Thanks for this info Charlie. You pointed to some good places.
What I found that worked, was I needed to remove the Scripts directory from the Request Filtering (in IIS Manager) for the cfadmin site. This should help other people with a locked down server.
Do you know of any issues that might arise from doing this?