Data is sent over the network as clear text (unencrypted) when Basic Authentication is configured on Web Servers.
Windows is dangerously insecure when unpacked from the box, and there are a few things that you must do before you use it.