IIS 7: The Administrator’s GuideIIS 7: The Administrator’s GuideIIS 7: The Administrator’s GuideIIS 7: The Administrator’s Guide

Alexis EllerAlexis EllerProgram ManagerProgram ManagerMicrosoft CorporationMicrosoft Corporation

IIS6 Request ProcessingIIS6 Request Processing

Send ResponseLog Compres

s

NTLM Basic

Determine

Handler

CGI

Static File

AuthenticationAnon

Monolithic Monolithic implementationimplementation Install Install all or all or nothingnothing……

Extend server functionality Extend server functionality only through only through ISAPIISAPI……

ASP.NET

PHPISAPI

…

…

IIS7 Request ProcessingIIS7 Request Processing

Send ResponseLog Compres

s

NTLM Basic

Determine

Handler

CGI

Static File

ISAPI

AuthenticationAnon

SendResponse

Authentication

Authorization

ResolveCache

ExecuteHandler

UpdateCache

…

…

Server functionality is Server functionality is split into ~ 40 split into ~ 40 modulesmodules......

Modules plug into a Modules plug into a generic request generic request pipeline…pipeline…

Modules Modules extend extend server functionality server functionality through a public module through a public module API.API.

…

…

Many, Many ModulesMany, Many Modules

Install, manage, and patch only the Install, manage, and patch only the modules you use…modules you use…

Reduces attack surfaceReduces attack surface

Reduces in-memory footprintReduces in-memory footprint

Provides fine grained controlProvides fine grained control

… … replacereplace core server components with core server components with custom componentscustom components……

Installing IIS7Installing IIS7Installing IIS7Installing IIS7

Consistently install the same set of Consistently install the same set of modulesmodules……

Avoid:Avoid:503 “Service Unavailable” 503 “Service Unavailable”

[module is enabled but not installed][module is enabled but not installed]

Application doesn’t work as expectedApplication doesn’t work as expected

[web.config references a module that isn’t [web.config references a module that isn’t installed]installed]

[unexpected module conflicts with custom [unexpected module conflicts with custom module]module]

IIS6 ASP.NET IntegrationIIS6 ASP.NET Integration

Runtime limitationsRuntime limitations

Only sees ASP.NET Only sees ASP.NET requestsrequests

Feature duplicationFeature duplication

Send ResponseLog Compres

s

NTLM Basic

Determine

Handler

CGI

Static File

ISAPI

AuthenticationAnon

…

…

AuthenticationForm

sWindo

ws

Map Handl

er

ASPX

Trace

……

…

aspnet_isapi.daspnet_isapi.dllll

IIS7 ASP.NET IntegrationIIS7 ASP.NET Integration

Two ModesTwo ModesClassic (runs as ISAPI)Classic (runs as ISAPI)

IntegratedIntegrated

Integrated ModeIntegrated Mode.NET modules / .NET modules / handlers plug directly handlers plug directly into pipelineinto pipeline

Process all requestsProcess all requests

Full runtime fidelityFull runtime fidelity

Log

Compress

Basic

Static File

ISAPI

Anon

SendResponse

Authentication

Authorization

ResolveCache

ExecuteHandler

UpdateCache

…

…AuthenticationForm

sWindo

ws

Map Handl

er

ASPX

Trace

……

…

aspnet_isapi.daspnet_isapi.dllll

Migrating to Integrated ASP.NETMigrating to Integrated ASP.NETMigrating to Integrated ASP.NETMigrating to Integrated ASP.NET

Replicate Content and ConfigReplicate Content and Config

Main IIS configuration file Main IIS configuration file (applicationHost.config)(applicationHost.config)

Built-in “IUSR” account, no more machine Built-in “IUSR” account, no more machine specific SID’sspecific SID’s

Simple file copySimple file copy, no command line tools , no command line tools requiredrequired

……watch for machine specific data like IP’s and watch for machine specific data like IP’s and drive letters drive letters

IIS config IIS config web.config, XCOPY with web.config, XCOPY with applicationapplication

Centralize Content and ConfigCentralize Content and Config

IIS config IIS config web.config, centralize on file web.config, centralize on file serverserver

File System:File System:Client Side Caching (CSC)Client Side Caching (CSC)

provides a provides a local disk cachelocal disk cache

Distributed File System Replication (DFSR)Distributed File System Replication (DFSR)abstracts multiple file servers to abstracts multiple file servers to one share nameone share name

provides provides content replicationcontent replication

Configuration moves to .config Configuration moves to .config files…files…Configure Configure IIS and ASP.NET IIS and ASP.NET properties in properties in the same filethe same file

Use locking to provide Use locking to provide delegationdelegation

Built for Built for simple, schema-based simple, schema-based extensibilityextensibility

… … welcome to a world of welcome to a world of xcopy xcopy deploymentdeployment……

Configuration LayoutConfiguration Layout

root configuration filesroot configuration files

machine.configmachine.config

root web.configroot web.config

applicationHost.coapplicationHost.confignfig

web.configweb.config.NET .NET

Framework Framework

ASP.NEASP.NETT

IISIIS

IIS + IIS + ASP.NET + ASP.NET +

.NET .NET FrameworkFramework

web.config filesweb.config files

Inheritance…Inheritance…

Configuration DelegationConfiguration DelegationDelegation is: Delegation is:

Configuration locking, “overrideMode” Configuration locking, “overrideMode”

ACL’s on configuration filesACL’s on configuration files

By default…By default…All IIS sections locked except:All IIS sections locked except:

Default DocumentDefault Document

Directory BrowsingDirectory Browsing

HTTP HeaderHTTP Header

HTTP RedirectsHTTP Redirects

All .NET Framework / ASP.NET sections are All .NET Framework / ASP.NET sections are unlockedunlocked

Determine your configuration lockdown Determine your configuration lockdown policy…policy…

Be conservative at firstBe conservative at first

Unlock as necessary (locking later could break Unlock as necessary (locking later could break apps)apps)

Compatibility: Compatibility: ABO MapperABO Mapper

Provides Provides compatibilitycompatibility for: for:scriptsscripts

command line toolscommand line tools

native calls into ABOnative calls into ABO

Not installed by defaultNot installed by default

Can only do what IIS6 could do…Can only do what IIS6 could do…Can’t read/write new IIS propertiesCan’t read/write new IIS properties

Application Pools: managedPipelineMode, Application Pools: managedPipelineMode, managedRuntimeVersionmanagedRuntimeVersion

Request Filtering Request Filtering

Failed Request TracingFailed Request Tracing

Can’t read/write ASP.NET propertiesCan’t read/write ASP.NET properties

Can’t read/write web.config filesCan’t read/write web.config files

Can’t access new runtime data, e.g. worker Can’t access new runtime data, e.g. worker processes, executing requestsprocesses, executing requests

applicationHost.coapplicationHost.confignfig

IISADMINIISADMIN

ABOMappABOMapperer

IIS6 IIS6 ADSI ScriptADSI Script

Management ToolsManagement Tools

Manage Manage IIS and ASP.NETIIS and ASP.NETView View enhanced runtime dataenhanced runtime data

worker processes, appdomains, executing requestsworker processes, appdomains, executing requests

Manage Manage delegationdelegationUse whichever management tool suits your Use whichever management tool suits your needs…needs…

GUIGUICommand LineCommand LineScriptScriptManaged CodeManaged Code

IIS ManagerIIS ManagerappcmdappcmdWMI (root\WMI (root\WebAdministration)WebAdministration)Microsoft.Web.AdministraMicrosoft.Web.Administrationtion

IIS ManagerIIS Manager

Remotes over HTTP, making it Remotes over HTTP, making it firewall friendly firewall friendly (remoting is not installed by default)(remoting is not installed by default)

Provides Provides managed extensibilitymanaged extensibility

Supports non-admin management of sites and Supports non-admin management of sites and applicationsapplications

Educate end users who publish their Educate end users who publish their application and use IIS Manager application and use IIS Manager configure it…configure it…

Scenario:Scenario:User publishes applicationUser publishes application

User changes app’s web.config using IIS User changes app’s web.config using IIS ManagerManager

User copies updated web.config to his User copies updated web.config to his local version of the applicationlocal version of the application

Several days later, user re-publishes applicationSeveral days later, user re-publishes application

** modifications make to the app’s ** modifications make to the app’s web.config using IIS Manager have just web.config using IIS Manager have just

been blown away**been blown away**

Appcmd – Listing and FilteringAppcmd – Listing and FilteringC:\> C:\> appcmd list sitesappcmd list sitesSITE "Default Web Site" (id:1,bindings:HTTP/*:80:,state:Started)SITE "Default Web Site" (id:1,bindings:HTTP/*:80:,state:Started)SITE "Site1" (id:2,bindings:http/*:81:,state:Started)SITE "Site1" (id:2,bindings:http/*:81:,state:Started)SITE "Site2" (id:3,bindings:http/*:82:,state:Stopped)SITE "Site2" (id:3,bindings:http/*:82:,state:Stopped)

C:\> C:\> appcmd list requestsappcmd list requestsREQUEST "fb0000008000000e" (url:GET /wait.aspx?REQUEST "fb0000008000000e" (url:GET /wait.aspx?time=10000,time:4276 msec,client:localhost) time=10000,time:4276 msec,client:localhost)

C:\> C:\> appcmd list requests /apppool.name:DefaultAppPoolappcmd list requests /apppool.name:DefaultAppPool

C:\> C:\> appcmd list requests /wp.name:3567appcmd list requests /wp.name:3567

C:\> C:\> appcmd list requests /site.id:1 appcmd list requests /site.id:1

C:\>C:\>

C:\>C:\>

Filter results by Filter results by application pool, application pool, worker process, or worker process, or sitesite

C:\>C:\>

appcmdappcmdappcmdappcmd

Scripting: IIS6 WMI ProviderScripting: IIS6 WMI ProviderSet oIIS = GetObject("winmgmts:root\MicrosoftIISv2")

' Create binding for new siteSet oBinding = oIIS.Get("ServerBinding").SpawnInstance_oBinding.IP = ""oBinding.Port = "80"oBinding.Hostname = "www.site.com"

' Create site and extract site name from return valueSet oService = oIIS.Get("IIsWebService.Name='W3SVC'")

strSiteName = oService.CreateNewSite("NewSite", array(oBinding), "C:\inetpub\wwwroot")

Set objPath = CreateObject("WbemScripting.SWbemObjectPath") objPath.Path = strSiteNamestrSitePath = objPath.Keys.Item("")

Set oSite = oIIS.Get("IIsWebServer.Name='" & strSitePath & "'")oSite.Start

' Create the vdir for our application

Set oVDirSetting = oIIS.Get("IIsWebVirtualDirSetting").SpawnInstance_ oVDirSetting.Name = strSitePath & "/ROOT/bar" oVDirSetting.Path = "C:\inetpub\bar" oVDirSetting.Put_

' Make the VDir an applicationSet oVDir = oIIS.Get("IIsWebVirtualDir.Name='" & strSitePath & "/ROOT/bar'")

oVDir.AppCreate2 1

Create Site

Create Virtual Directory

Create Application

NOT CONSISTENT

Scripting: new WMI ProviderScripting: new WMI Provider

Set oService = GetObject("winmgmts:root\WebAdministration")

' Create binding for siteSet oBinding = oService.Get("BindingElement").SpawnInstance_oBinding.BindingInformation = "*:80:www.site.com"oBinding.Protocol = "http"

' Create site oService.Get("Site").Create _ "NewSite", array(oBinding), "C:\inetpub\wwwroot"

' Create application oService.Get("Application").Create _ "/foo", "NewSite", "C:\inetpub\wwwroot\foo"

Static Create methods

CONSISTENT

WMI – Unloading WMI – Unloading AppDomainsAppDomains …through script …through script …through PowerShell …through PowerShell

WMI – Unloading WMI – Unloading AppDomainsAppDomains …through script …through script …through PowerShell …through PowerShell

Coding: Coding: Microsoft.Web.AdministrationMicrosoft.Web.Administration

ServerManager iisManager = new ServerManager();

foreach(WorkerProcess w3wp in iisManager.WorkerProcesses) {    Console.WriteLine("W3WP ({0})", w3wp.ProcessId);                foreach(Request request in w3wp.GetRequests(0)) {        Console.WriteLine("{0} - {1},{2},{3}",                    request.Url,                    request.ClientIPAddr,                    request.TimeElapsed,                    request.TimeInState);    }}

New Troubleshooting FeaturesNew Troubleshooting Features

Detailed custom errors, just like ASP.NETDetailed custom errors, just like ASP.NET

Failed Request TracingFailed Request TracingNo more ETW tracing and waiting for a repro…No more ETW tracing and waiting for a repro…

New runtime data:New runtime data:worker processesworker processes

appdomainsappdomains

currently executing requestscurrently executing requests

Failed Request TracingFailed Request Tracing

No-repro tracingNo-repro tracing for “failed requests”for “failed requests”Configure Configure custom failure definitionscustom failure definitions per per URLURL

Time taken Time taken Status/substatus codesStatus/substatus codesError levelError level

Persist failure log filesPersist failure log files

Will it tell me what’s wrong?Will it tell me what’s wrong?Sometimes… for example, ACL issuesSometimes… for example, ACL issuesLook for cluesLook for clues

Can use for all requests to see what’s going Can use for all requests to see what’s going onon

Failed Request TracingFailed Request TracingFailed Request TracingFailed Request Tracing

SummarySummary

Troubleshoot…Troubleshoot…Use: Detailed Errors, Failed Request Tracing, Use: Detailed Errors, Failed Request Tracing, Currently Executing requestsCurrently Executing requests

Manage…Manage…Manage IIS and ASP.NET through the same toolsManage IIS and ASP.NET through the same tools

Use ABO Mapper compatibility (not installed by Use ABO Mapper compatibility (not installed by default)default)

Determine configuration lockdown policyDetermine configuration lockdown policy

Deploy…Deploy…~ 40 modules, install only what you need~ 40 modules, install only what you need

Migrate to ASP.NET Integrated ModeMigrate to ASP.NET Integrated Mode

Easier centralization/replicationEasier centralization/replication

alexise@microsoft.comalexise@microsoft.com

TechCenter to easily find the info you needTechCenter to easily find the info you need

Advice and assistance in ForumsAdvice and assistance in Forums

Insider info on new technology (IIS7!)Insider info on new technology (IIS7!)Online labs, play with IIS7 in your browserOnline labs, play with IIS7 in your browser

New home for IIS Community!New home for IIS Community!

Some upcoming IIS sessions…Some upcoming IIS sessions…Today3:15 – 4:30 Chalktalk: Configuration Management of Web Platform

Tomorrow

8:30 – 9:45 IIS 7: Under the Hood for Web Request Tracing

10:15 – 11:30 Chalktalk: Using Managed Code to Administer IIS 7

1:00 – 2:15 Chalktalk: Introducing the New and Improved IIS Manager in IIS 7

2:45 – 4:00 IIS 6: Effective Management of Web Farms

4:30 – 5:45 IIS 6: Everything the Web Administrator Needs to Know about MOM

Wednesday

8:30 – 9:45 Chalktalk: Extending the IIS Manager Tool in IIS 7

2:00 – 3:15 Chalktalk: IIS 6.0 Security: Setting the Record Straight

4:45 – 5:00 Chalktalk: IIS and Microsoft.com Operations: Migrating IIS 6.0 to 64 bit

5:30 – 6:45 Chalktalk: IIS 7 Q&A

Fill out a session Fill out a session evaluation on evaluation on

CommNet andCommNet and Win an XBOX Win an XBOX

360!360!

© 2006 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries.

The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation.

MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Additional InformationAdditional Information

Installation OptionsInstallation Options

• Lots of componentsLots of components• Static server by Static server by defaultdefault• [client] Use [client] Use Windows Windows FeaturesFeatures

• Replaces sysocmgrReplaces sysocmgr

• File format is File format is completely differentcompletely different

• [client] Pick [client] Pick components, components, cannot set cannot set configurationconfiguration

Install, Migration, UpgradeInstall, Migration, Upgrade

Install log: Install log: \Windows\IIS7.log\Windows\IIS7.log

UninstallUninstallStop services to avoid a rebootStop services to avoid a reboot

Deletes configuration files, backup before Deletes configuration files, backup before uninstalluninstall

Migration: none for Vista, LH Server TBD…Migration: none for Vista, LH Server TBD…

UpgradeUpgradeAll web and/or FTP components are installed, All web and/or FTP components are installed, uninstall unnecessary components uninstall unnecessary components afterwards…afterwards…

Application pools will be ISAPI mode, configured Application pools will be ISAPI mode, configured for no managed code => for no managed code => all ASP.NET all ASP.NET requests will failrequests will fail

ASP.NET: Migration ASP.NET: Migration Application PoolsApplication Pools

ASP.NET Integrated mode by defaultASP.NET Integrated mode by default

Configure to load a specific version of the .NET Configure to load a specific version of the .NET FrameworkFramework

Integrated ModeIntegrated ModeDifferent server environment for some pipeline Different server environment for some pipeline notificationsnotifications

e.g. request is not authenticated for BeginRequeste.g. request is not authenticated for BeginRequest

Handler and module configuration integrated with IISHandler and module configuration integrated with IISsystem.webServer/handlers, system.webServer/modulessystem.webServer/handlers, system.webServer/modules

Validation warns on httpHandlers, httpModules, or identity Validation warns on httpHandlers, httpModules, or identity configconfig

Remove “managedHandler” precondition on an ASP.NET Remove “managedHandler” precondition on an ASP.NET module to have it execute for all contentmodule to have it execute for all content

ISAPI ModeISAPI ModeCan’t configure HTTP handlers and modules from the UICan’t configure HTTP handlers and modules from the UI

Replicating Replicating applicationHost.configapplicationHost.configWill cause all application pools to recycle:Will cause all application pools to recycle:

changes to default settings for all application poolschanges to default settings for all application pools

changes to the <globalModules> listchanges to the <globalModules> list

Will cause one application pool to recycle:Will cause one application pool to recycle:application pool settingsapplication pool settings

Use only RSA machine-encryption (default), Use only RSA machine-encryption (default), replicate RSA machine keyreplicate RSA machine key

http://msdn2.microsoft.com/en-us/library/yxw286t2(VS.80).aspx

Gotcha's:Gotcha's:Machine specific data, like IP addresses or drive lettersMachine specific data, like IP addresses or drive letters

Servers must have Servers must have same set of modules installed same set of modules installed (reference to non-existent module in <globalModules> (reference to non-existent module in <globalModules> causes 503's)causes 503's)

Configuration DelegationConfiguration DelegationTwo kinds of configuration locking:Two kinds of configuration locking:

overrideMode overrideMode (similar to "allowOverride")(similar to "allowOverride")

granular locking, e.g. lockItem, lockElementsgranular locking, e.g. lockItem, lockElements

By default…By default…All IIS sections locked (overrideMode=“Deny”) All IIS sections locked (overrideMode=“Deny”) except:except:

Default Document, Directory Browsing, HTTP Header, Default Document, Directory Browsing, HTTP Header, HTTP Redirects, ValidationHTTP Redirects, Validation

All .NET Framework / ASP.NET sections are All .NET Framework / ASP.NET sections are unlockedunlocked

Determine your Determine your configuration lockdown configuration lockdown policypolicy

be conservative at firstbe conservative at first

unlock as necessary (locking later could break unlock as necessary (locking later could break apps)apps)

Configuration SchemaConfiguration Schema

Use the schema file to see all config Use the schema file to see all config settings:settings:

%windir%\system32\inetsrv\config\schema\IIS_schema.xml%windir%\system32\inetsrv\config\schema\IIS_schema.xml

Schema describes:Schema describes:property typesproperty types

default valuesdefault values

validationvalidation

encrypted by default?encrypted by default?

note: config is case sensitivenote: config is case sensitive

Appcmd – Viewing Config Appcmd – Viewing Config SchemaSchemaC:\> C:\> appcmd list config /section:? | findstr system.webServerappcmd list config /section:? | findstr system.webServer

system.webServer/globalModulessystem.webServer/globalModulessystem.webServer/serverSideIncludesystem.webServer/serverSideIncludesystem.webServer/httpTracingsystem.webServer/httpTracing......

C:\> C:\> appcmd list config /section:directoryBrowseappcmd list config /section:directoryBrowse<system.webServer><system.webServer>  <directoryBrowse enabled="true" />  <directoryBrowse enabled="true" /></system.webServer> </system.webServer>

C:\> C:\> appcmd list config /section:directoryBrowse /config:*appcmd list config /section:directoryBrowse /config:*<system.webServer><system.webServer>  <directoryBrowse enabled="true" showFlags="Extension, Size, Time, Date" />  <directoryBrowse enabled="true" showFlags="Extension, Size, Time, Date" /></system.webServer> </system.webServer>

C:\> C:\> appcmd list config /section:directoryBrowse /text:*appcmd list config /section:directoryBrowse /text:*CONFIGCONFIG  CONFIG.SECTION: system.webServer/directoryBrowse  CONFIG.SECTION: system.webServer/directoryBrowse  path: MACHINE/WEBROOT/APPHOST  path: MACHINE/WEBROOT/APPHOST  overrideMode: Inherit  overrideMode: Inherit  [system.webServer/directoryBrowse]  [system.webServer/directoryBrowse]    enabled:"true"    enabled:"true"    showFlags:"Extension, Size, Time, Date"     showFlags:"Extension, Size, Time, Date"

C:\>C:\>

C:\>C:\>

IIS sections – also try IIS sections – also try “system.web” and “system.web” and “system.applicationHost”“system.applicationHost”

C:\>C:\>

C:\>C:\>Shows attributes Shows attributes that aren’t set that aren’t set explicitlyexplicitly

Coding: Coding: Microsoft.Web.AdministrationMicrosoft.Web.AdministrationFirst managed code API for administering First managed code API for administering IISIIS

Same objects and functionality as WMI, appcmdSame objects and functionality as WMI, appcmd

What about System.Configuration?What about System.Configuration?System.Configuration: System.Configuration:

Strongly typed ASP.NET and .NET Framework configStrongly typed ASP.NET and .NET Framework config

Microsoft.Web.Administration: Microsoft.Web.Administration: Weakly typed IIS, ASP.NET, and .NET Framework configWeakly typed IIS, ASP.NET, and .NET Framework config

Strongly typed IIS objects like Sites and Application Strongly typed IIS objects like Sites and Application PoolsPools