My approach now is …
if ( preg_match( '~IIS/(\d+\.\d+)~', $_SERVER['SERVER_SOFTWARE'], $matches ) )
$version = $matches[1];
… but I have no experience with IIS, and after searching for a while I found no information how reliable that is. The server signature might be suppressed, or the pattern might be changed in older versions or by additional software.
Is it possible to detect the full correct IIS version with PHP? Maybe with the Windows only extensions? Are there any pitfalls I should be aware of?