, the first place you should start is with a server baseline.
As the name implies, it is the baseline settings you expect your server to have. This includes things like the audit policy with respect to events, what your local security policy sets for permissions, etc. Once you have that baseline, you have something to hold all your servers to. And it makes sense to have multiple baselines, dependent on role. For instance, in the Windows Server 2003 Security Guide, there are different baselines for domain controllers versus member servers.
With a baseline in hand, you'll want to either use your own custom tools (scripting and some free tools) to verify the baseline or you'll want to use a 3rd party tool specifically designed for that, such as Symantec's (formerly BindView's) Control Compliance Suite. Do the scan periodically, check the results. The reason this is important is that there are things which a vulnerability scanner won't report on (such as how you having auditing configured) because it's designed to detect vulnerabilities. But server security involves the configuration, as well.
And with the baseline scanner, you'll want to pair it with the vulnerability scanner. It may also be a good idea to use another tool like a patch management or inventory management tool to make sure your server is kept patched up. The latter also ensures unexpected programs don't get installed without your knowledge.