M11: IIS & Web Services

Internet Information Services (IIS) is Microsoft's web server platform for hosting websites, web applications, and web services on Windows Server.

What You'll Learn

  • IIS architecture and modules
  • Creating and configuring websites
  • Application pools and isolation
  • SSL/TLS certificates
  • URL Rewrite and ARR

Prerequisites

  • Windows Server basics
  • DNS fundamentals (M08)
  • Basic networking
  • Certificate concepts (M13 helpful)
Enterprise Reality: IIS powers millions of websites and is essential for hosting ASP.NET applications, SharePoint, Exchange OWA, and custom web services.
IIS hosts websites and web apps on WindowsclientHTTP GETIIS web servercorp.localSite: Default Web SiteApp Pool: DefaultAppPoolw3wp.exe200 OKHTMLWebsites + App Pools + Bindings + Auth + SSL + Logging + ModulesAll managed via IIS Manager or PowerShell (WebAdministration)

IIS Architecture

IIS uses a modular architecture with separate worker processes for isolation.

Core Components

  • HTTP.sys: Kernel-mode HTTP listener
  • WAS: Windows Process Activation Service
  • W3SVC: World Wide Web Publishing Service
  • Worker Process (w3wp.exe): Handles requests

Module Types

  • Native: C++ modules (performance)
  • Managed: .NET modules (flexibility)
  • Authentication modules
  • Compression, caching, logging

Install the IIS web server role and management tools with PowerShell.

# Install IIS core web server with management console PS C:\> Install-WindowsFeature -Name Web-Server -IncludeManagementTools
# Expected output: # ───────────────────────────────────────── Success Restart Needed Exit Code Feature Result ─────── ────────────── ───────── ────────────── True No NoChangeNeeded {Web-Server, Web-Mgmt-Console...}

Add ASP.NET support and additional modules for hosting web applications.

# Install ASP.NET 4.5, HTTP redirect, and management console PS C:\> Install-WindowsFeature -Name Web-Asp-Net45, Web-Http-Redirect, Web-Mgmt-Console
IIS architecture: kernel mode listener + worker procshttp.sys (kernel mode listener)listens on TCP 80, 443. Routes incoming requests to user modeWAS, Windows Process Activation Servicelaunches w3wp.exe worker processes when needed (idle timeout aware)w3wp.exeDefaultAppPool2 sitesw3wp.exeApiPoolREST endpointsw3wp.exeLegacyPool.NET 2.0 app

Request Processing Pipeline

Understanding how IIS processes an HTTP request from arrival to response.

Request Flow

  • HTTP.sys receives the request in kernel mode and queues it
  • WAS determines which application pool handles the request
  • W3SVC routes the request to the correct worker process
  • w3wp.exe processes the request through the module pipeline
  • Response travels back through the pipeline and HTTP.sys sends it to the client

Integrated Pipeline

  • Native and managed modules unified
  • .NET modules can handle all requests
  • Default mode for IIS 7.0+
  • Better performance and flexibility

Classic Pipeline

  • Backward compatibility mode
  • Separate ISAPI and .NET pipelines
  • Required for some legacy apps
  • Limited .NET module scope
Key Insight: Integrated pipeline mode is strongly recommended for all new applications. Classic mode should only be used when legacy app compatibility requires it.
Request travels through modules in orderRequestAuthenticateAuthorizeHandler mapsStatic handler200 OK11 events in the integrated pipeline:BeginRequest → AuthenticateRequest → AuthorizeRequest→ ResolveRequestCache → MapRequestHandler → AcquireRequestState→ ExecuteRequestHandler → UpdateRequestCache → EndRequest

Websites and Bindings

A website is a container for web content, identified by bindings (IP, port, hostname).

Binding Components

  • IP Address - All Unassigned or specific IP
  • Port - 80 (HTTP) or 443 (HTTPS)
  • Host Header - Domain name for virtual hosting
  • Protocol - HTTP or HTTPS

Create a new website by specifying its name, physical path, and host header binding.

# Create a new website bound to a specific hostname on port 80 PS C:\> New-Website -Name "Corporate Portal" -PhysicalPath "C:\inetpub\portal" -HostHeader "portal.hexworth.local" -Port 80
# Expected output: # ───────────────────────────────────────── Name ID State Physical Path Bindings Corporate Portal 2 Started C:\inetpub\portal http *:80:portal.hexworth.local

Add an HTTPS binding to the same site so it can serve encrypted traffic on port 443.

# Add an HTTPS binding to the existing site PS C:\> New-WebBinding -Name "Corporate Portal" -Protocol https -Port 443 -HostHeader "portal.hexworth.local"
Binding = IP + Port + Host header# Three sites on one server, three bindingshttps : 443 : www.corp.local → C:\inetpub\corpwww.corp.localIP: * Port: 443Host header: www.corpSite root: C:\corpcorporate websiteSSL cert pinnedapi.corp.localIP: * Port: 443Host header: api.corpSite root: C:\apiREST APIsame IP, different hostintranet.corpIP: 10.0.0.5 Port: 80Host: anySite root: C:\intrainternal portalHTTP only, internal IP

Website vs Web Application vs Virtual Directory

IIS organizes content in a three-level hierarchy that controls isolation and configuration scope.

Website

  • Top-level container with bindings
  • Has its own application pool
  • Unique combination of IP:port:hostname
  • Contains one or more applications

Web Application

  • Runs within a website at a sub-path
  • Can have its own application pool
  • Has its own web.config scope
  • Full isolation from parent site

Virtual Directory

  • Maps a URL path to a physical folder
  • Inherits parent application pool
  • No separate configuration scope
  • Useful for serving files from another location

When to Use Each

  • Website: Distinct domain or service
  • Application: Separate app needing isolation
  • Virtual Dir: Content on a different drive/share
Site → App → Virtual Directory hierarchyWeb Sitecorp.local, root URL spaceApplication/blog → AppPool, rootApplication/api → ApiPoolVirtual Dir/blog/images → other pathVirtual Dir/api/docs → /docs

Application Pools

Application pools isolate websites by running them in separate worker processes.

Benefits

  • Process isolation (crash containment)
  • Security boundaries (different identities)
  • Resource management
  • Independent recycling

Identity Options

  • ApplicationPoolIdentity (default)
  • NetworkService
  • LocalSystem
  • Custom account

Create a dedicated application pool for each website to ensure process isolation.

# Create a new application pool for the portal site PS C:\> New-WebAppPool -Name "PortalAppPool"
# Expected output: # ───────────────────────────────────────── Name State PortalAppPool Started

Set the .NET runtime version and identity type for the pool.

# Set the managed runtime to .NET 4.0 PS C:\> Set-ItemProperty "IIS:\AppPools\PortalAppPool" -Name managedRuntimeVersion -Value "v4.0"
# Set the pool to run under the default virtual identity PS C:\> Set-ItemProperty "IIS:\AppPools\PortalAppPool" -Name processModel.identityType -Value ApplicationPoolIdentity
Best Practice: Each website should have its own application pool. Never share pools between different applications or customers.
App Pool = isolation boundary for one or more appsDefaultAppPoolw3wp.exe (PID 4012)corp/blog/ApiPoolw3wp.exe (PID 6128)api/v1/api/v2/LegacyPoolw3wp.exe (PID 7320)legacy-app/ (.NET 2.0)Per-pool settings:Identity:ApplicationPoolIdentity (default) or custom service account.NET CLR:v4.0, v2.0, or "No Managed Code"Pipeline:Integrated (modern) vs Classic (IIS 6 compat)Recycling:time-based, request-count-based, memory-threshold

Application Pool Recycling

Recycling restarts worker processes to recover memory and maintain stability.

Recycling Triggers

  • Regular Time Interval: Default 1740 minutes (29 hours)
  • Specific Time: Schedule at off-peak hours
  • Virtual Memory Limit: Threshold-based restart
  • Private Memory Limit: Per-process memory cap
  • Request Limit: After N total requests

Recycling Behavior

  • Overlapped Recycling: New process starts before old exits
  • Active requests complete in old process
  • New requests go to new process
  • Minimizes downtime during recycle
  • Event log entries for tracking

Disable the default 29-hour time-based recycle and set a private memory limit instead.

# Disable default time-based recycling (set to zero) PS C:\> Set-ItemProperty "IIS:\AppPools\PortalAppPool" -Name recycling.periodicRestart.time -Value "00:00:00"
# Set private memory limit to 1 GB (recycle when exceeded) PS C:\> Set-ItemProperty "IIS:\AppPools\PortalAppPool" -Name recycling.periodicRestart.privateMemory -Value 1048576

Schedule recycling at a specific off-peak time to avoid impacting users.

# Schedule recycling at 3:00 AM daily PS C:\> Set-ItemProperty "IIS:\AppPools\PortalAppPool" -Name recycling.periodicRestart.schedule -Value @{value="03:00:00"}
Best Practice: Disable the default 29-hour time-based recycling and instead set a specific recycling schedule during off-peak hours to avoid recycling during business hours.
Recycle: graceful restart, no dropped requestsw3wp.exeaging outspawn new w3wp.exeboth running brieflyw3wp.exehealthyTriggers (default):Regular timeevery 1740 min (29 hours, avoids fixed daily collision)Memory thresholdprivate bytes > X MBRequest counte.g. every 100,000 requestsSpecific timee.g. 03:00 dailyConfig changeedit applicationHost.configRestart-WebAppPool -Name DefaultAppPool (manual)

Virtual Directories & Applications

Extend website functionality by mapping additional paths.

Virtual Directory vs Application

  • Virtual Directory: Maps a URL path to a physical folder. Inherits parent's app pool.
  • Application: Has its own configuration and can run in a separate app pool.

A virtual directory maps a URL path to a folder on a different drive without its own app pool.

# Create a virtual directory pointing to an external docs folder PS C:\> New-WebVirtualDirectory -Site "Corporate Portal" -Name "docs" -PhysicalPath "D:\Documentation"

A web application gets its own configuration scope and can run in a separate app pool for isolation.

# Create an application with its own dedicated app pool PS C:\> New-WebApplication -Site "Corporate Portal" -Name "api" -PhysicalPath "C:\inetpub\portal\api" -ApplicationPool "APIAppPool"
# Expected output: # ───────────────────────────────────────── Path ApplicationPool EnabledProtocols /api APIAppPool http
VDir maps URL path to disk path, no isolationURL space (web client view)/blog/images/banner.pnglooks like one app, one siteresolves toDisk (admin view)C:\inetpub\corp\blog(blog app root)D:\media\images(virtual dir mapped to /blog/images)Same app pool, same identity, but content lives somewhere else on disk

Default Documents & Directory Browsing

Control what users see when they browse to a directory without specifying a file.

Default Documents

  • Ordered list of files IIS looks for
  • Default: Default.htm, Default.asp, index.htm, index.html, iisstart.htm, default.aspx
  • First match is served to the client
  • Configurable per site or application

Directory Browsing

  • Disabled by default (security)
  • Shows file listing when no default doc
  • Can display time, size, extension
  • Enable only for file download sites

Insert a custom default document at the top of the priority list so IIS serves it first.

# Add home.html as the highest-priority default document PS C:\> Add-WebConfiguration -Filter "/system.webServer/defaultDocument/files" -PSPath "IIS:\Sites\Corporate Portal" -AtIndex 0 -Value @{value="home.html"}

Enable directory browsing only on specific paths like a document library, never on the whole site.

# Enable directory browsing for the docs virtual directory only PS C:\> Set-WebConfigurationProperty -Filter "/system.webServer/directoryBrowse" -Name "enabled" -Value "True" -PSPath "IIS:\Sites\Corporate Portal\docs"
Security Warning: Never enable directory browsing on production websites. It exposes your file structure and can leak sensitive information.
When the URL ends in /, IIS picks a default fileGET https://corp.local/no file name, IIS walks the default document list# Order is significant. First match wins.1.Default.htmfound → serve2.Default.asp3.index.htm4.index.html5.iisstart.htmIf none found + Directory Browsing on → file listing

SSL/TLS Configuration

Secure your websites with HTTPS using SSL/TLS certificates.

Certificate Sources

  • Internal CA (AD CS): For intranet sites
  • Public CA: For internet-facing sites
  • Self-signed: For testing only
  • Let's Encrypt: Free automated certificates

Generate a self-signed certificate for testing HTTPS before purchasing a production cert.

# Create a self-signed certificate for the portal hostname PS C:\> New-SelfSignedCertificate -DnsName "portal.hexworth.local" -CertStoreLocation "Cert:\LocalMachine\My"
# Expected output: # ───────────────────────────────────────── PSParentPath : Microsoft.PowerShell.Security\Certificate::LocalMachine\My Thumbprint Subject ────────── ─────── A1B2C3D4E5F6A1B2C3D4E5F6A1B2C3D4E5F6A1B2 CN=portal.hexworth.local

Bind the certificate to the HTTPS binding so IIS presents it during the TLS handshake.

# Retrieve the certificate and bind it to the HTTPS port PS C:\> $cert = Get-ChildItem Cert:\LocalMachine\My | Where-Object { $_.Subject -like "*portal*" } PS C:\> New-Item "IIS:\SslBindings\0.0.0.0!443!portal.hexworth.local" -Value $cert
HTTPS binding + cert + TLS settingsbrowserTLS 1.3 handshakeIIS Site, HTTPS bindingPort: 443Cert: corp.local, *.corp.localSNI: enabled🔒SNI: many HTTPS sites on the same IP + portClient sends hostname in TLS ClientHello, IIS picks matching certWithout SNI: one cert per IP, expensive on a multi-tenant server

SSL/TLS Best Practices

Properly configuring TLS is critical for protecting data in transit.

Protocol Configuration

  • Disable: SSL 2.0, SSL 3.0, TLS 1.0, TLS 1.1
  • Enable: TLS 1.2 and TLS 1.3
  • Use strong cipher suites only
  • Enable Perfect Forward Secrecy (PFS)

Certificate Best Practices

  • Use 2048-bit RSA keys minimum
  • Include all SANs (Subject Alternative Names)
  • Set up certificate renewal alerts
  • Use HTTP Strict Transport Security (HSTS)

Require SSL so the site rejects any plain HTTP connections.

# Require SSL for all requests to the portal site PS C:\> Set-WebConfigurationProperty -Filter "system.webServer/security/access" -Name "sslFlags" -Value "Ssl" -PSPath "IIS:\Sites\Corporate Portal"
# HSTS (HTTP Strict Transport Security) via IIS Manager: # Site > HSTS > Enable, Max-Age: 31536000, IncludeSubDomains # Forces browsers to always use HTTPS for future visits
Compliance Tip: PCI DSS requires TLS 1.2 or higher. Disable all older protocols on servers handling payment data.
Where TLS certs come fromPublic CALet's Encrypt, DigiCert, GoDaddybrowsers trustby defaultno extra steps for usersFor: public webpublic APIs$ or freeInternal CA (AD CS)your own PKIdomain-joinedPCs trust itroot CA in GPO-deployed storeFor: internal sitesDC certs, RADIUSno recurring costSelf-signedcreated on the serverno one trusts itunless installedbrowser warning by defaultFor: dev onlyinternal testfree, instant

Authentication Methods

IIS supports multiple authentication schemes for different scenarios.

Windows Authentication

  • NTLM or Kerberos
  • Seamless SSO for domain users
  • Best for intranet sites

Other Methods

  • Basic (username/password over HTTPS)
  • Digest (hashed credentials)
  • Forms (custom login page)
  • Anonymous (public access)

Enable Windows Authentication so domain users get seamless SSO on the intranet.

# Turn on Windows Authentication for the portal PS C:\> Set-WebConfigurationProperty -Filter "/system.webServer/security/authentication/windowsAuthentication" -Name "enabled" -Value "True" -PSPath "IIS:\Sites\Corporate Portal"

Disable anonymous access so every user must authenticate before viewing content.

# Disable anonymous access to require credentials PS C:\> Set-WebConfigurationProperty -Filter "/system.webServer/security/authentication/anonymousAuthentication" -Name "enabled" -Value "False" -PSPath "IIS:\Sites\Corporate Portal"
IIS auth methods, pick what fitsAnonymousno creds needed, IUSR accountpublic sitesBasicprompts for username + password (base64, needs HTTPS)Digesthashed challenge, AD users onlyWindowsNTLM or Kerberos, transparent for domain-joined clientsFormsapp provides HTML login form, cookies afterClient Certmutual TLS, smartcard / device certsCombine carefully, IIS picks the first that succeeds

Authentication Deep Dive

Choosing the right authentication method depends on your environment and security requirements.

Anonymous Authentication

  • No credentials required
  • Uses IUSR built-in account by default
  • Can be mapped to a custom account
  • Required for public-facing websites

Basic Authentication

  • Credentials sent Base64-encoded (not encrypted)
  • Must use with HTTPS to protect credentials
  • Works across all browsers and platforms
  • Good for REST APIs with HTTPS

Digest Authentication

  • Sends hashed credentials (MD5)
  • Requires AD domain controller
  • Reversible encryption must be enabled
  • Rarely used in modern deployments

Windows Authentication

  • Negotiate (Kerberos preferred, NTLM fallback)
  • Kerberos requires SPN registration
  • Seamless SSO in domain environments
  • Does not work well through proxies
Security Note: Never use Basic authentication without HTTPS. Credentials are trivially captured via network sniffing.
Rule chain: allow + deny, top-down<authorization><allow users="*" verbs="GET" /><deny users="?" />deny anonymous<allow roles="Editors" verbs="POST,PUT" /><deny verbs="DELETE" /><allow users="admin@corp.local" /></authorization>First match wins. Default: implicit allow="*"

URL Authorization

Control access to specific URLs, directories, or files based on user identity and roles.

Authorization Rules

  • Allow rules - Grant access to users, roles, or verbs
  • Deny rules - Block access to users, roles, or verbs
  • Rules are evaluated in order; first match wins
  • Can be configured per site, application, or directory

Install the URL Authorization module so IIS can enforce access rules per URL path.

# Install the URL Authorization feature PS C:\> Install-WindowsFeature -Name Web-Url-Auth
# Expected output: # ───────────────────────────────────────── Success Restart Needed Exit Code Feature Result ─────── ────────────── ───────── ────────────── True No Success {URL Authorization}

Define authorization rules in web.config to restrict access to a specific AD group.

<!-- In web.config: allow only WebAdmins, deny everyone else --> <authorization> <remove users="*" /> <add accessType="Allow" roles="HEXWORTH\WebAdmins" /> <add accessType="Deny" users="*" /> </authorization>
Tip: URL Authorization works with any authentication method. Combine Windows Authentication with URL Authorization for granular intranet access control.
Request Filter: drop bad requests at the doorclient.html.exe../../../etc/passwdfilter.html → app404404Defaults to deny:file extensions (.exe, .bat, .cs, .config), HTTP verbs not in whitelistdouble-encoded URLs, hidden segments (../, .git/), max URL/query length

Request Filtering

Request filtering is IIS's first line of defense against malicious requests.

Filter Types

  • File Extension: Block .config, .cs, .mdf
  • URL Sequences: Block .., :, backslash
  • HTTP Verbs: Allow only GET, POST, HEAD
  • Hidden Segments: Block App_Code, bin
  • Request Limits: Max URL, query string, content

Request Limits

  • maxAllowedContentLength: 30 MB default
  • maxUrl: 4096 bytes default
  • maxQueryString: 2048 bytes default
  • Prevents buffer overflow attacks
  • Configurable per site

Block dangerous file extensions so users cannot download backup or source files.

# Block .bak files from being served to clients PS C:\> Add-WebConfigurationProperty -PSPath "MACHINE/WEBROOT/APPHOST" -Filter "system.webServer/security/requestFiltering/fileExtensions" -Name "." -Value @{fileExtension='.bak';allowed='False'}

Set a maximum upload size to prevent oversized requests from consuming server resources.

# Set maximum content length to 50 MB for the portal PS C:\> Set-WebConfigurationProperty -Filter "system.webServer/security/requestFiltering/requestLimits" -Name "maxAllowedContentLength" -Value 52428800 -PSPath "IIS:\Sites\Corporate Portal"
W3C log: forensics + analytics sourceC:\inetpub\logs\LogFiles\W3SVC1\u_ex240315.logone file per site per day (default rollover)#Fields: date time c-ip cs-username cs-method cs-uri-stem sc-status time-taken2024-03-15 10:15:00 10.0.0.50 jdoe GET /products/list 200 422024-03-15 10:15:08 10.0.0.51 - GET /favicon.ico 200 32024-03-15 10:15:14 10.0.0.99 - POST /api/order 401 122024-03-15 10:15:21 198.51.100.4 - GET /.git/config 404 42024-03-15 10:15:28 10.0.0.50 jdoe GET /products/12 200 382024-03-15 10:15:34 10.0.0.99 - DELETE /api/user 403 82024-03-15 10:15:41 10.0.0.50 jdoe POST /products/edit 200 156Feed into Log Parser, Splunk, ELK, Azure Monitor

Request Handling

Configure how IIS processes and optimizes web requests.

Key Features

  • Static Compression: Compress CSS, JS, HTML files
  • Dynamic Compression: Compress generated content
  • Output Caching: Cache frequently accessed content
  • Request Filtering: Block malicious requests

Enable static compression to gzip CSS, JS, and HTML files for faster page loads.

# Enable static content compression (CSS, JS, HTML) PS C:\> Enable-WindowsOptionalFeature -Online -FeatureName IIS-HttpCompressionStatic

Enable dynamic compression for server-generated responses like API output.

# Enable dynamic content compression (ASPX, API responses) PS C:\> Enable-WindowsOptionalFeature -Online -FeatureName IIS-HttpCompressionDynamic

Block .config files from being downloaded to prevent sensitive configuration leaks.

# Block .config files from being served via request filtering PS C:\> Set-WebConfigurationProperty -PSPath "MACHINE/WEBROOT/APPHOST" -Filter "system.webServer/security/requestFiltering/fileExtensions" -Name "." -Value @{fileExtension='.config';allowed='False'}
Authentication deep dive: Windows AuthWindows Authentication flowBrowserGETIIS, 401WWW-Auth: NegotiateBrowser + KerberosIIS validates ticket200 OKNo password prompt for domain-joined clients. Kerberos when SPN present, NTLM fallback.

HTTP Logging

IIS logging captures detailed information about every request for troubleshooting and auditing.

Log Formats

  • W3C Extended: Default, customizable fields
  • IIS: Fixed ASCII format
  • NCSA: Common log format
  • Custom: User-defined fields

Common Log Fields

  • Date, Time, Client IP
  • HTTP method, URI stem, query string
  • Status code, substatus code
  • Time taken, bytes sent/received
  • User agent, referer

Set the logging format to W3C Extended, which provides the most customizable field selection.

# Set the log format to W3C Extended for the portal site PS C:\> Set-WebConfigurationProperty -Filter "system.applicationHost/sites/site[@name='Corporate Portal']/logFile" -Name "logFormat" -Value "W3C" -PSPath "MACHINE/WEBROOT/APPHOST"

Move log files to a dedicated drive to keep the system volume from filling up.

# Redirect IIS logs to a separate drive PS C:\> Set-ItemProperty "IIS:\Sites\Corporate Portal" -Name logFile.directory -Value "D:\IISLogs"
Storage Note: IIS logs can grow rapidly on busy servers. Implement log rotation and archival. Consider centralized logging with tools like ELK Stack.
Authorization Rules + RolesUser: jdoein group: Editorsauthz checkroles="Editors" → allow# in web.config<allow roles="Editors,Authors" verbs="POST,PUT" /><allow users="admin@corp.local" /><deny users="?" />roles map to AD security groups via Windows auth

IIS Manager Navigation

The IIS Manager console provides a graphical interface for all configuration tasks.

Connection Pane (Left)

  • Server level: Global settings
  • Sites: All hosted websites
  • Application Pools: Worker process config
  • Expand sites to see applications and virtual dirs

Feature View (Center)

  • IIS section: Authentication, compression, SSL
  • ASP.NET section: .NET settings
  • Management section: Delegation, remote mgmt
  • Double-click icons to configure features

Launch IIS Manager directly from the command line or Run dialog.

# Open IIS Manager from the command line PS C:\> inetmgr.exe

If the management console is not installed, add it as a Windows feature.

# Install the IIS Management Console feature PS C:\> Install-WindowsFeature -Name Web-Mgmt-Console
Remote Management: Install the Web-Mgmt-Service feature and start the WMSVC service to allow remote IIS Manager connections over HTTPS (port 8172).
Request Filter: scenario matrixBlocked patterns.cs .config .vb .resx files/_vti_bin/ SharePoint internalsURLs > 2048 charsdouble-encoded paths %252eAllowed patterns.html .css .js .json .png .jpgGET POST PUT DELETE (typical)whitelisted HTTP headersUTF-8 chars in URL# Edit via IIS Manager → Request FilteringSet-WebConfigurationProperty /system.webServer/security/requestFiltering-Name fileExtensions.allowUnlisted -Value falseAdd-WebConfiguration "/system.webServer/security/requestFiltering/fileExtensions"

web.config Basics

The web.config file is an XML configuration file that controls IIS behavior for a specific site or directory.

Configuration Hierarchy

  • applicationHost.config - Server-level settings (locked by default)
  • machine.config / root web.config - .NET framework settings
  • Site web.config - Per-site overrides
  • App/Directory web.config - Most specific, wins conflicts
<!-- Example web.config --> <?xml version="1.0" encoding="UTF-8"?> <configuration> <system.webServer> <defaultDocument> <files><add value="home.html" /></files> </defaultDocument> <httpErrors errorMode="Custom"> <remove statusCode="404" /> <error statusCode="404" path="/errors/404.html" responseMode="ExecuteURL" /> </httpErrors> </system.webServer> </configuration>
Security: IIS automatically blocks web.config from being downloaded by clients. Never rename or move the request filtering rules that protect this file.
Key features beyond serving HTMLURL Rewritecanonical URLs, redirects, SEOOutput Cachingcache rendered pages for N secondsCompressiongzip / brotli static + dynamicHTTP/2 + HTTP/3stream multiplex, QUIC (Server 2022)WebSocketslong-lived bidirectional pipesFTP / FTPSfile transfer with TLSApplication Initializationwarm up the app on recycle so first user does not pay cold start

FTP Server Setup

IIS includes a built-in FTP server for file transfer services.

FTP Features

  • FTP over SSL (FTPS) support
  • User isolation (home directories)
  • Virtual host names
  • Firewall-compatible passive mode
  • Integration with IIS authentication

User Isolation Modes

  • Do not isolate: Shared root directory
  • Isolate by user name: User-specific folders
  • Isolate by AD: Home directory from AD
  • Prevents users from seeing other directories

Install the FTP Server role with all sub-features including FTP extensibility.

# Install FTP Server with all sub-features PS C:\> Install-WindowsFeature -Name Web-Ftp-Server -IncludeAllSubFeature

Create an FTP site pointing to a dedicated file share directory.

# Create a new FTP site on the standard port 21 PS C:\> New-WebFtpSite -Name "Corporate FTP" -Port 21 -PhysicalPath "D:\FTPRoot"
# Expected output: # ───────────────────────────────────────── Name ID State Physical Path Bindings Corporate FTP 3 Started D:\FTPRoot ftp *:21:

Enable basic authentication so FTP users can log in with AD credentials.

# Enable basic (username/password) authentication for FTP PS C:\> Set-ItemProperty "IIS:\Sites\Corporate FTP" -Name ftpServer.security.authentication.basicAuthentication.enabled -Value $true
IIS Manager: navigation mapInternet Information Services (IIS) ManagerConnections▸ FS01 (server) Application Pools Sites ▸ Default Web Site ▸ api.corp.localActions paneAdd Site, BrowseFS01 Home🔒 AuthenticationAnonymous, Windows...📋 Bindingshttp:80, https:443📝 LoggingW3SVC1 rollover daily🔧 Modulesordered handler listDouble-click any tile to dive in

WebDAV Configuration

Web Distributed Authoring and Versioning (WebDAV) allows clients to edit web content remotely over HTTP.

WebDAV Features

  • File management over HTTP/HTTPS
  • Works through firewalls (port 80/443)
  • Supports Windows Explorer mapping
  • Locking and versioning support
  • Alternative to FTP for content publishing

Authoring Rules

  • Define read/write permissions per path
  • Apply to users, roles, or all users
  • Control which content types are allowed
  • Combine with SSL for secure publishing

Install the WebDAV Publishing feature to enable remote file editing over HTTP.

# Install WebDAV Publishing feature PS C:\> Install-WindowsFeature -Name Web-DAV-Publishing

Enable WebDAV authoring on a specific site so clients can upload and edit files.

# Enable WebDAV authoring for the portal site PS C:\> Set-WebConfigurationProperty -Filter "system.webServer/webdav/authoring" -Name "enabled" -Value "True" -PSPath "IIS:\Sites\Corporate Portal"

Map the WebDAV share as a drive letter in Windows Explorer for easy file access.

# Map WebDAV share as drive Z: in Windows Explorer PS C:\> net use Z: https://portal.hexworth.local/docs /user:HEXWORTH\admin
Security Note: WebDAV extends the HTTP attack surface. Only enable it when needed and always require HTTPS and strong authentication.
PowerShell WebAdministration moduleImport-Module WebAdministrationPS> New-Website -Name "corp" -Port 443 -SSL-HostHeader www.corp.local -PhysicalPath C:\corpPS> New-WebAppPool -Name "ApiPool"PS> New-WebApplication -Site "corp" -Name "blog" \-PhysicalPath C:\corp\blog -ApplicationPool ApiPoolPS> Restart-WebAppPool -Name "DefaultAppPool"PS> Get-Website | Get-WebBinding | Format-TablePS> _

IIS PowerShell Module

The WebAdministration and IISAdministration modules provide comprehensive PowerShell management.

WebAdministration (Legacy)

  • Uses IIS: PSDrive provider
  • Navigate like a file system
  • Broad compatibility
  • Cmdlets: New-Website, Get-WebBinding

IISAdministration (Modern)

  • Pipeline-friendly objects
  • Better performance
  • Available on IIS 10+
  • Cmdlets: Get-IISSite, New-IISSite
Application initialization + idle timeoutWithout warm-upFirst request after idle⏱ 8.4 scold JIT, cache missdb connection pool fillWith Application InitFirst request after idle⚡ 80 mswarmed up bybackground pingerapplicationInitialization config:<applicationInitialization doAppInitAfterRestart="true"><add initializationPage="/warmup" /></applicationInitialization>

IIS PowerShell Module, Configuration

Import the WebAdministration module for the IIS: PSDrive and legacy cmdlets.

# Load the legacy WebAdministration module (IIS: drive) PS C:\> Import-Module WebAdministration

Use Get-Website or Get-IISSite to list all hosted sites, depending on which module you prefer.

# List all websites using the modern IISAdministration module PS C:\> Get-IISSite
# Expected output: # ───────────────────────────────────────── Name ID State Physical Path Bindings Default Web Site 1 Started C:\inetpub\wwwroot http *:80: Corporate Portal 2 Started C:\inetpub\portal http *:80:portal.hexworth.local

Navigate the IIS: PSDrive like a file system to browse sites and app pools.

# Browse all sites and application pools via the IIS: drive PS C:\> Get-ChildItem IIS:\Sites PS C:\> Get-ChildItem IIS:\AppPools

Export a site's full configuration to XML for backup or migration to another server.

# Export the portal's web server configuration to an XML file PS C:\> Get-WebConfiguration -Filter "system.webServer" -PSPath "IIS:\Sites\Corporate Portal" | Export-Clixml "C:\Backup\portal-config.xml"
Automation Tip: Use the IISAdministration module for new scripts. It provides cleaner object output and better integration with modern PowerShell practices.
Application initialization + idle timeoutWithout warm-upFirst request after idle⏱ 8.4 scold JIT, cache missdb connection pool fillWith Application InitFirst request after idle⚡ 80 mswarmed up bybackground pingerapplicationInitialization config:<applicationInitialization doAppInitAfterRestart="true"><add initializationPage="/warmup" /></applicationInitialization>

Lab Preview

Practice IIS configuration through both interfaces.

GUI Lab Tasks

  • Create a website with bindings
  • Configure application pool
  • Set up virtual directory
  • Enable Windows Authentication
  • Configure SSL binding
  • Set up request filtering rules
  • Configure HTTP logging

PowerShell Lab Tasks

  • Create sites with WebAdministration
  • Manage app pools and recycling
  • Configure authentication methods
  • Set up request filtering
  • Create FTP site with SSL
  • Configure default documents
  • Export/import configurations
Start GUI Lab Start PowerShell Lab
Module 11 takeawaysArchitecturehttp.sys + WAS + w3wpApp Poolsisolation, identityBindingsIP + Port + Host + SNISSL/TLSpublic + AD CS + selfAuthWindows/Forms/BasicFilteringblock bad requestsLoggingW3C format daily filesReady for IIS labs and quiz
Course Home