1. IIS 7: The Administrator’s Guide
Alexis Eller
Program Manager
Microsoft Corporation

2. C#, VB.NET… Microsoft.Web.Administration Failed Request Tracing
Deploy...
Server Modules
ASP.NET on IIS7
Centralization
Manage...
IIS Manager
Command Line… appcmd
Scripting… WMI
C#, VB.NET… Microsoft.Web.Administration
Troubleshoot...
Detailed Errors
Failed Request Tracing

3. IIS6 Request Processing
Monolithic implementation
Install all or nothing…
Authentication
NTLM
Basic
Anon …
Determine
Handler
CGI
Static File
ASP.NET
ISAPI
PHP …
Send Response
Extend server functionality only through ISAPI…
Log
Compress
Deploy...

4. IIS7 Request Processing
Server functionality is split into ~ 40 modules...
Authentication
Authentication
NTLM
Basic
Anon
Authorization …
Modules plug into a generic request pipeline…
ResolveCache
Determine
Handler
CGI …
Static File
ExecuteHandler
Modules extend server functionality through a public module API.
ISAPI … …
UpdateCache
Send Response
SendResponse
Log
Compress
Deploy...

5. Many, Many Modules Deploy...
Install, manage, and patch only the modules you use…
Reduces attack surface
Reduces in-memory footprint
Provides fine grained control
… replace core server components with custom components…
Deploy...

6. Installing IIS7 Deploy... 2/16/2019 12:00 PM 6
© 2006 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries.
The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

7. TIP Deploy... Consistently install the same set of modules… Avoid:
503 “Service Unavailable”
[module is enabled but not installed]
Application doesn’t work as expected
[web.config references a module that isn’t installed]
[unexpected module conflicts with custom module]
Deploy...

8. IIS6 ASP.NET Integration
Runtime limitations
Only sees ASP.NET requests
Feature duplication
Authentication
NTLM
Basic
Anon …
Determine
Handler
CGI
Authentication
Forms
Windows
Map Handler
ASPX
Trace …
aspnet_isapi.dll
Static File
ISAPI …
Send Response
Log
Compress
Deploy...

9. IIS7 ASP.NET Integration
Basic
Two Modes
Classic (runs as ISAPI)
Integrated
Integrated Mode
.NET modules / handlers plug directly into pipeline
Process all requests
Full runtime fidelity
Anon
Authentication
Authorization
ResolveCache …
aspnet_isapi.dll
Static File
Authentication
ExecuteHandler
Forms
Windows … …
ISAPI
ASPX
UpdateCache
Map Handler
Trace
SendResponse
Compress … …
Log
Deploy...

10. Migrating to Integrated ASP.NET
2/16/ :00 PM
Migrating to Integrated ASP.NET
Deploy... 10
© 2006 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries.
The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

11. Replicate Content and Config
Main IIS configuration file (applicationHost.config)
Built-in “IUSR” account, no more machine specific SID’s
Simple file copy, no command line tools required
…watch for machine specific data like IP’s and drive letters
IIS config  web.config, XCOPY with application
Deploy...

12. Centralize Content and Config
IIS config  web.config, centralize on file server
File System:
Client Side Caching (CSC)
provides a local disk cache
Distributed File System Replication (DFSR)
abstracts multiple file servers to one share name
provides content replication
Deploy...

13. Configuration moves to .config files…
Configure IIS and ASP.NET properties in the same file
Use locking to provide delegation
Built for simple, schema-based extensibility
… welcome to a world of xcopy deployment…
Themes of IIS7 was merger with ASP.NET
Manage...

14. Configuration Layout Manage... Inheritance… IIS + ASP.NET +
.NET Framework
Inheritance…
IIS
ASP.NET
applicationHost.config
web.config
.NET
Framework
\Windows\system32\inetsrv\applicationHost.config
root web.config
\Windows\Microsoft.NET\Framework\v \config\web.config
machine.config
\Windows\Microsoft.NET\Framework\v \config\machine.config
root configuration files
web.config files
Manage...

15. Configuration Delegation
Delegation is:
Configuration locking, “overrideMode”
ACL’s on configuration files
By default…
All IIS sections locked except:
Default Document
Directory Browsing
HTTP Header
HTTP Redirects
All .NET Framework / ASP.NET sections are unlocked
Manage...

16. TIP Manage... Determine your configuration lockdown policy…
Be conservative at first
Unlock as necessary (locking later could break apps)
Manage...

17. Compatibility: ABO Mapper
Provides compatibility for:
scripts
command line tools
native calls into ABO
Not installed by default
Can only do what IIS6 could do…
Can’t read/write new IIS properties
Application Pools: managedPipelineMode, managedRuntimeVersion
Request Filtering
Failed Request Tracing
Can’t read/write ASP.NET properties
Can’t read/write web.config files
Can’t access new runtime data, e.g. worker processes, executing requests
IIS6
ADSI Script
IISADMIN
ABOMapper
applicationHost.config
Manage...

18. Management Tools Manage... GUI IIS Manager Command Line appcmd Script
Managed Code
IIS Manager
appcmd
WMI (root\WebAdministration)
Microsoft.Web.Administration
Manage IIS and ASP.NET
View enhanced runtime data
worker processes, appdomains, executing requests
Manage delegation
Use whichever management tool suits your needs…
Manage...

19. IIS Manager Manage... Remotes over HTTP, making it firewall friendly
(remoting is not installed by default)
Provides managed extensibility
Supports non-admin management of sites and applications
Manage...

20. TIP
Educate end users who publish their application and use IIS Manager configure it…
Scenario:
User publishes application
User changes app’s web.config using IIS Manager
User copies updated web.config to his local version of the application
Several days later, user re-publishes application
** modifications make to the app’s web.config using IIS Manager have just been blown away**
Manage...

21. Appcmd – Listing and Filtering
C:\> appcmd list sites
SITE "Default Web Site" (id:1,bindings:HTTP/*:80:,state:Started) SITE "Site1" (id:2,bindings:http/*:81:,state:Started) SITE "Site2" (id:3,bindings:http/*:82:,state:Stopped)
C:\> appcmd list requests
REQUEST "fb e" (url:GET /wait.aspx?time=10000,time:4276 msec,client:localhost)
C:\> appcmd list requests /apppool.name:DefaultAppPool
C:\> appcmd list requests /wp.name:3567
C:\> appcmd list requests /site.id:1
C:\>
C:\>
C:\>
Filter results by application pool, worker process, or site
Manage...

22. 2/16/ :00 PM
appcmd
Manage... 22
© 2006 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries.
The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

23. Scripting: IIS6 WMI Provider
Set oIIS = GetObject("winmgmts:root\MicrosoftIISv2")
' Create binding for new site
Set oBinding = oIIS.Get("ServerBinding").SpawnInstance_
oBinding.IP = ""
oBinding.Port = "80"
oBinding.Hostname = "
' Create site and extract site name from return value
Set oService = oIIS.Get("IIsWebService.Name='W3SVC'")
strSiteName = oService.CreateNewSite("NewSite", array(oBinding), "C:\inetpub\wwwroot")
Set objPath = CreateObject("WbemScripting.SWbemObjectPath")
objPath.Path = strSiteName
strSitePath = objPath.Keys.Item("")
Set oSite = oIIS.Get("IIsWebServer.Name='" & strSitePath & "'")
oSite.Start
' Create the vdir for our application
Set oVDirSetting = oIIS.Get("IIsWebVirtualDirSetting").SpawnInstance_
oVDirSetting.Name = strSitePath & "/ROOT/bar"
oVDirSetting.Path = "C:\inetpub\bar"
oVDirSetting.Put_
' Make the VDir an application
Set oVDir = oIIS.Get("IIsWebVirtualDir.Name='" & strSitePath & "/ROOT/bar'")
oVDir.AppCreate2 1
NOT CONSISTENT
Create Site
Create Virtual Directory
Create Application
Manage...

24. Scripting: new WMI Provider
CONSISTENT
Set oService = GetObject("winmgmts:root\WebAdministration")
' Create binding for site
Set oBinding = oService.Get("BindingElement").SpawnInstance_
oBinding.BindingInformation = "*:80:
oBinding.Protocol = "http"
' Create site
oService.Get("Site").Create _
"NewSite", array(oBinding), "C:\inetpub\wwwroot"
' Create application
oService.Get("Application").Create _
"/foo", "NewSite", "C:\inetpub\wwwroot\foo"
Static Create methods
Manage...

25. WMI – Unloading AppDomains …through script …through PowerShell
2/16/ :00 PM
WMI – Unloading AppDomains …through script …through PowerShell
Manage... 25
© 2006 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries.
The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

26. Coding: Microsoft.Web.Administration
ServerManager iisManager = new ServerManager();
foreach(WorkerProcess w3wp in iisManager.WorkerProcesses) {     Console.WriteLine("W3WP ({0})", w3wp.ProcessId);                  foreach(Request request in w3wp.GetRequests(0)) {         Console.WriteLine("{0} - {1},{2},{3}",                     request.Url,                     request.ClientIPAddr,                     request.TimeElapsed,                     request.TimeInState);     } }
Manage...

27. New Troubleshooting Features
Detailed custom errors, just like ASP.NET
Failed Request Tracing
No more ETW tracing and waiting for a repro…
New runtime data:
worker processes
appdomains
currently executing requests
Troubleshoot...

28. Failed Request Tracing
No-repro tracing for “failed requests”
Configure custom failure definitions per URL
Time taken
Status/substatus codes
Error level
Persist failure log files
Will it tell me what’s wrong?
Sometimes… for example, ACL issues
Look for clues
Can use for all requests to see what’s going on
Troubleshoot...

29. Failed Request Tracing
2/16/ :00 PM
Failed Request Tracing
Troubleshoot... 29
© 2006 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries.
The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

30. Summary Deploy… Manage… Troubleshoot…
~ 40 modules, install only what you need
Migrate to ASP.NET Integrated Mode
Easier centralization/replication
Manage…
Manage IIS and ASP.NET through the same tools
Use ABO Mapper compatibility (not installed by default)
Determine configuration lockdown policy
Troubleshoot…
Use: Detailed Errors, Failed Request Tracing, Currently Executing requests

32. New home for IIS Community!
TechCenter to easily find the info you need
Advice and assistance in Forums
Insider info on new technology (IIS7!)
Online labs, play with IIS7 in your browser
IIS.net slide

33. Some upcoming IIS sessions…
Today
3:15 – 4:30 Chalktalk: Configuration Management of Web Platform
Tomorrow
8:30 – 9:45 IIS 7: Under the Hood for Web Request Tracing
10:15 – 11:30 Chalktalk: Using Managed Code to Administer IIS 7
1:00 – 2:15 Chalktalk: Introducing the New and Improved IIS Manager in IIS 7
2:45 – 4:00 IIS 6: Effective Management of Web Farms
4:30 – 5:45 IIS 6: Everything the Web Administrator Needs to Know about MOM
Wednesday
8:30 – 9:45 Chalktalk: Extending the IIS Manager Tool in IIS 7
2:00 – 3:15 Chalktalk: IIS 6.0 Security: Setting the Record Straight
4:45 – 5:00 Chalktalk: IIS and Microsoft.com Operations: Migrating IIS 6.0 to 64 bit
5:30 – 6:45 Chalktalk: IIS 7 Q&A
Upcoming sessions slide

34. Fill out a session evaluation on CommNet and
Win an XBOX 360!

35. 2/16/ :00 PM
© 2006 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries.
The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.
© 2006 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries.
The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

36. Additional Information

37. Installation Options Deploy... Server Manager Server Manager
2/16/ :00 PM
Installation Options
Server Manager
Server Manager
Lots of components
Static server by default
[client] Use Windows
Features
Package Manager
Package Manager
Replaces sysocmgr
Unattend
File format is
completely different
[client] Pick components,
cannot set configuration
Deploy... 37
© 2006 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries.
The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

38. Install, Migration, Upgrade
Install log: \Windows\IIS7.log
Uninstall
Stop services to avoid a reboot
Deletes configuration files, backup before uninstall
Migration: none for Vista, LH Server TBD…
Upgrade
All web and/or FTP components are installed, uninstall unnecessary components afterwards…
Application pools will be ISAPI mode, configured for no managed code => all ASP.NET requests will fail
Deploy...

39. ASP.NET: Migration Deploy... Application Pools Integrated Mode
ASP.NET Integrated mode by default
Configure to load a specific version of the .NET Framework
Integrated Mode
Different server environment for some pipeline notifications
e.g. request is not authenticated for BeginRequest
Handler and module configuration integrated with IIS
system.webServer/handlers, system.webServer/modules
Validation warns on httpHandlers, httpModules, or identity config
Remove “managedHandler” precondition on an ASP.NET module to have it execute for all content
ISAPI Mode
Can’t configure HTTP handlers and modules from the UI
Deploy...

40. Replicating applicationHost.config
Will cause all application pools to recycle:
changes to default settings for all application pools
changes to the <globalModules> list
Will cause one application pool to recycle:
application pool settings
Use only RSA machine-encryption (default), replicate RSA machine key
Gotcha's:
Machine specific data, like IP addresses or drive letters
Servers must have same set of modules installed (reference to non-existent module in <globalModules> causes 503's)
Deploy...

41. Configuration Delegation
Two kinds of configuration locking:
overrideMode (similar to "allowOverride")
granular locking, e.g. lockItem, lockElements
By default…
All IIS sections locked (overrideMode=“Deny”) except:
Default Document, Directory Browsing, HTTP Header, HTTP Redirects, Validation
All .NET Framework / ASP.NET sections are unlocked
Determine your configuration lockdown policy
be conservative at first
unlock as necessary (locking later could break apps)
Manage...

42. Configuration Schema Manage...
Use the schema file to see all config settings:
%windir%\system32\inetsrv\config\schema\IIS_schema.xml
Schema describes:
property types
default values
validation
encrypted by default?
note: config is case sensitive
Manage...

43. Appcmd – Viewing Config Schema
C:\> appcmd list config /section:? | findstr system.webServer
system.webServer/globalModules system.webServer/serverSideInclude system.webServer/httpTracing ...
C:\> appcmd list config /section:directoryBrowse
<system.webServer>   <directoryBrowse enabled="true" /> </system.webServer>
C:\> appcmd list config /section:directoryBrowse /config:*
<system.webServer>   <directoryBrowse enabled="true" showFlags="Extension, Size, Time, Date" /> </system.webServer>
C:\> appcmd list config /section:directoryBrowse /text:*
CONFIG   CONFIG.SECTION: system.webServer/directoryBrowse   path: MACHINE/WEBROOT/APPHOST   overrideMode: Inherit   [system.webServer/directoryBrowse]     enabled:"true"     showFlags:"Extension, Size, Time, Date"
C:\>
IIS sections – also try “system.web” and “system.applicationHost”
C:\>
C:\>
Shows attributes that aren’t set explicitly
C:\>
Manage...

44. Coding: Microsoft.Web.Administration
First managed code API for administering IIS
Same objects and functionality as WMI, appcmd
What about System.Configuration?
System.Configuration:
Strongly typed ASP.NET and .NET Framework config
Microsoft.Web.Administration:
Weakly typed IIS, ASP.NET, and .NET Framework config
Strongly typed IIS objects like Sites and Application Pools
Manage...