>A company runs a web site on Windows Server 2008 Standard. The web site contains several ASP.NET applications running under Anonymous Authentication (default for IIS). The applications are visited by a few dozen users on the Internet, outside of the LAN.
>
>How many CALs and what kind -- User or Device -- have to be installed on the server for not to be chased by the Microsoft for license violations?

http://social.technet.microsoft.com/Forums/windowsserver/en-US/54d7080b-357a-4399-9970-5a046aa76a05/cal-information-for-iisweb-server?forum=winservergen

specifically, call the toll-free number and speak to a specialist. MS licensing is so complex there are people who spend their lives trying to figure it out: http://www.microsoft.com/en-ca/licensing/training_accreditation.aspx