IIS Manager Help (IIS 6.0)

The IIS Manager 6.0 Microsoft Management Console (MMC) snap-in is installed with IIS 7.0, so you can manage IIS 6.0 Web servers from your IIS 7.0 Web server. In addition, you must use IIS Manager 6.0 to manage FTP sites.

In This Section

Managing IIS 6.0 from Windows Vista

Configuring IIS For Dynamic Content

Accessing IIS 6.0 Help

FTP Site Administration


Managing IIS 6.0 from Windows Vista

When you are using IIS 7.0, you can still manage remote Web servers that are running IIS 6.0 on Windows Server 2003. The IIS Manager MMC snap-in that you used in IIS 6.0 is available on IIS 7.0. Use the following procedure to install the IIS Manager snap-in.

Procedure

Install IIS Manager

  1. Click Start and then click Control Panel.

  2. Do one of the following:

    1. On the Classic View, double-click Add or Remove Programs.

    2. On the Control Panel Home view, in the Programs category, click Add a program.

  3. In the left pane of the Add a Program page, click Advanced Options, and then click Windows Features.

  4. In the Turn Windows features on or off dialog box, expand Componentized IIS Web Server.

  5. Click Web Server Management Tools, click IIS 6 Management Compatibility, select IIS 6 Management Console, and then click OK.

See Also

  • FTP Site Administration


Configuring IIS For Dynamic Content

When you install IIS 6.0, it is locked down—only request handling for static Web pages is enabled, and only the World Wide Web Publishing Service (WWW service) is installed. By default, features, such as ASP, ASP.NET, Server-Side Includes Events, WebDAV publishing, and FrontPage® Server Extensions do not work unless they are enabled. If you do not enable this functionality after installing IIS, IIS returns a 404 error.

Note

If you install the Microsoft Visual Studio .NET 2003 development system with IIS 6.0 to host Web applications or XML Web services, you must enable ASP and FrontPage Server Extensions.

You can configure these request handlers, which are called Web service extensions, by manipulating the Web Service Extensions node in IIS Manager.

This section includes the following information:

  • Enabling and Disabling Dynamic Content in IIS 6.0: Explains how to enable or disable an individual Web service extension that is registered in the Web Service Extensions node in IIS Manager. Also discusses how to disable all Web Service extensions at once.

  • Adding a Web Service Extension: Describes how to register a Web service extension so that it appears in the Web Service Extensions node in IIS Manager.

  • Renaming a Web Service Extension: Explains how to rename a Web service extension that you have added to the list of Web service extensions in IIS.

  • Configuring an Application to Call a Web Service Extension: Describes how to specify which Web service extensions an application can call.


Enabling and Disabling Dynamic Content in IIS 6.0

You can enable or disable Web service extensions individually if they are registered in the Web Service Extensions node in IIS Manager. When enabled features are no longer required, you can disable them through the Web Service Extensions node in IIS Manager.

Important

You must be a member of the Administrators group on the local computer to perform the following procedure or procedures. As a security best practice, log on to your computer by using an account that is not in the Administrators group, and then use the runas command to run IIS Manager as an administrator. At a command prompt, type runas /User:Administrative_AccountName "mmc %systemroot%\system32\inetsrv\iis.msc".

Procedures

To enable or disable dynamic content

  1. In IIS Manager, expand the local computer, and then click Web Service Extensions.

  2. In the details pane, click the Web service extension that you want to enable or disable.

  3. Do one of the following:

    • To enable a disabled Web service extension, click Allow.

    • To disable an enabled Web service extension, click Prohibit.

    • To view the properties of a Web service extension, click Properties.

  4. Click OK.
Important

If you choose to allow all unknown ISAPI extensions or CGI extensions to run on your Web server, your Web server could be susceptible to computer viruses or worms that exploit these technologies. Instead, select only those specific ISAPI extensions or CGI extensions that you need to run on your Web server.

You can disable all Web service extensions that are registered on the local computer with one setting in the Web Service Extensions node of IIS Manager.

To disable all Web service extensions

  1. In IIS Manager, expand the local computer, and then click Web Service Extensions.

  2. Click Prohibit all extensions. A warning message appears.

  3. To disable all extensions, click Yes. To cancel the action, click No. To see more information, click Help.

  4. If you click Yes, the status of each Web service extension is disabled.


Adding a Web Service Extension

Before you can use, or to deny the use of, an HTTP request handler that is not in the list of Web service extensions, you must first register it by adding the HTTP request handler to the list of Web service extensions.

Procedures

To add a new Web service extension

  1. In IIS Manager, expand the computer name, and then click Web Service Extensions.

  2. In the details pane, click Add a new Web service extension.

  3. In the Extension name box, type the name of the new Web service extension.

  4. Click Add.

  5. In the Path to file box, type the path or click Browse to navigate to any files that the new Web service extension requires, and click OK.

  6. Optionally, select the Set extension status to Allowed check box to automatically set the status of the new Web service extension to Allowed.

  7. Click OK.


Renaming a Web Service Extension

You can rename a Web service extension you have added to IIS. Web service extensions included with IIS, however, cannot be renamed.

You can rename a Web service extension either in IIS Manager, or by directly editing the MetaBase.xml file. Using IIS Manager, the Web service extension you want to rename must first be removed, and then added using the new name. Renaming a Web service extension by editing the MetaBase.xml file is a more direct approach. Both methods are explained here.

Important

You must be a member of the Administrators group on the local computer to perform the following procedure or procedures. As a security best practice, log on to your computer by using an account that is not in the Administrators group, and then use the runas command to run IIS Manager as an administrator. At a command prompt, type runas /User:Administrative_AccountName "mmc %systemroot%\system32\inetsrv\iis.msc".

Procedures

To rename a Web service extension using IIS Manager

  1. In IIS Manager, expand the local computer, and then click Web Service Extensions.

  2. In the details pane, right-click the Web service extension that you want to rename, and then click Delete.

  3. At the confirmation prompt, click Yes.

  4. Add the Web service extension, using the new name for the extension.
To rename a Web service extension by editing the MetaBase.xml file

  1. Make sure that the metabase edit-while-running feature enabled.

  2. Open the \Windows\System32\Inetsrv\MetaBase.xml file in a text editor.

  3. Search for the name of the Web service extension that you want to rename, and then edit the name.

  4. Save and close the MetaBase.xml file.

  5. To verify that the Web service extension was renamed, in IIS Manager, right-click the Web Service Extensions folder, and click Refresh.

    The Web service extension is displayed with the new name in the details pane.

Related Information

  • For more information about adding a Web service extension, see Adding a Web Service Extension.


Configuring an Application to Call a Web Service Extension

Before an application can call a Web service extension, you must configure the application to make calls to that extension. A Web service extension can accept calls from more than one application.

Important

You must be a member of the Administrators group on the local computer to perform the following procedure or procedures. As a security best practice, log on to your computer by using an account that is not in the Administrators group, and then use the runas command to run IIS Manager as an administrator. At a command prompt, type runas /User:Administrative_AccountName "mmc %systemroot%\system32\inetsrv\iis.msc".

Procedures

To allow an application to call a Web service extension

  1. In IIS Manager, expand the local computer, and then click Web Service Extensions.

  2. Click Add and allow extensions for a specific application.

  3. From the Application list box, click the name of the application. The Web service extension that the application is allowed to call appears in the Extensions to be allowed box.

  4. Click OK.


Accessing IIS 6.0 Help

The following resources help you learn more about IIS 6.0.

IIS 6.0 Technical Overview

This paper is a technical overview of the many new features of IIS 6.0, including application pools and worker process isolation mode. It also describes IIS 6.0 improvements in Web server reliability, availability, management, scalability, and security. For more information, see the IIS 6.0 Technical Overview on the Microsoft Windows Server TechCenter.

IIS 6.0 Content Revision Summary

This document lists the changes that were made to the content in the IIS 6.0 Deployment Guide, the IIS 6.0 Operations Guide, and the IIS 6.0 Technical Reference since the original release of the documentation. To learn more, see the IIS 6.0 online documentation on the Microsoft Windows Server TechCenter.

IIS 6.0 Deployment

Prescriptive, task-based, and scenario-based guidance helps you design an IIS 6.0 solution that meets your needs. Scenarios include installing a new IIS 6.0 Web server, upgrading an existing Web server from an earlier version of IIS, and migrating existing Apache or IIS Web sites and applications to a newly installed Web server. To learn more, see the IIS 6.0 online documentation on the Microsoft Windows Server TechCenter.

IIS 6.0 Operations

Learn how to perform common administrative tasks, set up Web sites, administer Web servers, configure performance and logging settings, and troubleshoot IIS 6.0. Reference material includes descriptions of metabase properties, registry keys, performance counters, and events. To learn more, see the IIS 6.0 online documentation on the Microsoft Windows Server TechCenter.

IIS 6.0 Technical Reference

In-depth technical reference information helps you effectively operate, maintain, and troubleshoot servers that are running IIS 6.0. Content includes a complete description of IIS 6.0 architecture and the practical information and tools to help you perform everyday administrative tasks. To learn more, see the IIS 6.0 online documentation on the Microsoft Windows Server TechCenter.

IIS 6.0 TechCenter Web Site

This Web site contains links to many resources that help deploy, maintain, and support IIS. To learn more, see the IIS 6.0 TechCenter on the Microsoft Windows Server TechCenter.

UrlScan Version 2.5

This security tool restricts the types of HTTP requests that IIS processes. By blocking specific HTTP requests, UrlScan helps prevent potentially harmful requests from reaching the server. For more information, see the UrlScan Security Tool on the Microsoft Windows Server TechCenter.

IIS 6.0 Migration Tool

This command-line tool automates several of the steps that are required to move a Web application from IIS 4.0, IIS 5.0, or IIS 6.0 to a clean installation of IIS 6.0. The tool transfers configuration data, Web site content, and application settings to a new IIS 6.0 server. For more information, see the IIS 6.0 Migration Tool on the Microsoft Download Center.

IIS 6.0 Resource Kit Tools

The IIS 6.0 Resource Kit Tools can help you administer, secure, and manage IIS. Use them to query log files, deploy Secure Sockets Layer (SSL) certificates, use custom site authentication, verify permissions, troubleshoot problems, and more. For more information, see IIS 6.0 Resource Kit Tools on the Microsoft Download Center.

IIS IT Pro Community on TechNet

Contact other IT Professionals who use IIS. Participate in discussion groups, read FAQs, join a user group, and get the latest webcast schedule. For more information, see the IIS Community Center on the Microsoft Windows Server TechCenter.

White Papers

Deploying and Configuring Internet Information Services (IIS) 6.0 with Remotely Stored Content on UNC Servers and NAS Devices

This paper describes how to configure and tune IIS 6.0 and a remote server acting as a centralized store for files, applications, or other network resources made available to IIS using a Universal Naming Convention (UNC) path name. For more information, see Deploying and Configuring Internet Information Services (IIS) 6.0 with Remotely Stored Content on UNC Servers and NAS Devices on the Microsoft Windows Server TechCenter.

Configuring Application Isolation on Windows Server 2003 and Internet Information Services (IIS) 6.0

This paper explains application isolation as it relates to Web applications that run on Web servers that are running IIS 6.0 in worker process isolation mode. For more information, see Configuring Application Isolation on Windows Server 2003 and Internet Information Services (IIS) 6.0 on the Microsoft Windows Server TechCenter.

IIS Downloads

The Internet Information Services Downloads page provides links to tools and papers that help you manage and monitor an IIS 6.0 Web server.


FTP Site Administration

Whether your site is on an intranet or the Internet, the principles of providing a place to upload and download files using FTP are the same. You place your files in directories on your FTP server so that users can establish an FTP connection and transfer files with an FTP client or FTP-enabled Web browser. But beyond simply storing files on your server, you must manage how your site is deployed, and more importantly, how your site evolves. This section presents the basics of managing the infrastructure of an FTP site, from securing your site to hosting multiple sites.

This version of Internet Information Services (IIS) includes Isolating FTP Users to help administrators, and particularly Internet hosting providers, efficiently secure and commercialize the FTP services for their customers.

The FTP service is not installed by default on the operating systems in the Microsoft Windows ServerTM 2003 family. To install the FTP service, see FTP Site Setup.

This section includes the following information:

  • Changing FTP Site Home Directories: Describes the concept of a home directory and methods for changing the home directory of an FTP site.

  • Naming FTP Sites: Describes assigning a descriptive name to an FTP site.

  • Setting FTP Messages and Directory Output Style: Describes the message and directory output options.

  • Using Virtual Directories with FTP Sites: Describes the concept of a virtual directory and methods for creating and removing a virtual directory.

  • Stopping and Starting FTP Sites: Describes why you would need to stop and restart your FTP sites and how to perform these actions.

  • Changing Default FTP Site Settings: Describes how to change default settings globally or on an individual site.

  • Creating Multiple FTP Sites: Describes how to use IP addresses or port numbers to differentiate multiple FTP sites.

  • Adding FTP Sites to Your Server: Describes the process of adding a new FTP site to a server running IIS.

  • Redirecting FTP Requests to Directories or Network Shares: Describes forwarding file requests to a different directory or network share.

  • Modes and Data Transmission: Describes the different FTP connection and data transfer modes supported by IIS.

  • Server-to-Server FTP Transfer: Describes how to configure IIS for server-to-server FTP transfer by changing the EnablePortAttack registry key. The topic also suggests using Web Distributed Authoring and Versioning (WebDAV) publishing as a file transfer alternative.

  • Restarting FTP Uploads and Downloads: Describes the FTP rest command, which addresses the problem of losing a network connection while downloading a file.

  • Securing FTP Sites: Describes some of the misconceptions about FTP security and how to establish a secure FTP site.

  • Isolating FTP Users: Describes the concept of FTP user isolation and which type of isolation to use to restrict users to their own directories.


FTP Site Setup

IIS includes the File Transfer Protocol (FTP) service for publishing and managing files. This version of IIS includes Isolating FTP Users to help administrators (particularly Internet hosting providers) efficiently secure and commercialize FTP services for their customers.

The FTP service is not installed by default. To set up an FTP site, you must first install the FTP service through the Control Panel. Installing the FTP service creates a default FTP site, which you can then customize to your needs using IIS Manager.

Procedures

To install the FTP service

  1. From the Start menu, click Control Panel, double-click Add or Remove Programs, and then click Add/Remove Windows Components.

  2. From the Components list, click Application Server, and then click Details.

  3. From the Subcomponents of Application Server list, click Internet Information Services (IIS), and then click Details.

  4. From the Subcomponents of Internet Information Services (IIS) list, select the File Transfer Protocol (FTP) Service check box, and then click OK.

  5. Click Next. You might be prompted for the Windows Server 2003 product CD or the network install path.

  6. Click Finish.
Caution

Caution FTP sites or virtual directories that are configured to use Active Directory isolation or FTP load balancing should not be mapped to physical directories that are used for Web sites that use FrontPage® Server Extensions from Microsoft. Doing so can allow users to view any files in that folder structure over the network.

When you install the FTP service, a default FTP directory is created at LocalDrive:\Inetpub\Ftproot.

Setting up the FTP service for the first time involves first setting global FTP settings, then settings for the default FTP site, and finally adding the content to the FTP site. IIS uses an inheritance model, which means that settings on higher levels are automatically inherited by lower levels. Settings at lower levels can be edited individually to override inherited settings from the next level up.

If you change a setting at a lower level, then later change a setting at a higher level that conflicts with the lower-level setting, you will be prompted to choose whether you want to change the lower-level setting to match the new higher-level setting.

Before setting up the FTP service, see Securing FTP Sites with IIS 6.0 for clarification on security issues associated with the FTP service.

Important

You must be a member of the Administrators group on the local computer to perform the following procedure or procedures. As a security best practice, log on to your computer by using an account that is not in the Administrators group, and then use the runas command to run IIS Manager as an administrator. At a command prompt, type runas /User:Administrative_AccountName "mmc %systemroot%\system32\inetsrv\iis.msc".

To globally change FTP settings

  1. In IIS Manager, expand the local computer, right-click the FTP Sites folder, and click Properties.

  2. Change the default settings on the property pages as needed. The changes are inherited by all FTP sites on your computer. For information about individual settings, click Help.
To change settings for the default FTP site

  1. In IIS Manager, expand the local computer, expand the FTP Sites folder, right-click Default FTP site, and click Properties.

  2. Change the default settings on the property pages to replace any inherited settings as needed. For information about individual settings, click Help.
To publish content on your FTP site

  • Copy or move your content files into the default FTP publishing directory.
Note

If your network has a name resolution system, for example, DNS, visitors can type ftp:// followed by your computer name in the address box of their browsers to reach your site. If your network does not have a name resolution system, visitors must type ftp://, followed by the numerical IP address of your computer.

Related Information

  • For information about administering or adding an FTP site, see FTP Site Administration.

  • For conceptual information describing hosting multiple sites on one computer, see Hosting Multiple Web Sites on a Single Server.

  • To add virtual directories to an FTP site, see Using Virtual Directories with FTP Sites.

  • To customize the appearance of your FTP site, see Setting FTP Messages and Directory Output Style.

  • For information about isolating FTP users and the additional security it can provide, see Isolating FTP Users.


Adding FTP Sites to Your Server

IIS enables you to create multiple FTP sites on a single server. To add a site to a server, you must prepare the server and associated network services, and create a unique identity for the site.

Preparing to Add an FTP Site

Adding an FTP site to a server that is already hosting an FTP site requires some preparation.

  • Multiple FTP sites can use the same IP address. If you use a unique IP address to identify a new FTP site, however, you must obtain a static IP address from your organization or Internet service provider (ISP) and configure the TCP/IP settings on the server.

  • Standard FTP services use TCP port 21 by default, and it is generally not recommended to use any other port for FTP services. However, if you use a nonstandard TCP port number to identify a new FTP site for special situations (typically used on private Web sites for development and testing purposes), select a TCP port number above 1023 so it does not conflict with well-known port numbers assigned by the Internet Assigned Numbers Authority.

  • Use Windows Explorer to create a home directory for the FTP site content. Create subdirectories to store other content as needed. To organize home directories for multiple FTP sites on the same server, you can create a top-level directory for storing all home directories, and then create subdirectories for each site. You can create a home directory on the local server, or as a uniform naming convention (UNC) path on a network share. You can also create virtual directories that map to the physical directories.

Adding an FTP Site

IIS provides the following two methods for adding a new FTP site:

  • IIS Manager.

  • The Iisftp.vbs command-line administration script.

Important

You must be a member of the Administrators group on the local computer to perform the following procedure or procedures. As a security best practice, log on to your computer by using an account that is not in the Administrators group, and then use the runas command to run IIS Manager as an administrator. At a command prompt, type runas /User:Administrative_AccountName "mmc %systemroot%\system32\inetsrv\iis.msc".

Procedures

To add an FTP site through IIS Manager

  1. In IIS Manager, double-click the local computer, right-click the FTP Sites folder or a specific FTP site folder, point to New, and then click FTP Site.

  2. In the FTP Site Creation Wizard, click Next.

  3. In the Description box, type the name that you have selected for the FTP site, and then click Next.

  4. Under Enter the IP address to use for this FTP site, click All Unassigned to allow FTP to respond to all unassigned IP addresses on the server, or click a specific IP address for the site.

    Note

    In the FTP Site Creation Wizard, All Unassigned refers to IP addresses that are assigned to a computer but not assigned to a specific site. The default FTP site uses all of the IP addresses that are not assigned to other sites. Only one site can be set to use unassigned IP addresses for a given port number. For more information about how sites are identified, see Creating Multiple FTP Sites.

  5. The TCP port is assigned to port 21 by default. To use a nonstandard port number to create a unique identity for a private FTP site, under Type the TCP port for this FTP site, type a new port number above 1023, and then click Next.

  6. Click the appropriate user isolation method for this site, and then click Next.

  7. In the Path box, type or browse to the path of your FTP site home directory, and then click Next.

  8. Select Read permissions, or select Read and Write permissions for the site.

  9. Click Next, and then click Finish to close the FTP Site Creation Wizard.
Important

You must be a member of the Administrators group on the local computer to run scripts and executables. As a security best practice, log on to your computer by using an account that is not in the Administrators group, and then use the runas command to run your script or executable as an administrator. At a command prompt, type runas /profile /User:MyComputer\Administrator cmd to open a command window with administrator rights and then type cscript.exe ScriptName (include the script's full path and any parameters).

To add an FTP site by using the Iisftp.vbs command-line administration script

  1. If the new FTP site will be in a new directory, create the new directory.

  2. From the Start menu, click Run.

  3. In the Open box, type cmd, and then click OK.

  4. At the command prompt, switch to the systemroot\System32 directory.

  5. Type the following, and then press ENTER:

    cscript iisftp.vbs /create HomeDirectory " SiteDescription " IPAddress /b PortNumber

    For example, the following command creates and starts an FTP site called MyFTPSite on port 21, which is at IP address 123.456.789 with C:\Inetpub\Ftproot\NewDirectory as its home directory:

    cscript iisftp.vbs /create c:\inetpub\ftproot\newdirectory "myftpsite" /i 123.456.789 /b 21.
Note

The Iisftp.vbs script supports many more options for creating an FTP site. To see the options available, search for "iisftp.vbs" in Help and Support Center for Windows Server 2003.

Related Information

  • For information about installing the FTP service, see FTP Site Setup.

  • For more information about creating a home directory, see Changing FTP Site Home Directories.

  • For information about how to change properties on existing FTP sites, see Changing Default FTP Site Settings.

  • For information about how to add virtual directories, see Using Virtual Directories with FTP Sites.

  • For information to help you decide which user isolation method is appropriate for your site, see Isolating FTP Users.

  • For information about how to perform common tasks from command-line scripts, see Using Command-Line Administration Scripts.


Naming FTP Sites

A server running IIS can host multiple FTP sites. Each site runs on a virtual server, and each FTP site has a descriptive name.

Important

You must be a member of the Administrators group on the local computer to perform the following procedure or procedures. As a security best practice, log on to your computer by using an account that is not in the Administrators group, and then use the runas command to run IIS Manager as an administrator. At a command prompt, type runas /User:Administrative_AccountName "mmc %systemroot%\system32\inetsrv\iis.msc".

Procedures

To name an FTP site

  1. In IIS Manager, expand the FTP Sites folder, right-click the FTP site you want to name, and click Properties.

  2. On the FTP Site tab, in the Description box, type a descriptive name for the site.

  3. Click OK.

Related Information

  • For information about installing the FTP service, see FTP Site Setup.

  • For instructions about how to add new FTP sites, see Adding FTP Sites to Your Server.


Using Virtual Directories with FTP Sites

A virtual directory is a friendly name, or alias, either for a physical directory on your server hard disk that does not usually reside under the FTP site's home directory. The use of aliases is secure because users do not know where your files are physically located on the server relative to the FTP site's home directory, and therefore cannot use that information to attempt to modify your files. Aliases also make it easier for you to move directories in your site. Rather than changing the URL for the directory, you need only change the mapping between the alias and the physical location of the directory.

Another advantage of aliases is that you can publish content in multiple directories, to be accessed by all users, and control read/write permissions for each virtual directory separately. Even with User Isolation enabled, you can share public content by creating a virtual directory with access permission for all users.

If your FTP site contains files that are located in a directory other than the home directory, or on other computers, you must create virtual directories to include those files in your FTP site. To create a virtual directory that points to a physical directory on another computer, you must specify the full UNC path to the directory, and provide a user name and password for user rights.

If you want to publish from any directory not contained within your home directory, you must create a virtual directory. For example, suppose you are setting up a FTP site for your marketing team on your company's intranet. The following table shows an example of how you might construct the mapping between the physical location of the files and the URL that accesses the files.

URL | Physical Location | Alias
ftp://SampleFTPSite | C:\Inetpub\Ftproot | home directory
ftp://SampleFTPSite/PR | C:\Marketing\PublicRel | PR
ftp://SampleFTPSite/PR/OldPR | C:\Documents\Old | OldPR
ftp://SampleFTPSite/PRPublic | C:\Documents\Public | PRPublic
ftp://SampleWebSite/Customers | //Server2/SalesData | Customers

Both virtual directories and physical directories (directories without an alias) appear in IIS Manager. A modified folder icon indicates a virtual directory. The following illustration shows the FTP site example described above, where Customers, PR, and PRPublic are virtual directories.

You can also define nested virtual directories. For example, within the PR virtual directory, you can create another virtual directory, for example, named Oldpr. The content in Oldpr is accessible using the URL ftp://SampleFTPSite/PR/Oldpr.

Note

The FTP server does not include the names of any virtual directories when the content of the current working directory is requested by a client application. Physical directories, however, are listed.

Important

Access to the content of a virtual directory depends on the current working directory. For example, if a user is connected to the root directory of SampleFTPSite, assuming that the user has the necessary permissions, the user can change the working directory to the following paths: /PRPublic, /PR, /PR/Oldpr, and /Customers only if the user knows the site structure. For example, if the current working directory is /PRPublic, the user will receive an error message when attempting to change the working directory to /PR by typing the command cwd /PR, but will successfully change the working directory to /PR by typing the command cwd ./PR.

Also, a user can use a combination of physical directory names and virtual directory names to change the working directory. For example, assume that under the physical path to which the PR virtual directory is mapped, there is a physical folder named Test, and the current working directory is the root of SampleFTPSite. The user can change the working directory to the physical Test folder using the command cwd PR/Test.

For a basic FTP site, you can place all of your files in the site's home directory, and most likely do not need to add virtual directories. If you have a complex site, or want to specify different URLs for different parts of your site, you can add virtual directories as needed. To make a virtual directory accessible from multiple sites, you must add the virtual directory to each site.

There are two ways to create or delete a virtual directory:

  • Using IIS Manager.

  • Using the iisftpdr.vbs administration script.

Important

You must be a member of the Administrators group on the local computer to perform the following procedure or procedures. As a security best practice, log on to your computer by using an account that is not in the Administrators group, and then use the runas command to run IIS Manager as an administrator. At a command prompt, type runas /User:Administrative_AccountName "mmc %systemroot%\system32\inetsrv\iis.msc".

Procedures

To create a virtual directory using IIS Manager

  1. In IIS Manager, expand the local computer, expand the FTP Sites folder, expand the FTP site to which you want to add a virtual directory, right-click the site or folder within which you wish to create the virtual directory, point to New, and then click Virtual Directory.

  2. Click Next.

  3. In the Alias box, type a name for the virtual directory, and click Next. This is the name the user types, and should be short and easy to type.

  4. In the Directory box, type or browse to the physical directory in which the virtual directory resides, and click Next.

  5. Under Allow the following permissions, select the check boxes next to the access permissions appropriate to your needs, and click Next.

  6. Click Finish. The virtual directory is created below the currently selected folder level.
Important

You must be a member of the Administrators group on the local computer to run scripts and executables. As a security best practice, log on to your computer by using an account that is not in the Administrators group, and then use the runas command to run your script or executable as an administrator. At a command prompt, type runas /profile /User:MyComputer\Administrator cmd to open a command window with administrator rights and then type cscript.exe ScriptName (include the script's full path and any parameters).

To create a virtual directory using the Iisftpdr.vbs administration script

  1. From the Start menu, click Run.

  2. In the Open box, type cmd, and click OK.

  3. At the command prompt, type cscript iisftpdr.vbs /create SampleFTPSite VirtualDirectoryName x:\path, and press ENTER. Substitute your FTP site name, virtual directory name, and path to the physical directory as appropriate.
Note

Deleting a virtual directory does not delete the corresponding physical directory or files.

To delete a virtual directory using IIS Manager

  • In IIS Manager, expand the FTP site containing the virtual directory you want to delete, right-click the virtual directory, click Delete, and then click Yes.
Note

The below method does not work for root virtual directories.

To delete a virtual directory using the Iisftpdr.vbs administration script

  1. From the Start menu, click Run.

  2. In the Open box, type cmd, and click OK.

  3. At the command prompt, type cscript iisftpdr.vbs /delete SampleFTPSite VirtualDirectoryName, and press ENTER. Substitute Your FTP site name and virtual directory name as appropriate.

Related Information

  • For information about installing the FTP service, see FTP Site Setup.

  • For information about Security for virtual directories, see Securing Virtual Directories, and see Access Control with IIS 6.0.


Changing Default FTP Site Settings

During installation of IIS, default values are set for the various properties assigned to FTP sites. Properties can be set at the global level, affecting all FTP sites on a server; on the individual site level; or at the directory or file level. IIS uses an inheritance model, which means that settings at higher levels are automatically inherited by lower levels. Settings at lower levels can be edited individually to override inherited settings from the next level up.

If you change a setting at a lower level, then later change a setting at a higher level that conflicts with the lower level setting, you are prompted to choose whether you want to change the lower-level setting to the new higher-level setting.

Important

You must be a member of the Administrators group on the local computer to perform the following procedure or procedures. As a security best practice, log on to your computer by using an account that is not in the Administrators group, and then use the runas command to run IIS Manager as an administrator. At a command prompt, type runas /User:Administrative_AccountName "mmc %systemroot%\system32\inetsrv\iis.msc".

Procedures

To globally set properties for all FTP sites

  1. In IIS Manager, expand the local computer, right-click the FTP Sites folder, and click Properties.

  2. Click Help on any of the tabs for more information about those settings.
To set properties for a single FTP site

  1. In IIS Manager, expand the FTP Sites folder, right-click the FTP site whose settings you want to change, and click Properties.

  2. Click Help on any of the tabs for more information about those settings.

Related Information

  • For information about installing the FTP service, see FTP Site Setup.


Creating Multiple FTP Sites

You can create multiple FTP sites using multiple IP addresses and multiple ports. While creating multiple sites with multiple IP addresses is a common and recommended practice, it can be more complicated because, by default, clients call port 21 when using the FTP protocol. Therefore, if you create multiple FTP sites using multiple ports, you need to inform users of the new port number so their FTP clients can locate and connect to the port.

If you create a new site using the same port as an existing site with the same IP address, the new site will not start. The general rule is that you can have multiple sites using the same IP and port, but only one site from this group can run at a time. If you try to start another site from this group, you receive an error message.

Important

You must be a member of the Administrators group on the local computer to perform the following procedure or procedures. As a security best practice, log on to your computer by using an account that is not in the Administrators group, and then use the runas command to run IIS Manager as an administrator. At a command prompt, type runas /User:Administrative_AccountName "mmc %systemroot%\system32\inetsrv\iis.msc".

Procedures

To create multiple FTP sites using multiple IP addresses

  1. In IIS Manager, expand the local computer, right-click the FTP Sites folder, point to New, and click FTP Site.

  2. Click Next.

  3. In the Description box, type a description of your FTP site, and then click Next.

  4. Under Enter the IP address to use this FTP site, type a new IP address, and leave the TCP port setting at 21.

  5. Complete the rest of the FTP Site Creation Wizard.
To create multiple FTP sites using multiple ports

  1. In IIS Manager, expand the local computer, right-click the FTP Sites folder, point to New, and click FTP Site.

  2. Click Next.

  3. In the Description box, type a description of your FTP site, and then click Next.

  4. Under Enter the IP address to use for this FTP site, type your Web server's IP address.

  5. Under Type the TCP port for this FTP site, change the TCP port from the default setting of 21 to an unallocated port number. If you are uncertain which port numbers are already allocated, choose a high number, for example a number between 5000 and 5999.

  6. Complete the rest of the FTP Site Creation Wizard.

Related Information

  • For information about installing the FTP service, see FTP Site Setup.


Stopping and Starting FTP Sites

The need to stop and restart an FTP site typically indicates a problem with the site. If your FTP site is slow, unresponsive, or is not running properly in some other way, stopping and then restarting the site can resolve a temporary problem with the software.

By default, FTP sites start automatically when your computer restarts. Starting a site restarts or resumes a specific site, or the FTP service if it was not previously running, which might immediately fix problems. Stopping a site disables the specific FTP site, disconnecting all client connections to the site. Stopping the FTP service stops all FTP sites and unloads the FTP service. Pausing a site prevents the FTP service from accepting new connections but does not affect requests that are already being processed.

Important

You must be a member of the Administrators group on the local computer to perform the following procedure or procedures. As a security best practice, log on to your computer by using an account that is not in the Administrators group, and then use the runas command to run IIS Manager as an administrator. At a command prompt, type runas /User:Administrative_AccountName "mmc %systemroot%\system32\inetsrv\iis.msc".

Procedures

To start, stop, or pause an FTP site

  • In IIS Manager, expand the local computer, expand the FTP Sites folder, right-click the site you want to start, stop, or pause, and click Start, Stop, or Pause.

If a site stops unexpectedly, IIS Manager might not correctly indicate the state of the site. In IIS Manager, right-click the FTP Sites folder and click Refresh to see the current state of all FTP sites.

Related Information

  • For information about installing the FTP service, see FTP Site Setup.

  • For information about restarting all of your Internet services,see Restarting IIS.

  • To change properties on existing FTP sites, see Changing Default FTP Site Settings.


Setting FTP Messages and Directory Output Style

By default, the IIS FTP service sends a banner message that identifies the FTP service, and the fact that FTP runs in IIS, to the client. The message can be a greeting that welcomes users to the FTP site when they log on, an exit message (see note) that users see when they log off, a message that informs users when the maximum number of connections has been reached, or a banner message. Also, you can send the client informational messages about your FTP sites. The message can be a greeting, an exit message, or information about connection status. These messages are blank by default.

Important

You must be a member of the Administrators group on the local computer to run scripts and executables. As a security best practice, log on to your computer by using an account that is not in the Administrators group, and then use the runas command to run your script or executable as an administrator. At a command prompt, type runas /profile /User:MyComputer\Administrator cmd to open a command window with administrator rights and then type cscript.exe ScriptName (include the script's full path and any parameters).

Procedures

To suppress the default FTP banner for all FTP sites on a computer

  1. From the Start menu, click Run.

  2. In the Open box, type cmd and click OK.

  3. At the prompt, type the following command and then press ENTER:

    Cscript.exe adsutil.vbs SET MSFTPSVC/SuppressDefaultFTPBanner true

Important

You must be a member of the Administrators group on the local computer to perform the following procedure or procedures. As a security best practice, log on to your computer by using an account that is not in the Administrators group, and then use the runas command to run IIS Manager as an administrator. At a command prompt, type runas /User:Administrative_AccountName "mmc %systemroot%\system32\inetsrv\iis.msc".

To globally set messages on all FTP sites

  1. In IIS Manager, expand the local computer, right-click the FTP Sites folder, and then click Properties.

  2. Click the Messages tab.

  3. Type messages in any of, or all of, the Banner, Welcome, Exit, and Maximum connections boxes. These messages will appear on all FTP sites.

  4. Click Apply, and then click OK.
To set messages on a specific FTP site

  1. In IIS Manager, right-click the FTP site for which you want to change messages, and then click Properties.

  2. Click the Messages tab.

  3. Type messages in any of, or all of, the Banner, Welcome, Exit, and Maximum connections boxes. Messages set at the individual FTP site level override messages set at the global level.

  4. Click Apply, and then click OK.

Setting the Directory Output Style

You can set the directory output style of all FTP sites, or an individual FTP site to be in either MS-DOS® or UNIX format. The directory output style defines the format that is used when an FTP client sends a /list command. The default directory output style is MS-DOS format.

Note

Although the exit message box can contain up to 30,000 characters, the FTP exit message size is limited to 1024 characters, including the reply code, blank, carriage return, and null. To prevent the exit message from being truncated, limit the length of the exit message to 1017 characters.

The UNIX directory listing style displays the year in a four-digit format when the year in the date of the file is different from the year in the date of the FTP server. No year is returned in cases where the year in the date of the file is the same as the year in the date of the FTP server.

To set the global FTP directory output style

  1. In IIS Manager, right-click the FTP Sites folder, and then click Properties.

  2. Click the Home Directory tab.

  3. Under Directory listing style, click UNIX or MS-DOS®.

  4. Click Apply, and then click OK.
To set the FTP directory output style for an individual FTP site

  1. In IIS Manager, expand the FTP Sites folder, right-click the FTP site for which you want to change the directory listing style, and then click Properties.

  2. Click the Home Directory tab.

  3. Under Directory listing style, click UNIX or MS-DOS®. The output style set at the individual FTP site level overrides the output style set at the global level.

  4. Click Apply, and then click OK.
Note

The MS-DOS directory listing style displays the year in a two-digit format by default. You can change this setting to display the year in a four-digit format.

Related Information

  • For information about installing the FTP service, see FTP Site Setup.


Changing FTP Site Home Directories

Each FTP site on a computer must have its own home directory. The default home directory for the default FTP site is LocalDrive:\Inetpub\Ftproot.

There are two ways to change the home directory of an FTP site:

  • Use IIS Manager

  • Edit the MetaBase.xml file directly.

Important

You must be a member of the Administrators group on the local computer to perform the following procedure or procedures. As a security best practice, log on to your computer by using an account that is not in the Administrators group, and then use the runas command to run IIS Manager as an administrator. At a command prompt, type runas /User:Administrative_AccountName "mmc %systemroot%\system32\inetsrv\iis.msc".

Procedures

To change the home directory of an FTP site using IIS Manager

  1. In IIS Manager, expand the local computer, expand the FTP Sites folder, right-click the FTP site whose home directory you want to change, and click Stop.

  2. Right-click the FTP site again, and click Properties.

  3. Click the Home Directory tab.

  4. Under The content for this resource should come from, click the location of your home directory.

    Note

    If you select a directory on a network share, you might need to enter a user name and password to access the resource. IUSR_computername is the default account used if another account is not specified. If you use an account with administrative credentials on the server, clients can gain access to server operations. This seriously jeopardizes the security of your network. For more information about security see, Security Best Practices in Windows Help.

  5. Click Apply, and then click OK.

  6. Right-click the FTP site you've just changed, and click Start.

  7. Optional: Move or copy the content for the FTP site from the original home directory to the new home directory.
To change the home directory of an FTP site by editing the MetaBase.xml file

  1. In IIS Manager, right-click the local computer, point to All Tasks, and click Select Restart IIS....

  2. In the Stop/Start/Reset dialog box, click Stop Internet Services, and click OK.

  3. Expand the FTP Sites folder, right-click the FTP site you want to change, and click Stop.

  4. In Windows Explorer, from the localdrive\System32\Inetsrv folder, open the MetaBase.xml file in a text editor.

  5. To change the FTP home directory, search for "/msftpsvc/1/root" and change the Path= value to the new location of the FTP home directory. Substitute the value 1 with the value corrresponding to the FTP site you want to change.

  6. In IIS Manager, right-click the local computer, point to All Tasks, and click Select Restart IIS....

  7. In the Stop/Start/Reset dialog box, click Start Internet Services, and click OK.

  8. Optional: Move or copy the content for the FTP site from the original home directory to the new home directory.

Related Information

  • For information about installing the FTP service, see FTP Site Setup.


Securing FTP Sites with IIS 6.0

FTP is commonly misunderstood as a secure means for transferring data, because the FTP server can be configured to require a valid user name and password combination prior to granting access. Be aware that neither the credentials specified at logon nor the data itself is encrypted or encoded in any way. All credentials are sent across the network in plaintext. In other words, all FTP data can be easily intercepted and analyzed by any station on any network between the FTP client and FTP server. The risk of plaintext credentials is that someone other than the intended users could log on to FTP and download the files you have placed there. If you intend to place sensitive data on your FTP site or if secure communication between clients and your FTP server are important, consider using FTP over an encrypted channel such as a Virtual Private Network secured with Point-to-Point Tunneling Protocol or Secure Internet Protocol (IPSec). You should also consider using WebDAV, which utilizes Secure Sockets Layer (SSL).

Caution

FTP sites or virtual directories that are configured to use Active Directory isolation or FTP load balancing should not be mapped to physical directories that are used for Web sites that use FrontPage® Server Extensions from Microsoft. Doing so can allow users to view any files in that folder structure over the network.

  • For information about installing the FTP service, see FTP Site Setup.

  • To learn how to set up a private network over the Internet using Point-to-Point Tunneling Protocol (PPTP) or how to set up secure IP communications with a Virtual Private Network (VPN) and IPSec, see "PPTP", "VPN", and "IPSec" in Help and Support Center for Windows Server 2003.


Isolating FTP Users

FTP user isolation is a solution for Internet service providers (ISPs) and application service providers who want to offer their customers individual FTP directories for uploading files and Web content. FTP user isolation prevents users from viewing or overwriting other users' Web content by restricting users to their own directories. Users cannot navigate higher up the directory tree because the top-level directory appears as the root of the FTP service. Within their specific site, users have the ability to create, modify, and delete files and folders.

FTP user isolation is a site property, not a server property. It can be turned on or off for each FTP site.

FTP user isolation supports the following three isolation modes, each of which enables different levels of isolation and authentication:

  • Do not isolate users: This mode does not enable FTP user isolation. It is designed to work similarly to earlier versions of IIS.

  • Isolate users: This mode authenticates users against local or domain accounts before they can access the home directory that matches their user name.

  • Isolate users using Active Directory: This mode authenticates user credentials against a corresponding Active Directory container, rather than searching the entire Active Directory, which requires large amounts of processing time.

    Note

    This mode requires an Active Directory server running on an operating system in the Windows Server 2003 family. A Windows 2000 Active Directory can also be used but requires manual extension of the User Object schema. To learn more about setting up an Active Directory server, see Help and Support Center for Windows Server 2003.

In this section:

  • Creating a New FTP Site with Isolate Users Mode: Describes how to create a new FTP site with Isolate users mode.

  • Converting an Existing FTP Site to Isolate Users Mode: Describes how to convert an existing FTP site to Isolate users mode.

  • Creating a New FTP Site with Isolate Users Using Active Directory Mode: Describes how to create a new FTP site with Isolate users using Active Directory mode.

  • Enabling Anonymous Access for an FTP Site Configured with Isolate Users Using Active Directory Mode: Describes how to enable anonymous access for an FTP site configured with Isolate users using Active Directory mode.

  • Converting an Existing FTP Site to Isolate Users Using Active Directory Mode: Describes how to prepare and convert an existing FTP site to Isolate users using Active Directory mode.

Related Information

  • For more information about FTP user isolation modes, see Hosting Multiple FTP Sites with FTP User Isolation.

  • For information about installing the FTP service, see FTP Site Setup.


Creating a New FTP Site with Isolate Users Mode

Isolate users mode authenticates users against local or domain accounts before they can access the home directory that matches their user name. All user home directories are in a directory structure under a single FTP root directory where each user is placed and restricted to their home directory. Users are not permitted to navigate out of their home directory. If users need access to dedicated shared folders, you can also establish a virtual root. This mode does not authenticate against Active Directory directory service.

Important

You must be a member of the Administrators group on the local computer to perform the following procedure or procedures. As a security best practice, log on to your computer by using an account that is not in the Administrators group, and then use the runas command to run IIS Manager as an administrator. At a command prompt, type runas /user:Administrative_AccountName "mmc %systemroot%\system32\inetsrv\iis.msc".

To create a new FTP site with Isolate users mode

  1. In IIS Manager, click the local computer, right-click the FTP Sites folder, point to New, and then click FTP Site.

  2. In Welcome to the FTP Site Creation Wizard, click Next.

  3. In FTP Site Description, type a description for the FTP site, and then click Next.

  4. In IP Address and Port Settings, type an IP address and port number, and then click Next.

  5. In FTP User Isolation, click Isolate users, and then click Next.

  6. In FTP Site Home Directory, type or browse to the FTP site home directory, and then click Next.

  7. Enable the Read and Write permissions as appropriate, and then click Next, and click Finish.
Important

Adhere to the following convention when creating each user's FTP site directories:

  • If anonymous access is allowed, create the subdirectories LocalUser and LocalUser\Public under the FTP site home directory.

  • If users of the local computer log on with their individual account user names (rather than as anonymous users), create the subdirectory LocalUser and a separate directory LocalUser\UserName under the FTP site home directory for each user allowed to connect to the FTP site.

  • If users of different domains log on with their explicit Domain\UserName credentials, create a subdirectory for each domain (by using the name of the domain) under the FTP site root directory. Under each domain directory, create a directory for each user. For example, to support access by user Contoso\user1, create the Contoso and Contoso\user1 directories.

Related Information


Converting an Existing FTP Site to Isolate Users Mode

You can convert an existing FTP site to Isolate users mode after you upgrade to Windows Server 2003.

To convert an existing FTP site to Isolate users mode

  1. In IIS Manager, click the local computer, double-click the FTP Sites folder, right-click the FTP site that you want to convert, and then click Stop.

    Important

    You must stop the FTP service because you need to move user directories to new locations.

  2. If users log on to the FTP site with local machine accounts or if you allow anonymous access to the FTP site, complete the following steps:

    1. Under the FTP home directory, create a subdirectory named LocalUser.

    2. If you allow anonymous access to the site, create a subdirectory under LocalUser named Public. This will be the home directory for anonymous users.

    3. Move the content for the anonymous user from the existing location to the new Public subdirectory.

    4. For each FTP user with a local computer account, create a subdirectory under LocalUser with the user account name. Move content from existing user directories to these new directories.

  3. If domain users access the site, complete all of the following steps:

    1. Create a subdirectory under the FTP home directory for each domain for which users are accessing the site. The subdirectories must be named by the domain names.

    2. For each user, create a subdirectory under the corresponding domain-named subdirectory, and move existing content into the new subdirectories.

  4. To finish the conversion, do one of the following:

    • Use the FTP Site Creation Wizard to create a new FTP site, and point the site path to the FTP home directory.

    • Edit the metabase, set the UserIsolationMode metabase property to 1 for the site and the path in the corresponding /Root virtual root section to the new site home directory.

    Important

    Before you edit the metabase, verify that you have a backup copy that you can restore if a problem occurs.

  5. In IIS Manager, click the local computer, double-click the FTP Sites folder, right-click the converted FTP site, and then click Start.

Related Information


Creating a New FTP Site with Isolate Users Using Active Directory Mode

Isolate users using Active Directory mode authenticates user credentials against a corresponding Active Directory container, rather than searching the entire Active Directory, which requires large amounts of processing time.

Note

This mode requires an Active Directory server running on an operating system in the Windows Server 2003 family. A Windows 2000 Active Directory can also be used but requires manual extension of the User Object schema. To learn more about setting up an Active Directory server, see Help and Support Center for Windows Server 2003.

Specific FTP server instances can be dedicated to each customer to ensure data integrity and isolation. When a user's object is located within the Active Directory container, the msIIS-FTPRoot and msIIS-FTPDir properties are extracted to provide the full path to the user's home directory. If the FTP service can successfully access the path, the user is placed within the home directory, which represents the FTP root location. The user sees only their FTP root location and is, therefore, restricted from navigating higher up the directory tree. The user is denied access if either the msIIS-FTPRoot or msIIS-FTPDir property do not exist, or, if these two together do not form a valid and accessible path.

Important

You must be a member of the Administrators group on the local computer to perform the following procedure or procedures. As a security best practice, log on to your computer by using an account that is not in the Administrators group, and then use the runas command to run IIS Manager as an administrator. At a command prompt, type runas /user:Administrative_AccountName "mmc %systemroot%\system32\inetsrv\iis.msc".

To create FTP sites with Isolate users using Active Directory mode

  1. In IIS Manager, click the local computer, right-click the FTP Sites folder, point to New, and click FTP Site.

  2. In the Welcome to the FTP Site Creation Wizard, click Next.

  3. In FTP Site Description, type a description for the FTP site, and then click Next.

  4. In IP Address and Port Settings, type an IP address and port, and then click Next.

  5. In FTP User Isolation, click Isolate users using Active Directory, and then click Next.

  6. In the User name text box, type the user name, using the Domain\User format, or browse to the user name. Choose a user with minimal domain privileges. This user name is used to access Active Directory and read the home directory properties.

  7. In the Password text box, type the password of the user.

  8. In the Enter the default Active Directory domain text box, type or browse to the default domain name.

    Note

    This domain name is used for the users who do not specify their user domain when they log on. In other words, a user connecting with the user name Domain1\User1 is authenticated against Domain1, while a user connecting as User2 is authenticated against the default logon domain. If a default domain is not named and a user does not specify a domain name, access is denied for all but anonymous users. Type the base domain name only, not the fully qualified name. For example, type MyDomain, not MyDomain.dept.microsoft.com.

  9. Click Next. You are prompted to re-enter the password for the user entered in the previous steps.

  10. Enable the Read and Write permissions as appropriate, and then click Next, and click Finish.

Related Information


Enabling Anonymous Access for an FTP Site Configured with Isolate Users Using Active Directory Mode

By default, anonymous access is disabled to sites created in Isolate users using Active Directory mode.

To enable anonymous access for the FTP site configured with Isolate users using Active Directory mode

  • Configure the metabase properties as shown in the following example. You can do so by using the adsutil.vbs SET command-line tool.

    • adsutil set /msftpsvc/6634/AllowAnonymous TRUE

    • adsutil set /msftpsvc/6634/AnonymousOnly FALSE

    • adsutil set /msftpsvc/6634/AnonymousUserName MyDomain\LowPrivUser

    • adsutil set /msftpsvc/6634/AnonymousUserPass PaSsWoRd

Note

When a site is created with Isolate Users Using Active Directory mode, the Path property of the root FTP virtual directory (which, for the other isolation modes identifies the home directory) is set empty. Also, the AccessFlags property of the root FTP virtual directory contains the AccessNoPhysicalDir flag. Do not alter these two values. If you change or remove them, further access to the site is not allowed.

Related Information

  • For more information about FTP user isolation, see Hosting Multiple FTP Sites with FTP User Isolation.

  • For more information about using adsutil.vbs, see Using the Adsutil.vbs Administration Script.


Converting an Existing FTP Site to Isolate Users Using Active Directory Mode

You can convert an existing FTP site to Isolate users using Active Directory mode after you upgrade to Windows Server 2003. Before you convert an existing FTP site to the Isolate users using Active Directory mode, complete the following procedure.

To prepare to convert an existing FTP site to Isolate users using Active Directory mode

  1. Plan user distribution over your network file server resources.

  2. Create server shares and user directories for all users that have access to FTP.

  3. Make sure to create a directory for anonymous access (if you want to enable anonymous user connections).

  4. For each user, set the msIIS-FTPRoot and msIIS-FTPDir properties in Active Directory to point to the new home directory using Iisftp.vbs, by typing the following at the command line:

    Iisftp.vbs /SetADProp UserName FTPRoot Server \ Share

    Iisftp.vbs /SetADProp UserName FTPDir Directory

    For complete Iisftp.vbs syntax, type Iisftp.vbs /SetADProp /? at the command prompt.

You can complete the conversion by using the FTP Site Creation Wizard (recommended), or by following the procedure below to configure the metabase.

To convert an existing FTP site to Isolate users using Active Directory mode

  1. In IIS Manager, click the local computer, double-click the FTP Sites folder, right-click the FTP site that you want to convert, and then click Stop.

  2. Move existing user content into the new directories.

  3. Edit the metabase directory or use adsutil.vbs to configure the following metabase properties:

    • UserIsolationMode: Set to 2.

    • ADConnectionUserName: Set to a user that has permission to read Active Directory properties. Use Domain\UserName format.

    • ADConnectionPassword: Set to the password for the user in ADConnectionUserName.

    • DefaultLogonDomain: Set to the default domain name.

    • For the site root virtual directory: Set the Path property to an empty string, and add the value AccessNoPhysicalDir to the AccessFlags property, using the | operator; for example: AccessFlags = AccessRead | AccessNoPhysicalDir.

    • AllowAnonymous, AnonymousUserName, and AnonymousPassword: See To enable anonymous access for the Isolate Users Using Active Directory FTP site earlier in this topic for information about how to set these properties.

      Important

      Before you edit the metabase, verify that you have a backup copy that you can restore if a problem occurs.

  4. In IIS Manager, click the local computer, double-click the FTP Sites folder, right-click the converted FTP site, and then click Start.

Related Information


Modes and Data Transmission

When using FTP, there are two things to consider. The first is the connection mode, which can be either passive or active; and the second is the data transfer mode, which can be stream, block, or compressed.

The IIS-based FTP service supports both active and passive mode connections, depending on the method that is specified by the client. IIS does not support disabling either active or passive connection modes.

The default data transfer mode for IIS-based FTP is stream. IIS does not currently support block or compressed data transfer mode.

Unlike HTTP and other protocols used on the Internet, the FTP protocol uses a minimum of two connections during a session: a half-duplex connection for control, and a full-duplex connection for data transfer. By default, TCP port 21 is used on the server for the control connection, but the data connection is determined by the method that the client uses to connect to the server, as detailed below.

  • Active-mode FTP connections are sometimes referred to as "client-managed" because the client sends a port command to the server, over the control connection. The command requests the server to establish a data connection from TCP port 20 on the server to the client, using the TCP port that is specified by the port command.

  • Passive-mode FTP connections are sometimes referred to as "server-managed", because after the client issues a pasv command, the server responds with one of its transient ports used as the server-side port of the data connection. After a data connection command is issued by the client, the server connects to the client using the port immediately above the client-side port of the control connection.

Data Transfer and Firewalls

The most common problem encountered with FTP over the Internet involves data transfers through a proxy server, a firewall, or a Network Address Translation (NAT) device. In most cases these network security devices allow the control connection to be established over TCP port 21 (that is, the user can successfully log on to the FTP server), but when the user attempts a data transfer such as DIR, LS, GET, or PUT, the FTP client appears to stop responding because the network security device is blocking the data connection port that is specified by the client. If the network security device supports logging, you can verify port blocking by reviewing the deny/reject logs on the network security device.

The following table includes FTP clients provided by Microsoft, and the connection mode supported by each client.

FTP Client | Transfer Mode
Command line | Active
Internet Explorer 5.1 and earlier | Passive
Internet Explorer 5.5 and later | Active and Passive
FrontPage 1.1 to FrontPage 2002 | Active
  • For information about installing the FTP service, see FTP Site Setup.

  • For more information about FTP data transmission, refer to the FTP protocol specification at the World Wide Web Consortium Web site.

  • For information about setting the port range used for passive-mode FTP connections, see the PassivePortRange Metabase Property.


Restarting FTP Uploads and Downloads

If your connection closes unexpectedly while uploading or downloading a file using FTP, it might not be necessary to transfer the entire file again, because the IIS -based FTP service supports restarting failed FTP uploads and downloads. If your FTP client software supports FTP restart, you can reestablish the FTP connection and restart the file transfer; and the file transfer will automatically pick up where it left off.

The command-line FTP client included with Microsoft Windows does not support restarting downloads. You must use a third-party command-line FTP client for that functionality. If you are using a command-line FTP client, uploads can be resumed by using the append command to add data to an existing file. Downloads can be restarted by first issuing a rest command with the desired offset, and then issuing the retr command.

Note

The IIS implementation of FTP restart is limited to an offset of less than four gigabytes.

  • For information about installing the FTP service, see FTP Site Setup.

  • For information about the commands supported by the Microsoft Windows command-line FTP client, see the Microsoft Developer Network (MSDN) Web site.

  • For the official FTP specification with the entire FTP command set, see the World Wide Web Consortium Web site.


Server-to-Server FTP Transfer

You can configure IIS to allow server-to-server FTP transfers by changing the EnableDataConnTo3rdIP and EnablePasvConnFrom3rdIP keys in the system registry. By default, the EnablePasvConnFrom3rdIP registry key is disabled to prevent malicious attacks against the FTP service. Although details for configuring server-to-server transfers are listed below, Microsoft does not recommend enabling the EnablePasvConnFrom3rdIP registry key on IIS-based FTP servers connected to the Internet.

Important

Using Registry Editor incorrectly can cause serious problems that require reinstalling the operating system. Because Registry Editor bypasses the standard safeguards that prevent you from entering settings that are conflicting or likely to degrade performance or damage your system, exercise caution when making changes to the registry. Microsoft cannot guarantee that problems resulting from the incorrect use of Registry Editor can be solved. For information about how to edit the registry, see the "Changing Keys and Values" topic in Registry Editor Help.

The procedure below lists the steps required to transfer a binary file (called MyFile.xls) from Server1 (IP Address: 192.168.0.10) to Server2 (IP Address: 192.168.1.20) using the command-line FTP client on Workstation1. You must have Write permissions granted on Server2 for this example to work. You must also have two computers running the IIS-based FTP service.

The server that initiates the data channel (Server1 in this

example) must have the following value set in the registry:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MSFTPSVC\Parameters\EnableDataConnTo3rdIP=1

Server2 must have the following value set in the registry:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MSFTPSVC\Parameters\EnablePasvConnFrom3rdIP=1

In normal client/server FTP transfers, the user is only responsible for entering "friendly" commands to the server; the client responds automatically. When a server-to-server FTP transfers is performed, another server is the client. Therefore, the user is responsible for sending all FTP commands to both servers (in RFC959 format, preceded by the "literal" keyword).

Procedures

To transfer a binary file between FTP servers

  1. Connect to Server1 using a command-line FTP client. (This connection will be referred to as Client1).

  2. Connect to Server2 using a command-line FTP client. (This connection will be referred to as Client2).

  3. Issue the following command in Client2: literal pasv.

    The computer responds with: 227 Entering Passive Mode (192,168,1,20,15,61).

    Note that 15,61 represents the low and high order bytes of the port number (port 3901 in this case), which is randomly assigned with each FTP connection. As a result, the last two numbers of this string will be different.

  4. Issue the following command in Client1: literal port 192,168,1,20,15,61.

    The computer responds with: 200 Port Command Successful.

    Use the IP and port string returned in step 3.

  5. Issue the following command in both Client1 and Client2: literal type i.

    The computer responds with: 200.

  6. Type set to I.

  7. Issue the following command in Client1: literal retr myfile.bin.

    The computer responds with: 125 Data Connection already open; Transfer Starting.

  8. Issue the following command in Client2: literal stor myfile.bin.

    The computer responds with: Opening BINARY mode data connection for myfile.bin.

  9. Continue issuing the literal stat command on Client2 until it returns a 211 response indicating "No data connection is listed".

    This 211 response message is several lines long and indicates that the transfer is no longer in progress.

  10. To transfer files from Server2 to Server1, issue the literal retr command from Client1 and the literal stor command from Client2.

File Transfer Alternatives

If you are concerned about FTP security, or if a network security device like a firewall prevents server-to-server data transmission, consider using a file transfer alternative like Web authoring with WebDAV. WebDAV is the recognized standard for HTTP file transfers.

Related Information

  • For information about port, pasv, stor, retr, stat, and other literal FTP commands, see the World Wide Web Consortium Web site.


Redirecting FTP Requests to Directories or Network Shares

You can redirect requests for files in one directory to a different directory or to a network share. When an FTP client requests the file from the original URL, the FTP server instructs the client to request the file from the redirected resource. Redirection is useful when users have grown accustomed to using a particular URL to access certain files.

Important

You must be a member of the Administrators group on the local computer to perform the following procedure or procedures. As a security best practice, log on to your computer by using an account that is not in the Administrators group, and then use the runas command to run IIS Manager as an administrator. At a command prompt, type runas /User:Administrative_AccountName "mmc %systemroot%\system32\inetsrv\iis.msc".

Procedures

To redirect requests to another directory or network share

  1. In IIS Manager, expand the FTP Sites folder, right-click the FTP site or directory within an FTP site to which you want to add a redirect, and click Properties.

  2. Click the Home Directory, Virtual Directory, or Directory tab.

  3. Under The content for this resource should come from, click the location from which the files should be served.

  4. In the Local path box, type or browse to the path from which you want the files served.

  5. Click OK.

Making an FTP virtual directory visible to users

You can configure your FTP site so that a user browsing the site sees a directory entry for a virtual directory. While the directory entry the user sees is a physical directory, when the user navigates into the physical directory, the contents listed are actually of a virtual directory you have specified. This is possible because IIS lists virtual paths before listing physical paths. This makes it appear to the user that they are seeing the contents of a physical directory, when in fact they are seeing the content in a virtual directory.

To make an FTP virtual directory visible to users

  1. Create a physical directory in the user's home FTP directory. For example, if your FTP site is configured for user isolation, the user's home directory will either be LocalUser\Public (for anonymous users), or LocalUser\username (for authenticated users).

  2. In IIS Manager, expand the local computer, expand the FTP Sites folder, expand the FTP site to which you want to add a virtual directory, right-click the site or folder within which you wish to create the virtual directory, point to New, and then click Virtual Directory.

  3. Click Next.

  4. In the Alias box, type the name for the virtual directory and click Next.

    Important

    The alias must exactly match the name of the directory you created in step 1.

  5. In the Directory box, type the path to, or browse to the physical directory where the content for this virtual directory resides, and click Next.

  6. Under Allow the following permissions, select the check boxes next to the access permissions appropriate to your needs, and click Next.

  7. Click Finish. The virtual directory is created within the FTP site.

    When a user browses the FTP site, the physical directory you created in step 1 is displayed in the folder listing. When the user then navigates to the physical directory, however, the content of the redirected virtual directory is actually displayed
Note

You can also use this procedure with nested virtual directories.

Related Information

  • For information about how to set up a user's home FTP directory using user isolation, see Isolating FTP Users.

  • For information about installing the FTP service, see FTP Site Setup.


IIS 6.0 F1: IIS 6.0 User Interface Help

This file provides context-sensitive Help for Internet Information Services (IIS) 6.0.

To view this Help, run Internet Information Services (IIS) 6.0 Manager and click Help from any property page within IIS.

Related Topics

To view detailed conceptual and procedural information about IIS 6.0, see the IIS 6.0 online documentation on the Microsoft Windows Server TechCenter.


IIS 6.0 F1: Connect to Computer

Use this dialog box to connect to a remote computer by typing the IP address, server name (if you are on the same subnet), or fully-qualified domain name.

To log on as another user for the target computer, type the appropriate user name and password.

Computer Name

Type the name of the computer to which you want to connect.

Browse

Browse the network to locate the name of the computer to which you want to connect.

Connect As

Click to connect to another computer using a specific name.

Related Topics

To learn more about remotely administering IIS, see the IIS 6.0 online documentation on the Microsoft Windows Server TechCenter.


IIS 6.0 F1: Configuration Backup/Restore

After connecting to the computer that you want to back up or restore, use this dialog box to save configuration settings for all Web sites, FTP sites, virtual directories, directories, and files that you administer on your computer. (You must first connect to the computer that you want to back up or restore.) Most configuration settings are stored in the metabase, but some are stored in the registry. This utility backs up only the configuration settings of the metabase.

Previous Backups

The Backups list box lists all configuration backups, their version numbers, and the date and time the backups were created. You must supply the name when a backup file is created.

Restoring the Metabase Configuration Settings

To return to a previous configuration state of the metabase, click a backup version, and then click Restore. IIS stops all services, overwrites all current configuration settings from the backup file, and then restarts all IIS services. Completion time is dependent on the size of the metabase.

Backups

This is a list of all backups available for the currently selected computer, including version number (#) and the creation date and time.

Create backup

Click to create a backup of the current metabase configuration settings after you supply a name for the backup version.

Restore

Click to replace the configuration settings in the current metabase with the settings of the currently selected version.

Delete

Click to delete the currently selected backup file and remove the name from this list.

Related Topics

To learn more about the role and structure of the metabase, and about the role of the registry, see the IIS 6.0 online documentation on the Microsoft Windows Server TechCenter.


IIS 6.0 F1: Restarting IIS

Restarting or stopping Internet Information Services (IIS), or rebooting your Web server, is a severe action. When you restart the Internet services, all sessions connected to your Web server (including Internet, FTP, SMTP, and NNTP) are dropped. Any data held in Web applications is lost. All Internet sites are unavailable until Internet services are restarted. For this reason, you should avoid restarting, stopping, or rebooting your server if at all possible. IIS 6.0 includes application pool recycling and several other features that provide alternatives to restarting IIS. For a list of features designed to improve IIS reliability and remedy the need to restart IIS, see "Restarting IIS" in IIS Help.

Note

Internet services include Web, FTP, SMTP, NNTP, and IIS Administrative services.

What do you want IIS to do?

This is a list of IIS restart options, as well as explanations and consequences of each option.

Start Internet Services

Click to start all Internet services. You can use the Services node in the Computer Management snap-in to change which services start up automatically. If Internet services do not respond after issuing this command, restart your computer.

Stop Internet Services

Click to stop all Internet services. All sessions connected to your Web server (including Internet, FTP, SMTP, and NNTP) are dropped. Any data held in Web applications is lost. All Internet sites are unavailable until Internet services are restarted. Certain changes to IIS require stopping the Internet services in order to register those changes, for example when installing a new COM component or ISAPI filter.

Restart <Local Machine>

Click to reboot your server. Rebooting your server is a severe action. All sessions connected to your Web server (including Internet, FTP, SMTP, and NNTP) are dropped. Any data held in Web applications is lost. All Internet sites are unavailable until the server and Internet services are restarted.

Restart Internet Services

Click to stop and then restart all Internet services. All sessions connected to your Web server (including Internet, FTP, SMTP, and NNTP) are dropped. Any data held in Web applications is lost. All Internet sites are unavailable until Internet services are restarted.

Related Topics

To learn more about restarting IIS, including a list of features in IIS 6.0 that improve reliability and availability and thereby mitigate the need to restart your server or the Internet service, see the IIS 6.0 online documentation on the Microsoft Windows Server TechCenter.


IIS 6.0 F1: Internet Information Services

The following features, when enabled, impact all Internet services. Internet Information Services (IIS) prompts the Internet services to restart before the changes can take effect.

Enable Direct Metabase Edit

This feature is also known as edit-while-running. Select this option to change metabase property values while IIS is running. Changes take effect immediately. You can implement changes to the metabase using common text-editing tools like Notepad. You must be an administrator of the computer running IIS to enable and use this feature.

Note

To use edit-while-running, the metabase history feature must be enabled. The metabase history feature is enabled by default.

UTF-8 Logging

IIS 6.0 supports writing log files for Web sites in UTF-8, instead of just ASCII (or local code page). IIS 6.0 does not support UTF-8 logging for FTP sites. When enabled, all Web sites on your IIS server begin logging in UTF-8. If UTF-8 is not selected, IIS logs in the Local Character Set.

MIME Types (Global Level)

Multipurpose Internet Mail Extensions (MIME) are mappings that set the various file types that IIS serves to clients. IIS serves only files with extensions registered in the MIME type list.

MIME types can be defined globally for IIS, and additional MIME types can be defined at the Web site, Web site directory, and Web site virtual directory level.

Note

IIS 6.0 returns an error (404.3) if a request refers to a file with a file extension that is not in the MIME mapping or script mapping. To remedy the 404.3 error, you must add the requested file extension to the MIME mapping. Click MIME Types on the open dialog box to configure MIME mappings.

MIME Types

Click to configure MIME mappings. These mappings set the various file types that the World Wide Web Publishing Service (WWW service) returns to browsers.

Related Topics

To learn more about MIME types and the metabase history feature, see the IIS 6.0 online documentation on the Microsoft Windows Server TechCenter.


IIS 6.0 F1: Web Site Properties - Custom Errors Tab

Use this tab to customize HTTP error messages that are sent to clients when Web server errors occur. Administrators can use generic default HTTP 1.1 errors, detailed custom error files that IIS provides, or create their own custom error files.

These values can be set globally for all sites or separately within each site. IIS uses an inheritance model for these settings. If you set or change a setting that conflicts with a setting at another node in the hierarchy, you are prompted to specify the nodes to which this new setting applies.

Edit

Click to change the properties of the currently selected custom error message.

Set to Default

Click to configure the currently selected custom error message to use the default HTTP 1.1 error.

Note

To change the settings for multiple errors, press the CTRL or SHIFT key and click the HTTP errors.

Related Topics

To learn more about custom error messages, see the IIS 6.0 online documentation on the Microsoft Windows Server TechCenter.


IIS 6.0 F1: Edit Custom Error Properties

Use this dialog box to edit custom error messages. Click a custom error message, and then click Edit.

For security and other system concerns, some errors cannot be customized to point to a URL. For example, the error 401;2 “Unauthorized - Logon failed due to server configuration” does not allow a custom error message on a URL because if a server configuration exists, it might not be possible to reach the URL containing the custom error file.

Message type

Click the type of message that you want to be returned to the client browser — Default, File, or URL — from the Message type list box.

Default

Click to return the default HTTP 1.1 error to the client browser. File allows you to map the custom error to a file by using a fully qualified file name. URL allows you to map the custom error to a URL. If the output type is a URL, this URL must exist on the local server. Click OK to save your selections.

File/URL

Browse to or type the location of the file mapped to the custom error.

Browse

Click to locate the directory and file.

Related Topics

To learn more about custom error messages, see the IIS 6.0 online documentation on the Microsoft Windows Server TechCenter.


IIS 6.0 F1: Web Site Properties - HTTP Headers Tab

Use the HTTP Headers tab to set values returned to the browser in the header of the HTML page. You can also set content ratings for content, and define MIME types.

These values can be set globally for all sites or separately within each site. Internet Information Services (IIS) uses an inheritance model for these settings. If you set or change a setting that conflicts with a setting at another node in the hierarchy, you are prompted to specify the nodes to which this new setting applies.

Enable content expiration

Select the Enable content expiration check box to include expiration information for time-sensitive material, such as special offers or event announcements. The browser compares the current date to the expiration date to determine whether to display a cached page, or to request an updated page from the server.

Expire immediately

Click this option and content expires immediately after it is served. This setting forces the browser to always retrieve the content fresh from the server on subsequent requests.

Expire after

Set a specific period of time after which the browser is forced to retrieve the content again from the server on the subsequent requests.

Expire on

Select to set a specific date and time after which the browser is forced to retrieve the content again from the server on the subsequent requests.

Custom HTTP headers

You can use this property to send a custom HTTP header from the Web server to the client browser. Custom headers can be used to send instructions from the Web server to the client browser that are not yet supported in the current HTTP specification, such as newer HTTP headers that IIS may not inherently support at the time of the product's release. For example, you can use a custom HTTP header to allow the client browser to cache the page but prevent proxy servers from caching the page.

Add

Click to add a new custom HTTP header.

Edit

Click to edit the properties of the currently selected custom HTTP header.

Remove

Click to remove the currently selected custom HTTP header.

Content rating

Use content ratings to embed descriptive labels in the HTTP headers of your Web pages. Browsers, such as Microsoft® Internet Explorer, version 3.0 or later, can detect content ratings to help users identify potentially objectionable Web content.

Edit Ratings

Click to set content rating values.

MIME types (site, directory, and virtual directory levels)

Multipurpose Internet Mail Extensions (MIME) mappings set the various file types that IIS serves to clients. IIS serves only files with extensions registered in the MIME types list.

MIME types can be defined globally for IIS, and additional MIME types can be defined at the Web site, Web site directory, and Web site virtual directory level.

IIS uses an inheritance model for MIME type settings. MIME types defined at the global level are inherited by all Web sites, Web site directories, and Web site virtual directories. MIME types defined at the Web site, Web site directory, or Web site virtual directory are used only at that particular node. If you set or change a MIME type that conflicts with a setting at another node in the hierarchy, you are prompted with an Inheritance Override dialog box where you can specify the nodes to which the new setting applies.

The registered file types that are installed on this computer are listed in the Registered MIME types (file extensions) list box.

Note

IIS 6.0 returns an error (404.3) if a request refers to a file with a file name extension that is not in the MIME mapping or script mapping. To remedy the 404.3 error, you must add the requested file name extension to the MIME mapping. Click MIME Types on the open dialog box to configure MIME mappings.

MIME Types

Click to configure MIME mappings. These mappings set the various file types that the Web service returns to browsers.

Note

When you click a MIME type, the MIME mappings are listed in the MIME Types box.

Related Topics

To learn more about content ratings and MIME types, see the IIS 6.0 online documentation on the Microsoft Windows Server TechCenter.


IIS 6.0 F1: Add/Edit Custom HTTP Header

Custom headers appear in the HTTP Headers tab of a property sheet in the form Name: Value. Type the name and value of your custom HTTP header in the Custom header name and Custom header value boxes.

Related Topics

To learn how to create multiple Web sites using host header names, see the IIS 6.0 online documentation on the Microsoft Windows Server TechCenter.


IIS 6.0 F1: Content Ratings - Ratings Tab

Use this tab to configure your Web server's content rating features for a particular Web site, directory, or file.

Your Web server's Platform for Internet Content Selection (PICS) system uses a rating system developed by the Internet Content Rating Association (ICRA), which rates content according to levels of violence, nudity, sex, and offensive language. For more information about ICRA, see http://www.icra.org.

Enable ratings for this content

Select to set the rating levels on this Web site for each of the listed categories.

Category

Adjust the Rating slider bar for each category to the appropriate level for this content.

E-mail address of person rating this content

Type an e-mail address in the text box to identify the person rating this content.

Expire on

Select an expiration date to control the duration of the rating. After this date, no rating is associated with the content.

Related Topics

To learn more about content ratings, see the IIS 6.0 online documentation on the Microsoft Windows Server TechCenter.


IIS 6.0 F1: Web Site Properties - Documents Tab

Use this tab to define your site's default Web page and to append a footer to the site's documents.

Enable default content page

When enabled, the default document is served to the browser whenever the browser request does not specify a document name. Default documents can be a directory's home page or an index page containing a site document directory listing. Multiple documents can be listed in a top-down search order. The files shown are located in the site’s Home directory. The order can be modified by using the Move Up and Move Down buttons.

Select the Enable default content page check box to enable the Web server to identify a default document whenever a browser request does not specify a document name.

Add

Click to add additional default documents. Default documents are served in the order in which the names appear in the list. The server returns the first document it finds.

Remove

Click to remove a default document from the list without deleting the file.

Enable document footer

Select the Enable document footer check box to configure your Web server to automatically append a footer to every document your Web server returns. The footer file should not be a complete HTML document. It should only include only HTML tags that are necessary to format the appearance and function of your footer content.

Browse

Click to locate and specify the full path and file name for your footer file.

Related Topics

To learn more about a default document and about adding a footer to your Web pages, see the IIS 6.0 online documentation on the Microsoft Windows Server TechCenter.


IIS 6.0 F1: Web Site Properties - BITS Server Extension Tab

The Background Intelligent Transfer Service (BITS) is a background file transfer mechanism and queue manager, also known as a drizzle service. BITS throttles file requests to minimize bandwidth consumption and enhance the end-user experience. Enable BITS with IIS to maintain Web server quality of service.

Allow clients to transfer data to this virtual directory

Use to enable uploads from the BITS client into this virtual directory. If not enabled, BITS clients that attempt an upload will be denied access. BITS disables all Script and Execute permissions on a BITS-Upload enabled virtual directory.

Use default settings

Select to use use the default configuration for this virtual directory. If this directory is embedded in another virtual directory and the outer virtual directory defines a custom configuration, then that configuration will be used instead of the defaults.

Customize settings

Select to use the configuration information from this property page. No default or inherited settings will be used.

Maximum file size

Select to set the maximum amount of data that can be uploaded in a single BITS job. If not enabled, an unlimited amount of data is permitted.

Delete incomplete jobs after

Select to delete incomplete uploads if no progress is made for the specified time period. The timeout is checked each time the MSTASK cleanup work item is run. Click Schedule Cleanup to configure the frequency for which the timeout should be checked for this virtual directory.

Enable server farm support

Select to force a client to reconnect using the specified name instead of the name used by the client. This allows clients which are uploading to server farms to continue uploading to the same server that the upload was started with. Uploading to Web farms is not recommended without enabling and configuring this feature.

Reconnect to IP address

Select to specify the public IP to use for reconnecting to this server.

Use original IP address after

After receiving an error, clients will continue attempting to reconnect to the server using the Reconnect to IP address name until this timeout is exceeded. After the timeout is exceeded, clients fall back to the original name.

Allow notifications

Use to enable notifications for this virtual directory. The Notification type and Notification URL settings are required if this setting is enabled.

Notification type

Use to configure the type of notification to perform after the job is uploaded.

  • Send the file name: The server sends the path to the uploaded file to the URL indicated by the Notification URL setting. The server may return a file to the client.

  • Send the data: The server sends the entire uploaded file to the URL indicated by the Notification URL as the entity of the Power-on Self Test (POST). The response entity is sent to the client.

Notification URL

If the Notification type is Send the data or Send the file name, this URL indicates where the uploaded file will be posted. The URL may be absolute or self-relative. If the URL is self-relative, then the original request URL is used as the base.

Schedule Cleanup

This setting configures the frequency for which BITS Extensions should scan this virtual directory for incomplete files. If an incomplete upload is found, the file is checked against the timeout value. If progress has not been made on this file for longer than the timeout period, the upload is automatically cancelled. This setting is not affected by inheritance and applies only to this virtual directory.

Run Cleanup Now

Select to start a check for files which have had no progress since the timeout period. To remove all incomplete files for this virtual directory, set the timeout value to 0 before running the cleanup.


IIS 6.0 F1: Web Site Properties - Directory Security Tab

Use this tab to set IIS security features to confirm the user identity of users before granting access to restricted content.

Authentication and access control

This setting allows you to configure your Web server to confirm the user identity of users before assigning access to restricted content. Before your Web server can authenticate users, however, you must first create valid Windows user accounts and then configure the NTFS directory and file permissions for those accounts.

Edit

Click to configure your Web server's authentication and anonymous access features.

IP address and domain name restrictions

This setting allows you to assign or deny specific users, computers, groups of computers, or domains from accessing this Web site, directory, or file based on IP address or domain name.

Edit

Click to add settings that set restrictions on or deny access to this Web site, directory, or file by specific users, computers, groups of computers, or domains.

Secure communications

Windows provides means to secure communication between the client and the Web server using server certificates and certificate mapping. You can implement secure communications by enabling Windows directory service mapping, which allows you to use the directory service client-certificate mapping rather than one-to-one or many-to-one mapping. To enable this service, the server must be a member of the Windows® Server 2003 domain.

Enable the Windows directory service mapper

Select to use directory service client-certificate mapping rather than one-to-one or many-to-one mapping. To enable this service, the server must be a member of the Windows Server 2003 domain. This option is available only when editing properties for all Web sites.

When editing properties for a specific Web site, the following options are available:

Server Certificate

Click to start the Web Server Certificate Wizard and obtain a server certificate.

View Certificate

Click to view the server certificate (if there is one installed) for this Web site.

Edit

Click to enable communication settings such as certificate acceptance, certificate mapping, and the certificate trust list.

Related Topics

To learn more about user authentication in IIS, access control, certificates in IIS, and mapping client certificates to user accounts, see the IIS 6.0 online documentation on the Microsoft Windows Server TechCenter.


IIS 6.0 F1: Authentication Methods

Use this dialog box to configure your Web server to verify user identities. You can authenticate individuals or select groups of users to prevent unauthorized persons from establishing a Web (HTTP) connection to restricted content. Anonymous access allows users to establish an anonymous connection. The user logs on to IIS with an anonymous or guest account. There are currently four Authenticated access methods:

  • Windows Integrated authentication uses a cryptographic exchange with the user's Web browser to confirm the identity of the user.

  • Digest authentication works only with Active Directory® accounts, sending a hash value over the network, rather than a plaintext password. Digest authentication works across proxy servers and other firewalls and is available on Web Distributed Authoring and Versioning (WebDAV) directories.

  • Basic authentication transmits passwords across the network in cleartext, an unencrypted form.

Enable anonymous access

Select this check box to establish an anonymous connection for users. IIS logs on the user with an anonymous or guest account. By default, the server creates and uses the account IUSR_computername.

User name

This is the user name for the account used for anonymous access only within Windows.

Password

The anonymous user account password is used only within Windows. Anonymous users do not log on by using a user name and password.

Browse

Click to search and select the object type, such as user, and the location, such as your computer or any accessible computer connected on the network.

Authenticated access

Options selected in this section require that users provide a valid Microsoft Windows user name and password before they access any information on your server.

Integrated Windows authentication

Select to ensure that the user name and password are sent across the network in the form of a hash. This provides a secure form of authentication.

Note

If this authentication method is enabled, IIS uses Windows Integrated authentication only when Anonymous access is disabled and Anonymous access is denied because Windows file system permissions have been set, requiring users to provide a Windows user name and password before establishing a connection with restricted content.

Digest authentication for Windows domain servers

Select to work with Active Directory® and send a hash value over the network, rather than a cleartext password. This method works across proxy servers and other firewalls. Using Digest authentication requires that a Realm be defined.

Basic authentication (password is sent in cleartext)

Select to send the password across the network in cleartext. Basic authentication is part of the HTTP specification and is supported by most browsers; however, user name and password are not encrypted and could present security risks.

Default domain

This identifies the Windows domain used for user authentication control.

Select

To authenticate the user or group, click to view a list of all domains to which you are connected.

Realm

This identifies the domain or other operating system authentication controller used to authenticate the user or group.

Select

Click to view a list of all domains and realms to which you are connected.

Related Topics


IIS 6.0 F1: Basic Authentication Warning

This warning appears when you choose to use the Basic authentication method. With basic authentication, the user's Web browser transmits Windows account user names and passwords across the network in plaintext. Malicious users can then intercept this information. You can use Basic authentication and still protect account information using Secure Sockets Layer (SSL) encryption. To enable SSL, you must first install a server certificate.

Yes

Click to implement the authentication option selected and continue with the security configuration.

No

Click to cancel the selection of the authentication option and return to the previous dialog box.

Related Topics

To learn more about user authentication, encryption, and Secure Sockets Layer, see the IIS 6.0 online documentation on the Microsoft Windows Server TechCenter.


IIS 6.0 F1: Digest Authentication Warning

The authenticated access method, Digest authentication, applies only to domain accounts on servers running Microsoft® Windows® Server 2003 and requires the accounts to store passwords using reversible encryption. Internet Information Services (IIS) sends a hash value rather than the password over the network, working across proxy servers and other firewalls.

Requirements for Digest Authentication

Before enabling Digest authentication on your server running IIS, ensure that all of the following minimum requirements are met. Only domain administrators can verify that the domain controller requirements are met. Check with your domain administrator if you are unsure about whether your domain controller meets the following requirements:

  • All clients that access a resource that is secured with Digest authentication are using Microsoft Internet Explorer 5 or later.

  • The user and the server running IIS must be members of, or be trusted by, the same domain.

  • Users must have a valid Windows user account stored in Active Directory® on the domain controller.

  • The domain must have a Windows 2000 or later domain controller.

  • The IIS server must be running a member of the Windows Server 2003 family or later.

Yes

Click to set the authentication method in IIS to Digest authentication.

No

Click to stop the operation and return to the previous dialog box to make another selection.

Related Topics

To learn more about user authentication and Digest authentication, see the IIS 6.0 online documentation on the Microsoft Windows Server TechCenter.


IIS 6.0 F1: IP Address and Domain Name Restrictions

Use this dialog box to provide users access to (or to prevent access to) a Web site, directory, or file.

Note

Computers accessing your server across proxy servers display the same IP address as the proxy server.

IP address access restrictions

Granted access

Click to grant access to all computers.

To add computers, groups of computers, or domains that you want to deny access to, click Add, and type the required information in the Deny Access dialog box. The computers that are denied access appear in the Except the following list box.

Denied access

Click to deny access to all computers.

To add computers, groups of computers, or domains that you want to grant access to, click Add, and type the required information in the Grant Access dialog box. The computers that are granted access appear in the Except the following list box.

Add

Click to define a computer or group of computers to which you want to grant or deny access.

Remove

Click to remove the currently selected item from the exception list.

Edit

Click to modify the specific properties of the currently selected item in the exception list.

Related Topics

To learn more about security, see the IIS 6.0 online documentation on the Microsoft Windows Server TechCenter.


IIS 6.0 F1: Grant Access or Deny Access

Use these two dialog boxes to list the computers, groups of computers, or domains that you want to grant or deny access to this resource.

Single computer

Click to define access rights for a single computer.

If you select a single computer you will need to know the IP address of the computer.

IP address

Type the Internet Protocol (IP) address of the computer.

DNS Lookup

Click to look up a specific computer's IP address using the domain name (for example, www.contoso.com). In the DNS Lookup dialog box, type the DNS name for the computer in the Type the DNS name box, and click OK.

You can configure IIS to perform a DNS lookup every time access is requested for the site, virtual directory, or file. However, using the DNS lookup each time a request is made can affect server performance.

Note

If you get a "Host not found" error, either the domain name you typed in is incorrect, or the computer you referred to is not available on the network.

Groups of computers

Click to define access rights for a group of computers based on network ID and subnet mask.

When you grant or deny access to groups of computers, you are required to identify them by network ID and subnet mask. A subnet mask, or address mask, is a numerical address of a subnet that includes the network. The mask simply overlays all but the significant part of the network address. Ask your network administrator for information about TCP/IP networking, IP addressing, and the use of subnet masks.

Network ID

This identifies the numerical address of the network that the group of computers belong to.

Subnet mask

This identifies the address mask that, to make the subnet address unique, replaces all but the non-significant numbers of the network ID in order to make the subnet address unique.

Related Topics

To learn more about security and FTP authentication, see the IIS 6.0 online documentation on the Microsoft Windows Server TechCenter.


IIS 6.0 F1: Web Site Properties - Directory Tab

Use this tab to configure your directory. You can configure the physical location by setting user access permissions, choosing whether to log requests for these resources, and choosing whether to index a site using the Indexing Service. To specify when the request is received, applications must be identified, located, and given the appropriate execute permissions and protection.

The content for this resource should come from

A directory located on this computer

Click to permit users to access a specified directory on this computer to view or update Web content. You can control access to the contents by implementing any Windows security method.

A redirection to a URL

Click to redirect the client application, such as a browser, to another Web site or virtual directory. When selected, redirect options are substituted for path options.

Setting up local or network paths allows the request to be directed to the correct physical location. You can further configure the physical location by setting user access properties, whether or not to log requests for these resources, and whether or not to index this site using the Index Service. To execute when the request is received, applications must be identified, located, and given the appropriate execute permissions and protection.

Note

Enable the Index Service through Add or Remove Programs in the Control Panel.

Local path

Type or browse to the path to the directory that stores your default Web site files. By default, these files are stored in the systemdrive\inetpub\wwwroot directory for the default Web site.

Script source access

Select to allow users to access source code if either Read or Write permissions are set. Source code includes scripts in ASP applications.

Read

Select to allow users to read or download files or directories and their associated properties.

Write

Select to allow users to upload files and their associated properties to the enabled directory on your server or to change content in a Write-enabled file. Write access is allowed only with a browser that supports the PUT feature of the HTTP 1.1 protocol standard.

Directory browsing

Select to allow users to see a hypertext listing of the files and subdirectories in this virtual directory. Because virtual directories do not appear in directory listings, users must know a virtual directory's alias. If Directory browsing is disabled and the user does not specify a file name, the Web server displays an "Access Forbidden" error message in the user's Web browser.

Log visits

Select to configure IIS to record visits to this directory in a log file. Visits are recorded only if logging is enabled for this Web site.

Index this resource

Select to allow the Microsoft Indexing Service to include this directory in a full-text index of your Web site.

Note Before setting this option, you must enable the Indexing Service through the Add or Remove Programs item in Control Panel.

Application settings:

Application name

Type the name of the root directory that contains the files and subdirectories of an application.

Starting point

This displays the metabase node where this application is configured.

Execute permissions

This option determines the program execution level allowed for this site's resources.

  • Set permissions to None to restrict access to static files, such as HTML or image files.

  • Set permissions to Scripts to allow only scripts to run, not executables.

  • Set permissions to Scripts and Executables to remove all restrictions so that all file types can be accessed or executed.

Application Pool

Select the application pool associated with this home directory.

Browse

Click to locate directory path.

Remove

Click to remove the application from the Web site while leaving the virtual directory intact.

Configuration

Click to configure application mappings, options, and debugging features.

Unload

Click to unload an isolated application from memory, or to unload a pooled application not referenced by any other application.

Related Topics

To learn more about logging site activity and configuring applications, see the IIS 6.0 online documentation on the Microsoft Windows Server TechCenter.


IIS 6.0 F1: Application Configuration - Mappings Tab

Use this tab to map file name extensions to the program or interpreter that processes those files. Mapped applications include Active Server Pages (ASP) applications, Internet Database Connector (IDC) applications, and files that use server-side include (SSI) directives. For example, when the Web server receives a request for a page with an .asp extension, it uses the application mapping to determine that the executable file asp.dll should be called to process the page. You can also use this tab to install wildcard script map ISAPI applications that are executed for every request, regardless of the file name extension.

Cache ISAPI extensions

Internet Server API (ISAPI) DLLs can be loaded and cached so that further requests can be processed without calling the application again. Most ISAPI applications (including ASP) benefit from caching. You should clear this check box only for special circumstances, such as debugging ISAPI applications. If the same ISAPI application has been loaded and cached by more than one Web site on a server, then clearing this option for the server does not unload the application from memory. You must clear this option for all Web sites that use the ISAPI application. Clearing this option does not unload running applications. Only subsequent requests are not cached.

Application extensions

You can develop Web applications using a number of programming and scripting languages. Internet Information Services (IIS) uses the file name extension of a requested resource on your Web site to determine which ISAPI or CGI program to run to process a request. For example, a request for a file ending with an .asp extension causes the Web server to call the ASP program (Asp.dll) to process the request. The association of a file name extension with an ISAPI or CGI program is called application mapping. IIS is preconfigured to support common application mappings. You can add or remove mappings for all applications on a Web site or for individual applications.

The Application extensions table lists the file name extension associated with an executable file and the path to the executable file. If the word "ALL" appears in the Verbs column, all verbs are sent to the application. Click the Add, Edit, and or Remove buttons to modify application mappings.

Important

On the Application Mappings tab for IIS 4.0, there was a list of verbs in the Exclusions column. This has changed to the Verbs column, which lists the HTTP verbs run by the application.

Select to configure the Web server to load and cache ISAPI so that subsequent requests can be processed without calling the application again. Most ISAPI applications (including ASP) benefit from caching.

Add

Click to add an application mapping by identifying the file name extension, executable path, and HTTP verbs.

Edit

Click to modify an application mapping by changing the file name extension, executable path, and HTTP verbs.

Remove

Click to remove an application mapping from IIS.

Wildcard application maps

This table lists ISAPI applications that are executed before a Web file is processed, regardless of the file name extension. These ISAPI applications are called wildcard script maps. Using wildcard script maps is similar to using ISAPI filters, except that wildcard script maps can be installed on virtual directories as well as Web sites, they have access to the body of a request, they are not event-driven, and the ISAPI extension API has more functionality than the ISAPI filter API. A virtual directory only inherits wildcard script maps from its parent virtual directory or Web site if it doesn’t contain its own wildcard script maps.

Insert

Click to add a wildcard script map that is executed for every request to a Web file in this Web site or virtual directory.

Edit

Click to modify the currently selected wildcard script map in the Wildcard application maps table.

Remove

Click to remove the currently selected wildcard script map in the Wildcard application maps table.

Move up

Click to move the currently selected wildcard script map higher in the execution order in the Wildcard application maps table.

Move down

Click to move the currently selected wildcard script map lower in the execution order in the Wildcard application maps table.

Related Topics

To learn more about configuring applications and about wildcard application mappings, see the IIS 6.0 online documentation on the Microsoft Windows Server TechCenter.


IIS 6.0 F1: Add/Edit Application Extension Mapping (for Application Extensions)

Use this dialog box to add to or modify the mapping between a file name extension and the program or interpreter that processes those files. The Executable is the name of the .exe or .dll that you want to run. The executable file must be located on your Web server's local hard disk. The Extension is the file name extension associated with your application. If you do not want all HTTP verbs to be passed to your applications through these mappings, then you can set restrictions appropriately. For example, by default, the file Asp.dll processes requests using the HTTP verbs GET, HEAD, and POST. (TRACE requests are handled by IIS.) To enable all verbs, select the All Verbs radio button. Separate verb or method names with a comma (,).

Executable

Type the name of the executable file (.exe or .dll). The executable file must be located on your Web server's local hard disk.

Browse

Click to locate your Web server's local hard disk for the executable file (.exe or .dll).

Extension

Type the file name extension associated with your application.

Verbs

This allows options to restrict the number of HTTP verbs that can be associated with each application extension.

You can select one of two options:

  • All verbs.

  • Limit to. This option restricts the application to one or multiple verbs as defined by a specific number.

Script engine

Select when you want the application to run in a directory without execute permissions. This setting is intended primarily for script-based applications, such as ASP and IDC, that are mapped to an interpreter. To run a script-mapped application, you must select either Script only or Scripts and Executables from the Execute permissions list box on the Directory tab for the directory in which the application is located.

  • To allow only script-mapped applications to run, click Script only access.

  • To allow both script-mapped applications and executable files (.exe and .dll) to run, click Scripts and Executables access.

Verify that file exists

Select to instruct the Web server to verify the existence of the requested script file and to ensure that the requesting user has access permission for that script file. If the script does not exist or the user does not have permission, the appropriate warning message is returned to the browser and the script engine is not invoked. This option can be useful for scripts mapped to non-CGI executables, such as the Perl interpreter, that do not send a CGI response if the script is not accessible. Because the script must be opened twice, once by the server and once by the script engine, enabling this option can impact performance.

Related Topics

To learn more about configuring applications, see the IIS 6.0 online documentation on the Microsoft Windows Server TechCenter.


IIS 6.0 F1: Add/Edit Application Extension Mapping (for Wildcard Application Maps)

Use this dialog box to add or modify wildcard script map ISAPI applications that are executed for every request, regardless of the file name extension. Using wildcard script maps is similar to using ISAPI filters, except that wildcard script maps can be installed on virtual directories as well as Web sites, they have access to the body of a request, they are not event-driven, and the ISAPI extension API has more functionality than the ISAPI filter API. A virtual directory inherits only wildcard script maps from its parent virtual directory or Web site if it doesn’t contain its own wildcard script maps.

Executable

Type the name of the executable file (.exe or .dll). The executable file must be located on your Web server's local hard disk.

Browse

Click to locate your Web server's local hard disk for the ISAPI application.

Verify that file exists

Select Verify that file exists to instruct the Web server to verify the existence of the requested script file and to ensure that the requesting user has access permission for that script file. If the script does not exist or the user does not have permission, the appropriate warning message is returned to the browser and the script engine is not invoked. This option can be useful for scripts mapped to non-CGI executables, such as the Perl interpreter, that do not send a CGI response if the script is not accessible. Because the script must be opened twice, once by the server and once by the script engine, enabling this option can impact performance.

Related Topics

To learn more about configuring applications and about wildcard application mappings, see the IIS 6.0 online documentation on the Microsoft Windows Server TechCenter.


IIS 6.0 F1: Application Configuration - Options Tab

Use this tab to control how Active Server Pages (ASP) run within the currently selected application. Applications that run in Internet Information Services (IIS) can be configured for efficiency by enabling session state and timeout, buffering, parent paths, language, and ASP script timeout.

Note

You can set application configuration properties at the Web site, virtual directory, or directory level.

Enable session state

Select to enable session state.

When session state is enabled, Active Server Pages (ASP) creates a session for each user who accesses an ASP application so that so that you can identify the user across pages in the application. When session state is disabled, ASP does not track users and does not allow an ASP script to store information in the Session object or to use the Session_OnStart or Session_OnEnd events. A session automatically ends if the user has not requested or refreshed a page in an application by the end of the timeout period.

Session timeout

Set the timeout period for all inactive sessions on this system.

Session timeout controls the duration of the user's session, or more accurately, it controls the lifetime of the session object. A script can explicitly end a session by using the Session.Abandon method. Even when session state is enabled for an application, you can disable session state for an individual ASP page by using the <%@ ENABLESESSIONSTATE = False %> directive.

Enable buffering

Select to enable IIS to allow all output that is generated by an ASP page is to be collected before it is sent to the browser. When the page is displayed by the browser, all content is complete. Buffering output enables you to set HTTP headers from anywhere in an ASP script.

When the check box is cleared, output is returned to the browser as the page is processed, giving the page a "painted" image. You can override this option in a script by using the Response.Buffer method in your ASP scripts.

Enable parent paths

Select to allow ASP pages to use relative paths to the parent directory of the current directory (paths using the .. syntax).

If you enable this option, do not give the parent directories execute access because a script could execute an unauthorized program in a parent directory.

Default ASP language

Specify the primary script language for Active Server Pages, the language used to process commands within ASP delimiters (<% and %>).

ASP comes with two Microsoft® ActiveX® script engines: Microsoft Visual Basic® Scripting Edition (VBScript) and Microsoft Jscript® (JScript). The initial value of Default ASP language is VBScript. You can specify the name of any language for which an ActiveX script engine is installed on your server; be sure to use the exact keyword required for your engine as documented by your script engine provider. You can override the default language on an ASP page by using the <%@ LANGUAGE %> directive.

ASP script timeout

Specify the length of time ASP allows a script to run. You can set the timeout period to a value between 1 and 2147483647.

If the script does not finish running by the end of the timeout period, ASP stops the script and writes an event to the Windows event log. You can override this option in an ASP page by using the Server.ScriptTimeout method.

Enable Side by Side assemblies

Side-by-side (SxS) assemblies allow ASP applications to specify which version of a system DLL or classic COM component to use, such as MDAC, MFS, MSVCRT, MSXML, etc. For example, if your ASP application relies on MSXML, version 2.0, you can ensure that your application still uses MSXML, version 2.0 even after service packs are applied to the server. Any new version of MSXML is still installed on the computer, but version 2.0 remains and is used by your application. Configuring SxS assemblies requires that you know the path to the DLL, and that the COM+ manifest file exists in every virtual directory that needs to use the DLL.

Note

Shared DLLs must support SxS assemblies.

Manifest file name

Type the COM+ manifest file name. The COM+ manifest is an XML file that has information about where a DLL is installed. IIS does not verify that the manifest exists.

To view an excerpt from a manifest file, see the IIS 6.0 online documentation on the Microsoft Windows Server TechCenter.

Related Topics

To learn more about Active Server Pages and about configuring applications, see the IIS 6.0 online documentation on the Microsoft Windows Server TechCenter.


IIS 6.0 F1: Application Configuration - Debugging Tab

Use this tab to set debugging options for Active Server Pages (ASP) that run in the currently selected application.

You can set two types of debugging flags that enable server-side and client-side script debugging. You can use the Microsoft® Script Debugger to troubleshoot ASP scripts while those scripts are being processed. Enabling ASP server-side debugging forces ASP to run in single-threaded mode. For performance reasons, ASP server-side or client-side debugging is not recommended in a production environment.

You can control when and what error messages are sent to the browser when an error is encountered in your ASP scripts. You can configure Internet Information Services (IIS) to send detailed error messages that contain specific debugging information (including the file name, error message, and line number) to the browser so that you can easily analyze the output. You can also configure IIS to send a default error message to the browser when any error prevents the Web server from processing the ASP page. A specific error message is written to the error log. Additionally, you can change the default error message by typing a message in the text box.

Enable ASP server-side script debugging

Select to enable the Web server to invoke the Microsoft Script Debugger while processing ASP pages.

Enable ASP client-side script debugging

Select to enable the client to invoke the Microsoft Script Debugger while processing ASP pages.

Send detailed ASP error messages to client

Click to enable IIS to send specific debugging information (including the file name, error message, and line number) to the browser.

Send the following text error message to client

Click to enable IIS to send a default error message to the browser when any error prevents the Web server from processing the ASP page. You can use the default error message or change it by typing a new message in the box.

Related Topics

To learn more about Active Server Pages and configuring applications, see the IIS 6.0 online documentation on the Microsoft Windows Server TechCenter.


IIS 6.0 F1: Application Configuration - Cache Options Tab

Use this tab to set your application caching options. You can configure Internet Information Services (IIS) to not cache any Active Server Pages (ASP) files on the client. This forces the client browser to query the server for a new (or updated) page at each request. Although this process saves disk space on the client computer, performance is reduced. Caching ASP script files enhances performance because cached ASP scripts are not compiled each time they are called.

Do not cache ASP files

Click to ensure that no ASP files are cached by the browser. As a result, every repeated request from the browser results in a fresh request of the ASP file from the server.

Cache all ASP files in memory

Click to ensure that all ASP files that have been requested by the browser from the server are cached on this computer. If you choose this option, you should identify a directory in the Disk cache directory box and set a limit for script engines cached in the Number of script engines cached box.

Cache limited ASP files in memory

Click to cache a limited number of compiled ASP files (templates) in memory. Type (or click the up and down arrows to set) the number of files you want to cache in the box. After you click this option, choose one of the following options to either cache all remaining ASP files or to cache a limited number of the remaining files on disk.

Cache remaining ASP files on disk

Click to cache all remaining compiled ASP files (those files not cached in memory) to disk.

Cache limited ASP files on disk

Click to cache a limited number of compiled ASP files (those files not cached in memory) to disk.

Disk cache directory

Type or browse to the target directory to house the ASP files.

Browse

Click to locate a directory on this computer to store cached ASP files.

Number of script engines cached

Type a number or click the up and down arrows to control the number of script engines cached. Script engines, such as Microsoft® Visual Basic® Scripting Edition (VBScript), require memory and accessibility. By limiting the number of script engines cached on your computer, you can better manage performance and memory.

Related Topics

To learn more about Active Server Pages, caching ASP pages, and configuring applications, see the IIS 6.0 online documentation on the Microsoft Windows Server TechCenter.


IIS 6.0 F1: Application Configuration - Process Options Tab

Use this tab to change settings for the applications running in a single process. You can use this tab to change settings for two types of processes: the Web server process and the isolated application processes. Options set for the Web site affect all applications running in the Web server process. Options set for an isolated application affect only that application.

Write unsuccessful client requests to event log

Select to configure IIS so that the Web server writes unsuccessful client requests to the Windows Event Log.

Enable debug exception catching

Select to configure IIS so that ASP sends a general error message when it cannot create an instance of an object provided by a COM component (a call to Server.CreateObject). When this option is not selected, ASP passes on the specific error message from the component. Do not select this option when you are debugging a component. When you have finished debugging, select the option again.

CGI script timeout

Set or change the timeout value, which is the amount of time a CGI script is given to execute and return a value before the operation is stopped. You can set application configuration properties at the Web site, virtual directory, or directory level.

Related Topics

To learn more about Active Server Pages and configuring applications, see the IIS 6.0 online documentation on the Microsoft Windows Server TechCenter.


IIS 6.0 F1: Web Site Properties - Service Tab

Use this tab to enable Internet Information Services (IIS) 5.0 isolation mode and HTTP compression.

Isolation mode

In IIS 6.0, the default process mode is worker process isolation. For backward compatibility, IIS 5.0 isolation mode is also available.

Run WWW service in IIS 5.0 isolation mode

Select to use IIS 5.0 isolation mode for applications that violate worker process isolation mode restrictions, such as the following:

  • Multi-instance ISAPIs: ISAPI applications that are written to be loaded by multiple processes and run concurrently.

  • Out-of-worker process: Applications that are written to farm out requests to other worker processes. This is not supported in worker process isolation mode.

  • Session state persisted in-process: Applications that persist session state in process. Session state may be lost upon worker process recycling. This is not an issue for ASP.NET applications, which always persist state off-process.

HTTP compression

You can select the process to compress files before they are sent to compression-enabled clients. When a file is requested, the compressed copy is created and stored in a cache directory. This compressed file is sent when subsequent requests are received. Files are compressed only when they are requested.

Select to configure IIS to run your IIS applications in the same isolated process mode as IIS 5.0.

Compress application files

Select to configure IIS to compress application files before they are sent to a compression-enabled client to be cached.

Compress static files

Select to configure IIS to compress only static files before they are sent to a compression-enabled client to be cached.

Temporary directory

Type or browse to the path of the directory in which you want to cache the compressed files. The directory must be on an NTFS file system partition on the local hard disk and should not be shared or marked for compression.

Browse

Click to locate the directory path.

Unlimited

Click to configure IIS to not restrict the size of the cache directory where the compressed files are located.

Limited to

Click to configure IIS to limit the size of the cache directory where the compressed files are located.

Type the number of megabytes you want to limit the cache directory to in the adjacent box.

Related Topics

To learn more about IIS 5.0 isolation mode and HTTP compression, see the IIS 6.0 online documentation on the Microsoft Windows Server TechCenter.


IIS 6.0 F1: Web Site Properties - Web Site Tab

Use this tab to set a friendly name for your Web site, configure access to your Web site, set connection limits to your site, and enable logging and configure the logging format for your site.

Web site identification

In order for browsers to access your Web content, both an IP address and TCP port number must be defined.

Description

Type a friendly name for your Web site. The friendly name appears in the console tree of IIS Manager.

IP address

Assign an IP address from the list box or type a new IP address to be used for accessing this site. If you do not assign a specific IP address, this site responds to all IP addresses assigned to this computer and not assigned to other sites, which makes this the default Web site. For an IP address to appear in the list, the IP address must have already been defined for use on this computer in Control Panel. See Windows Server 2003 family Help for more information. The description of the site is not required.

TCP port

Assign the TCP port on which the Web service is running; the default for the Web service is port 80. You can change the port to any unique TCP port number, but if you change the port number, clients must know in advance to request that port number, or their requests fail to connect to your server. A port number is required; this text box cannot be left blank.

SSL port

Assign the SSL port that is to be associated with this Web site identity. The default SSL port number is 443. You can change the SSL port to any unique TCP port number, but to connect to your server, clients must know in advance to request that port number, in order to connect to your server. An SSL port number is required only if SSL encryption is used. Otherwise, if SSL encryption is not enabled for your site, the SSL Port box is unavailable.

Advanced

Click to further configure the IP address, TCP port number, and Host Header value that are used to access to your site.

Connections

You can set the length of time in seconds before the server disconnects an inactive user. This ensures that all connections are closed if the HTTP protocol fails to close a connection. Most Web browsers ask the server to keep the connection open across multiple requests. This is referred to as an HTTP Keep-Alive, an HTTP specification that allows for greatly enhanced server performance. Without it, a browser has to make numerous connection requests for a page containing multiple elements, such as graphics. A separate connection may need to be made for each element. These additional requests and connections require additional server activity and resources, decreasing server efficiency. Additional requests also make a browser much slower and less responsive, especially across a high-latency (slow) connection. HTTP Keep-Alives are enabled by default during the installation process.

Connection timeout

Type a number in the box to set the length of time in seconds before the server disconnects an inactive user. This ensures that all connections are closed if the HTTP protocol fails to close a connection.

Enable HTTP Keep-Alives

Select to enable a client to maintain an open connection with your server, rather than re-opening the client connection with each new request. Disabling Keep-Alives may degrade server performance. HTTP Keep-Alives are enabled by default.

Enable Logging

Select this option to enable your Web site's logging features, which records details about user activity and creates logs in your choice of format.

The information is stored in ASCII files or an ODBC-compliant database. Logging information in IIS goes beyond the scope of the event-logging or performance-monitoring features of Microsoft ® Windows®. The logs can include information such as who has visited your site, what the visitor viewed, and when the information was viewed last. You can use the logs to assess content popularity or identify information bottlenecks.

Active log format

Select one of the following formats for the log files.

  • Microsoft IIS Log Format: A fixed ASCII format.

  • NCSA Common Log File Format: A fixed ASCII format.

  • ODBC Logging: A fixed format logged to a database that is compatible with that database.

  • W3C Extended Log File Format: A customizable ASCII format, selected by default. To use Process Accounting, the W3SVC Extended Log File format must be selected.

Properties

Click to configure options for log file creation (for example, weekly, or by file size), or to configure properties for W3C Extended logging or ODBC logging.

Related Topics

To learn more about naming Web sites, encrypting data with SSL, HTTP Keep-Alives, and logging site activity, see the IIS 6.0 online documentation on the Microsoft Windows Server TechCenter.


IIS 6.0 F1: Advanced Web Site Identification

Use this dialog box to add additional Web site identities, or SSL identities to your computer.

A Web site identity consists of an IP address, TCP port, and an optional host header name, which associates a name with a single static IP address to host multiple sites. You add the host name to your name resolution system (typically DNS) so that when a request reaches the server, IIS uses the host name to determine which site the clients are requesting. This host name is passed in the HTTP header.

An SSL identity consists of an IP address and an SSL port number.

Multiple identities for this Web site

You can add, remove, or edit Web site identities for this Web site. A Web site identity consists of an IP address, TCP port, and an optional host header name. Each Web site must have a unique combination of identification characteristics. Therefore, while multiple Web sites can share two of their three identification characteristics, (IP address, TCP port, and host header name), they must have at least one characteristic that is different. Because SSL certificates contain the domain name in them, Web sites using certificates cannot share an IP address with other Web sites.

Add

Click to add a Web site identity.

Remove

Click to remove the currently selected Web site identity from the list.

Edit

Click to edit the currently selected Web site identity.

Multiple SSL identities for this Web site

You can add, remove, or edit SSL identities for this Web site. An SSL identity consists of an IP address and an SSL port number. An SSL identity is required only if SSL encryption is used. If SSL encryption is not enabled on your site, the Add, Remove, and Edit buttons are unavailable.

Add

Click to add an SSL identity for this Web site, which consists of an IP address and an SSL port number. The Advanced Web Site SSL Identification dialog box appears. The default port number for SSL is 443. If a port number, other than the default is used, your clients must know in advance to request that port number as part of the URL; otherwise their requests fail to connect properly to your server.

Remove

Click to remove the currently selected SSL identity from this Web site.

Edit

Click to edit the currently selected SSL identity for this Web site.

Related Topics

To learn more about naming Web sites and encrypting data with SSL, see the IIS 6.0 online documentation on the Microsoft Windows Server TechCenter.


IIS 6.0 F1: Add/Edit Web Site Identification

Use this dialog box to configure the identity of your Web site. The Web site identity consists of an IP address, TCP port, and an optional host header name. For an IP address to appear in the list box, you first must associate the address with your computer. Host header names must be registered with the Domain Name System (DNS). A DNS server maps your registered host header name (domain name) to the IP address of your computer. The mapping of the host header name to the IP address of your computer enables requests that are addressed to your host header name to be routed to your computer.

IP Address

Select an IP address from the list box that you want to associate with this Web site. Only IP addresses that have been defined on this computer, using Control Panel, appear in the IP Address list box. If you do not assign a specific IP address, this Web site responds to all IP addresses assigned to this computer that are not assigned to other Web sites.

TCP port

This setting determines the TCP port on which the World Wide Web Publishing Service (WWW service) is running. The default port is 80. You can change the port to any unique TCP port number. However, to connect to your server, clients must know in advance to request that port number.

Host Header value

You can assign multiple host names, also referred to as domain names, to one computer using a single IP address. If the Web site requested in the host header is stopped, the client receives the default Web site. Therefore, Internet service providers (ISPs) should set the default Web site as the ISP home page, rather than a customer site.

Related Topics

To learn more about naming Web sites and about how Web site identities are used to route client requests to your Web site, see the IIS 6.0 online documentation on the Microsoft Windows Server TechCenter.


IIS 6.0 F1: Logging Properties - General Tab

Use this tab to specify how log files are created and saved. A file name is displayed under the Log file directory box; this name is determined by the log file format and the criterion used for starting new log files.

New log schedule (common for all log formats)

Any changes to the log schedule defined takes effect immediately after applying the new settings.

Hourly

Click to create log files hourly.

Daily

Click to create log files daily, starting with the first entry that occurs after midnight.

Weekly

Click to create log files weekly, starting with the first entry that occurs after midnight Saturday.

Monthly

Click to create log files created monthly, starting with the first entry that occurs after midnight of the last day of the month.

Note

"Midnight" is midnight local time. Midnight is used for all log file formats except W3C Extended format, which by default uses midnight Greenwich Mean Time, but can be specified as midnight local time (by selecting the Use local time for file naming and rollover option below).

Unlimited file size

Click to always append data to the same log file. You can access this log file only after stopping the server.

When file size reaches

Click to create a new log file when the current log file reaches a given size. Type or click the up and down arrows to specify the size you want.

Use local time for file naming and rollover (W3C-specific)

Select to set creation time and naming format for W3C Extended log files to midnight local time rather than Greenwich Mean Time.

Log file directory

Type or browse to the directory in which log files will be saved.

Browse

Click to locate the directory to which log files will be saved.

Related Topics

To learn more about logging site activity, see the IIS 6.0 online documentation on the Microsoft Windows Server TechCenter.


IIS 6.0 F1: Logging Properties - Advanced Tab

Use this tab to customize W3C Extended logging by choosing the fields (items) to be recorded in the log. Where appropriate, the abbreviated field name appears after the proper name. To limit log size, omit unneeded fields.

Date

Select to record the date the activity occurred.

Time

Select to record the time the activity occurred.

Extended Properties

Client IP Address

Select to record the IP address of the client that accessed your server.

User Name

Select to record the name of the authenticated user who accessed your server. This does not include anonymous users, who are represented by a hyphen (-).

Service Name

Select to record the Internet service and instance number that was accessed by a client.

Server Name

Select to record the name of the server on which the log entry was generated.

Server IP

Select to record the IP address of the server on which the log entry was generated.

Server Port

Select to record the port number the client is connected to.

Method

Select to record the action the client was trying to perform (for example, a GET command).

URI Stem

Select to record the resource accessed (for example, an HTML page, a CGI program, or a script).

URI Query

Select to record the query, if any, the client was trying to perform; that is, one or more search strings for which the client was seeking a match.

Protocol Status

Select to record the status of the action, in HTTP or FTP terms.

Protocol Substatus

Select to record additional status of the action, in HTTP terms. For more information about the Protocol Substatus property, see the IIS 6.0 online documentation on the Microsoft Windows Server TechCenter.

Win32 Status

Select to record the status of the action, in terms used by the Microsoft® Windows® operating system.

Bytes Sent

Select to record the number of bytes sent by the server.

Bytes Received

Select to record the number of bytes received by the server.

Time Taken

Select to record the length of time the action took to complete. For all log formats except ODBC logging, Time Taken is logged in milliseconds, according to the following technical breakdown: The client-request timestamp is initialized when HTTP.sys (the kernel-mode driver) receives the first byte (before HTTP.sys begins parsing the request). The client-request timestamp is stopped when the send completion occurs (for the last send) in IIS. Time Taken does not reflect time across the network. Also note, the first request to the site shows a slightly longer time taken than other similar/same requests because HTTP.sys opens the log file with the first request.

Protocol Version

Select to record the protocol (HTTP, FTP) version used by the client. For HTTP, this is either HTTP 1.0 or HTTP 1.1.

Host

Select to record the content of the host header.

User Agent

Select to record the browser used on the client.

Cookie

Select to record the content of the cookie sent or received, if any.

Referrer

Select to record the previous site visited by the user. This site provided a link to the current site.

Related Topics

To learn more about W3C Extended logging and logging site activity, see the IIS 6.0 online documentation on the Microsoft Windows Server TechCenter.


IIS 6.0 F1: Web and FTP Site ODBC Logging Properties - ODBC Properties Tab

Use this tab to identify the data source, the table within that data source (if applicable), and the access to that data source, meaning the user name and password. A data source can be any ODBC-compliant file, such as a database or comma-delimited file.

  • Use this tab to set ODBC logging options. Before you can begin ODBC logging from IIS, do the following:

  • Use ODBC-compliant database software (such as Microsoft® Access or Microsoft SQL® Server) to create a database.

  • Within the database, create a table containing the fields listed at the end of this topic.

  • Create a Data Source Name (DSN). For more information, see Windows Server 2003 family Help.

  • Supply IIS with the DSN and Table name by using this dialog box.

  • If required, supply a user name and password for accessing the database.

ODBC Data Source Name (DSN)

Type the name of the data source to which you want to connect. When created, this name is recorded in the ODBC Data Source Administrator, which is accessed through Administrative Tools.

Table

Type the name of the table in the ODBC Data Source specified above.

User Name

Type the alias of the user permitted to access this data source and table.

Password

Type the password associated with the user name specified above.

Related Topics

To learn more about ODBC logging and logging site activity, see the IIS 6.0 online documentation on the Microsoft Windows Server TechCenter.


IIS 6.0 F1: Web Site Properties - Performance Tab

Use this tab to set properties that affect bandwidth use, and the number of client Web connections. By configuring network bandwidth on a given site, you can better control the amount of traffic allowed to that site. For example, by restricting bandwidth and/or the number of connections on a low-priority Web site, you allow other, higher-priority sites to handle larger traffic loads. Settings are site-specific and can be adjusted as network traffic and usage changes.

Bandwidth throttling

Bandwidth throttling limits the bandwidth available to this Web site. Bandwidth throttling uses Packet Scheduler to manage when data packets are sent. When you configure a site to use bandwidth throttling using IIS Manager, Packet Scheduler is automatically installed, and IIS automatically sets bandwidth throttling to a minimum of 1024 bytes/second. However, if you use another method (for example, Active Directory® Service Interfaces [ADSI] or Windows Management Instrumentation [WMI]), you must install Packet Scheduler for bandwidth throttling to work correctly.

Limit the network bandwidth available to this Web site

Select to enable bandwidth throttling on this Web site.

Maximum bandwidth

Type a number in the box or click the up and down arrows to set the maximum bandwidth, in kilobytes per second, that you want to be available to this Web site.

Web site connections

You can configure Internet Information Services (IIS) to allow an unlimited number of concurrent connections, or to limit the number of connections it accepts for this Web site. Setting the number to an unlimited amount circumvents constant administration if your connections tend to fluctuate. However, system performance can be impacted if the number of connections exceeds your system resources. Restricting this site to a specified number of connections can keep performance stable. Settings are site-specific and can be adjusted as network traffic and usage changes.

Unlimited

Click to configure this Web site to handle an unlimited number of concurrent connections.

Connections limited to

Click to set a specific number of concurrent connections to this Web site. Type a number in the box or click the up and down arrows to set the number of connections.

Related Topics

To learn more about the bandwidth throttling feature, limiting simultaneous connections to a Web site, and the role of the performance management, see the IIS 6.0 online documentation on the Microsoft Windows Server TechCenter.


IIS 6.0 F1: Web Site Properties - ISAPI Filters Tab

Use this tab to set options for ISAPI filters. An ISAPI filter is a program that responds to events during the processing of an HTTP request. The table lists each filter's status (which can be enabled or disabled), file name, and priority for loading into memory. You can change the execution order of filters only with the same priority.

Important

If you have added or changed a filter at the global level, you must restart Internet Information Services (IIS) to load the new filter. If you have added or changed a filter at the Web site level, the filter is not loaded until a request is made to the Web site.

Add

Click to add an existing ISAPI filter by browsing for the executable file and providing a friendly name.

Remove

Click to remove the currently selected ISAPI filter from this load list.

Edit

Click to modify the properties of the currently selected ISAPI filter.

Disable

Click to prevent the currently selected ISAPI filter from loading, but keep it in the filter list.

Move up

Click to move the currently selected filter higher in the execution order.

Move down

Click to move the currently selected filter lower in the execution order.

Related Topics

To learn more about ISAPI filers, see the IIS 6.0 online documentation on the Microsoft Windows Server TechCenter.


IIS 6.0 F1: Add/Edit Filter Properties

Use this dialog box to establish ISAPI filter properties. An ISAPI filter is a program that responds to events during the processing of an HTTP request.

Filter Name

Type a friendly name for the ISAPI filter. Friendly names often include version numbers to ensure proper updates with future versions of the filter.

Executable

Type the full path to the executable program associated with this ISAPI filter.

Browse

Click to locate the ISAPI filter.

Related Topics

To learn more about ISAPI filers, see the IIS 6.0 online documentation on the Microsoft Windows Server TechCenter.


IIS 6.0 F1: Add New Application Pool

Use this dialog box to add a new application pool. An application pool is a set of one or more applications assigned to a set of one or more worker processes. Because pools are separated by process boundaries, an application in one pool is not affected by problems caused by applications in other pools.

Application pool ID

Type the ID tag for the application pool you are creating.

Use default settings for new application pool

Establish master settings by right-clicking the Applications Pools directory in the console tree of IIS Manager, and then clicking Properties. All application pool settings established at this level are considered master settings. These settings are propagated into all application pools contained in the directory.

Use existing application pool as template

Click to inherit the settings of an existing application pool on the application pool you are creating. The existing application pool settings act as a template for the application pool you are creating.

Application pool name

Identify the friendly name of the existing application pool to be used as a template for the application pool you are creating.

Related Topics

To learn more about application pools, see the IIS 6.0 online documentation on the Microsoft Windows Server TechCenter.


IIS 6.0 F1: Application Pools - Recycling Tab

Use this tab to administrate the recycling of worker processes. In worker process isolation mode, you can configure IIS to periodically restart worker processes in an application pool, allowing you to manage precisely those worker processes that are faulty. This ensures that specified applications in those pools remain healthy, and that system resources can be recovered.

To recycle a worker process, the ability of the faulty worker process to receive requests is throttled until it completes processing of all remaining requests that it has stored in the request queue. To drain its current requests, the process is given a configured limit. A replacement worker process for the same namespace group starts before the old worker process stops. This prevents service interruptions. The old process completes its outstanding requests, and then shuts down normally or is explicitly terminated if it does not shut down after a configurable time limit, number of requests, on a set schedule, or when a specified limit of memory usage is reached.

Recycle worker processes (in minutes)

Select to recycle worker processes after a specific period of inactivity.

Recycle worker process (number of requests)

Select to recycle worker processes after a specific number of requests.

Recycle worker processes at the following times

Select to use a scheduling scheme to shut down a process and start a replacement.

Add

Click to add a time of day to the scheduled-based worker process recycling criteria.

Remove

Click to remove the currently selected scheduled-based criteria for worker process recycling.

Edit

Click to modify the currently selected scheduled-based criteria for worker process recycling.

Recycle worker process after consuming too much memory

This option allows use of a memory consumption limit scheme to shut down a process and start a replacement. These settings control the memory recycling thresholds when the amount of virtual memory or private memory used by a worker process becomes too high in relation to total system memory. Memory-based recycling is suited for reducing heap fragmentation and recovering memory from applications with memory leaks.

Maximum virtual memory

Select to set the maximum number of megabytes of your system’s common virtual memory to be used by a worker process before that process is recycled.

Entering too high a value can severely decrease system performance. As a starting point, use the default value and work down to the lowest value possible while maintaining good performance.

Maximum used memory

Select to set the maximum number of megabytes of privately allocated system physical memory to be used by a worker process before the process is recycled.

Entering too high a value can severely decrease system performance. As a starting point, use the default value and work down to the lowest value possible while maintaining good performance.

Related Topics

To learn more about worker processes and recycling, see the IIS 6.0 online documentation on the Microsoft Windows Server TechCenter.


IIS 6.0 F1: Application Pools Properties - Performance Tab

Use this tab to configure the way that Internet Information Services (IIS) shuts down idle worker processes, the number of requests waiting to be processed, CPU monitoring, and the number of processes in a Web garden.

Idle timeout

Idle timeout limits helps conserve system resources by terminating unused worker processes by gracefully closing idle processes after a specified idle duration. This allows you to better manage the resources on particular computers when the processing load is heavy, when identified applications consistently fall into an idle state, or when new processing space is not available.

Shutdown worker processes after being idle for (time in minutes)

Select to terminate any idle worker processes after a specific period of inactivity.

Type a number in the box, or click the up and down arrows, to set the amount of minutes before an idle worker process terminates.

Request queue limit

Select to configure IIS to monitor the number of requests for a designated application pool queue before queuing a new request.

Application pool queue length limits prevent large numbers of requests from queuing up and overloading your server. If adding the new request to the queue exceeds the capacity of the queue, the server rejects the request and sends a non-customizable 503-error response to the client.

Limit the kernel request queue (number of requests)

Select to configure IIS to use a numeric-based scheme for limiting incoming HTTP requests and allow you to limit the size of the request queue. When the limit is reached, IIS does not process those additional requests, but sends a non-customizable 503-error response to the client.

Type a number in the box, or click the up and down arrows, to set the limit for the number of requests allowed in the queue.

Enable CPU monitoring

Select to configure IIS to use CPU accounting to track and terminate worker processes that consume large amounts of CPU time that exceed the specified limits. CPU monitoring is available only for applications pools and does not apply to CGI applications.

Maximum CPU use (percentage)

Type a number in the box, or click the up and down arrows, to set the percentage of CPU usage a worker process is permitted to use.

Refresh CPU usage numbers (in minutes)

Type a number in the box, or click the up and down arrows, to set how often CPU process numbers are to be refreshed in order to be used by CPU monitoring.

Action performed when CPU usage exceeds maximum CPU use

From the list box, click the best action to perform when the CPU exceeds its specified maximum usage.

  • If No action is selected, when the CPU usage for a specific application pool or group of pools reaches the set limit, IIS writes an error in the Event Log.

  • If Shutdown is selected, when the CPU usage for a specific application pool reaches the set limit, IIS initiates a shutdown of all worker processes in the application pool by allowing each worker process the application pool's specified ShutdownTimeLimit seconds to shut down. If the processes do not shut down in that time frame, IIS terminates the worker processes. The application pool shuts down and resets according to the time limit set in CPUResetInterval.

Web garden

A Web garden is an application pool using more than one worker process.

Maximum number of worker processes

Type a number in the box, or click the up and down arrows, to set the maximum number of worker processes allowed within an application pool.

Related Topics

To learn more about the timeout and CPU features, and about Web gardens, see the IIS 6.0 online documentation on the Microsoft Windows Server TechCenter.


IIS 6.0 F1: Application Pools Properties - Health Tab

Use this tab to configure worker processes health monitoring. You can set limits for communicating with the worker processes, determine a course of action if a number of processes rapidly fail, and set startup and shutdown times.

Enable pinging

Select to configure Internet Information Services (IIS) to ping each worker process in an application pool every specified number of seconds to detect the activity of the processes.

IIS monitors the health of worker processes by periodically pinging them to determine their responsiveness. If worker processes fail to respond to a ping, the worker process is terminated and a replacement worker process is created.

Ping worker process every (frequency in seconds)

Type a number in the box, or click the up and down arrows, to set the time interval, in seconds, when worker processes are pinged for activity.

Enable rapid-fail protection

Select to configure IIS to remove this application pool from service and place it in a mode where the kernel-mode driver immediately returns a 503 Service Unavailable - out-of-service message to any requests to that application pool.

Rapid-fail protection protects your Internet service from widespread interruptions by detecting and isolating application pools where worker processes are rapidly failing.

Failures

Type a number in the box, or click the up and down arrows, to set a numerical limit on unexpected program terminations. This must be set in conjunction with the Time period setting.

Time period (time in seconds)

Type a number in the box, or click the up and down arrows, to set a time limit in which to detect the corresponding number of unexpected program terminations. This must be set in conjunction with the Failures setting.

Startup time limit

Worker process must startup within (time in seconds)

Type a number in the box, or click the up and down arrows, to set the worker process startup time in seconds.

Shutdown time limit

Worker process must shutdown within (time in seconds)

Type a number in the box, or click the up and down arrows, to set the worker process termination time, in seconds, after IIS detects inactivity.

Related Topics

To learn more about rapid fail protection, see the IIS 6.0 online documentation on the Microsoft Windows Server TechCenter.


IIS 6.0 F1: Application Pools Properties - Identity Tab

The identity of an application pool is the name of the account under which an application pool's worker process runs. By default, application pools operate under the NetworkService account, which has the least user rights that are required to run Web applications. This account provides the most security against attackers who might attempt to take over the computer on which the World Wide Web Publishing Service (WWW service) is running. You can configure application pools to run as LocalSystem, which is an account with more assigned user rights than the NetworkService account; however, running an application pool under an account with more user rights assigned presents a more serious security risk.

For example, suppose that an Internet service provider (ISP) wants to allow customers to upload Common Gateway Interface (CGI) applications and then add them to an application pool. Running the CGI-enabled applications in a separate application pool under the NetworkService account—with its minimal user rights—prevents these applications from being used to take over the server.

Predefined

Click any of the predefined security accounts in the list box.

Configurable

Click to configure your own application pool security by specifying the identity with a user name and the associated password. If you use a custom user account, that account must be part of the IIS_WPG group, or the application pool will fail.

User name

Type the alias of the user permitted to access this data source and table.

Password

Type the password that is associated with the user name specified above.

Browse

Click to view a list of available Windows user accounts on this server.

Note

In previous versions of IIS, worker processes ran under the LocalSystem account. Because the LocalSystem account has access to almost all resources, this can have serious security implications. For better security, the IIS 6.O default is to run worker processes under the newly built-in NetworkService account. IIS 6.0 also allows you to configure the account on which worker processes run.

Related Topics

To learn more about the NetworkService account and the LocalSystem account in IIS, see the IIS 6.0 online documentation on the Microsoft Windows Server TechCenter.


IIS 6.0 F1: Add/Edit Web Site SSL Identification

Use this dialog to configure the Web site Secure Sockets Layer (SSL) identity for this Web site. The Web site SSL identity consists of an IP address and an SSL port number. Only IP addresses that have been defined on this computer, using Control Panel, appear in the IP Address list box. Only one SSL connection per IP address is allowed.

IP address

Select an IP address from the list box that will is to be associated with the SSL connection to this Web site.

SSL port

Specify the port number used for SSL (Secure Sockets Layer) encryption, enter the port number in the SSL Port text box. The default port used for SSL is port is 443. You can change the port to any unique port number, but if you change the port number, clients must know in advance to request that port number, or their requests fail to connect to your server.

Related Topics

To learn more about encrypting data with SSL, naming Web sites, and about how Web site identities are used to route client requests to your Web site, see the IIS 6.0 online documentation on the Microsoft Windows Server TechCenter.


IIS 6.0 F1: Secure Communications

Use this dialog box to configure Secure Sockets Layer (SSL) settings for encrypted communication. When a Web browser supporting secure communications connects to a Web site configured to use SSL (URLs starting with https:// ), a secure connection protects the data being transferred. A client certificate is a digital identification issued by a trusted, third-party organization, referred to as a certification authority. You can configure your Web server to accept, require, or reject client certificates as a means of establishing a connection with a particular file or directory. Users attempting to access a site with client certificates can be mapped; users without client certificates can use other authentication methods. Client certificate mappings match information contained in a client's certificate against Windows user account information. A certificate trust list (CTL) is a list of approved certification authorities for a particular Web site.

Require secure channel (SSL)

Select to configure IIS to require an encrypted communication link for a Web browser to connect with this Web site, directory, or file. When this option is selected, all data sent to and from this Web site is encrypted using a certificate.

Require 128 bit encryption

Select to configure IIS to require a 128-bit encrypted communication link for a Web browser to connect with this Web site, directory, or file.

Ignore client certificates

Select to allow users access to this site without being prompted to present a client certificate.

Accept client certificates

Select to allow access for users with client certificates, without requiring the certificate. Users with client certificates can be mapped; users without client certificates can use other authentication methods.

Require client certificates

Select to allow only users with a valid client certificate to connect. Users without a valid client certificate are denied access to this site. Before you can select this option to require client certificates, you must select the Require secure channel (SSL) option.

Enable client certificate mapping

Select to configure your server to authenticate users who log on with a valid client certificate.

Edit

Click to edit or, if no certificate mapping exists, create a client certificate mapping. When a user logs on to your Web site with a certificate, their permissions match those of the user account to which the certificate is mapped.

Enable the Windows directory service mapper

Select to use directory service client-certificate mapping rather than one-to-one or many-to-one mapping. To enable this service, the server must be a member of the Windows Server 2003 domain.

Enable certificate trust lists

Select to edit existing CTLs or create a new one. A CTL is a list of approved certification authorities for a particular Web site and are applicable only at the Web-site level.

Current CTL

Click a CTL for this site from the list box.

New

Click to create a new CTL for this site.

Edit

Click to change the settings of the currently selected CTL in the list box.

Related Topics

To learn more about certificate mapping and certificates, see the IIS 6.0 online documentation on the Microsoft Windows Server TechCenter.


IIS 6.0 F1: Secure Communications - Account Mappings 1-to-1 Tab

Use this tab to edit one-to-one mappings. One-to-one mappings require the Web server to have access to a text (ASCII) copy of the user's client certificate. The Web server compares the copy of the client certificate it holds with the client certificate sent by the browser. For the mapping to proceed, the two must be absolutely identical. If a client gets another certificate containing all of the same user information, it must be mapped again. To map multiple certificates to a single account, you must define a one-to-one mapping for each client certificate. For use in IIS one-to-one mapping, some certificates need to be exported using Internet Explorer.

Edit Map

Click to edit the currently selected mapping.

Add

Click to map a client certificate to a Windows user account.

Delete

Click to delete the currently selected mapping you created, and not the client certificate.

Related Topics

To learn more about certificate mapping and certificates, see the IIS 6.0 online documentation on the Microsoft Windows Server TechCenter.


IIS 6.0 F1: Secure Communications - Account Mappings Many-to-1 Tab

Use this tab to enable many-to-one mapping. Many-to-one mapping uses wildcard matching rules that verify whether a client certificate contains specific information, such as issuer or subject. This mapping does not compare the actual client certificate, but rather accepts all client certificates fulfilling the specific criteria. If a client gets another certificate containing all of the same user information, the existing mapping will still works. You can list matching rules for a certificate by clicking the Rule Description header, or list the matching rules by the account they are mapped to, by clicking the Mapped Windows Account header. Certificates do not need to be exported for use in many-to-one mapping.

Important

To ensure that changes to matching rules are enacted, stop and restart the Web site.

Enable Wildcard Client Certificate Matching

Select to configure IIS by enabling custom matching rules that check whether client certificate fields match pre-defined criteria.

Edit Rule

Click to modify the currently selected matching rule.

Add

Click to create a custom rule for checking a client certificate's fields for specific information before mapping the certificate to a Windows user account.

Delete

Click to remove the currently selected custom matching rule. To select multiple mappings, either press the CTRL key while selecting individual accounts, or press the SHIFT key while selecting a range of accounts.

Move Up

Click to move the currently selected rule higher in the matching rules list. Moving a rule higher in the list gives it a higher priority.

Move Down

Click to move a rule lower in the matching rules list. Moving a rule lower in the list gives it a lower priority.

Note

If two rules that are defined for the same certificate criteria conflict, the rule with the higher priority is used, and the other rule is ignored. You can list the rules either by their names, by clicking on the Rule Description header, or by the account they are mapped to, by clicking the Mapped Windows Account header.

Related Topics

To learn more about certificate mapping and certificates, see the IIS 6.0 online documentation on the Microsoft Windows Server TechCenter.


IIS 6.0 F1: Edit Wildcard Mapping Rule - General Tab

Use the Edit Wildcard Mapping Rule dialog box and its associated tabs to create custom rules for mapping client certificates to Windows user accounts. The editor allows you to define whether certain client certificate fields match pre-defined criteria. Client certificates can contain identification information, such as company names, localities, or e-mail addresses, formatted into arrangements of fields and subfields.

You can create rules at any time but defer enabling to a later time.

The General tab contains the following elements:

Enable this wildcard rule

Select to configure IIS to enable the currently selected wildcard rule.

Description

Type an optional comment in the box.

Related Topics

To learn more about certificate mapping and certificates, see the IIS 6.0 online documentation on the Microsoft Windows Server TechCenter.


IIS 6.0 F1: Edit Wildcard Mapping Rule - Rules Tab

Use this tab to create matching rules that check whether certain client certificate fields match pre-defined criteria. If a field or subfield matches the criteria, the certificate is mapped to a Windows user account. Click the Certificate Field, Sub Field, or Match Criteria column header to sort the list by that type of information.

Edit

Click to modify the currently selected certificate field and its match criteria.

New

Click to create a new certificate field and its match criteria with the Edit Rule Element dialog box.

Delete

Click to delete the currently selected certificate field and match criteria.

Related Topics

To learn more about certificate mapping and certificates, see the IIS 6.0 online documentation on the Microsoft Windows Server TechCenter.


IIS 6.0 F1: Edit Rule Element

Use this dialog box to create or edit elements of a matching rule. Client certificates can contain identification information, such as company names, localities, or e-mail addresses, formatted into arrangements of fields and subfields. Your Web server can use this identification information to map the user's identity to a Windows user account.

Field names represent general categories of information, such as (Client) Subject and Issuer. For more information about the fields and subfields of a certificate, see the documentation for the certification authority that issued that certificate.

Subfield names represent information specific to each of the general Subject and Issuer categories. The following list describes basic subfields contained in a certificate:

(O) Organization

The top-level organization or company name, preferably International Organization for Standardization (ISO)-registered.

(OU) Organization Unit

A department within a company, (for example, Marketing).

(CN) Common Name

The domain name of the server, (for example, www.microsoft.com).

(C) Country/Region

Two-letter ISO country/region designation (for example, US, FR, AU, or UK).

(S) State or Province

The full, unabbreviated name of the state or province (for example, Washington instead of WA or Alberta instead of AB).

(L) Locality

The full name of the city where your company is located (for example, Redmond or Toronto).

Several non-standard subfield categories are supported as well, including the following:

(I) Inititals

Initials of the certificate owner.

(GN) Given Name

Given name of the certificate owner.

(T) Title

Title of the certificate owner.

(Email)

E-mail address of the certificate owner.

Consult a certification authority to obtain updated subfield information.

Match Capitalization

Select to configure IIS to make your rule element case sensitive.

Certificate Field

Click a certificate field element of a matching rule from the list box. Select this element before selecting the other elements in this dialog box.

Sub Field

Click a sub-element of the certificate field of a matching rule from the list box. Select an element from the Certificate Field list box first in order to view the entire valid list of valid subfields.

Criteria

Specify the criteria for matching field and subfield information. For example, if the subfield is "O", the criteria could be "Microsoft" to indicate to which organization the matching rule should correspond. You can use the wildcard character (*) to partially specify the text of your criteria.

Related Topics

To learn more about certificate mapping and certificates, see the IIS 6.0 online documentation on the Microsoft Windows Server TechCenter.


IIS 6.0 F1: Edit Wildcard Mapping Rule - Mapping Tab

Use this tab to specify what action to take when a Web client sends a certificate that matches the criteria specified on the preceding tabs. You can refuse access to the Web site or map the identity of the user to a specific Windows user account.

Accept this certificate for Logon Authentication

Click to configure IIS to allow access to resources on this Web site for any certificate matching the specified rules.

Refuse Access

Click to configure IIS to refuse access to resources on this Web site for any certificate matching the specified rules.

Account

Type the Windows user account to be used as the client's identity.

Browse

Click to view a list of available Windows user accounts on this server. If you find the account that you want to use as the client's identity while navigating this Web site, click the account name in the list. The name is entered in the Account box.

Password

Type the password of the Windows user account listed in the Account box. If you change the password in Windows, you must also change it here.

Apply

Click to complete the creation of the certificate account mapping.

Related Topics

To learn more about certificate mapping and certificates, see the IIS 6.0 online documentation on the Microsoft Windows Server TechCenter.


IIS 6.0 F1: Web Site Properties - Home Directory Tab

Use this property sheet to create and manage Web sites on your IIS server. The settings on this tab are similar to those available on the Home Directory tab of virtual directories.

Setting up local or network paths allows the request to be directed to the correct physical location. You can further configure the physical location by setting user access rights, choosing whether to log requests for these resources, and choosing whether to index this site using the Indexing Service. To specify when the request is received, applications must be identified, located, and given the appropriate execute permissions and protection.

The content for this resource should come from

This setting allows you to define the location of the home directory for this Web site.

A directory located on this computer

Click to permit users to access a specified directory on this computer to view or update Web content. You can type the directory name in the Local path text box. You can control access to the contents by implementing any Windows security method.

A share located on another computer

Click to permit users to view or update Web content on another computer that has an active connection to this computer. If you have administrative credentials on the remote computer, you can control access to the contents by implementing any Windows security method. When selected, you can enter the server name and directory name in the Network Directory box. Click Connect As to enter network user name and password information.

A redirection to a URL

Click to redirect the client application, such as a browser, to another Web site or virtual directory by entering a URL in the Redirect to box. When selected, redirect options are substituted for path options.

If you click either A directory located on this computer or A share located on another computer, the following options are available:

Local path

When content comes from a directory located on this computer, this box displays the path to the directory that stores your Web site files. By default, these files are stored in the systemdrive\inetpub\wwwroot directory.

Browse

Click to locate the directory path.

Network directory

When content comes from another computer on the network, this box displays the computer name and share name of the content location.

Connect as

When content comes from another computer on the network, click to provide a user name and password for access to the network share.

Script source access

Select to allow users to access source code if either Read or Write permissions are set. Source code includes scripts in ASP applications.

Read

Select to allow users to read or download files or directories and their associated properties.

Write

Select to allow users to upload files and their associated properties to the enabled directory on your server or to change content in a Write-enabled file. Write access is allowed only when a browser that supports the PUT feature of the HTTP 1.1 protocol standard.

Directory browsing

Select to allow users to see a hypertext listing of the files and subdirectories in this virtual directory. Because virtual directories do not appear in directory listings, users must know a virtual directory's alias. If Directory browsing is disabled and the user does not specify a file name, the Web server displays an "Access Forbidden" error message in the user's Web browser.

Log visits

Select to configure IIS to record visits to this directory in a log file. Visits are recorded only if logging is enabled for this Web site.

Index this resource

Select to allow the Microsoft Indexing Service to include this directory in a full-text index of your Web site.

Note

Before setting this option, you must enable the Indexing Service through the Add or Remove Programs item in Control Panel.

Application name

Type the name of the root directory that contains the files and subdirectories of an application.

Starting point

This displays the metabase node where the application is configured.

Execute permissions

This option determines the program execution level allowed for this site's resources.

  • Set permissions to None to restrict access only to static files such as HTML or image files.

  • Set permissions to Scripts to allow only scripts to run, not executables.

  • Set permissions to Scripts and Executables to remove all restrictions so that all file types can be accessed or executed.

Application pool

Click the application pool in the list box that is associated with this home directory.

Remove/Create

Click to remove an application, or to create an application from the Web site while leaving the virtual directory intact.

Configuration

Click to configure application mappings, options, and debugging features.

Unload

Click to unload an isolated application from memory, or to unload a pooled application not referenced by any other application.

If you click A redirection to a URL, the following options are available:

Redirect to

Type a fully qualified URL from which the content will be served.

The exact URL entered above

Select to redirect a virtual directory to the destination URL without adding any other portions of the original URL. You can use this option to redirect an entire virtual directory to one file. For example, to redirect all requests for the /scripts virtual directory to the Default.htm file in the home directory, type /Default.htm in the Redirect to box and select this option.

A directory below URL entered

Select to redirect a parent directory to a child directory. For example, to redirect your home directory (designated by /) to a subdirectory named /newhome, type /newhome in the Redirect To box and select this option. Without this option, the Web server will continually map the parent to itself.

A permanent redirection for this resource

Click to send the following message to the client: "301 Permanent Redirect." Redirects are considered temporary, and the client browser receives the following message: "302 Temporary Redirect." Some browsers can use the "301 Permanent Redirect" message as the signal to permanently change a URL, such as a bookmark.

Related Topics

To learn more about the home directory, redirect variables and redirect wildcards, and about configuring applications, see the IIS 6.0 online documentation on the Microsoft Windows Server TechCenter.


IIS 6.0 F1: Network Directory Security Credentials

Use this dialog box to establish security credentials for access to the network share from which content is to be served.

Note

The User name and Password boxes are not available if the Always use the authenticated user’s credentials when validating access to the network directory option at the bottom of the dialog box is selected. To establish a user name and password for all users when accessing this share, clear this check box.

User name

Type a user name. This name is used for all client connections to the remote share.

Password

Type a password. This password is used for all client connections to the remote share.

Browse

Click to locate the directory path.

Always use the authenticated user’s credentials when validating access to the network resource.

When this option is selected, connection attempts to the remote share are validated against the currently logged-on user’s name and password. When this option is cleared, all client connections to the remote share use the specific user name and password entered.

Related Topics

To learn more about directory security, see the IIS 6.0 online documentation on the Microsoft Windows Server TechCenter.


IIS 6.0 F1: Web Site Virtual Directory Properties - Virtual Directory Tab

Use this tab to create and manage virtual directories on your Web site. Virtual directories are pointers to Web files and Web folders that are stored on your computer and are used for content management. Configuring virtual directories is similar to configuring Web sites.

Setting up local or network paths allows the request to be directed to the correct physical location. You can further configure the physical location by setting user access rights, choosing whether to log requests for these resources, and choosing whether to index this site using the Indexing Service. To specify when the request is received, applications must be identified, located, and given the appropriate execute permissions and protection.

The content for this resource should come from

This setting allows you to define the location of the content for this virtual directory.

A directory located on this computer

Click to permit users to access a specified directory on this computer to view or update Web content. You can type the directory name in the Local path text box. You can control access to the contents by implementing any Windows security method.

A share located on another computer

Click to permit users to view or update Web content on another computer that has an active connection to this computer. If you have administrative credentials on the remote computer, you can control access to the contents by implementing any Windows security method. When selected, you can enter the server name and directory name in the Network Directory box. Click Connect As to enter network user name and password information.

A redirection to a URL

Click to redirect the client application, such as a browser, to another Web site or virtual directory. When selected, redirect options are substituted for path options.

If you click either A directory located on this computer or A share located on another computer, the following options are available:

Local path

When content comes from a directory located on this computer, this box displays the path to the directory that stores your Web site files. By default, these files are stored in the systemdrive\inetpub\wwwroot directory.

Browse

Click to locate directory path.

Script source access

Select to allow users to access source code if either Read or Write permissions are set. Source code includes scripts in ASP applications.

Read

Select to allow users to read or download files or directories and their associated properties.

Write

Select to allow users to upload files and their associated properties to the enabled directory on your server or to change content in a Write-enabled file. Write access is allowed only when a browser that supports the PUT feature of the HTTP 1.1 protocol standard.

Directory browsing

Select to allow users to see a hypertext listing of the files and subdirectories in this virtual directory. Because virtual directories do not appear in directory listings, users must know a virtual directory's alias. If Directory browsing is disabled and the user does not specify a file name, the Web server displays an "Access Forbidden" error message in the user's Web browser.

Log visits

Select to configure IIS to record visits to this directory in a log file. Visits are recorded only if logging is enabled for this Web site.

Index this resource

Select to allow the Microsoft Indexing Service to include this directory in a full-text index of your Web site.

Note

Before setting this option, you must enable the Indexing Service through the Add or Remove Programs item in Control Panel.

Application name

Type the name of the root directory that contains the files and subdirectories of an application.

Starting point

This displays the metabase node where the application is configured.

Execute permissions

This option determines the program execution level allowed for this site's resources.

  • Set permissions to None to restrict access only to static files such as HTML or image files.

  • Set permissions to Scripts to allow only scripts to run, not executables.

  • Set permissions to Scripts and Executables to remove all restrictions so that all file types can be accessed or executed.

Application pool

Click the application pool from the list box that is associated with this home directory.

Remove/Create

Click to remove an application, or to create an application from the Web site while leaving the virtual directory intact.

Configuration

Click to configure application mappings, options, and debugging features.

Unload

Click to unload an isolated application from memory, or to unload a pooled application not referenced by any other application.

If you click A redirection to a URL, the following options are available:

Redirect to

Type a fully qualified URL from which the content will be served.

The exact URL entered above

Select to redirect a virtual directory to the destination URL without adding any other portions of the original URL. You can use this option to redirect an entire virtual directory to one file. For example, to redirect all requests for the /scripts virtual directory to the Default.htm file in the home directory, type /Default.htm in the Redirect to box and select this option.

A directory below URL entered

Select to redirect a parent directory to a child directory. For example, to redirect your home directory (designated by /) to a subdirectory named /newhome, type /newhome in the Redirect To box and select this option. Without this option, the Web server will continually map the parent to itself.

A permanent redirection for this resource

Click to send the following message to the client: "301 Permanent Redirect." Redirects are considered temporary, and the client browser receives the following message: "302 Temporary Redirect." Some browsers can use the "301 Permanent Redirect" message as the signal to permanently change a URL, such as a bookmark.

Related Topics

To learn more about logging site activity and directory security, see the IIS 6.0 online documentation on the Microsoft Windows Server TechCenter.


IIS 6.0 F1: Virtual Directory Properties - Virtual Directory for File Tab

Use this tab to create and manage virtual directories on your Web site. Virtual directories are pointers to Web files and Web folders that are stored on your computer and are used for content management. Configuring virtual directories is similar to configuring Web sites. Content for the virtual directory can come from one of the following sources:

The content for this resource should come from

This setting allows you to define the location of the content for this virtual directory.

The designated file

Click to specify the default file initially displayed on the client or run on the server when the browser requests that site. You can control access to this file by implementing any Windows security method.

A redirection to a URL

Click to redirect the client application, such as a browser, to another Web site or virtual directory. When selected, redirect options are substituted for path options.

Local path

When content comes from a directory located on this computer, this box displays the path to the directory that stores your Web site files. By default, these files are stored in the systemdrive\inetpub\wwwroot directory.

Browse

Click to locate directory path.

Script source access

Select to allow users to access source code if either Read or Write permissions are set. Source code includes scripts in ASP applications.

Read

Select to allow users to read or download files or directories and their associated properties.

Write

Select to allow users to upload files and their associated properties to the enabled directory on your server or to change content in a Write-enabled file. Write access is allowed only when a browser that supports the PUT feature of the HTTP 1.1 protocol standard.

Directory browsing

Select to allow users to see a hypertext listing of the files and subdirectories in this virtual directory. Because virtual directories do not appear in directory listings, users must know a virtual directory's alias. If Directory browsing is disabled and the user does not specify a file name, the Web server displays an "Access Forbidden" error message in the user's Web browser.

Log visits

Select to configure IIS to record visits to this directory in a log file. Visits are recorded only if logging is enabled for this Web site.

Related Topics

To learn more about logging site activity and virtual directories, see the IIS 6.0 online documentation on the Microsoft Windows Server TechCenter.


IIS 6.0 F1: FTP Site Properties - FTP Site Tab

Use this tab to set a friendly name for your Web site, configure access to your Web site, set connection limits to your site, and enable logging and configure the logging format for your site.

FTP site identification

In order for browsers to access your FTP content, both an IP address and TCP port number must be defined.

Description

Type a friendly name for your Web site. The friendly name appears in the console tree of IIS Manager. The description of the site is not required.

IP address

Assign an IP address from the list box or type a new IP address to be used for accessing this site. If you do not assign a specific IP address, this site responds to all IP addresses assigned to this computer and not assigned to other sites, which makes this the default Web site. For an IP address to appear in the list, the IP address must have already been defined for use on this computer in Control Panel. See Windows Server 2003 family Help for more information.

TCP port

Type the TCP port on which the FTP service is running. The default port is 21. You can change the port to any unique TCP port number, but if you change the port number, clients must know in advance to request that port number, or their requests fail to connect to your server. A port number is required; this text box cannot be left blank.

FTP site connections

These settings determine the number of simultaneous client connections to your server.

Unlimited

Click to configure this FTP site to handle an unlimited number of concurrent connections. The server accepts connections until it runs out of memory.

Connections limited to

Click to enforce a limit of simultaneous client connections to the server. To maintain good server performance, it is recommended that you set a limit. When the limit is reached, IIS returns an error message to the client stating that the server is busy.

Connection timeout

Type a number in the box to set the length of time in seconds before the server disconnects an inactive user. This ensures that all connections are closed within the specified time period if the FTP protocol fails to close a connection.

Enable logging

Select to enable your FTP site's logging features, which records details about user activity and creates logs in your choice of format.

The information is stored in ASCII files or an ODBC-compliant database. Logging information in IIS goes beyond the scope of the event-logging or performance-monitoring features of Microsoft ® Windows®. The logs can include information such as who has visited your site, what the visitor viewed, and when the information was viewed last. You can use the logs to assess content popularity or identify information bottlenecks.

Active log format

Select one of the following formats for the log files:

  • Microsoft IIS Log Format: A fixed ASCII format.

  • ODBC Logging: A fixed format logged to a database that is compatible with that database.

  • W3C Extended Log File Format: A customizable ASCII format, selected by default. To use Process Accounting, the W3SVC Extended Log File format must be selected.

Properties

Click to configure options for log file creation (for example, weekly, or by file size), or to configure properties for W3C Extended logging or ODBC logging.

Current Sessions

Click to display a list of users currently connected to your site, not to your server.

Related Topics

To learn more about setting up an FTP site and logging site activity, see the IIS 6.0 online documentation on the Microsoft Windows Server TechCenter.


IIS 6.0 F1: FTP Site Logging Properties - General Tab

Use this dialog box to specify how log files are created and saved.

New log schedule (common for all log formats)

Any changes to the log schedule defined takes effect immediately after applying the new settings.

Hourly

Click to create log files hourly.

Daily

Click to create log files daily, starting with the first entry that occurs after midnight.

Weekly

Click to create log files weekly, starting with the first entry that occurs after midnight Saturday.

Monthly

Click to create log files monthly, starting with the first entry that occurs after midnight of the last day of the month.

Note

"Midnight" is midnight local time. Midnight is used for all log file formats except W3C Extended format, which by default uses midnight Greenwich Mean Time, but can be specified as midnight local time (by selecting the Use local time for file naming and rollover option below).

Unlimited file size

Click to always append data to the same log file. You can access this log file only after stopping the server.

When file size reaches

Click to create a new log file when the current log file reaches a given size. Type or click the up and down arrows to specify the size you want.

Use local time for file naming and rollover (W3C-specific)

Select to set creation time and naming format for W3C Extended log files to midnight local time rather than Greenwich Mean Time.

Log file directory

Type the directory in which log files should be saved, or click Browse to locate the directory.

Browse

Click to locate the directory to which log files will be saved.

Related Topics

To learn more about setting up an FTP site and logging site activity, see the IIS 6.0 online documentation on the Microsoft Windows Server TechCenter.


IIS 6.0 F1: FTP Site Logging Properties - Advanced Tab

Use this tab to customize W3C Extended logging, by choosing the fields (items) to be recorded in the log. To limit log size, omit unneeded fields.

Extended logging options

The fields are as follows:

Date

Select to record the date the activity occurred.

Time

Select to record the time the activity occurred.

Extended Properties

Client IP Address

Select to record the IP address of the client that accessed your server.

User Name

Select to record the name of the authenticated user who accessed your server. This does not include anonymous users, which are represented by a hyphen (-).

Service Name

Select to record the Internet service and instance number that was accessed by a client.

Server Name

Select to record the name of the server on which the log entry was generated.

Server IP

Select to record the IP address of the server on which the log entry was generated.

Server Port

Select to record the port number the client is connected to.

Method

Select to record the action the client was trying to perform (for example, a GET command).

URI Stem

Select to record the resource accessed (for example, an HTML page, a CGI program, or a script).

URI Query

Select to record the query, if any, the client was trying to perform; that is, one or more search strings for which the client was seeking a match.

Protocol Status

Select to record the status of the action, in HTTP or FTP terms.

Protocol Substatus

Select to record additional status of the action, in HTTP terms. For more information about the protocol substatus error codes, see the IIS 6.0 online documentation on the Microsoft Windows Server TechCenter.

Win32 Status

Select to record the status of the action, in terms used by the Windows operating system.

Bytes Sent

Select to record the number of bytes sent by the server.

Bytes Received

Select to record the number of bytes received by the server.

Time Taken

Select to record the length of time the action took.

Protocol Version

Select to record the protocol (HTTP, FTP) version used by the client. For HTTP, this is either HTTP 1.0 or HTTP 1.1.

Host

Select to record the content of the host header.

User Agent

Select to record the browser used on the client.

Cookie

Select to record the content of the cookie sent or received, if any.

Referrer

Select to record the previous site visited by the user. This site provided a link to the current site.

Related Topics

To learn more about setting up an FTP site and logging site activity, see the IIS 6.0 online documentation on the Microsoft Windows Server TechCenter.


IIS 6.0 F1: FTP Site Logging Properties - ODBC Properties Tab

Use this tab to set ODBC logging options. Before you can begin ODBC logging from IIS, complete the following tasks:

  • Use ODBC-compliant database software (such as Microsoft® Access or Microsoft SQL® Server) to create a database.

  • Within the database, create a table containing the fields listed at the end of this topic.

  • Create a Data Source Name (DSN). For more information, see Windows® Server 2003 family Help.

  • Supply IIS with the DSN and Table name by using this dialog box.

  • If required, supply a user name and password to access the database.

ODBC Data Source Name (DSN)

Type the name of the data source you want to connect to. When created, this name is recorded in the ODBC Data Source Administrator, which is accessed through Administrative Tools.

Table

Type the name of the table in the ODBC data source specified above.

User name

Type the alias of the user permitted to access this data source and table.

Password

Type the password that is the associated with the user name specified above.

Related Topics

To learn more about setting up an FTP site and logging site activity, see the IIS 6.0 online documentation on the Microsoft Windows Server TechCenter.


IIS 6.0 F1: FTP Site Properties - Security Accounts Tab

Use this tab to control who can administer this FTP site. You can specify the account to be used for anonymous client requests to log on to the computer, and you can control those users with user rights as site operators.

Allow anonymous connections

Select to allow anonymous connections to the FTP site using a predefined user name and password.

User name

Type the user name that should be used for anonymous connections, or click Browse to select another user.

Browse

Click to search and select the object type, such as user, and the location, such as your computer or any accessible computer connected on the network.

Password

Type the password that is associated with the specified user name.

Allow only anonymous connections

Select to configure IIS to allow only anonymous connections. When selected, users cannot log on with user names and passwords. This option denies access to those who use an account with administrative credentials; only those who use an anonymous access account are assigned access.

Related Topics

To learn more about setting up an FTP site, logging site activity, and FTP authentication and security, see the IIS 6.0 online documentation on the Microsoft Windows Server TechCenter.


IIS 6.0 F1: FTP Site Properties - Messages Tab

Use this tab to create a banner, welcome, and exit message that displays when a user connects to your FTP site.

Banner

Type a banner message. The FTP server displays this message before clients connect to the FTP server. The message is blank by default.

Welcome

Type a welcome message. The FTP server displays this message when clients connect to the FTP server. The message is blank by default.

Exit

Type an exit message. The FTP server displays this message when clients log off the FTP server. The message is blank by default.

Maximum connections

Type a maximum connections message. The FTP server displays this message when clients try to connect and are unable to because the FTP service has reached the maximum number of client connections allowed. The message is blank by default.

Related Topics

To learn more about messages and FTP site administration, see the IIS 6.0 online documentation on the Microsoft Windows Server TechCenter.


IIS 6.0 F1: FTP Site Properties - Home Directory Tab

Use this tab to change the home directory for your FTP site or to modify its properties. The home directory is the central location for the published files in your FTP site. A default home directory, stored in the systemdrive\inetpub\ftproot, was created when you installed the FTP service.

You can change the location of the home directory to one of the following:

A directory located on this computer

Click to permit users to access a specified directory on this computer to view or update FTP content. You can control access to the content by implementing any Windows security method.

In the Local Path box, type the path to the directory or the destination URL. The syntax must match the currently selected path type. For a local directory, use the full path, for example, C:\Inetpub\Ftproot). For a network share, use a Universal Naming Convention (UNC) server and share name, for example \\Webserver\htmlfiles.

A directory located on another computer

Click to permit users to view or update FTP content on another computer that has an active connection to this computer. If you have administrative credentials on the remote computer, you can control access to the content by implementing any Windows security method.

In the Network share box you can type the server name and directory name. Click the Connect As button to type or change the network user name and password information.

FTP site directory

If you click A directory located on this computer, the following options are available:

Local path

When content comes from a directory located on this computer, this box displays the path to the directory that stores your FTP site files. By default, these files are stored in the systemdrive\inetpub\Ftproot directory.

Browse

Click to locate the directory path.

If you click A directory located on another computer, the following options are available:

Network share

Type the server name and directory name.

Connect as

Click to provide a user name and password for access to the network share.

If you click either A directory located on this computer or A directory located on another computer, the following options are available:

Read

Select to enable users to read or download files stored in a home directory or a virtual directory.

Write

Select to allow users to upload files to the enabled directory on your server. You should enable write permissions only for directories that are intended to accept files from users.

Log visits

Select to record visits to this directory in a log file. Visits are recorded only if logging is enabled for this FTP site. Logging is enabled by default.

Directory listing style

These settings allow you to choose between MS-DOS and UNIX style directory listings.

UNIX

Click to display the year in a four-digit format when the date of the file is different from the year of the FTP server. No year is returned in cases where the file date has the same year as the FTP server.

MS-DOS

Click to display the year in a date in a two-digit format by default. You can programmatically change this setting to display years in a four-digit format by enabling the FtpDirBrowseShowLongDate metabase property.

Related Topics

To learn more about FTP site administration, setting up an FTP site, logging site activity, and the FtpDirBrowseShowLongDate metabase property, see the IIS 6.0 online documentation on the Microsoft Windows Server TechCenter.


IIS 6.0 F1: FTP Site Properties - Directory Security Tab

Use this tab to allow or block access to your FTP site to individual computers or groups of computers.

TCP/IP address access restrictions

By specifying the TCP or IP address of the computer or computers to be assigned or denied access, you can control access to FTP resources, such as sites, virtual directories, or files.

Granted access

Click this option to grant access to all computers.

To add computers, groups of computers, or domains that you want to deny access to, click Add, and type the required information in the Deny Access dialog box. The computers that are denied access appear in the Except the following list box.

Denied access

Click this option to deny access to all computers.

To add computers, groups of computers, or domains that you want to grant access to, click Add, and type the required information in the Grant Access dialog box. The computers that are granted access appear in the Except the following list box.

Add

Click to define a computer or group of computers to which you want to grant or deny access.

Note

Computers accessing your server across proxy servers appear to have the same IP address as the proxy server.

Remove

Click to remove the currently selected item from the exception list.

Edit

Click to modify the specific properties of the currently selected item in the exception list.

Related Topics

To learn more about FTP site administration, and FTP authentication and security, see the IIS 6.0 online documentation on the Microsoft Windows Server TechCenter.


IIS 6.0 F1: FTP Site Properties - FTP Site Tab (Service)

Use this tab to set a friendly name for your Web site, configure access to your Web site, set connection limits to your site, and enable logging and configure the logging format for your site.

FTP site identification

In order for browsers to access your FTP content, both an IP address and TCP port number must be defined.

Description

Type a friendly name for your Web site. The friendly name appears in the console tree of IIS Manager. The description of the site is not required.

IP address

Assign an IP address from the list box or type a new IP address to be used for accessing this site. If you do not assign a specific IP address, this site responds to all IP addresses assigned to this computer and not assigned to other sites, which makes this the default Web site. For an IP address to appear in the list, the IP address must have already been defined for use on this computer in Control Panel. See Windows Server 2003 family Help for more information.

TCP port

Type the TCP port on which the FTP service is running. The default port is 21. You can change the port to any unique TCP port number, but if you change the port number, clients must know in advance to request that port number, or their requests fail to connect to your server. A port number is required; this text box cannot be left blank.

FTP site connections

These settings determine the number of simultaneous client connections to your server.

Unlimited

Click to configure this FTP site to handle an unlimited number of concurrent connections. The server accepts connections until it runs out of memory.

Connections limited to

Click to enforce a limit of simultaneous client connections to the server. To maintain good server performance, it is recommended that you set a limit. When the limit is reached, IIS returns an error message to the client stating that the server is busy.

Connection timeout

Type a number in the box to set the length of time in seconds before the server disconnects an inactive user. This ensures that all connections are closed within the specified time period if the FTP protocol fails to close a connection.

Enable logging

Select to enable your FTP site's logging features, which records details about user activity and creates logs in your choice of format.

The information is stored in ASCII files or an ODBC-compliant database. Logging information in IIS goes beyond the scope of the event-logging or performance-monitoring features of Microsoft ® Windows®. The logs can include information such as who has visited your site, what the visitor viewed, and when the information was viewed last. You can use the logs to assess content popularity or identify information bottlenecks.

Active log format

Select one of the following formats for the log files:

  • Microsoft IIS Log Format: A fixed ASCII format.

  • ODBC Logging: A fixed format logged to a database that is compatible with that database.

  • W3C Extended Log File Format: A customizable ASCII format, selected by default. To use Process Accounting, the W3SVC Extended Log File format must be selected.

Properties

Click to configure options for log file creation (for example, weekly, or by file size), or to configure properties for W3C Extended logging or ODBC logging.

Current Sessions

Click to display a list of users currently connected to your site, not to your server.

Related Topics

To learn more about setting up an FTP site and logging site activity, see the IIS 6.0 online documentation on the Microsoft Windows Server TechCenter.


IIS 6.0 F1: FTP User Sessions

This dialog box displays a list of all currently connected users, the connection source, and the time they connected.

Disconnect

Click to disconnect only those users you have selected from the list.

Disconnect All

Click to disconnect all current users.

Close

Click to close the dialog box.

Refresh

Click to refresh the list with changes made to the list after you opened the dialog box.

Related Topics

To learn more about FTP site administration, see the IIS 6.0 online documentation on the Microsoft Windows Server TechCenter.


IIS 6.0 F1: FTP Network Directory Security Credentials

Use this dialog box to establish security credentials for access to the network share from which content is to be served.

Note

The User name and Password boxes are not available if the Always use the authenticated user’s credentials when validating access to the network directory option at the bottom of the dialog box is selected. To establish a user name and password for all users when accessing this share, clear this check box.

User name

Type a user name. This name is used for all client connections to the remote share.

Password

Type a password. This password is used for all client connections to the remote share.

Browse

Click to locate the directory path.

Always use the authenticated user’s credentials when validating access to the network resource.

Select to validate connection attempts to the remote share against the currently logged-on user’s name and password. When this option is cleared, all client connections to the remote share use the specific user name and password entered.

Important

If you specify a user name and password to connect to a network drive, all FTP server access to that directory will use that user name and password. Choose the user name carefully to prevent possible security breaches. For tighter security, use the IUSR_computername account (the anonymous user) for the computer on the network.

Related Topics

To learn more about directory security, see the IIS 6.0 online documentation on the Microsoft Windows Server TechCenter.


IIS 6.0 F1: FTP Site Virtual Directory Properties - Virtual Directory Tab

Use this tab to change the properties of a virtual directory in your FTP site. A virtual directory is a directory that is not physically contained within the home directory. To visitors of your site, it appears as though the virtual directory is contained within the home directory.

To add a new virtual directory to an FTP site, right-click the FTP site in IIS Manager, select Create New, and then click Virtual Directory.

The content for this resource should come from

A directory located on this computer

Click to permit users to access a specified directory on this computer to view or update FTP content. You can control access to the content by implementing any Windows security method.

In the Local Path box, type the path to the directory or the destination URL. The syntax must match the currently selected path type. For a local directory, use the full path, for example, C:\Inetpub\Ftproot). For a network share, use a Universal Naming Convention (UNC) server and share name, for example \\Webserver\htmlfiles.

A directory located on another computer

Click to permit users to view or update FTP content on another computer that has an active connection to this computer. If you have administrative credentials on the remote computer, you can control access to the content by implementing any Windows security method.

In the Network share box you can type the server name and directory name. Click the Connect As button to type or change the network user name and password information.

FTP site directory

If you click A directory located on this computer, the following options are available:

Local path

When content comes from a directory located on this computer, this box displays the path to the directory that stores your FTP site files. By default, these files are stored in the systemdrive\inetpub\Ftproot directory.

Browse

Click to locate the directory path.

If you click A directory located on another computer, the following options are available:

Network share

Type the server name and directory name.

Connect as

Click to provide a user name and password for access to the network share.

If you click either A directory located on this computer or A directory located on another computer, the following options are available:

Read

Select to enable users to read or download files stored in a home directory or a virtual directory.

Write

Select to allow users to upload files to the enabled directory on your server. You should enable write permissions only for directories that are intended to accept files from users.

Log visits

Select to record visits to this directory in a log file. Visits are recorded only if logging is enabled for this FTP site. Logging is enabled by default.

Related Topics

To learn more about FTP site administration, setting up an FTP site, and logging site activity, see the IIS 6.0 online documentation on the Microsoft Windows Server TechCenter.


IIS 6.0 F1: New Web Service Extension

In an effort to reduce the attack surface of your Web server, IIS 6.0 serves only static content after a default installation. Programmatic functionality provided by IIS APIs (ISAPIs) or Common Gateway Interfaces (CGIs) must be manually enabled by an IIS administrator. ISAPIs and CGIs extend the ability of your Web pages and for this reason ISAPIs and CGIs are referred to here as Web service extensions. For example, in order to run Active Server Pages (ASP) with this version of IIS, the ISAPI Asp.dll must be enabled as a new Web service extension.

Use the options in this dialog box to enable or disable specific ISAPIs or CGIs.

Note

ISAPI filters are not considered Web service extensions. ISAPI filters are not enabled through this dialog box.

Note

For a Web service extension to run, the ISAPI or CGI must be located in the content directory on your server running IIS (for example, LocalDrive:\Inetpub\wwwroot for a default installation).

Extension name

Type the friendly name of the ISAPI or CGI (for example, Microsoft® FrontPage® Server Extensions).

Required files

This is a list of all of the ISAPIs or CGIs required for the Web service extension to run. For example, FrontPage Server Extensions is composed of five files and all five files need to be enabled before you can begin extending Web pages with FrontPage Server Extensions.

Add

Click to select required files.

Remove

Click to remove the currently selected file from the list.

Set extension status to Allowed

Select to allow the Web service extensions to run on your server. Clear this option to prohibit Web service extensions from running on your Web server. For example, by entering Nimda.dll information in this dialog box and then setting the status to Prohibit (status when option is cleared), you prohibit Nimda.dll from running on your Web server.

Related Topics

To learn more about Web service extensions and configuring applications, see the IIS 6.0 online documentation on the Microsoft Windows Server TechCenter.


IIS 6.0 F1: Allow all Web service extensions for a specific application

Use this dialog box to enable Web service extensions for your applications. If an application has suddenly stopped working, use this dialog box to confirm and enable all Web service extensions for that application.

Application

Click the name of the application from the list box.

Extensions to be allowed

This lists all of the required Web service extensions for the currently selected application.

Note

Click OK to enable the list of allowed Web service extensions for the currently selected application.

Related Topics

To learn more about Web service extensions and configuring applications, see the IIS 6.0 online documentation on the Microsoft Windows Server TechCenter.


IIS 6.0 F1: Web Service Extension Properties - General Tab

Use this tab when making decisions on whether to prohibit a Web service extension. If you prohibit the current Web service extension, the applications in the Used by list might stop working correctly and other applications (not listed in this dialog box) may stop working as well. It is also possible that Internet Information Services (IIS) may not detect other dependencies that could stop applications from running correctly.

Used by

This is a list of applications known to use the designated Web service extension, identified at the top of this tab.

Related Topics

To learn more about Web service extensions and configuring applications, see the IIS 6.0 online documentation on the Microsoft Windows Server TechCenter.


IIS 6.0 F1: Web Server Extension Properties - Required Files Tab

Use this tab to do the following:

  • View a list of required files for the designated Web service extension.

  • Add or remove files for a specific Web service extension.

  • Customize security for a designated Web service extension (allow or prohibit files).

Files

This is a list of the required files and their current status for the designated Web service extension.

Add

Click to add a required file to the list.

Remove

Click to remove the currently selected file from the list.

Allow

Click to allow the currently selected file to run on your Web server.

Prohibit

Click to prohibit the currently selected file from running on your Web server.

Note

If all required files do not have the same status (for example, if one file has a status of Prohibited and the rest of the files have a status of Allowed), the status of the Web service extension displays as Custom.

Related Topics

To learn more about Web service extensions and configuring applications, see the IIS 6.0 online documentation on the Microsoft Windows Server TechCenter.


IIS 6.0 F1: Prohibit All Web Service Extensions

Prohibiting all Web service extensions from running on your Web server will cause applications to lose functionality or quit working altogether. Internet Information Services (IIS) will be able to serve only static content. If you are uncertain how prohibiting Web service extensions will impact your applications, click each Web service extension individually and note the list of dependent applications in the Used by list on the General tab.

Note

IIS might not detect all applications that depend on particular Web service extensions to run. If you prohibit all Web service extensions, other applications (not listed on the General tab) might stop working.

Related Topics

To learn more about Web service extensions and configuring applications, see the IIS 6.0 online documentation on the Microsoft Windows Server TechCenter.


IIS 6.0 F1: Unknown ISAPI Extensions

In an effort to reduce the attack surface of your Web server, IIS 6.0 serves only static content after a default installation. Programmatic functionality provided by ISAPIs or Common Gateway Interfaces (CGIs) must be manually enabled by an IIS administrator. ISAPIs and CGIs extend the ability of your Web pages and for this reason, ISAPIs and CGIs are referred to here as Web service extensions. For example, in order to run Active Server Pages (ASP) with this version of IIS, the ISAPI Asp.dll must be enabled as a new Web service extension.

Important

If you chose to allow all IIS Application Program Interfaces (ISAPIs) to run on your Web server, your Web server could be susceptible to computer viruses or worms that exploit ISAPI technology. Instead, use the Web Service Extensions node in IIS Manager to select only those ISAPIs that are allowed to run on your Web server

Related Topics

To learn more about Web service extensions and configuring applications, see the IIS 6.0 online documentation on the Microsoft Windows Server TechCenter.


IIS 6.0 F1: Unknown CGI Extensions

In an effort to reduce the attack surface of your Web server, IIS 6.0 serves only static content after a default installation. Programmatic functionality provided by ISAPIs or Common Gateway Interfaces (CGIs) must be manually enabled by an IIS administrator. ISAPIs and CGIs extend the ability of your Web pages and for this reason, ISAPIs and CGIs are referred to here as Web service extensions. For example, in order to run Active Server Pages (ASP) with this version of IIS, the ISAPI Asp.dll must be enabled as a new Web service extension.

Important

If you chose to allow all Common Gateway Interfaces (CGIs) to run on your Web server, your Web server could be susceptible to computer viruses or worms that exploit CGI technology. Instead, use the Web Service Extensions node in IIS Manager to select only those CGIs that are allowed to run on your Web server

Related Topics

To learn more about Web service extensions and configuring applications, see the IIS 6.0 online documentation on the Microsoft Windows Server TechCenter.


IIS 6.0 F1: Confirm Prohibit Extension

Because Internet Information Services (IIS) might not detect all applications that are dependent on this Web service extension, prohibiting this Web service extension might cause applications other than those listed to stop working.

Related Topics

To learn more about Web service extensions and configuring applications, see the IIS 6.0 online documentation on the Microsoft Windows Server TechCenter.


IIS 6.0 F1: Web Site Properties - File Tab

Use the options on this tab to determine content and user permissions for this file.

The content for this resource should come from

The designated file

Click if all content is contained in the currently selected file.

A redirection to a URL

Click to redirect the client application, such as a browser, to another Web site or virtual directory. When selected, redirect options are substituted for path options.

Setting up local or network paths allows the request to be directed to the correct physical location. You can further configure the physical location by setting user access properties, choosing whether to log requests for these resources, and choosing whether to index this site using the Indexing Service. To specify when the request is received, applications must be identified, located, and given the appropriate execute permissions and protection.

Note

Enable the Indexing Service through the Add or Remove Programs item in Control Panel.

If you click The designated file, the following options are available:

Script source access

Select to allow users to access source code if either Read or Write permissions are set.

Read

Select to allow users to read or download this file.

Write

Select to allow users to change content in the currently selected file. Write actions can be performed only with a browser that supports the PUT feature of the HTTP 1.1 protocol standard.

Log visits

Select to configure IIS to record visits to the currently selected file in a log file. Visits are recorded only if logging is enabled for this Web site.

If you click The designated file, the following options are available:

Redirect to

Type the target URL to which the client will be sent.

The exact URL entered above

Select to redirect requests for this resource to the destination URL without adding any other portions of the original URL.

A permanent redirection for this resource

Select to send the following message to the client: "301 Permanent Redirect." In most cases, redirects are considered temporary, and the client browser receives the following message: "302 Temporary Redirect." Some browsers can use the "301 Permanent Redirect" message as the signal to permanently change a URL, such as a bookmark.

Related Topics

To learn more about logging site activity and setting up a Web site, see the IIS 6.0 online documentation on the Microsoft Windows Server TechCenter.


IIS 6.0 F1: Import Configuration

With Internet Information Services (IIS) 6.0, you can import and export the configuration of your FTP sites, Web application pools, and Web sites. Before you can import a configuration file, you must export a configuration file from an existing FTP site, Web application pool, or Web site. Exporting a configuration file in IIS Manager is called Save Configuration to a File. The exported configuration is stored as a metabase XML configuration file. After you have exported the configuration file, you can then import that file into a different location on the same Web server or to a different Web server.

Exporting and importing sites and application pools as configuration files allows administrators to quickly migrate sites and application pools between servers. This feature also allows administrators to import Web applications when the developer has stored the application in a configuration file.

File

Type the full path to the configuration file.

Browse

Click to locate the configuration file.

Read File

Click to populate the Select a configuration to import list box with all configurations contained in the currently selected configuration file.

Select a configuration to import

One metabase XML configuration file can contain several configurations. After you click Read File, this list box is automatically populated with all configurations contained in the currently selected XML configuration file. Click a configuration in this list and then click OK to import the configuration.

Related Topics

To learn more about metabase configurations files, see the IIS 6.0 online documentation on the Microsoft Windows Server TechCenter.


IIS 6.0 F1: Save Configuration to a File

With Internet Information Services (IIS) 6.0, you can import and export the configuration of your FTP sites, Web application pools, and Web sites. When you save a configuration to a file, you export all metabase property configurations for the currently selected FTP site(s), Web application pool(s), or Web site(s) to a metabase XML configuration file. After you have exported the configuration file, you can then import that file to a different location on the same Web server or to a different Web server. Exporting and importing sites and application pools as configuration files allows administrators to quickly migrate sites and application pools between servers. This feature also allows administrators to export Web applications when the developer has stored the application in a configuration file.

Exporting a configuration file in IIS Manager is called Save Configuration to a File. Use this dialog box to store the exported configuration as a metabase XML configuration file. After you have exported the configuration file, you can then import that file into a different location on the same Web server or to a different Web server.

File name

Type a name for the configuration file.

Path

Type the full path where you would like to store the configuration file.

Browse

Click to locate a directory where you would like to store the configuration file.

Encrypt configuration using password

Select to secure the configuration file with an encrypted password.

Password

Type the password.

Confirm password

Type the password again to confirm.

Related Topics

To learn more about metabase configurations files, see the IIS 6.0 online documentation on the Microsoft Windows Server TechCenter.


IIS 6.0 F1: Inheritance Overrides

You have changed a setting also defined in one or more child nodes. The new setting differs from the setting in the child nodes. You can choose whether the child nodes should inherit this new setting.

If you want the child nodes to retain their current setting, do not select any nodes and click OK.

If you want child nodes to use the new setting, select the nodes that should inherit the new setting, and click OK.