A short pointer: IIS 6 will – by design – only serve .exe files if the following conditions are met:

1. The directory that is serving the executable(s) must NOT have “Scripts and Executables” permission
2. The .exe MIME type must be registered with IIS (it is registered, by default)

I’m writing this because I’ve been through this issue before, but forgot about the “Scripts and Executables” permission – one of those ‘duh’ moments. Maybe this will help someone else remember.