Avoid the ISAPI module ESPECIALLY if you are planning on working with PHP4's session handling features. The ISAPI module still has bugs in it and it seems the CGI (PHP.EXE) version is better tested at this point.
I've been working on some security scripts involving session management, and though I'd much rather use the ISAPI module for all its purported benefits (faster, doesn't load/unload memory with each invocation in the same manner, etc.), I only run the CGI version at this point. Just my 2.2 cents worth. :-)