Just found that SSLv2 is enabled in IIS 7.5 by default and to change it requires tweaking in registry. What is the design decision for it? Is there a disadvantage of disabling it?
It's enabled by default in Server 2008 R2 for backwards compatibility for really ancient client applications.
For most web servers, all client browsers support at least SSLv3; SSLv2 can be safely disabled.