Maybe try running Firebug for Firefox (then go to the "Net" tab) or hit F12 in IE and look at the HTTP calls behind the scenes. Sometimes there is valuable info there showing the exact headers being sent and received. Invaluable debugger tool if you ask me.
Otherwise, the fact that you say you "hardened" CF already could mean a lot of things are on lockdown with permissions, etc. You may want to undo a few of the variables you already hardened until you achieve success, then ramp back up (for example, turn Directory Browsing back on and see if you can "see" the docs on the root). It's all about eliminating variables. Perhaps post a screen shot of your CF settings summary? Are you running any URL Rewrite mods, or a separate URLScan utility?
It's also beneficial to run Failed Request Tracing as Anit pointed out, and enable it for 404 error. This is an option under your site in IIS. Anyway, it really does sound more like an IIS issue than a CF issue based on my experience. But I would also try Anit's other suggestions if you are still at a loss.