Do NOT run Microsoft's IIS Lockdown tool after the installation of Neverfail Heartbeat. This can ONLY be done prior to installing Neverfail Heartbeat with IIS Server AM(X).
You must run IISLockdown on both Primary and Secondary servers, using the same settings as you go through the IISLockdown wizard.
If you are running the IISLockdown on an existing installation of Neverfail Heartbeat, then you will need to perform the install again.
IISLockdown creates new groups and assigns users to those groups. These changes cannot be replicated to the Passive server.
Note: You can secure IIS Server using Neverfail Heartbeat by simply stopping and setting to manual services not required prior to Neverfail Heartbeat installation.