Web Server (IIS) Administration

IIS 7.0 is the Web server role in Windows Server® 2008 and Windows Vista®. By using IIS 7.0 administration tools, such as IIS Manager, you can configure settings for Web servers, sites, and applications.

In This Section

Web Server Role Overview

IIS Checklists

Installation

IIS Manager Help

Common Administrative Tasks

More Information About IIS 7.0


Web Server Role Overview

The Web server role in Windows Server® 2008 lets you share information with users on the Internet, an intranet, or an extranet. Windows Server 2008 delivers IIS 7.0, which is a unified Web platform that integrates IIS, ASP.NET, and Windows Communication Foundation. The key features and improvements in IIS 7.0 include the following:

  • A unified Web platform that delivers a single, consistent Web solution for both administrators and developers.

  • Enhanced security and the ability to customize the server to reduce the attack surface.

  • Simplified diagnostic and troubleshooting features to aide in resolution of problems.

  • Improved configuration and support for server farms.

  • Delegated administration for hosting and enterprise workloads.

In the following sections, learn more about the Web server role, the required and optional features in a Web server, and hardware and software used for running a Web server. At the end of this topic, learn how to open the interface for the Web server and how to find more information about Web servers.

What Are Web Servers?

Web servers are computers that have specific software that allows them to accept requests from client computers and return responses to those requests. Web servers let you share information over the Internet, or through intranets and extranets.

With a Web server, you can:

  • Provide information to users on the Internet.

  • Let users download and upload content with FTP or World Wide Web Distributed Versioning and Authoring (WebDAV).

  • Host Web services that contain business logic for three-tier applications.

  • Distribute applications to users over the Internet instead of through physical media, such as floppy disks or CDs.

Web servers can be useful for different customers and needs. For example:

  • Small business owners might provide information about their services by using a simple Web site.

  • Owners of medium-sized businesses might offer their goods and services through an online ordering system composed of various applications in a site.

  • Enterprise businesses might develop and provide business applications to employees over corporate intranets.

  • Hosting companies might provide individual customers with server space and services to host different online content and applications.

  • Corporations might provide pertinent information and applications to business partners through extranets.

Features in the IIS 7.0 Web Server Role

The following sections describe features of and improvements to IIS 7.0, the Web platform in Windows Server 2008.

New Administration Tools

IIS 7.0 provides a new task-based UI and a new powerful command-line tool. These new administration tools let you:

  • Manage IIS and ASP.NET in one tool.

  • View health and diagnostic information that includes the ability to view currently executing requests in real-time.

  • Configure user and role permissions for sites and applications.

  • Delegate site and application configuration to non-administrators.

Configuration

IIS 7.0 introduces a new configuration store that integrates IIS and ASP.NET configuration settings for the whole Web platform. The new configuration store lets you:

  • Configure IIS and ASP.NET settings in one configuration store, which uses a consistent format and can be accessed from a common set of APIs.

  • Delegate configuration in a precise and secure manner to distributed configuration files that live in content directories.

  • Copy configuration and content for a particular site or application to another computer.

  • Script configuration for IIS and ASP.NET using a new WMI provider.

Diagnostics and Troubleshooting

IIS 7.0 Web server lets you more easily diagnose and troubleshoot problems on the Web server. The new diagnostics and troubleshooting features let you:

  • View real-time state information about application pools, worker processes, sites, application domains, and current requests.

  • Log detailed trace information about a request as it makes its way through the IIS request-processing channel.

  • Configure IIS to log detailed trace information automatically based on elapsed time or error response codes.

Modular Architecture

In IIS 7.0, the Web server is composed of modules that you can add and remove from the server as needed. The new architecture lets you:

  • Customize your server by adding only the features that you need and use, which minimizes the security and memory footprint of the Web server.

  • Configure features (such as authentication, authorization, and custom errors) that were previously duplicated in IIS and ASP.NET in one location.

  • Apply existing ASP.NET features, such as Forms authentication or URL authorization, to all request types.

Compatibility

IIS 7.0 Web server guarantees maximum compatibility for existing applications. IIS 7.0 lets you continue to:

  • Use existing Active Directory Service Interfaces (ADSI) and WMI scripts.

  • Run Active Server Pages (ASP) applications without changes to code.

  • Run existing ASP.NET 1.1, and ASP.NET 2.0 applications to work without code changes (when you run in an application pool with ISAPI mode in IIS 7.0).

  • Use existing ISAPI extensions without changes.

  • Use existing ISAPI filters except those which rely on READ RAW notifications.

Hardware and Software for the IIS 7.0 Web Server Role

The hardware and software requirements for the Web server role are the same as requirements for Windows Server 2008. Use performance counters, lab test results, existing data from production environments, and pilot roll-outs to determine the capacity needed for your server and adjust as necessary.

Installing a Web Server

After you finish installing the operating system, a list of initial configuration tasks appears. To install the Web server role, in the list of tasks, click Add roles and then click Web Server. For more information on installing IIS, see Installation.

Managing a Web Server

Once you have IIS installed, use the following procedures to open IIS Manager on Windows Server 2008 or Windows Vista®.

To open Web Server Manager on Windows Server® 2008

  • Click Start, point to Administrative Tools, and click Internet Information Services (IIS) Manager.
To open Web Server Manager on Windows Vista

  1. Click Start and then click Control Panel.

  2. In Control Panel, click System and Maintenance.

  3. In System and Maintenance, click Administrative Tools.

  4. In Administrative Tools, click Internet Information Services (IIS) Manager.

For More Information

To learn more about the Web server role you can view the Help on your server. To do this, open IIS Manager as described in the previous section and press F1.

For more information about the Web server role, see topics for Windows Server 2008 on the Web:

  • For more information about the Web server role and information about operating a Web server, see http://go.microsoft.com/fwlink/?LinkId=89710.

  • For more information about deploying, operating, and troubleshooting a Web server, see IIS.NET (http://go.microsoft.com/fwlink/?LinkId=84933).


IIS Checklists

The topics in this section help you understand how to accomplish key IIS tasks using IIS 7.0.

In this section:

Troubleshoot Web applications

Suppress certain expressions in URLs

Restrict access to Web sites

Confirm the identity of users requesting access to a Web site

Provide a better user experience for visitors to your Web site

Provide a network location where customers can upload and download files

Encrypt data sent between the Web server and client

Host multiple Web sites on one server

Isolate Web applications

Allow non-computer administrators to manage sites


Troubleshoot Web applications

IIS 7.0 includes advances in diagnosing and troubleshooting Web applications. IIS supports buffering trace events for a given request and saving these events to disk only if they fall into a user-configured error condition. IIS also captures real-time state information about application pools, worker processes, sites, application domains, and running requests.

Notes

You must enable trace logging before a trace log will be created for a failed request.

 | Step | Reference
Check box | Overview of troubleshooting in IIS 7.0. | Troubleshooting Overview
Check box | Define failure conditions for applications and configure which trace events to log on a per-URL basis. | Configure Tracing for Failed Requests
Check box | Configure IIS log settings. | Configure Logging
Check box | View a list of worker processes running on a server and view a list of currently executing requests for each worker process. | Monitor Worker Processes and Currently Executing Requests

See Also

  • Web Server role on Tech Center (online)


Suppress certain expressions in URLs

URLScan was a utility Microsoft distributed that enabled you to monitor all incoming URLs and suppress certain strings before they were processed. This enabled Web server administrators to do things like block certain executables, create hidden directories unreachable with HTTP, and set limits for connections, among others. All of this functionality has been included into this version of IIS.

Notes

If you used the URLScan tool in IIS 6.0 and have a library of expressions in the Urlscan.ini file, you can migrate these expressions to the new IIS 7.0 XML configuration files to continue filtering HTTP requests for these same expressions.

If you cannot migrate these expressions immediately, you can continue using the same Urlscan.ini file. To do this, you must continue using the URLScan tool, but the installer for UrlScan version 2.5 does not work on Windows Server® 2008. To work around this issue, copy Urlscan.dll and Urlscan.ini to the server running IIS 7.0 and then setup Urlscan.dll as a global ISAPI filter in IIS.

 | Step | Reference
Check box | Review how request filtering works. | Overview of Request Filtering
Check box | Configure IIS 7.0 to filter HTTP requests. | Configure Request Filtering

See Also

  • Web Server role on Tech Center (online)


Restrict access to Web sites

You can authorize access to the content on your Web site in two ways. If your site uses an authentication method that identifies its users, you can set up authorization rules that allow access to some users and deny access to others. If you want to authorize access based on domain names or an IP address space, you can use IP and domain restriction rules to allow access to some domains and deny access to others. You can mix and match these rules to configure an authorization scheme that provides the best level of security for your content.

Notes

The Authorization Rules and IPv4 and Domain Restrictions features are not installed by default. If you want to use either of these features, you must first install them.

 | Step | Reference
Check box | Read an overview of how to set up an authorization strategy. | Overview of IIS Authorization Features
Check box | Install IPv4 and Domain Restriction and Authorization Rules using the Add Role Services Wizard from Server Manager. | Installing IIS 7.0
Check box | Use IIS 7.0 to configure Authorization Rules. | Configure Authorization Rules
Check box | Use IIS 7.0 to configure IPv4 and Domain Restrictions. | Configure IPv4 Address and Domain Restrictions

See Also

  • Web Server role on Tech Center (online)


Confirm the identity of users requesting access to a Web site

Authentication helps you confirm the identity of users requesting access to your Web sites. IIS supports both challenge-based and login redirection-based authentication methods. Challenge-based authentication methods require clients to respond correctly to a server-initiated challenge. Login redirection-based authentication methods rely on redirection to a login page to determine the identity of the user. You cannot use both authentication methods at the same time. IIS also supports client certificate authentication, which requires configuring Secure Sockets Layer (SSL) for the site.

Notes

Only Anonymous authentication is installed by default. If you want to authenticate clients with IIS, you must install the authentication features you want to use.

 | Step | Reference
Check box | Read an overview of how to set up an authentication strategy. | Overview of IIS Authentication Features.
Check box | Install different types of authentication using the Add Role Services Wizard from Server Manager. | Installing IIS 7.0
Check box | Use IIS 7.0 to configure authentication. | Configure authentication

See Also

  • Web Server role on Tech Center (online)


Provide a better user experience for visitors to your Web site

You can configure default HTTP settings to provide a better user experience for visitors to your web site. For example, you can configure IIS to return custom error messages whenever an HTTP error occurs. Custom error messages can provide friendlier or more informative feedback. You can also configure IIS to serve either a default document or a list of all the documents available from the server. Customers who do not specify the name of a document would be presented with either a default page or a list of all available pages, depending on the HTTP settings configuration.

Notes

 | Step | Reference
Check box | Configure whether IIS returns custom or detailed errors when an HTTP error occurs, and add custom error pages for specific HTTP errors. | Configuring Error Pages
Check box | Configure a list of default documents that can be returned to clients who do not specify a document name in a request, and, depending on your needs, enable or disable this feature for specific sites, applications, or directories. | Configuring Default Documents
Check box | Configure whether a directory listing is returned to clients who do not specify a document name in a request, and, depending on your needs, enable or disable this feature for specific sites, applications, or directories. | Configuring Directory Browsing
Check box | Configure custom headers to include in the server's HTTP response header. | Configuring HTTP Response Headers
Check box | Specify the types of content that can be served to a browser or mail client by configuring Multipurpose Internet Mail Extensions (MIME) types on the server. | Configuring MIME Types
Check box | Configure redirection settings to redirect clients to a different directory than the requested directory, or to redirect them to a different URL. | Configuring HTTP Redirection

See Also

  • Web Server role on Tech Center (online)


Provide a network location where customers can upload and download files

You can use an FTP site when you want customers to upload or download files. After you publish the address of the FTP site, customers can establish a connection using the FTP protocol and appropriate client software. To set up an FTP site, you must first install the FTP service and snap-in, which are not part of the default IIS installation. Installing the FTP service creates a default FTP site that you can then customize to your needs using IIS 6.0 Manager. A default FTP directory is created on the file system of the Web server at LocalDrive:\Inetpub\Ftproot.

Notes

By default, the FTP service is not installed. Once you install the feature, the FTP site starts automatically the next time you restart the IIS services.

 | Step | Reference
Check box | Install the FTP publishing service. | Set Up FTP in IIS 7.0
Check box | Configure and secure FTP sites. | Configuring FTP Sites

See Also

  • Web Server Role on Tech Center (online)


Encrypt data sent between the Web server and client

Enable Secure Sockets Layer (SSL) to encrypt data sent between a Web server and a client. To enable SSL, you must obtain and install a valid server certificate. You can acquire a server certificate from a certification authority (CA), which can be an internal Windows domain CA or a trusted third-party public CA. You can also create a self-signed server certificate for troubleshooting, testing, or application development. After obtaining the server certificate, you must install the certificate and bind the HTTPS protocol to your Web site.

Notes

You must first have a server certificate to create a site binding for HTTPS or to enable any SSL settings for a site. Server certificates can only be configured at the Web server level, but site bindings and SSL settings can only be configured at the site, application, or physical directory level.

There are a number of ways to obtain a server certificate. You can generate a self-signed certificate, purchase a certificate from an external third party-public certification authorities (CA), or request a certificate from an internal domain CA. Of the three options, self-signed certificates are the least secure and should only be used for testing or troubleshooting applications that use HTTPS.

 | Step | Reference
Check box | Obtain a server certificate appropriate for your project and then install the certificate in IIS. | Configuring Server Certificates
Check box | Create an HTTPS binding for the site that will host the encrypted data. | Add a Binding to a Web Site
Check box | Configure SSL settings for the site, application, or physical directory. | Configuring SSL Settings

See Also

  • Web Server role on Tech Center (online)


Host multiple Web sites on one server

Host headers enable you to assign multiple sites to one IP address on a Web server, without assigning a unique IP address to each Web site or designating non-standard TCP port numbers. Using host headers is the most common way to host multiple Web sites.

Notes

The following list outlines the steps to complete, in IIS, to add a host header name or multiple host header names to an IP address. After you complete the following steps, you must then register the host header name or names with the appropriate name resolution system. If your computer is on an intranet, register the host header name or names with the intranet's name resolution system. If your computer is on the Internet, register the host header name or names with the Domain Name System (DNS), which is administered by InterNic.

 | Step | Reference
Check box | Add a Web site to the Web server. | Add a Site
Check box | Edit the Web site binding and add a host header name, or create a new binding with a host header name. | Configure Bindings for a Site
Check box | Add additional bindings with the same IP address and port number, but different host headers if you want to have additional sites assigned to one IP address. | Configure Host Header Names for a Web Site

See Also

  • Web Server role on Tech Center (online)


Isolate Web applications

An application pool is a worker process to which you can assign web applications. By using application pools to isolate Web applications, you can improve application security by reducing one application’s ability to access another application's resources. This separation also helps to prevent the Web applications in one application pool from negatively affecting the availability of Web applications in another on the same Web server. For example, if one Web application fails or consumes excessive resources, in the majority of cases, applications in other application pools on the Web server are not affected.

Notes

Creating too many application pools on a Web server may adversely affect Web server performance.

 | Step | Reference
Check box | Create an application pool. | Manage Application Pools
Check box | Add a Web application to an application pool. | Manage Web Applications

See Also

  • Web Server role on Tech Center (online)


Allow non-computer administrators to manage sites

The delegation management features let computer administrators retain full control of the Web server, while enabling them to delegate configuration of features in sites or applications to non-computer administrators. You can permit Windows users and IIS Manager users to connect to a site or an application. These users can configure delegated features in any sites and applications to which you grant them permission. You must configure the Management Service to enable remote connections if you want these users to be able to connect to the Web server using IIS Manager.

Notes

 | Step | Reference
Check box | Add IIS Manager user accounts, and permit Windows and IIS Manager users to connect to a site or an application. | Configuring User Accounts to Connect to Sites and Applications in IIS Manager
Check box | Configure the delegation state of site and application features for site and application users to view and configure. | Delegating Management of Features in Sites and Applications
Check box | Configure connection settings and enable remote management. | Configuring the Management Service

See Also

  • Web Server role on Tech Center (online)


Installation

By default, the Web Server role (IIS) is not installed on Windows Server 2008 and Windows Vista. Additionally, some of the IIS Manager features and IIS 7.0 functionality is not available on all editions of Windows Vista. Refer to the topics in this section for more information about the functionality available in Windows Server 2008 and Windows Vista, and for procedures to install IIS 7.0.

This section contains the following topics:

Available Role Services in IIS 7.0

Installing IIS 7.0 on Windows Server 2008

Installing IIS 7.0 on Windows Vista Business or Vista Ultimate

Installing IIS 7.0 on Windows Vista Home Premium


Available Role Services in IIS 7.0

Internet Information Services (IIS) 7.0 is the Web server role in Windows Vista® and Windows Server® 2008. The Web server has been redesigned in IIS 7.0 to enable you to customize a server by adding or removing modules to meet your specific needs. Modules are individual features that the server uses to process requests. For example, IIS uses authentication modules to authenticate client credentials, and cache modules to manage cache activity.

Windows Server 2008 has all the IIS features you need to support hosting of Web content in production environments. Windows Vista also has IIS features, but the available features depend on the version of Windows Vista. IIS in Windows Vista is ideal for those who want to build and test Web applications.

Available IIS Features

The tables in this section display the availability of features in each version of Windows Vista and Windows Server 2008.

Server Core

When you install Windows Server 2008, you can perform a Server Core installation, which installs a minimal server installation of Windows Server 2008. For example, with this type of installation the traditional Windows interface is not installed, so you must configure the server from the command prompt. Although the Web Server role is available on a Server Core installation, some modules that rely on the .NET Framework and managed code are not. We call out these modules with an asterisk (*) in the following tables.

Availability of these features is described as:

  • Default: The feature is selected by default when you install IIS on your computer, but you can decide not to install a feature if you do not need it.

  • Available: The feature is available, but it is not selected by default when you install IIS on your computer. You can install the feature if you need it.

  • Unavailable: The feature is unavailable and cannot be installed when you install IIS.

See the following tables to learn more about the availability of features in each version:

  • Common HTTP Features

  • Application Development Features

  • Health and Diagnostics Features

  • Security Features

  • Performance Features

  • Management Tools

  • Windows® Process Activation Service

  • File Transfer Protocol (FTP) Publishing Service Features

  • Simultaneous Connection Limits

Common HTTP Features

Feature Name/ Description | Windows Server 2008 Editions | Windows Vista Ultimate, Business, and Enterprise Editions | Windows Vista Home Premium Edition | Windows Vista Home Basic and Starter Editions
Static Content Static Content lets the Web server publish static Web file formats, such as HTML pages and image files. Use Static Content to publish files on your Web server that users can then view using a Web browser. | Default | Default | Default | Unavailable
Default Document Default Document lets you configure a default file for the Web server to return when users do not specify a file in a URL. Default documents make it easier and more convenient for users to reach your Web site. | Default | Default | Default | Unavailable
Directory Browsing Directory Browsing lets users see the contents of a directory on your Web server. Use Directory Browsing to enable an automatically generated list of all directories and files available in a directory when users do not specify a file in a URL and default documents are either disabled or not configured. | Default | Default | Default | Unavailable
HTTP Errors HTTP Errors lets you customize the error messages returned to users’ browsers when the Web server detects a fault condition. Use HTTP errors to give users a better user experience when they run up against an error message. Consider providing users with an e-mail address for staff who can help them resolve the error. | Default | Default | Default | Default
HTTP Redirection HTTP Redirection provides support to redirect user requests to a specific destination. Use HTTP redirection whenever you want customers who might use one URL to actually end up at another URL. This is helpful in many situations, from renaming your Web site, to overcoming a domain name that is difficult to spell, or forcing clients to use the HTTPS protocol. | Default | Default | Default | Default

Application Development Features

Feature Name/ Description | Windows Server 2008 Editions | Windows Vista Ultimate, Business, and Enterprise Editions | Windows Vista Home Premium Edition | Windows Vista Home Basic and Starter Editions
ASP.NET ASP.NET provides a server side object-oriented programming environment for building Web sites and Web applications that use managed code. ASP.NET is not just a new version of ASP. ASP.NET provides a robust infrastructure for building Web applications, and it has been completely re-architected to provide a highly productive programming experience based on the .NET Framework. | Available * | Available | Available | Unavailable
.NET Extensibility .NET Extensibility lets managed code developers change, add, and extend Web server functionality in the request pipeline, the configuration, and the UI. Developers can use the familiar ASP.NET extensibility model and rich .NET APIs to build Web server features that are just as powerful as those written using the native C++ APIs. | Default * | Default | Default | Default
ASP Active Server Pages (ASP) provides a server side scripting environment for building Web sites and Web applications. ASP offers improved performance over CGI scripts by providing IIS with native support for both VBScript and JScript. Use ASP if you have existing applications that require ASP support. For new development, consider using ASP.NET. | Available | Available | Available | Unavailable
CGI Common Gateway Interface (CGI) defines how a Web server passes information to an external program. Typical uses might include using a Web form to collect information and then passing that information to a CGI script to be e-mailed somewhere else. Because CGI is a standard, CGI scripts can be written by using a variety of programming languages. The downside to using CGI is the performance overhead. | Available | Available | Available | Unavailable
ISAPI Extensions Internet Server Application Programming Interface (ISAPI) Extensions provides support for dynamic Web content development using ISAPI extensions. An ISAPI extension runs when requested, just like any other static HTML file or dynamic ASP file. Since ISAPI applications are compiled code, they are processed much faster than ASP files or files that call COM+ components. | Available | Available | Available | Unavailable
ISAPI Filters Internet Server Application Programming Interface (ISAPI) Filters provides support for Web applications that use ISAPI filters. ISAPI filters are files that can extend or change the functionality provided by IIS. An ISAPI filter reviews every request made to the Web server, until the filter finds one that it needs to process. | Available | Available | Available | Unavailable
Server-Side Includes Server Side Includes (SSI) is a scripting language that is used to generate HTML pages dynamically. The script runs on the server before the page is delivered to the client and typically involves inserting one file into another. For example, you might create an HTML navigation menu and use SSI to dynamically add it to all pages on a Web site. | Available | Available | Available | Unavailable

* This module is not available on a Server Core installation.

Health and Diagnostics Features

Feature Name/ Description | Windows Server 2008 Editions | Windows Vista Ultimate, Business, and Enterprise Editions | Windows Vista Home Premium Edition | Windows Vista Home Basic and Starter Editions
HTTP Logging HTTP Logging provides logging of Web site activity for this server. When a loggable event (usually an HTTP transaction) occurs, IIS calls the selected logging module, which then writes to one of the logs stored in the file system of the Web server. These logs are kept in addition to those provided by the operating system. | Default | Default | Default | Default
Logging Tools Logging Tools provides infrastructure to manage Web server logs and automate common logging tasks. | Default | Default | Default | Default
Request Monitor Request Monitor provides infrastructure to monitor Web application health by capturing information about HTTP requests in an IIS worker process. Administrators and developers can use Request Monitor to understand which HTTP requests are executing in a worker process when the worker process has become unresponsive or very slow. | Default | Default | Default | Default
Tracing Tracing provides infrastructure to diagnose and troubleshoot Web applications. By using failed request tracing, you can troubleshoot difficult to capture events like poor performance or authentication-related failures. This feature buffers trace events for a request and only flushes them to disk if the request falls into a user-configured error condition. | Default | Default | Default | Default
Custom Logging Custom Logging provides support for logging Web server activity in a format that differs greatly from how IIS generates log files. Use Custom Logging to create your own logging module. Custom logging modules are added to IIS by registering a new COM component that implements ILogPlugin or ILogPluginEx. | Available | Available | Available | Unavailable
ODBC Logging ODBC Logging provides infrastructure that supports logging Web server activity to an ODBC-compliant database. By using a logging database, you can programmatically display and manipulate data from the logging database on an HTML page. You might do this to search logs for specific events that you want to monitor. | Available | Available | Unavailable | Unavailable

Security Features

Feature Name/Description | Windows Server 2008 Editions | Windows Vista Ultimate, Business, and Enterprise Editions | Windows Vista Home Premium Edition | Windows Vista Home Basic and Starter Editions
Basic Authentication Basic Authentication offers strong browser compatibility. Appropriate for small internal networks, this authentication method is rarely used on the public Internet. Its major disadvantage is that it transmits passwords across the network using an easily decrypted algorithm. If intercepted, these passwords are simple to decipher. Use SSL with Basic authentication. | Available | Available | Available | Unavailable
Windows Authentication Windows Authentication is a low cost authentication solution for internal Web sites. This authentication scheme allows administrators in a Windows domain to take advantage of the domain infrastructure for authenticating users. Do not use Windows authentication if users who must be authenticated access your Web site from behind firewalls and proxy servers. | Available | Available | Unavailable | Unavailable
Digest Authentication Digest Authentication works by sending a password hash to a Windows domain controller to authenticate users. When you need improved security over Basic authentication, consider using Digest authentication, especially if users who must be authenticated access your Web site from behind firewalls and proxy servers. | Available | Available | Unavailable | Unavailable
Client Certificate Mapping Authentication Client Certificate Mapping Authentication uses client certificates to authenticate users. A client certificate is a digital ID from a trusted source. IIS offers two types of authentication using client certificate mapping. This type uses Active Directory to offer one-to-one certificate mappings across multiple Web servers. | Available | Available | Unavailable | Unavailable
IIS Client Certificate Mapping Authentication IIS Client Certificate Mapping Authentication uses client certificates to authenticate users. A client certificate is a digital ID from a trusted source. IIS offers two types of authentication using client certificate mapping. This type uses IIS to offer one-to-one or many-to-one certificate mapping, and offers better performance over Client Certificate Mapping authentication. | Available | Available | Unavailable | Unavailable
URL Authorization URL Authorization allows you to create rules that restrict access to Web content. You can bind these rules to users, groups, or HTTP header verbs. By configuring URL authorization rules, you can prevent users who are not members of certain groups from accessing content or interacting with Web pages. | Available | Available | Available | Available
Request Filtering Request Filtering screens all incoming requests to the server and filters these requests based on rules set by the administrator. Many malicious attacks share common characteristics, such as very long URLs, or requests for an unusual action. By filtering requests, you can try to reduce the impact of these types of attacks. | Default | Default | Default | Default
IP and Domain Restrictions IP and Domain Restrictions allow you to enable or deny content based on the originating IP address or domain name of the request. Instead of using groups, roles, or NTFS file system permissions to control access to content, you can specify IP addresses or domain names. | Available | Available | Available | Available

Performance Features

Feature Name/Description | Windows Server 2008 Editions | Windows Vista Ultimate, Business, and Enterprise Editions | Windows Vista Home Premium Edition | Windows Vista Home Basic and Starter Editions
Static Content Compression Static Content Compression provides infrastructure to configure HTTP compression of static content. This provides more efficient use of bandwidth. Unlike dynamic responses, compressed static responses can be cached without degrading CPU resources. | Default | Default | Default | Default
Dynamic Content Compression Dynamic Content Compression provides infrastructure to configure HTTP compression of dynamic content. Enabling dynamic compression always gives you more efficient use of bandwidth, but if your server's processor utilization is already very high, the CPU load imposed by dynamic compression might make your site perform more slowly. | Available | Available | Available | Available

Management Tools

Feature Name/Description | Windows Server 2008 Editions | Windows Vista Ultimate, Business, and Enterprise Editions | Windows Vista Home Premium Edition | Windows Vista Home Basic and Starter Editions
IIS Management Console IIS Manager provides infrastructure to manage IIS 7.0 by using a graphical user interface. You can use IIS Manager to manage a local or remote Web server that runs IIS 7.0. To manage Simple Mail Transfer Protocol (SMTP) or File Transfer Protocol (FTP), you must install and use IIS Manager from IIS 6.0. | Default * | Default | Default | Unavailable
IIS Management Scripts and Tools IIS Management Scripts and Tools provide infrastructure to manage an IIS 7.0 Web server programmatically by using commands in a Command Prompt window or by running scripts. You can use these tools when you want to automate commands in batch files or when you do not want to incur the overhead of managing IIS by using the graphical user interface. | Available | Available | Available | Available
Management Service Management Service provides infrastructure to configure the IIS 7.0 user interface, IIS Manager, for remote management in IIS 7.0. | Available * | Available | Available | Unavailable
IIS 6.0 Management Compatibility IIS 6.0 Management Compatibility provides forward compatibility for your applications and scripts that use Admin Base Object (ABO) and Active Directory Service Interface (ADSI) APIs. This lets you use existing IIS 6.0 scripts to manage an IIS 7.0 Web server. | Available | Available | Available | Available
IIS Metabase Compatibility IIS 6.0 Metabase Compatibility provides infrastructure to query and configure the metabase so that you can run applications and scripts written in earlier versions of IIS that used the Admin Base Object (ABO) or Active Directory Service Interface (ADSI) APIs. | Available | Available | Available | Available
IIS 6 WMI Compatibility IIS 6.0 WMI Compatibility provides Windows Management Instrumentation (WMI) scripting interfaces to programmatically manage and automate tasks for IIS 7.0 by using a set of scripts that you create in the WMI provider. You can manage sites with this service by using the WMI CIM Studio, WMI Event Registration, WMI Event Viewer, and WMI Object Browser tools. | Available | Available | Available | Unavailable
IIS 6 Scripting Tools IIS 6.0 Scripting Tools provides the ability to continue using IIS 6.0 scripting tools that were built to manage IIS 6.0 in IIS 7.0. This is especially useful if your applications and scripts use ActiveX Data Objects (ADO) or Active Directory Service Interface (ADSI) APIs. IIS 6.0 Scripting Tools requires the WAS Configuration API. | Available | Available | Available | Unavailable
IIS 6 Management Console IIS 6.0 Manager provides infrastructure for administration of remote IIS 6.0 servers from this computer. | Available * | Available | Available | Unavailable

* This module is not available on a Server Core installation.

Windows® Process Activation Service Features

Feature Name/Description | Windows Server 2008 Editions | Windows Vista Ultimate, Business, and Enterprise Editions | Windows Vista Home Premium Edition | Windows Vista Home Basic and Starter Editions
Process Model Process Model hosts Web and WCF services. Introduced with IIS 6.0, the process model is a new architecture that features rapid failure protection, health monitoring, and recycling. WAS Process Model removes the dependency on HTTP. | Default | Default | Default | Default
.NET Environment .NET Environment supports managed code activation in the process model. | Available * | Available | Available | Available
Configuration APIs Configuration APIs enable applications that are built using the .NET Framework to configure WAS programmatically. This lets the application developer automatically configure WAS settings when the application runs instead of requiring the administrator to manually configure these settings. | Available * | Available | Available | Available

* This module is not available on a Server Core installation.

File Transfer Protocol (FTP) Publishing Service Features

Feature Name/Description | Windows Server 2008 Editions | Windows Vista Ultimate, Business, and Enterprise Editions | Windows Vista Home Premium Edition | Windows Vista Home Basic and Starter Editions
FTP Server FTP Server provides infrastructure to create an FTP site where users can upload and download files using the FTP protocol and appropriate client software. FTP uses TCP/IP to distribute files in a manner similar to how HTTP works to distribute Web pages. An FTP site is especially useful for offering customers the ability to upload files. | Available | Available | Unavailable | Unavailable
FTP Management Console FTP Management Snap-in provides the ability to manage an FTP site. IIS 7.0 uses IIS Manager in IIS 6.0 for FTP server management. You can use the FTP management snap-in to manage a local or remote FTP server. | Available * | Available | Unavailable | Unavailable

* This module is not available on a Server Core installation.

Simultaneous Connection Limits

Windows Server 2008 Editions | Windows Vista Ultimate, Business, and Enterprise Editions | Windows Vista Home Premium Edition | Windows Vista Home Basic and Starter Editions
Unlimited | 10 | 3 | 3

See Also

  • Server Core Installation Option (online)


Installing IIS 7.0 on Windows Server 2008

By default, IIS 7.0 is not installed on Windows Server® 2008. You can install IIS by using the Add Roles wizard in Server Manager or by using the command line.

When you install Windows Server 2008, you can perform a Server Core installation, which installs a minimal server installation of Windows Server 2008. For example, with this type of installation the traditional Windows interface is not installed, so you must configure the server from the command prompt.

If you use a Server Core installation, you cannot install some modules that rely on the .NET Framework or managed code. For this reason, we also provide procedures that show how to install IIS 7.0 on a Windows Server 2008 Server Core installation.

Requirements

Administrative Credentials

You must be a member of the following IIS administrative role or roles to perform this procedure:

  • Web Server Administrator

To Install IIS 7.0 on Windows Server® 2008

You can perform this procedure using the user interface (UI) or a script.

Using the UI

  1. Click Start, point to Administrative Tools and then click Server Manager.

  2. In Roles Summary, click Add Roles.

  3. Use the Add Roles Wizard to add the Web server role.
Important

If you use the Add Roles Wizard to install IIS, you get the default installation, which has a minimum set of role services. If you need additional IIS role services, such as Application Development or Health and Diagnostics, make sure to select the check boxes associated with those features in the Select Role Services page of the wizard.
Using a script

  • Type the following command into a script:

    start /w pkgmgr /iu:IIS-WebServerRole;IIS-WebServer;IIS-CommonHttpFeatures;IIS-StaticContent;IIS-DefaultDocument;IIS-DirectoryBrowsing;IIS-HttpErrors;IIS-HttpRedirect;IIS-ApplicationDevelopment;IIS-ASPNET;IIS-NetFxExtensibility;IIS-ASP;IIS-CGI;IIS-ISAPIExtensions;IIS-ISAPIFilter;IIS-ServerSideIncludes;IIS-HealthAndDiagnostics;IIS-HttpLogging;IIS-LoggingLibraries;IIS-RequestMonitor;IIS-HttpTracing;IIS-CustomLogging;IIS-ODBCLogging;IIS-Security;IIS-BasicAuthentication;IIS-WindowsAuthentication;IIS-DigestAuthentication;IIS-ClientCertificateMappingAuthentication;IIS-IISCertificateMappingAuthentication;IIS-URLAuthorization;IIS-RequestFiltering;IIS-IPSecurity;IIS-Performance;IIS-HttpCompressionStatic;IIS-HttpCompressionDynamic;IIS-WebServerManagementTools;IIS-ManagementConsole;IIS-ManagementScriptingTools;IIS-ManagementService;IIS-IIS6ManagementCompatibility;IIS-Metabase;IIS-WMICompatibility;IIS-LegacyScripts;IIS-LegacySnapIn;IIS-FTPPublishingService;IIS-FTPServer;IIS-FTPManagement;WAS-WindowsActivationService;WAS-ProcessModel;WAS-NetFxEnvironment;WAS-ConfigurationAPI

Important
  • If you use this script, you get the full IIS installation, which installs all available feature packages. If there are feature packages you do not need, you should edit the script to install only the packages you require.

To Install IIS 7.0 on Windows Server 2008 using a Server Core installation

Using a script for the full IIS installation on Server Core

  • Type the following command into a script:

    start /w pkgmgr /iu: IIS-WebServerRole;IIS-WebServer;IIS-CommonHttpFeatures;IIS-StaticContent;IIS-DefaultDocument;IIS-DirectoryBrowsing;IIS-HttpErrors;IIS-HttpRedirect;IIS-ApplicationDevelopment;IIS-ASP;IIS-CGI;IIS-ISAPIExtensions;IIS-ISAPIFilter;IIS-ServerSideIncludes;IIS-HealthAndDiagnostics;IIS-HttpLogging;IIS-LoggingLibraries;IIS-RequestMonitor;IIS-HttpTracing;IIS-CustomLogging;IIS-ODBCLogging;IIS-Security;IIS-BasicAuthentication;IIS-WindowsAuthentication;IIS-DigestAuthentication;IIS-ClientCertificateMappingAuthentication;IIS-IISCertificateMappingAuthentication;IIS-URLAuthorization;IIS-RequestFiltering;IIS-IPSecurity;IIS-Performance;IIS-HttpCompressionStatic;IIS-HttpCompressionDynamic;IIS-WebServerManagementTools;IIS-ManagementScriptingTools;IIS-IIS6ManagementCompatibility;IIS-Metabase;IIS-WMICompatibility;IIS-LegacyScripts;IIS-FTPPublishingService;IIS-FTPServer;WAS-WindowsActivationService;WAS-ProcessModel

Important
  • If you use this script, you get the full IIS installation, which installs all available feature packages for Server Core. If there are feature packages you do not need, you should edit the script to install only the packages you require.
Using a script for the default installation on Server Core

  • Type the following command into a script:

    start /w pkgmgr /iu:IIS-WebServerRole;WAS-WindowsActivationService;WAS-ProcessModel

Important
  • If you use this script, you get the default IIS installation, which installs a minimal set of available feature packages.

See Also

  • Windows Automated Installation Kit (WAIK) User's Guide for Windows Vista (online)
  • Server Core Installation Option (online)


Installing IIS 7.0 on Windows Vista Business or Vista Ultimate

By default, IIS 7.0 is not installed on Windows Vista® Business or Windows Vista® Ultimate. You can install IIS by clicking Windows Features in Advanced Options under Programs in Control Panel.

Note

You must be a member of the Administrators group to install IIS 7.0.

To Install IIS 7.0 on Windows Vista

You can perform this procedure using the user interface (UI) or a script.

Using the UI

  1. Click Start and then click Control Panel.

  2. In Control Panel, click Programs and then click Turn on or off Windows features.

  3. In the Windows Features dialog box, click Internet Information Services and then click OK.

Important

If you use Control Panel to install IIS, you get the default installation, which has a minimum set of features. If you need additional IIS features, such as Application Development Features or Web Management Tools, make sure to select the check boxes associated with those features in the Windows Features dialog box.
Using a script

  • Type the following command into a script:

    start /w pkgmgr /iu:IIS-WebServerRole;IIS-WebServer;IIS-CommonHttpFeatures;IIS-StaticContent;IIS-DefaultDocument;IIS-DirectoryBrowsing;IIS-HttpErrors;IIS-HttpRedirect;IIS-ApplicationDevelopment;IIS-ASPNET;IIS-NetFxExtensibility;IIS-ASP;IIS-CGI;IIS-ISAPIExtensions;IIS-ISAPIFilter;IIS-ServerSideIncludes;IIS-HealthAndDiagnostics;IIS-HttpLogging;IIS-LoggingLibraries;IIS-RequestMonitor;IIS-HttpTracing;IIS-CustomLogging;IIS-ODBCLogging;IIS-Security;IIS-BasicAuthentication;IIS-WindowsAuthentication;IIS-DigestAuthentication;IIS-ClientCertificateMappingAuthentication;IIS-IISCertificateMappingAuthentication;IIS-URLAuthorization;IIS-RequestFiltering;IIS-IPSecurity;IIS-Performance;IIS-HttpCompressionStatic;IIS-HttpCompressionDynamic;IIS-WebServerManagementTools;IIS-ManagementConsole;IIS-ManagementScriptingTools;IIS-ManagementService;IIS-IIS6ManagementCompatibility;IIS-Metabase;IIS-WMICompatibility;IIS-LegacyScripts;IIS-LegacySnapIn;IIS-FTPPublishingService;IIS-FTPServer;IIS-FTPManagement;WAS-WindowsActivationService;WAS-ProcessModel;WAS-NetFxEnvironment;WAS-ConfigurationAPI

    Important

    If you use this script, you get the full IIS installation, which installs all available feature packages. If there are feature packages you do not need, you should edit the script to install only the packages you require.

See Also

  • Windows Automated Installation Kit (WAIK) User's Guide for Windows Vista (online)


Installing IIS 7.0 on Windows Vista Home Premium

By default, IIS 7.0 is not installed on Windows Vista® Home Premium. You can install IIS by clicking Windows Features in Advanced Options under Programs in Control Panel.

Note

You must be a member of the Administrators group to install IIS 7.0.

To Install IIS 7.0 on Windows Vista

You can perform this procedure using the user interface (UI) or a script.

Using the UI

  1. Click Start and then click Control Panel.

  2. In Control Panel, click Programs and then click Turn on or off Windows Features.

  3. In the Windows Features dialog box, click Internet Information Services and then click OK.

Important

If you use Control Panel to install IIS, you get the default installation, which has a minimum set of features. If you need additional IIS features, such as Application Development Features or Web Management Tools, make sure to select the check boxes associated with those features in the Windows Features dialog box.
Using a script

  • Type the following command into a script:

    start /w pkgmgr /iu:IIS-WebServerRole;IIS-WebServer;IIS-CommonHttpFeatures;IIS-StaticContent;IIS-DefaultDocument;IIS-DirectoryBrowsing;IIS-HttpErrors;IIS-HttpRedirect;IIS-ApplicationDevelopment;IIS-ASPNET;IIS-NetFxExtensibility;IIS-ASP;IIS-CGI;IIS-ISAPIExtensions;IIS-ISAPIFilter;IIS-ServerSideIncludes;IIS-HealthAndDiagnostics;IIS-HttpLogging;IIS-LoggingLibraries;IIS-RequestMonitor;IIS-HttpTracing;IIS-CustomLogging;IIS-Security;IIS-BasicAuthentication;IIS-URLAuthorization;IIS-RequestFiltering;IIS-IPSecurity;IIS-Performance;IIS-HttpCompressionStatic;IIS-HttpCompressionDynamic;IIS-WebServerManagementTools;IIS-ManagementConsole;IIS-ManagementScriptingTools;IIS-ManagementService;IIS-IIS6ManagementCompatibility;IIS-Metabase;IIS-WMICompatibility;IIS-LegacyScripts;IIS-LegacySnapIn;WAS-WindowsActivationService;WAS-ProcessModel;WAS-NetFxEnvironment;WAS-ConfigurationAPI

Important

If you use this script, you get the full IIS installation, which installs all available feature packages. If there are feature packages you do not need, you should edit the script to install only the packages you require.

See Also

  • Windows Automated Installation Kit (WAIK) User's Guide for Windows Vista (online)


IIS Manager Help

IIS 7.0 provides a new UI, IIS Manager, which lets you:

  • Manage IIS and ASP.NET in one tool.

  • View health and diagnostic information that includes the ability to view currently running requests in real time.

  • Configure user and role authorization for Web sites and Web applications.

  • Connect to a Web server, site, or application remotely using HTTP.

Additionally, you can extend the UI to include your own custom functionality.

F1 Help

IIS Manager provides descriptions of all user interface (UI) elements on each feature page, dialog box, and wizard page within IIS Manager. To display this help, press the F1 key on the active feature page, dialog box, or wizard page.

Menu and Task Bar Help

For consistency with other Microsoft Management Console (MMC) snap-ins, IIS Manager Help is available from both the snap-in menu and task bar.

Menu Help

The menu bar displays a Help menu. From this menu, you can view Help about the UI, in addition to all the Help content available on your computer. If you have an Internet connection, you can browse the Windows Server 2008 Technical Library on Microsoft TechNet to see all available IIS 7.0 Help content for IT Administrators.

Task Bar Help

The task bar displays a Help icon that you can click to view Help about the IIS 7.0 user interface. The task bar appears at the top of every UI page.

Actions Pane Help

The Actions pane displays a Help icon that you can click to view Help about the IIS 7.0 user interface. The Actions pane appears on every UI page.


.NET Compilation Page

Use the .NET Compilation properties page to manage ASP.NET application code configuration settings.

Use the Display list to select one of the following options that specifies how the settings are displayed: Friendly Names, Configuration Names, or Both Names.

UI Element List

The following tables describe the UI elements that are available on the feature page and in the Actions pane.

Feature Page Elements

Element Name | Description
Batch Compilations [batch] | Indicates whether batch processing is supported. The default is True.
Maximum File Size [maxBatchGeneratedFileSize] | Specifies the maximum size, in kilobytes, of the generated source files per batched compilation. The default is 1000 KB.
Maximum Size of Batch [maxBatchSize] | Specifies the maximum number of pages per batched compilation. The default is 1000.
Time-out (hh:mm:ss)[batchTimeout] | Indicates the time-out period for batch compilation. If compilation cannot be completed in the time-out period, the compiler reverts to single compilation mode for the current page. The default is 00:15:00 (15 minutes).
Debug [debug] | Specifies whether release or debug binaries will be used for compilation. When true, debug binaries will be used for compilation. The default value is false.
Number of Recompiles [numRecompilesBeforeAppRestart] | Indicates the number of dynamic recompiles of resources that can occur before the application restarts. The default is 15.
Url Line Pragmas [urlLinePragmas] | Specifies whether instructions to the compiler use physical paths or URLs. When true, URLs will be used for the compiler instructions instead of physical paths. The default value is false.
Explicit Compile Option [explicit] | Specifies whether to set the Microsoft Visual Basic explicit compile option. If True, all variables must be declared by using a Dim, Private, Public, or ReDim statement. The default is True.
Strict Compile Option [strict] | Specifies whether to enable the Visual Basic strict compile option. When true, compilation explicitly disallows any data-type conversions in which data loss would occur, and any conversion between numeric types and strings. The default value is false.
Assemblies [assemblies] | Defines the set of assemblies, from the \bin folder or from the Global Assembly Cache (GAC), which is referenced during compilation. The GAC stores .NET assemblies specifically designated to be shared by several applications on the computer. Use an asterisk ("*") to include every assembly in the directory.
Default Language [defaultLanguage] | Specifies the default programming language, such as C# or VB.NET, to use in dynamic compilation files. The default programming language is vb, which specifies VB.NET as the default programming language.
Code Sub Directories [codeSubDirectories] | Defines subdirectories that contain files that are compiled at run time. You can have any number of subdirectories.
Temporary Directory [tempDirectory] | Specifies the directory to use for temporary file storage during compilation. The default is an empty string that puts temporary files in a location under the Temporary ASP.NET Files directory.

Actions Pane Elements

Element Name | Description
Apply | Saves the changes that you have made on the feature page.
Cancel | Cancels the changes that you have made on the feature page.

See Also

  • Configuring .NET Compilation Settings in IIS 7.0 (online)


.NET Globalization Page

Use the .NET Globalization feature page to configure .NET Framework globalization settings. Globalization is the process of internationalizing application code, then localizing the application to other languages and cultures. The internationalization process makes it possible to translate, store, retrieve, and present application content for any locale, using the same application code base whenever possible. Locale is the combination of language and cultural environment. This includes date formats, times, currencies, telephone numbers, and so on. Localization means adapting your application to other locales by translating and formatting content according to culture, preferably without touching the code itself.

You can configure the following .NET Framework globalization settings in IIS 7.0:

  • Culture settings such as the UI culture

  • Encoding settings such as encoding for response headers

UI Element List

The following tables describe the UI elements that are available on the feature page and in the Actions pane.

Feature Page Elements

Element Name Description

Culture [culture]

Specifies the default culture for processing incoming Web requests.

Enable Client Based Culture [enableClientBasedCulture]

Gets or sets a value indicating whether the Culture and UICulture properties should be based on the AcceptLanguage header field value that is sent by the client browser.

UI Culture [uiCulture]

Specifies the default culture for processing locale-dependent resource searches.

File [fileEncoding]

Specifies the file encoding for .aspx, .asmx, and .asax file parsing. Unicode and UTF-8 files that are saved with the byte-order mark prefix are automatically recognized, regardless of the value for this attribute.

Requests [requestEncoding]

Specifies the assumed encoding of each incoming request, including posted data and the query string.

If the request includes a request header that contains an Accept-Charset attribute, it overrides this attribute in the configuration.

The default encoding is UTF-8, which is specified in the globalization section in the Machine.config file that was created when the .NET Framework was installed. If request encoding is not specified in a Machine.config or Web.config file, encoding defaults to the Regional and Language Options locale setting for the computer.

In single-server applications, this attribute and the responseEncoding attribute should be the same. For the less common case (multiple-server applications where the default server encodings are different for each server), you can vary the request and response encoding by using local Web.config files.

Response Headers [responseHeaderEncoding]

Specifies the content encoding of response headers.

Responses [responseEncoding]

Specifies the content encoding of responses.

The default encoding is UTF-8, which is specified in the globalization section in the Machine.config file that was created when the .NET Framework was installed. If response encoding is not specified in a Machine.config or Web.config file, encoding defaults to the Regional and Language Options locale setting for the computer.

In single-server applications, this attribute and the responseEncoding attribute should be the same. For the less common case (multiple-server applications where the default server encodings are different for each server), you can vary the request and response encoding by using local Web.config files.

Actions Pane Elements

Element Name | Description
Apply | Saves the changes that you have made on the feature page.
Cancel | Cancels the changes that you have made on the feature page.

See Also

  • Configuring .NET Globalization Settings in IIS 7.0 (online)


.NET Profile

This section contains the following topics:

.NET Profile Page

Add or Edit .NET Profile Property Dialog Box

Add or Edit Group Dialog Box

Edit Profile Settings Dialog Box


.NET Profile Page

Use the .NET Profile feature page to manage a list of profile properties that are used to track any custom information your application requires.

Sort the list by clicking one of the feature page column headings or select a value from the Group by drop-down list to group similar items.

UI Element List

The following tables describe the UI elements that are available on the feature page and in the Actions pane.

Feature Page Elements

Element Name | Description
Name | Displays the name of the profile property.
Data Type | Displays the data type for the property. This will be either a common data type such as String, Int32, DateTime, StringCollection, and so on, or a custom data type that contains custom information that is passed to the profile provider.
Default Value | Displays the value to which the property is initialized.
Allow Anonymous | Displays whether the property is managed for anonymous users. The value is either True or False.
Entry Type | Displays whether the item is local or inherited. Local items are read from the current configuration file, and inherited items are read from a parent configuration file.

Actions Pane Elements

Element Name | Description
Add Property | Opens the Add .NET Profile Property dialog box from which you can add a .NET profile property.
Add Group | Opens the Add Group dialog box from which you can add a group to group .NET profile properties.
Add Property to Group | Opens the Add .NET Profile Property to Name Group dialog box from which you can add .NET profile properties to the selected group.
Edit | Opens the Edit .NET Profile Property or Edit .NET Profile Property in Name Group dialog box from which you can edit the selected .NET profile property.
Rename | Enables the Name field of the selected .NET profile property so that you can rename the property.
Remove | Removes the item that is selected from the list on the feature page.
Disable | Disables the .NET Profile feature.
Set Default Provider | Opens the Edit Profile Settings dialog box from which you can select a default provider for the feature.
Providers | Opens the Providers feature page from which you can add additional providers for the .NET Profile feature.

See Also

  • Configuring .NET Profiles in IIS 7.0 (online)


Add or Edit .NET Profile Property Dialog Box

Use the .NET Profile Property dialog box to set or edit profile properties that track any custom information that your application requires, including:

  • User information, such as an address or city.

  • Preferences, such as a color scheme or list of stocks to follow.

  • Custom information about the current session, such as a shopping cart.

UI Element List

Element Name | Description
Name | Defines the name of the profile property.
Data Type | Specifies the type for the property. The default is String. You can specify any .NET class as the type (Int32, DateTime, StringCollection, and so on).
Default value | Specifies the value with which the property is initialized.
Serialization option | Specifies the serialization formatter (String, Binary, XML, or provider-specific serialization). The default is String.
Read only | Specifies whether the property can be modified.
Available for anonymous users | Specifies whether the property is managed for anonymous users. By default, this check box is clear.

See Also

  • Configuring .NET Profiles in IIS 7.0 (online)


Add or Edit Group Dialog Box

Use the Add Group dialog box to add a profile group. Groups are helpful for organizing profile properties.

UI Element List

Element Name | Description
Name | Defines the name of the profile group.

See Also

  • Configuring .NET Profiles in IIS 7.0 (online)


Edit Profile Settings Dialog Box

Use the Edit Profile Settings dialog box to define the default interface between the ASP.NET membership service and membership data sources.

UI Element List

Element Name Description

Default Provider

Defines the default interface between the ASP.NET membership services and membership data sources.

Note

The default ASP.NET computer configuration contains a default SqlProfileProvider instance named AspNetSqlProfileProvider that connects to SQL Server on the local computer. By default, the ASP.NET profile feature uses this instance of the provider. Alternatively, you can specify a different default provider. For more information about ASP.NET profile providers, see ASP.NET Profile Providers.

See Also

  • Configuring .NET Profiles in IIS 7.0 (online)


.NET Roles

This section contains the following topics:

.NET Roles Page

Add .NET Role Dialog Box

Edit .NET Roles Settings Dialog Box


.NET Roles Page

Use the .NET Roles feature page to manage a list of user groups. User groups offer the ability to categorize a set of users and perform security-related operations, such as authorization, on a defined set of users.

Sort the list by clicking one of the feature page column headings or select a value from the Group by drop-down list to group similar items.

UI Element List

The following tables describe the UI elements that are available on the feature page and in the Actions pane.

Feature Page Elements

Element Name | Description
Name | Lists the name of the role.
Users | Shows the number of users assigned to a role.

Actions Pane Elements

Element Name | Description
Add | Opens the Add .NET Role dialog box from which you can add role names to this provider.
View Users | Opens the .NET Users feature page, filtered by the selected role.
Rename | Enables you to edit the selected role.
Remove | Removes the item that is selected from the list on the feature page.
Disable | Disables the .NET Roles feature page.
Set Default Provider | Opens the Edit .NET Roles Settings dialog box, so you can set the default provider.
Providers | Opens the Providers feature page.

See Also

  • Configuring .NET Roles in IIS 7.0 (online)


Add .NET Role Dialog Box

Use the Add .NET Role dialog box to add role names to the database referenced by this provider. Roles enable you to categorize users and then perform a security related task, such as authorization, more efficiently.

UI Element List

Element Name | Description
Name | Requests the name of the role.

See Also

  • Configuring .NET Roles in IIS 7.0 (online)


Edit .NET Roles Settings Dialog Box

Use the Edit .NET Roles Settings dialog box to set the default provider for membership roles.

UI Element List

Element Name Description

Default Provider

Sets the default provider for .NET Roles. IIS 7.0 includes the following providers:

  • AspNetSqlRoleProvider - Stores role information in a SQL Server database.

  • AspNetWindowsTokenRoleProvider - Uses role information based on Windows domain accounts. The Windows provider is useful only if your application runs on a network where all users have domain accounts.

See Also

  • Configuring .NET Roles in IIS 7.0 (online)


.NET Trust Levels Page

Use the .NET Trust Levels feature page to set the trust element in the Web.config file. The trust element enables you to configure the level of code access security (CAS) that is applied to an application.

UI Element List

The following tables describe the UI elements that are available on the feature page and in the Actions pane.

Feature Page Elements

Element Name Description

Trust Level

Displays the name of the trust level. Available options include:

  • Full (internal) - Specifies unrestricted permissions. Grants the ASP.NET application permissions to access any resource that is subject to operating system security. All privileged operations are supported.

  • High (web_hightrust.config) - Specifies a high level of code access security, which means that the application cannot do any one of the following things by default:

    • Call unmanaged code.

    • Call serviced components.

    • Write to the event log.

    • Access Message Queuing service queues.

    • Access ODBC, OleDb, or Oracle data sources.

  • Medium (web_mediumtrust.config) - Specifies a medium level of code access security, which means that, in addition to High Trust Level restrictions, the ASP.NET application cannot do any of the following things by default:

    • Access files outside the application directory.

    • Access the registry.

    • Make network or Web service calls.

  • Low (web_lowtrust.config) - Specifies a low level of code access security, which means that, in addition to Medium Trust Level restrictions, the application cannot do any of the following things by default:

    • Write to the file system.

    • Call the Assert method.

  • Minimal (web_minimaltrust.config) - Specifies a minimal level of code access security, which means that the application has only execute permissions.

Actions Pane Elements

Element Name | Description
Apply | Saves the changes that you have made on the feature page.
Cancel | Cancels the changes that you have made on the feature page.

See Also

  • Configuring .NET Trust Levels in IIS 7.0 (online)


.NET Users

This section contains the following topics:

.NET Users Page

Add .NET User - .NET User Account Details

Add .NET User - .NET User Roles

Edit .NET User Dialog Box

Edit .NET Users Settings Dialog Box


.NET Users Page

Use the .NET Users feature page to manage a list of user identities for an application.

Sort the list by clicking one of the feature page column headings or select a value from the Group by drop-down list to group similar items.

UI Element List

The following tables describe the UI elements that are available on the feature page and in the Actions pane.

Feature Page Elements

Element Name | Description.
Name | Displays a unique user identity.
E-mail Address | Displays the e-mail address for a user.
Created | Displays the date the user identity was created.
Last Login | Displays the date on which the user last logged in to the application.

Actions Pane Elements

Element Name | Description
Add | Opens the .NET User Account Details wizard from which you can add a new user.
Set Default Provider | Opens the Edit .NET Users Settings dialog box, so you can set the default provider.
Reset Password | Resets the selected user's password.
Edit | Opens the Edit .NET User dialog box from which you can edit a user's role or e-mail address. This action is available only when an item is selected from the list on the feature page.
Remove | Removes the item that is selected from the list on the feature page.
Providers | Opens the Providers feature page.
Roles | Opens the .NET Roles feature page.

See Also

  • Configuring .NET Users in IIS 7.0 (online)


Add .NET User - .NET User Account Details

Use the .NET User Account Details wizard to add a new user. If the Roles feature is not enabled, the .NET User Account Details page is the only page in the wizard. Enter the information for the new user and then click Next to add roles, or Finish if the Roles feature is not enabled.

UI Element List

Element Name | Description
User Name | Defines a new user identity. This value must be unique.
E-mail | Sets a default e-mail address for a user.
Password | Configures a password for the user.
Confirm Password | Confirms that the password matches what was entered in the Password box.
Question | Specifies a security question that users can use to reset their passwords. Select one of the default questions from the drop-down list, or enter a custom question.
Answer | Specifies the answer to the security question.

See Also

  • Configuring .NET Users in IIS 7.0 (online)


Add .NET User - .NET User Roles

Use .NET User Roles Wizard to specify roles for a new user. Select the roles for the user, and then click Finish. If you want to edit user information that is on the previous page of the wizard, click Previous.

UI Element List

Element Name | Description
Users | Specifies user names available to assign roles.
Roles | Specifies a list of available roles from the default provider. You can associate a single user name with multiple roles.

See Also

  • Configuring .NET Users in IIS 7.0 (online)


Edit .NET User Dialog Box

Use the Edit .NET User dialog box to modify a user's role or e-mail address.

UI Element List

Element Name | Description
User Name | Defines a unique user identity.
E-mail | Sets a default e-mail address for a user.
Roles | Defines the role or roles to which a user belongs.

See Also

  • Configuring .NET Users in IIS 7.0 (online)


Edit .NET Users Settings Dialog Box

Use the Edit .NET Users Settings dialog box to set the default provider.

UI Element List

Element Name Description

Default Provider

Sets the default provider for .NET Users. IIS 7.0 includes the following provider:

  • AspNetSqlMembershipProvider - Use this provider for storing user information in a SQL Server database.


Application Pools

This section contains the following topics:

Application Pools Page

Add or Edit Application Pool Dialog Box

Application Pool Identity Dialog Box

Recycling Conditions Wizard Page

Recycling Events to Log Wizard Page


Application Pools Page

Use the Application Pools feature page to manage a list of application pools on a Web server.

Sort the list by clicking one of the feature page column headings or select a value from the Group by drop-down list to group similar items. Search the list by typing search criteria in the Filter box, expand the Go list to select the field on which to search, and then click Go or press ENTER. Click Show All to remove the filter criteria.

UI Element List

The following tables describe the UI elements that are available on the feature page and in the Actions pane.

Feature Page Elements

Element Name | Description
Name | Displays the name of each application pool.
Status | Displays whether or not an application pool is started.
.NET Framework Version | Displays the version of the .NET Framework that an application pool uses. If the application pool was configured to not use the .NET Framework, the value is No Managed Code.
Managed Pipeline Mode | Displays the request-processing mode that an application pool uses. Values can be Integrated or Classic. When the value is Integrated, IIS uses the integrated IIS and ASP.NET request-processing pipeline to process requests in the application pool. When the value is Classic, IIS uses separate IIS and ASP.NET request-processing pipelines to process requests in the application pool.
Identity | Displays the identity used by an application pool. Values can be Network Service, Local Service, Local System, or the name of the user account for a custom identity.
Applications | Displays the number of applications that an application pool contains.

Actions Pane Elements

Element Name Description

Add Application Pool

Opens the Add Application Pool dialog box from which you can add an application pool to the Web server.

Set Application Pool Defaults

Opens the Application Pool Defaults dialog box from which you can set default values that apply to all application pools that you add to the Web server.

Start

Starts the selected application pool.

Stop

Stops the selected application pool. This causes the Windows Process Activation Service (WAS) to shut down all running worker processes serving that application pool. An administrator must restart a stopped application pool or else requests made to applications in that application pool will receive HTTP 503-Service Unavailable errors.

Recycle

Stops and restarts the selected application pool. Restarting an application pool causes the application pool to be temporarily unavailable until the restart is complete.

Basic Settings

Opens the Edit Application Pool dialog box from which you can edit the settings that were specified when the application pool was created. This action is available only when an item is selected from the list on the feature page.

Recycling

Opens the Edit Application Pool Recycling Settings wizard from which you can specify conditions under which to recycle an application pool and configure how recycling events are logged.

Advanced Settings

Opens the Advanced Settings dialog box from which you can configure advanced settings for the selected application pool.

Rename

Enables the Name field of the selected application pool so that you can rename the application pool.

Remove

Removes the item that is selected from the list on the feature page.

Note

You cannot remove an application pool that contains applications. You must move any applications out of the application pool before you can remove it.

View Applications

Opens the Applications feature page from which you can view the applications that belong to the selected application pool.

See Also

  • Managing Application Pools in IIS 7.0 (online)


Add or Edit Application Pool Dialog Box

Use the Add Application Pool and Edit Application Pool dialog boxes to create or edit an application pool. An application pool is a group of one or more URLs that are served by a worker process or a set of worker processes. Application pools set boundaries for the applications that they contain; these boundaries prevent applications in one application pool from affecting applications in another application pool.

UI Element List

Element Name Description

Name

Type a unique, friendly name for your application pool. You can use this name to easily identify the application pool later, and to simplify the assignment of applications to the application pool.

Note

You cannot rename an application pool from the Edit Application Pool dialog box. To rename an application pool, use the Rename action in the Actions pane on the Application Pools feature page.

.NET Framework version

Select the version of the .NET Framework that will be loaded by this application pool. If the applications that you want to assign to this application pool do not contain managed code, select the No Managed Code option from the list.

An application pool can load only one version of the .NET Framework; all applications in the application pool must use the same version.

Note

If you select .NET Framework version 1.1, the Managed pipeline mode list will be disabled. Additionally, if you are running IIS 7.0 on 64-bit Windows, and you have installed .NET Framework version 1.1, the value will not appear in the .NET Framework Version list when you add or edit an application pool. This is because .NET Framework version 1.1 installs under the Framework directory, but IIS reads values from the Framework64 directory on 64-bit Windows. You must set the managedRuntimeVersion attribute to v1.1 for the application pool in the configuration file directly or by using a tool such as IIS 7.0 command-line tool.

Managed pipeline mode

Select one of the following values from the list to specify how IIS processes requests for managed content:

  • Integrated - IIS processes requests for managed content with the integrated IIS and ASP.NET request-processing pipeline.

  • Classic - IIS processes requests for managed content with the separate IIS and ASP.NET request-processing pipelines. Use this mode only when the applications in the application pool cannot run in Integrated mode.

Start application pool immediately

Select this option to enable the application pool to start whenever the Windows Process Activation Service (WAS) is started. If you disable automatic startup, you must start the application pool manually or else requests made to applications in the application pool will return an HTTP 503-Service Unavailable error.

See Also

  • Managing Application Pools in IIS 7.0 (online)


Application Pool Identity Dialog Box

Use the Application Pool Identity dialog box to configure the account under which an application pool's worker process runs. You can select one of the predefined security accounts or configure a custom account.

Note

If you use a custom identity, make sure that the user account you specify is a member of the IIS_IUSRS group on the Web server so that the account has proper access to resources. Additionally, when you use Windows and Kerberos authentication in your environment, you might need to register a Service Principle Name (SPN) with the domain controller (DC).

To configure an application pool identity

  1. On the Application Pools feature page, select an application pool from the list.

  2. In the Actions pane, click Advanced Settings.

  3. Under Process Model, locate the Identity field and click … (the Properties button) to open the Application Pool Identity dialog box.

  4. Select an identity option:

    • Select Built-in account to use a predefined security account, and then select one of the accounts from the list.

    • Select Custom account to configure a custom account, and then click Set to open the Set Credentials dialog box from which you can specify the user name and password for the account.

UI Element List

Element Name Description

Built-in account

Select this option to use one of the predefined security accounts. Then select one of the following accounts:

  • LocalService - The Local Service account is a member of the Users group and has the same user rights as the Network Service account, but the Local Service account is limited to the local computer. Use this account when the worker process in your application pool does not require access outside the Web server on which it runs.

  • LocalSystem - The Local System account has all user rights, and it is part of the Administrators group on the Web server. Whenever possible, avoid using the Local System account because it presents a more serious security risk for your Web server.

  • NetworkService - By default, the Network Service account is selected. It is a member of the Users group and has user rights that are required to run applications. It can interact throughout an Active Directory-based network by using the credentials of the computer account. This account provides the most security against an attack that might try to take over the Web server.

Custom account

Select this option to configure a custom account. Then click the corresponding Set button to configure the user name and password for the account.

Set

Opens the Set Credentials dialog box from which you can specify credentials for the custom account.

User name

Type the alias of the user account under which you want the worker process to run.

Password

Type the password for the user account that you specified in the User name box.

Confirm password

Retype the password for the user account that you specified in the User name box.

See Also

  • Managing Application Pools in IIS 7.0 (online)


Recycling Conditions Wizard Page

Use the Recycling Conditions page of the Edit Application Pool Recycling Settings Wizard to configure IIS to periodically restart worker processes in an application pool. This can help you to recover valuable system resources and to better manage faulty worker processes.

UI Element List

Element Name | Description
Regular time intervals (in minutes) | Select this option to specify a time interval, in minutes, at which you want IIS to recycle the worker process. You might choose this option if you have an application that causes problems when it runs for an extended time. Based on what you know about the application, you should set the value to be less than the length of time elapsed before application failure.
Fixed number of requests | Select this option to specify the number of requests after which you want IIS to recycle the worker process. You might choose this option if you have an application that causes problems after reaching a certain number of requests. Based on what you know about the application, you should configure the value to be less than the number of requests processed before application failure.
Specific time(s) | Select this option to specify a time or times at which you want IIS to recycle the worker process in a 24-hour period. For example, to recycle a worker process at 4:30 A.M. and 4:30 P.M., enter 4:30 AM, 4:30 PM. The time that you specify uses the local time on the Web server. You might choose this option if you have an application that causes problems when it runs for an extended time and you want to recycle the application pool at a specific time, such as a time that is late at night or early in the morning, to avoid a negative impact on users. Based on what you know about the application, you should set the interval to be frequent enough to prevent application failure.
Virtual memory usage (in KB) | Select this option to specify the maximum number of kilobytes of your system's common virtual memory that can be used by a worker process before that process is recycled. You might choose this option when you notice a steady increase in the virtual memory used on your server. This might indicate that an application reserves memory multiple times, which fragments the memory heap. Entering too high a value can severely decrease system performance. At first, you should set the virtual memory threshold to be less than 70 percent of available virtual memory, and then adjust the setting if you have to.
Private memory usage (in KB) | Select this option to specify the maximum number of kilobytes of privately allocated system physical memory that can be used by a worker process before the process is recycled. You might choose this option when you have an application that leaks memory. Entering too high a value can severely decrease system performance. At first, you should set this value to be less than 60 percent of the available physical memory on the server, and then adjust this setting if you have to.

See Also

  • Managing Application Pools in IIS 7.0 (online)


Recycling Events to Log Wizard Page

Use the Recycling Events to Log page of the Edit Application Pool Recycling Settings Wizard to configure IIS to log an event when a worker process is recycled.

You can configure IIS to log information for recycling events that you configure, such as at a fixed interval, or for recycling events that occur at runtime, such as when an ISAPI declares itself unhealthy.

UI Element List

Element Name | Description
Regular time intervals | Select this option to log an event when a worker process is recycled at a specified time interval. This option is available only when the Regular time intervals (in minutes) option is selected and a time interval is specified on the previous wizard page.
Virtual memory usage | Select this option to log an event when a worker process is recycled after using a specified amount of virtual memory. This option is available only when the Virtual memory usage (in KB) option is selected and a number of kilobytes is specified on the previous wizard page.
Number of requests | Select this option to log an event when a worker process is recycled after reaching a specified number of requests. This option is available only when the Fixed number of requests option is selected and a number of requests is specified on the previous wizard page.
Scheduled time(s) | Select this option to log an event when a worker process is recycled at a specified time. This option is available only when the Specific time(s) option is selected and a time is specified on the previous wizard page.
Private memory usage | Select this option to log an event when a worker process is recycled after using a specified amount of physical memory. This option is available only when the Private memory usage (in KB) option is selected and a number of kilobytes is specified on the previous wizard page.
On-demand | Select this option to log an event when you recycle a worker process by using IIS Manager or IIS 7.0 command-line tool to correct a problem.
Configuration changes | Select this option to log an event when a change to configuration causes the application pool to recycle.
Unhealthy ISAPI | Select this option to log an event when an ISAPI extension reports to the worker process that it is unhealthy.

See Also

  • Managing Application Pools in IIS 7.0 (online)


Application Settings

This section contains the following topics:

Application Settings Page

Add or Edit Application Setting Dialog Box


Application Settings Page

Use the Application Settings feature page to manage a list of key/value pairs that are stored in the Web.config file of your application. Application settings can be accessed from anywhere within the application.

Sort the list by clicking one of the feature page column headings or select a value from the Group by drop-down list to group similar items.

UI Element List

The following tables describe the UI elements that are available on the feature page and in the Actions pane.

Feature Page Elements

Element Name | Description
Name | Displays the name of the application setting variable.
Value | Displays the value assigned to the application setting variable.
Entry Type | Displays whether the item is local or inherited. Local items are read from the current configuration file, and inherited items are read from a parent configuration file.

Actions Pane Elements

Element Name | Description
Add | Opens the Add Application Setting dialog box in which you can add an application setting variable and value.
Edit | Opens the Edit Application Setting dialog box in which you can edit the selected application setting.
Remove | Removes the item that is selected from the list on the feature page.

See Also

  • Configuring Application Settings in IIS 7.0 (online)


Add or Edit Application Setting Dialog Box

Use the Add Application Setting and Edit Application Setting dialog boxes to add or edit global variables that are stored in a central location. These name/value pairs can be accessed from anywhere in an application.

UI Element List

Element Name | Description
Name | Defines a unique name for the application setting.
Value | Defines a value for the application setting.

See Also

  • Configuring Application Settings in IIS 7.0 (online)


Applications

This section contains the following topics:

Applications Page

Add or Edit Application Dialog Box


Applications Page

Use the Applications feature page to manage the list of applications in a site.

Sort the list by clicking one of the feature page column headings or select a value from the Group by drop-down list to group similar items. Search the list by typing search criteria in the Filter box, expand the Go list to select the field on which to search, and then click Go or press ENTER. Click Show All to remove the filter criteria.

UI Element List

The following tables describe the UI elements that are available on the feature page and in the Actions pane.

Feature Page Elements

Element Name | Description
Virtual Path | Displays the virtual path used in a URL to access the application.
Physical Path | Displays the physical path of the directory that holds application content.
Site | Displays the site to which the application belongs.
Application Pool | Displays the application pool in which the application runs.

Actions Pane Elements

The following table describes the actions available when connected to a server.

When you are connected to a site and select an application on the Applications page, the available actions are Browse and View Virtual Directories.

Element Name | Description
Add Application | Opens the Add Application dialog box in which you can add an application.
Set Application Defaults | Opens the Application Defaults dialog box in which you can configure default settings that apply to all applications.
Change Application Pool | Opens the Select Application Pool dialog box in which you can change the application pool to which the selected application belongs. This action is the only available action on the Applications page that displays when you view applications in an application pool. This action is not available on the Applications page that displays when you view applications in a site.
Explore | Opens the physical directory (in Windows Explorer) that is mapped to the root virtual directory for the selected application.
Edit Permissions | Opens the Windows Properties dialog box for the physical directory that is mapped to the root virtual directory for the selected application.
Remove | Removes the item that is selected from the list on the feature page.
Browse | Opens the selected application in an Internet browser.
Basic Settings | Opens the Edit Application dialog box in which you can edit the settings that were specified when the selected application was created.
Advanced Settings | Opens the Advanced Settings dialog box in which you can configure advanced settings for the selected application.
View Virtual Directories | Opens the Virtual Directories feature page in which you can view the virtual directories that belong to the selected application.

See Also

  • Managing Applications in IIS 7.0 (online)


Add or Edit Application Dialog Box

Use the Add Application and the Edit Application dialog boxes to add an application to a site, or to edit an existing application. An application is a grouping of files that delivers content or provides services over protocols, such as HTTP. In addition to belonging to a site, an application belongs to an application pool, which isolates the application from applications in other application pools on the server. When you create an application in IIS, the application's path becomes part of the site's URL. You designate a directory as the application root, or starting point, for the application and then specify properties specific to that application.

UI Element List

Element Name | Description
Site name | Displays the name of the site that will contain the application.
Path | Displays the application's path. If you create an application at the site level, this box will display /. If you create an application within another application, this box will display the path of the existing application that will contain the new application, such as /myApp.
Alias | Type a name that clients can use to access content from a Web browser. For example, if your site address is http://www.contoso.com/ and you create an application for this site called /marketing, users can access the application from their Web browser by typing http://www.contoso.com/marketing.
Application pool | Displays the selected application pool for the application.
Select | Opens the Select Application Pool dialog box from which you can select the application pool in which the application will run.
Physical path | Type or navigate to the physical path where the application content is stored. The content can reside on the local computer or come from a remote share. If your content is stored on the local computer, enter the physical path, such as C:\Content. If your content is stored in a remote share, enter the UNC path, such as \\Server\Share. Optionally, click Connect as to provide credentials for an account that is authorized to access content in the physical path.
… | Opens the Browse for Folder dialog box from which you can select the physical location of your application content.
Connect as | Opens the Connect As dialog box from which you can select how to connect to the path that you typed in the Physical path box. By default, Application user (pass-through authentication) is selected.
Test Settings | Opens the Test Settings dialog box from which you can view a list of test results to assess whether the path settings are valid.

See Also

  • Connect As Dialog Box - Sites, Applications, and Virtual Directories
  • Managing Applications in IIS 7.0 (online)


ASP Page

Use the ASP properties page to manage a list of ASP (Classic) configuration settings.

Use the Display list to select one of the following options that specifies how the settings are displayed: Friendly Names, Configuration Names, or Both Names.

UI Element List

The following tables describe the UI elements that are available on the feature page and in the Actions pane.

Feature Page Elements

Element Name | Description
Code Page [codePage] | Specifies the default code page for an ASP application.
Enable Buffering [bufferingOn] | Specifies whether output from an ASP application will be buffered. The default is True.
Enable Chunked Encoding [enableChunkedEncoding] | Specifies whether HTTP 1.1 chunked transfer encoding is enabled for the World Wide Web publishing service (WWW service). The default is True.
Enable HTML Fallback [enableAspHtmlFallback] | Controls the behavior of ASP when the request queue is full. When set to True, ASP will search for an HTML file that has _asp added to the file name and return the file if found. For example, if the name of the requested .asp file is Hello.asp, the name of the .htm file that is returned will be Hello_asp.htm. If the file does not exist, a 500.13 (Server too busy) HTTP error will be returned to the client. This error will also be returned if the value is set to False. The default value for this attribute is True.
Enable Parent Paths [enableParentPaths] | Specifies whether an ASP page allows paths relative to the current directory (using the "...\" notation) or above the current directory. The default is False.
Client Connection Test Interval [queueConnectionTestTime] | Specifies the period of time that a request should be queued. If the request is queued longer than the time specified, ASP checks to determine whether the client is still connected before running the request. If the client is no longer connected, the request is not processed and is deleted from the queue. The default is 00:00:03 seconds.
Maximum Requesting Entity Body Limit [maxRequestEntityAllowed] | Specifies the maximum number of bytes allowed in the entity-body of an ASP request. The default is 200000 bytes.
Queue Length [requestQueueMax] | Specifies the maximum number of concurrent ASP requests that are permitted in the queue. The default is 3000.
Request Queue Time-out [queueTimeout] | Specifies the period of time that an ASP script request is allowed to wait in the queue. The default is 00:00:00 (infinite).
Response Buffering Limit [bufferingLimit] | Sets the maximum size of the ASP buffer. If response buffering is turned on, this property controls the maximum number of bytes that an ASP page can write to the response buffer before a flush occurs. The default is 4194304 bytes.
Script Time-out [scriptTimeout] | Specifies the default length of time that ASP pages allow a script to run before attempting to stop the script and writing an event to the Windows event log. The default is 00:01:30 minutes.
Threads Per Processor Limit [processorThreadMax] | Specifies the maximum number of worker threads per processor that IIS can create to run ASP requests. The default is 25.
Locale ID [lcid] | Sets the default locale identifier (LCID) for an application. LCIDs define how dates, times, and currencies are formatted. The default is 1033, which represents US English (en-us).
Restart On Config Change [enableApplicationRestart] | Determines whether an ASP application can be automatically restarted when a change is made to critical configuration properties of that application. The default is True.
Calculate Line Numbers [calcLineNumber] | Specifies whether ASP should calculate and store the line number of each executed line of code in order to provide that number in an error report. The default is True.
Catch COM Component Exceptions [exceptionCatchEnable] | Specifies whether ASP pages trap exceptions thrown by components. If set to False, the ASP page does not catch exceptions thrown by the component. This can lead to the exception being handled by some other layer of the process, such as VB Script or the IIS worker process (which typically ends the worker process). The default is True.
Enable Client-side Debugging [appAllowClientDebug] | Specifies whether ASP client-side debugging is enabled. The default is False.
Enable Log Error Requests [logErrorRequests] | Controls whether the Web server writes ASP errors to the application section of the Windows event log. By default, ASP errors are written to the client browser and to the IIS log files. The default is True.
Enable Server-side Debugging [appAllowDebugging] | Specifies whether ASP debugging is enabled on the server. The default is False.
Log Errors to NT Log [errorsToNTLog] | Specifies which ASP errors are written to the Windows event log. By default, ASP errors are written to the client browser and to the IIS log files. The default is False.
Run On End Functions Anonymously [runOnEndAnonymously] | Specifies whether the SessionOnEnd and ApplicationOnEnd global ASP functions should be run as the anonymous user. If set to False, the functions are not run. The default is True.
Script Error Message [scriptErrorMessage] | Specifies the error message to send to the browser if specific debugging errors are not sent to the client. The default message sent is "An error occurred on the server when processing the URL. Please contact the system administrator."
Send Errors To Browser [scriptErrorSentToBrowser] | Specifies whether the Web server writes debugging specifics (file name, error, line number, description) to the client browser in addition to logging them to the IIS request log. The default is True.
Script Language [scriptLanguage] | Specifies the default script language for all ASP applications that are running on the Web server. The default is VBScript.
Cache Directory Path [diskTemplateCacheDirectory] | Contains the name of the directory that ASP uses to store compiled ASP templates to disk after overflow of the in-memory cache. The default is systemroot\inetpub\temp\ASP Compiled Templates.
Enable Type Library Caching [enableTypelibCache] | Specifies whether type libraries are cached on the server. The default is True.
Maximum Disk Cached Files [maxDiskTemplateCacheFiles] | Specifies the maximum number of compiled ASP templates that can be stored. The default is 2000.
Maximum Memory Cached Files [scriptFileCacheSize] | Specifies the number of precompiled script files to cache. If set to 0, no script files are cached. If set to 4291967295, all the requested script files are cached. This property is used to tune performance depending on the amount of available memory and the amount of script file traffic. The default is 500.
Maximum Script Engines Cached [scriptEngineCacheMax] | Specifies the maximum number of scripting engines that ASP pages will keep cached in memory. The default is 250.
Enable Side by Side Component [appServiceFlags] | Enables COM+ side-by-side assemblies, which allow ASP applications to specify which version of a system DLL or COM component to use. The default is False.
Enable Tracker [appServiceFlags] | Enables COM+ tracker, which then lets administrators or developers debug ASP applications. The default is False.
Execute In MTA [executeInMta] | Specifies whether ASP can run scripts in a multithreaded compartment. The default is False.
Honor Component Threading Model [trackThreadingModel] | Specifies whether IIS examines the threading model of any components that your application creates. The default is False.
Partition ID [partitionID] | Set this property to the GUID of the COM+ partition. When this property is defined, set the Use Partition element to True.
Side By Side Component [sxsName] | Set this property to the name of the COM+ application. When this property is defined, set the Enable Side by Side Component element to True.
Use Partition [appServiceFlags ] | Isolates applications into their own COM+ partitions. When this property is set to True, you must define a value for the Partition ID element. The default is False.
Enable Session State [allowSessionState] | Enables session state persistence for the ASP application. The default is True.
Maximum Sessions [max] | Specifies the maximum number of concurrent sessions that IIS will allow. The default is 2147483647.
New ID On Secure Connection [keepSessionIdSecure] | Generates a new cookie when a transition from a non-secure to a secure connection is made. The default is True.
Time-out [timeout] | Specifies how long a session object is maintained after the last request associated with the object is made. The default is 00:20:00.

Actions Pane Elements

Element Name | Description
Apply | Saves the changes that you have made on the feature page.
Cancel | Cancels the changes that you have made on the feature page.

See Also

  • Configuring ASP Settings in IIS 7.0 (online)


Authentication

This section contains the following topics:

Authentication Page

Active Directory Client Certificate Authentication

Anonymous Authentication

Edit Anonymous Authentication Credentials Dialog Box

Set Credentials Dialog Box - Anonymous Authentication Feature

Basic Authentication

Edit Basic Authentication Settings Dialog Box

Digest Authentication

Edit Digest Authentication Settings Dialog Box

Forms Authentication

Edit Forms Authentication Settings Dialog Box

Windows Authentication

Advanced Settings Dialog Box - Windows Authentication Feature

ASP.NET Impersonation

ASP.NET Impersonation Settings Dialog Box

Set Credentials Dialog Box - ASP.NET Impersonation Feature


Authentication Page

Use the Authentication feature page to configure the authentication methods that clients can use to gain access to your content.

Sort the list by clicking one of the feature page column headings or select a value from the Group by drop-down list to group similar items.

UI Element List

Element Name Description

AD Client Certificate Authentication

AD Client Certificate authentication allows you to use Active Directory directory service features to map users to client certificates for authentication. Mapping users to client certificates lets you automatically authenticate users, without other authentication methods such as Basic, Digest, or Integrated Windows authentication.

This kind of authentication is not available on Windows Vista® Home Premium.

Anonymous Authentication

Anonymous authentication allows any user to access any public content without providing a user name and password. By default, Anonymous authentication is enabled in IIS 7.0.

Note

Use Anonymous authentication when you want all clients who visit your site to be able to view its content.

ASP.NET Impersonation

ASP.NET impersonation allows you to run ASP.NET applications under a context other than the default ASPNET account. Use impersonation with other IIS authentication methods or set up an arbitrary user account.

Basic Authentication

Basic authentication requires that users provide a valid user name and password to gain access to content.

Note

Basic authentication transmits passwords across the network with weak encryption. You should use Basic authentication only when you know that the connection between the client and the server is secure.

Digest Authentication

Digest authentication uses a Windows domain controller to authenticate users who request access to content on your server. Consider using Digest authentication when you need improved security over Basic authentication.

This kind of authentication is not available on Windows Vista Home Premium.

Note

Any browser that does not support the HTTP 1.1 protocol cannot support Digest authentication.

Forms Authentication

Forms authentication uses client-side redirection to forward unauthenticated users to an HTML form where they can enter their credentials, which are usually a user name and password. After the credentials are validated, users are redirected to the page they originally requested.

Important

Because Forms authentication sends the user name and password to the Web server as plain text, you should use Secure Sockets Layer (SSL) encryption for the logon page and for all other pages in your application.

Windows Authentication

Windows authentication uses NTLM or Kerberos protocols to authenticate clients. Windows authentication is best suited for an intranet environment. Windows authentication is not suited for use on the Internet because that environment does not require or encrypt user credentials.

This kind of authentication is not available on Windows Vista Home Premium.

Important

The default setting for Windows authentication is Negotiate. This setting means that the client can select the appropriate security support provider.

See Also

  • Configuring Authentication in IIS 7.0 (online)


Active Directory Client Certificate Authentication

Use Active Directory (AD) Client Certificate authentication to map client certificate information across many servers.

Note

Wildcard mapping with AD Client Certificate authentication is less efficient than the native IIS wildcard mapping.

If you select AD Client Certificate authentication, you cannot use IIS certificate mapping for any other sites hosted on the selected server.

UI Element List

The following tables describe the UI elements that are available on the feature page and in the Actions pane.

Feature Page Elements

Element Name | Description
Active Directory Client Certificate Authentication | Select to manage Active Directory Client Certificate authentication.

Actions Pane Elements

Element Name | Description
Enable | Turns on Active Directory Client Certificate authentication.
Disable | Turns off Active Directory Client Certificate authentication.

See Also

  • Configuring Authentication in IIS 7.0 (online)


Anonymous Authentication

Use Anonymous authentication to allow any user to access any public content without providing a user name and password challenge to the client browser. By default, Anonymous authentication is enabled in IIS 7.0.

If only selected users should view some content and you intend to use Anonymous authentication, you must configure the appropriate NTFS file system permissions to prevent anonymous users from accessing that content. If you want only registered users to view selected content, configure an authentication method for that content that requires a user name and password, for example, Basic or Digest authentication.

UI Element List

The following tables describe the UI elements that are available on the feature page and in the Actions pane.

Feature Page Elements

Element Name | Description
Anonymous Authentication | Select to manage Anonymous authentication.

Actions Pane Elements

Element Name | Description
Disable | Turns off Anonymous authentication.
Enable | Turns on Anonymous authentication.
Edit | Displays the Edit Anonymous Authentication Credentials dialog box where you can set the security principle that anonymous users will use to connect to the site. You can perform this action only when you select Anonymous Authentication from the list on the feature page.

See Also

  • Edit Anonymous Authentication Credentials Dialog Box
  • Set Credentials Dialog Box - Anonymous Authentication Feature
  • Configuring Authentication in IIS 7.0 (online)


Edit Anonymous Authentication Credentials Dialog Box

Use the Edit Anonymous Authentication Credentials dialog box to change the account that IIS uses to access your sites and applications.

UI Element List

Element Name Description

Specific user

Type the specific account name that you want IIS to use to access your site or application. By default, IIS 7.0 uses IUSR as the user name for anonymous access. This user name is created when you install IIS 7.0.

Set

Opens the Set Credentials dialog box, where you can specify an account name and password for IIS to use for Anonymous authentication.

Application pool identity

Select Application pool identity to enable IIS processes to run using the account that is currently specified on the property page for the application pool. By default, this is the Network Service account.

Important

If you use the Network Service account, you grant anonymous users all the internal network access associated with that account.

See Also

  • Set Credentials Dialog Box - Anonymous Authentication Feature
  • Configuring Authentication in IIS 7.0 (online)


Set Credentials Dialog Box - Anonymous Authentication Feature

Use the Set Credentials dialog box to change the account that IIS uses for anonymous access to your sites and applications. By default, IIS 7.0 uses IUSR as the account for anonymous access. This account is created when you install IIS 7.0.

UI Element List

Element Name Description

User name

Type the name of the account that you want IIS to use to access your sites and applications.

Important

Changing the anonymous user account from IUSR to another network account may affect security because you are giving anonymous users the administrative credentials associated with that account.

Password

Type the password associated with the account that you want IIS to use for anonymous access to your sites and applications.

Important

If the password associated with this account is changed, you must also change the password in the Set Credentials dialog box. If the password on the account and the password in the Set Credentials dialog box do not match, the associated site or application is disabled.

Confirm password

Retype the password associated with the account that you want IIS to use for anonymous access to your sites and applications.

See Also

  • Edit Anonymous Authentication Credentials Dialog Box
  • Configuring Authentication in IIS 7.0 (online)


Basic Authentication

Use Basic authentication to require that users provide a valid user name and password to access content. All major browsers support this authentication method and it works across firewalls and proxy servers. The disadvantage of Basic authentication is that it transmits passwords across the network using weak encryption. You should use Basic authentication only when you know that the connection between the client and the server is secure.

Disable Anonymous authentication if you use Basic authentication. The first request that all browsers send to a server is for anonymous access to server content. If you do not disable Anonymous authentication, users can anonymously access all the content on your server, including restricted content.

UI Element List

The following tables describe the UI elements that are available on the feature page and in the Actions pane.

Feature Page Elements

Element Name | Description
Basic Authentication | Select to manage Basic authentication.

Actions Pane Elements

Element Name | Description
Enable | Turns on Basic authentication.
Disable | Turns off Basic authentication.
Edit | Displays the Edit Basic Authentication Settings dialog box where you can set the default domain and realm. You can perform this action only when you select Basic Authentication the list on the feature page.

See Also

  • Edit Basic Authentication Settings Dialog Box
  • Configuring Authentication in IIS 7.0 (online)


Edit Basic Authentication Settings Dialog Box

Use the Edit Basic Authentication Settings dialog box to configure Basic authentication for a site.

UI Element List

Element Name Description

Default domain

Type the name of a domain against which you want users to be authenticated by default. Any users who do not provide a domain name when they log on to your site are authenticated against this domain.

Realm

Type the DNS domain name or address that will use the credentials that have been authenticated against the default domain. Providing a Realm is optional for Basic authentication.

Important

If you enter the default domain name in the Realm box, your internal Microsoft Windows domain name may be exposed to external users during the user name and password challenge.

See Also

  • Configuring Authentication in IIS 7.0 (online)


Digest Authentication

Use Digest authentication to offer authentication that is significantly more secure than Basic authentication. Digest authentication is also supported by all modern browsers, and works through proxy and firewall servers.

To use Digest authentication successfully, you must first disable Anonymous authentication. The first request that all browsers send to a server is for anonymous access to server content. If you do not disable Anonymous authentication, users can anonymously access all the content on your server, including restricted content.

UI Element List

The following tables describe the UI elements that are available on the feature page and in the Actions pane.

Feature Page Elements

Element Name | Description
Digest Authentication | Select to manage Digest authentication.

Actions Pane Elements

Element Name | Description
Enable | Turns on Digest authentication.
Disable | Turns off Digest authentication.
Edit | Opens the Edit Digest Authentication Settings dialog box where you can set the realm against which the credentials should be authenticated. You can perform this action only when you select Digest Authentication from the list on the feature page.

See Also

  • Edit Digest Authentication Settings Dialog Box
  • Configuring Authentication in IIS 7.0 (online)


Edit Digest Authentication Settings Dialog Box

Use the Edit Digest Authentication Settings dialog box to define the realm name.

UI Element List

Element Name Description
  • Realm

Type the DNS domain name or address that will use the credentials that have been authenticated against your internal Windows domain. Providing a Realm is mandatory for Digest authentication.

See Also

  • Configuring Authentication in IIS 7.0 (online)


Forms Authentication

Use Forms authentication to provide authentication for high-traffic sites or applications on public servers. This authentication mode lets you manage client registration and authentication at the application level, instead of relying on the authentication mechanisms provided by the operating system.

UI Element List

The following tables describe the UI elements that are available on the feature page and in the Actions pane.

Feature Page Elements

Element Name | Description
Forms Authentication | Select to manage Forms authentication.

Actions Pane Elements

Element Name | Description
Enable | Turns on Forms authentication.
Disable | Turns off Forms authentication.
Edit | Opens the Edit Forms Authentication Settings dialog box where you can set various parameters for Forms authentication, such as cookie settings and the login URL that will redirect unauthenticated clients. You can perform this action only when you select Forms Authentication from the list on the feature page.

See Also

  • Edit Forms Authentication Settings Dialog Box
  • Configuring Authentication in IIS 7.0 (online)


Edit Forms Authentication Settings Dialog Box

Use Forms authentication to manage client registration and authentication at the application level, instead of relying on the authentication mechanisms provided by the operating system.

Important

Because Forms authentication sends the user name and password to the server as plain text, you should use Secure Sockets Layer (SSL) encryption for the logon page and for all other pages in your application except the home page.

UI Element List

Element Name Description

Login URL

Specifies the URL to which the request is redirected for logon if no valid authentication cookie is found. The default value is login.aspx.

Authentication cookie time-out (in minutes)

Specifies the time, in integer minutes, after which the cookie expires. The default value is 30. If the SlidingExpiration attribute is true, the time-out attribute is a sliding value, expiring at the specified number of minutes after the time the last request was received. To prevent compromised performance, and to avoid multiple browser warnings for users who have cookie warnings turned on, the cookie is updated when more than half the specified time has elapsed.

Mode

Specifies where to store the Forms authentication ticket. The options are:

  • Do not use cookies - Cookies are not used.

  • Use cookies - Cookies are always used, regardless of device.

  • Auto Detect - Cookies are used if the device profile supports cookies. Otherwise, no cookies are used. For desktop browsers that are known to support cookies, ASP.NET checks to determine whether cookies are enabled.

  • Use device profile - Cookies are used if the device profile supports cookies. Otherwise, no cookies are used. ASP.NET does not check to determine whether cookies are enabled on devices that support cookies. This is the default setting.

Name

Sets the name of the Forms authentication cookie. The default is .ASPXAUTH.

Protection mode

Specifies the type of encryption, if any, to use for cookies. The options are:

  • Encryption and validation - Specifies that both data validation and encryption are used to help protect the cookie. This option uses the configured data validation algorithm (based on the <machineKey> element). Triple-DES (3DES) is used for encryption, if available and if the key is long enough (48 bytes or more). Encryption and validation is the default, and recommended, value.

  • None - Specifies that both encryption and validation are disabled for sites that use cookies only for personalization and that have weaker security requirements. Microsoft does not recommend that you use this setting; however, it is the least resource-intensive way to enable personalization using the .NET Framework.

  • Encryption - Specifies that the cookie is encrypted using Triple-DES or DES, but data validation is not performed on the cookie. Cookies used in this manner might be subject to plaintext attacks.

  • Validation - Specifies that a validation scheme verifies that the contents of an encrypted cookie have not been changed in transit. The cookie is created using cookie validation by concatenating a validation key with the cookie data, computing a message authentication code (MAC), and appending the MAC to the outgoing cookie.

Requires SSL

Specifies whether an SSL connection is required to transmit the authentication cookie. By default, this is disabled.

Extend cookie expiration on every request

Specifies whether sliding expiration is enabled. Sliding expiration resets an active authentication cookie's time to expire upon each request during a single session. By default, this is enabled.

See Also

  • Configuring Authentication in IIS 7.0 (online)


Windows Authentication

Use Windows authentication only in an intranet environment. This authentication enables you to use authentication on your Windows domain to authenticate client connections.

UI Element List

The following tables describe the UI elements that are available on the feature page and in the Actions pane.

Feature Page Elements

Element Name | Description
Windows Authentication | Select to manage Windows authentication.

Actions Pane Elements

Element Name | Description
Enable | Turns on Windows authentication.
Disable | Turns off Windows authentication.
Advanced Settings | Opens the Advanced Settings dialog box where you can enable or disable kernel mode authentication. You can perform this action only when you enable Windows Authentication from the list on the feature page.

See Also

  • Advanced Settings Dialog Box - Windows Authentication Feature
  • Configuring Authentication in IIS 7.0 (online)


Advanced Settings Dialog Box - Windows Authentication Feature

Use the Advanced Settings dialog box to specify whether Windows authentication is performed in kernel mode. By default, IIS enables kernel-mode authentication, which may improve authentication performance and prevent authentication problems with application pools configured to use a custom identity.

As a best practice, do not disable this setting if you use Kerberos authentication and have a custom identity on the application pool.

See Also

  • Windows Authentication


ASP.NET Impersonation

Use ASP.NET Impersonation authentication when you want to run your ASP.NET application under a security context different from the default.

If you enable impersonation for an ASP.NET application, that application can run in one of two different contexts: either as the user authenticated by IIS or as an arbitrary account that you set up. For example, if you were using Anonymous authentication and chose to run the ASP.NET application as the authenticated user, the application would run under an account set up for anonymous users (typically, IUSR). Likewise, if you chose to run the application under an arbitrary account, it would run under whatever security context was set up for that account.

UI Element List

The following tables describe the UI elements that are available on the feature page and in the Actions pane.

Feature Page Elements

Element Name | Description
ASP.NET Impersonation | Select to manage ASP.NET Impersonation authentication.

Actions Pane Elements

Element Name | Description
Enable | Turns on ASP.NET Impersonation authentication.
Disable | Turns off ASP.NET Impersonation authentication.
Edit | Opens the Edit ASP.NET Impersonation Settings dialog box where you can specify the identity under which the ASP.NET application should run. You can perform this action only when you select ASP.NET Impersonation from the list on the feature page.

See Also

  • ASP.NET Impersonation Settings Dialog Box
  • Set Credentials Dialog Box - ASP.NET Impersonation Feature
  • Configuring Authentication in IIS 7.0 (online)


ASP.NET Impersonation Settings Dialog Box

Use the ASP.NET Impersonation Settings dialog box to specify the account your ASP.NET application should impersonate.

UI Element List

Element Name | Description
Specific user | Type the name of the specific account that you want your ASP.NET application to impersonate.
Set | Opens the Set Credentials dialog box, where you can specify an account name and password for IIS to use for ASP.NET impersonation.
Authenticated user | Select Authenticated user to enable the ASP.NET application to run under the security context of the user account authenticated by IIS.

See Also

  • Set Credentials Dialog Box - ASP.NET Impersonation Feature
  • Configuring Authentication in IIS 7.0 (online)


Set Credentials Dialog Box - ASP.NET Impersonation Feature

Use the Set Credentials dialog box to specify the account that ASP.NET should impersonate.

UI Element List

Element Name | Description
User name | Type the name of the account that you want ASP.NET to impersonate.
Password | Type the password associated with the account that you want ASP.NET to impersonate.
Confirm password | Retype the password associated with the account that you want ASP.NET to impersonate.

See Also

  • ASP.NET Impersonation Settings Dialog Box
  • Configuring Authentication in IIS 7.0 (online)


Authorization Rules

This section contains the following topics:

Authorization Rules Page

Add or Edit Allow Authorization Rule and Add or Edit Deny Authorization Rule Dialog Boxes


Authorization Rules Page

Use the Authorization Rules page to manage the list of Allow or Deny rules that control access to content.

Sort the list by clicking one of the feature page column headings.

UI Element List

The following tables describe the UI elements that are available on the feature page and in the Actions pane.

Feature Page Elements

Element Name Description

Mode

Displays the type of rule. Values can be either Allow or Deny. Mode values indicate whether the rule is designed to allow or deny access to content.

Note

If a role, user, or group has been specifically denied access by one rule, it cannot be granted access by another.

Users

Displays the user type, user names, or user groups to whom the rule applies.

Roles

Displays the Microsoft Windows role or roles to which the rule applies, for example, the Administrator role.

Verbs

Displays the HTTP verb or verbs to which this rule applies, for example, GET or POST.

Entry Type

Displays whether the item is local or inherited. Local items are read from the current configuration file, and inherited items are read from a parent configuration file.

Actions Pane Elements

Element Name | Description
Add Allow Rule | Opens the Add Allow Authorization Rule dialog box from which you can define rules for access to content.
Add Deny Rule | Opens the Add Deny Authorization Rule dialog box from which you can define rules for access to content.
Edit | Opens the Edit Allow Authorization or Edit Deny Authorization dialog box from which you can edit authorization rules. This action is available only when an item is selected from the list on the feature page.
Remove | Removes the item that is selected from the list on the feature page.

See Also

  • Configuring URL Authorization Rules in IIS 7.0 (online)


Add or Edit Allow Authorization Rule and Add or Edit Deny Authorization Rule Dialog Boxes

Use the Add Allow Authorization Rule, the Edit Allow Authorization Rule, the Add Deny Authorization Rule, or the Edit Deny Authorization Rule dialog box to define rules for access to content.

UI Element List

Element Name | Description
All users | Select this option to manage access to content for both anonymous and authenticated users. By default, there is an allow rule configured for All users.
All anonymous users | Select this option to manage access to content for users that are not authenticated.
Specified roles or user groups | Select this option to manage access to content for specific Microsoft Windows roles or user groups.
Specified users | Select this option to manage access to content for a specific user account.
Apply this rule to specific verbs | Specifies that the rule applies to specific HTTP verbs such as GET or POST.

See Also

  • Configuring URL Authorization Rules in IIS 7.0 (online)


CGI Page

Use the CGI properties page to configure Common Gateway Interface (CGI) applications on the Web server. You can set the CGI time-out value for a CGI script, isolate a CGI application in its own console, or configure a CGI application to run at the system level or at the user level.

Use the Display list to select one of the following options that specifies how the settings are displayed: Friendly Names, Configuration Names, or Both Names.

UI Element List

The following tables describe the UI elements that are available on the feature page and in the Actions pane.

Feature Page Elements

Element Name | Description
Time-out (hh:mm:ss) [timeout] | Specifies the time-out (in seconds) for CGI applications. The default is 15 minutes (00:15:00).
Use New Console For Each Invocation [createCGIWithNewConsole] | Specifies whether a CGI application runs in its own console. If the value is set to True, each CGI application creates a new console when started. The default value is False.
Impersonate User [createProcessAsUser] | Specifies whether a CGI process is created in the system context or in the context of the requesting user. The default value is True.

Actions Pane Elements

Element Name | Description
Apply | Saves the changes that you have made on the feature page.
Cancel | Cancels the changes that you have made on the feature page.

See Also

  • Configuring CGI Settings in IIS 7.0 (online)


Compression Page

Use the Compression feature page to provide faster transmission times between IIS and compression-enabled browsers. Compression is helpful if your site uses lots of bandwidth, or if you want to use bandwidth more effectively. Compression can improve performance if your network bandwidth is restricted as it is, for example, with mobile phone clients. Compression also helps improve performance in a data center environment.

IIS provides the following compression options:

  • Static files only

  • Dynamic application responses only

  • Both static files and dynamic application responses

UI Element List

The following tables describe the UI elements that are available on the feature page and in the Actions pane.

Feature Page Elements

Element Name Description

Enable static content compression

Configures IIS to compress static content.

Note

Unlike dynamic responses, compressed static responses can be cached on disk across multiple requests without degrading CPU resources. On the next request, a compressed file can be retrieved from disk, which improves performance because the CPU does not have to compress the file again.

Enable dynamic content compression

Configures IIS to compress dynamic content.

Note

Compression of dynamic application responses can affect CPU resources because IIS does not cache compressed versions of dynamic output. If compression is enabled for dynamic responses and IIS receives a request for a resource that contains dynamic content, the response that IIS sends is newly compressed every time it is requested. Because dynamic compression consumes significant CPU time and memory resources, use it only on servers that have clients with slow network connections but that have CPU time to spare.

Only compress files larger than (in bytes)

Defines the minimum file size that you want IIS to compress. The default size is 256 bytes.

Note

This option is available at only the server level.

Cache directory

Defines the path of a local directory where a static file is cached after it is compressed, either until it expires or until the content changes. For security reasons, this temporary directory must be on a local drive on an NTFS-formatted partition. The directory cannot be compressed, and should not be shared.

Note

This box is available at only the server level.

Per application pool disk space limit (in MB)

Sets the maximum amount of space, in megabytes, you want IIS to use when compressing static content. When this setting is defined, IIS automatically empties the temporary directory when the set limit is reached. The default limit is 100 MB per application pool.

Note

This option is available at only the server level.

Actions Pane Elements

Element Name | Description
Apply | Saves the changes that you have made on the feature page.
Cancel | Cancels the changes that you have made on the feature page.

See Also

  • Configuring HTTP Compression in IIS 7.0 (online)


Connection Strings

This section contains the following topics:

Connection Strings Page

Add or Edit Connection String Dialog Box

Set Credentials Dialog Box - Connection Strings Feature


Connection Strings Page

Use the Connection Strings feature page to manage a list of connection strings generally used by managed code applications.

Sort the list by clicking one of the feature page column headings or select a value from the Group by drop-down list to group similar items.

UI Element List

The following tables describe the UI elements that are available on the feature page and in the Actions pane.

Feature Page Elements

Element Name | Description
Name | Displays the name of the connection string.
Connection String | Displays the connection string details.
Entry Type | Displays whether the item is local or inherited. Local items are read from the current configuration file, and inherited items are read from a parent configuration file.

Actions Pane Elements

Element Name | Description
Add | Opens the Add Connection String dialog box from which you can configure a SQL or custom connection string.
Edit | Opens the Edit Connection String dialog box from which you can edit the selected connection string.
Remove | Removes the item that is selected from the list on the feature page.

See Also

  • Configuring Connection Strings in IIS 7.0 (online)


Add or Edit Connection String Dialog Box

Use the Add Connection String and Edit Connection String dialog boxes to create or edit either a SQL or custom connection string for use in an application that connects to a database.

UI Element List

Element Name | Description
Name | Type a name for the connection string, such as StagingSqlServer. The name that you enter should be the same name that you reference in your application code to retrieve data that uses this connection string.
Server | Type the name of the SQL server that hosts the database.
Database | Type the name of the SQL server database.
Credentials | Defines the security credentials that are used to connect to the database.
Use Windows Integrated Security | Select this option to configure the connection string so that the application uses the current Windows identity established on the operating system thread to access the SQL Server database. Integrated security requires that SQL Server run on the same computer as IIS, unless the administrator has configured delegation between computers. Integrated security also requires that all application users have to be on the same domain so that their credentials are available to the Web server.
Specify credentials | Select this option to configure the connection string to use a SQL Server user name and password. This is helpful when the SQL Server database is on a computer other than the Web server.
Set | Opens the Set Credentials dialog box from which you can configure a user name and password to connect to the SQL Server database.
Custom | Type a custom database connection string. Use this instead of a SQL connection string when you want to connect to a different data store or configure additional connection string settings.

See Also

  • Set Credentials Dialog Box - Connection Strings Feature
  • Configuring Connection Strings in IIS 7.0 (online)


Set Credentials Dialog Box - Connection Strings Feature

Use the Set Credentials dialog box to configure a connection string to use a SQL Server user name and password. You should set these credentials when the SQL Server database is on a computer other than the Web server.

UI Element List

Element Name | Description
User name | Type the name of the account that you want IIS to use to access your SQL Server database.
Password | Type the password associated with your SQL Server database.
Confirm password | Retype the password associated with your SQL Server database.

See Also

  • Add or Edit Connection String Dialog Box
  • Configuring Connection Strings in IIS 7.0 (online)


Default Document

This section contains the following topics:

Default Document Page

Add Default Document Dialog Box


Default Document Page

Use the Default Documents feature page to configure the list of default documents. If a user accesses your site or application without specifying a document name (for example, by requesting http://www.contoso.com/ instead of http://www.contoso.com/Default.htm), you can configure IIS to serve a default document such as Default.htm. IIS returns the first default document in the list that matches a file name in the directory.

Note

To improve performance, make sure that the first default document in the list exists on disk and that it is the first file name in the list.

UI Element List

The following tables describe the UI elements that are available on the feature page and in the Actions pane.

Feature Page Elements

Element Name | Description
Name | Displays the file name that is added as a default document.
Entry Type | Displays whether the item is local or inherited. Local items are read from the current configuration file, and inherited items are read from a parent configuration file.

Actions Pane Elements

Element Name Description

Add

Opens the Add Default Document dialog box in which you can add a file name to the default document list.

Remove

Removes the item that is selected from the list on the feature page.

Move Up

Moves a selected item up in the list.

Note

When items in the list are reordered at a child level, the child will no longer inherit settings from the parent level (including any items that are added to or removed from the list at the parent level) after the list is reordered. If you want to inherit settings from a parent level, you must revert all the changes at the child level by using the Revert to Inherited action in the Actions pane.

Move Down

Moves a selected item down in the list.

Note

When items in the list are reordered at a child level, the child will no longer inherit settings from the parent level (including any items that are added to or removed from the list at the parent level) after the list is reordered. If you want to inherit settings from a parent level, you must revert all the changes at the child level by using the Revert to Inherited action in the Actions pane.

Disable

Disables the Default Documents feature. When default documents are disabled, and a user accesses your site or application without specifying a document name, client browsers receive a 403—Forbidden error because the Web server cannot determine which file to serve, and the client cannot view the contents of the directory.

Note

If the Default Documents feature is disabled but the Directory Browsing feature is enabled, client browsers receive a directory listing instead of a 403—Forbidden error.

Enable

Enables the Default Documents feature.

Revert to Inherited

Reverts the feature to inherit settings from the parent configuration. This deletes local configuration settings, including items from the list, for this feature. This action is not available at the server level.

See Also

  • Configuring Default Documents in IIS 7.0 (online)


Add Default Document Dialog Box

Use the Add Default Document feature page to add a file name to the list of default documents.

UI Element List

Element Name | Description
Name | Type the file name or relative path that you want to add to the list of default documents. This value is added to the beginning of this list.

See Also

  • Configuring Default Documents in IIS 7.0 (online)


Directory Browsing Page

Use the Directory Browsing feature page to modify the content settings for browsing a directory on the Web server. When you configure directory browsing, all subdirectories use the same settings unless you override them at a lower level.

UI Element List

The following tables describe the UI elements that are available on the feature page and in the Actions pane.

Feature Page Elements

Element Name | Description
Time | Select this option to display the last modified time for each file in a directory listing.
Size | Select this option to display the size of each file in a directory listing.
Extension | Select this option to display the file name extension of each file in a directory listing.
Date | Select this option to display the last modified date for each file in a directory listing.
Long date | Select this option to display, in extended format, the last modified date for each file in a directory listing.

Actions Pane Elements

Element Name | Description
Apply | Saves the changes that you have made on the feature page.
Cancel | Cancels the changes that you have made on the feature page.
Enable | Enables the Directory Browsing feature. When the Default Document feature is disabled but the Directory Browsing feature is enabled, client browsers receive a directory listing instead of a 403—Forbidden error. When both the Default Document feature and the Directory Browsing feature are enabled, IIS returns a default document if found, or a directory listing if no default document is found.
Disable | Disables the Directory Browsing feature. When the Default Document feature and the Directory Browsing feature are disabled, client browsers receive a 403—Forbidden error.

See Also

  • Configuring Directory Browsing in IIS 7.0 (online)


Error Pages

This section contains the following topics:

Error Pages Page

Add or Edit Custom Error Page Dialog Box

Edit Error Pages Settings Dialog Box

Set Localized Custom Error Path Dialog Box


Error Pages Page

Use the Error Pages feature page to manage a list of custom HTTP error messages.

Sort the list by clicking one of the feature page column headings or select a value from the Group by drop-down list to group similar items.

UI Element List

The following tables describe the UI elements that are available on the feature page and in the Actions pane.

Feature Page Elements

Element Name | Description
Status Code | Displays the HTTP status code to which the error page applies.
Path | Displays the path of the error page if you choose the File path type, or the URL of the custom error page if you use either the Execute URL or the Redirect path type.
Type | Displays the path type (file, execute URL, or redirect URL) of the error page.
Entry Type | Displays whether the item is local or inherited. Local items are read from the current configuration file, and inherited items are read from a parent configuration file.

Actions Pane Elements

Element Name | Description
Add | Opens the Add Custom Error Page dialog box in which you can add a custom error to the list of HTTP errors.
Edit | Opens the Edit Custom Error Page dialog box in which you can edit the selected custom error.
Change Status Code | Enables the Status Code field of the selected list item so you can change the status code to which the error page applies.
Remove | Removes the item that is selected from the list on the feature page.
Edit Feature Settings | Opens the Edit Error Pages Settings dialog box in which you can configure settings that apply to the entire Error Pages feature.

See Also

  • Configuring Error Pages in IIS 7.0 (online)


Add or Edit Custom Error Page Dialog Box

Use the Add Custom Error Page and Edit Custom Error Page dialog boxes to configure IIS to return a custom error message whenever a specific HTTP error occurs.

UI Element List

Element Name Description

Status code

Type the HTTP status code (and optional sub-status code) to which the custom error page applies.

Insert content from static file into the error response

Select this option when the error page should include static content, such as from an HTML file. In the corresponding File path box, type or browse for the physical path of the static file.

Caution

If the file that you configure in the File path box is not static content, such as a .aspx file, the code will be displayed instead of running when the response is returned.

Browse

Opens the file menu from which you can browse for the static file.

Try to return the error file in the client language

Select this option when the error should be returned in the client language (if possible). When you select this check box, click the Set button to configure the path.

Set

Opens the Set Localized Custom Error Path dialog box from which you can configure the path of localized error files.

Note

This button is enabled only when you select Try to return the error file in the client language.

Execute a URL on this site

Select this option when the error page should include dynamic content, such as from an ASP file. In the corresponding URL (relative to site root) box, type the relative path to the custom error.

Respond with a 302 redirect

Select this option when you want the client to be redirected to a different URL. In the corresponding Absolute URL box, type the full URL to which the client is redirected.

See Also

  • Configuring Error Pages in IIS 7.0 (online)


Edit Error Pages Settings Dialog Box

Use the Edit Error Pages Settings dialog box to return a default error message any time an HTTP error occurs for which there is no predefined error page.

UI Element List

Element Name Description

Custom error pages

Under Error Responses, select this option to respond with only custom error pages for both local requests and for requests that are made from other computers.

Detailed errors

Under Error Responses, select this option to respond only with detailed errors for both local requests and for requests that are made from other computers.

Caution

Detailed error messages might display sensitive server information to the client.

Detailed errors for local requests and custom error pages for remote requests

Under Error Responses, select this option to display detailed errors for local requests and custom errors for requests that are made from other computers.

Path

Under Default Page, type or browse for the path of the default error page. Depending on the option you select from the Path type drop-down list, the value that you type in the Path field should be one of the following:

  • If you select File, specify a physical path.

  • If you select Execute URL, specify a URL that is relative to the site root URL.

  • If you select Redirect, type a URL.

Path type

Under Default Page, select one of the following options from the Path type drop-down list:

  • File: The default error is static content, such as from an HTML file.

  • Execute URL: The default error is dynamic content, such as from an ASP file.

  • Redirect: The default error is at a redirection URL.

See Also

  • Configuring Error Pages in IIS 7.0 (online)


Set Localized Custom Error Path Dialog Box

Use the Set Localized Custom Error Path dialog box to configure the path of localized error files.

UI Element List

Element Name | Description
Root directory path | Type the physical path of the root directory of the localized error files. The root directory path is the part of the path before the locale directory, such as EN-US. For example, if the full path of the error files for the EN-US locale is d:\errors\EN-US\messages\404.htm, you type d:\errors.
Browse | Opens the file menu from which you can browse for the path.
Relative file path | Type the relative physical path of the localized error file. The relative file path is the part of the path after the locale directory, such as EN-US. For example, if the full path of the error files for the EN-US locale is d:\errors\EN-US\messages\404.htm, you type \messages\404.htm.

See Also

  • Configuring Error Pages in IIS 7.0 (online)


Failed Request Tracing Rules

This section contains the following topics:

Failed Request Tracing Rules Page

Specify Content to Trace Wizard Page

Define Trace Conditions Wizard Page

Select Trace Providers Wizard Page


Failed Request Tracing Rules Page

Use the Failed Request Tracing Rules feature page to manage a list of tracing rules for failed requests.

Sort the list by clicking one of the feature page column headings or select a value from the Group by drop-down list to group similar items.

UI Element List

The following tables describe the UI elements that are available on the feature page and in the Actions pane.

Feature Page Elements

Element Name | Description
Path | Displays the URL traced by a tracing rule for failed requests. The URL can contain, at most, one wildcard and must be local to the directory where the failed request definition is set. For example, the wildcard patterns *.aspx, and ind* will all match the URL www.contoso.com/index.aspx.
Associated Providers | Displays the trace providers associated with a tracing rule for failed requests. A provider defines the functional area for tracing. One example is the ASP.NET trace provider, which traces transitions into and out of managed code, including *.aspx requests.
Status Codes | Displays the HTTP status code(s) and substatus code combination(s) traced by a tracing rule for failed requests. There can be multiple status codes in this list, with commas separating each code.
Time Taken | Displays the maximum time, in seconds, that the request should take.
Entry Type | Displays whether the item is local or inherited. Local items are read from the current configuration file, and inherited items are read from a parent configuration file.

Actions Pane Elements

Element Name Description

Add

Opens the Add Failed Request Tracing Rule wizard in which you can add a rule to trace for failed requests.

Edit

Opens the Edit Failed Request Tracing Rule wizard in which you can edit the selected failed request tracing rule.

Remove

Removes the item that is selected from the list on the feature page.

Edit Site Tracing

Opens the Edit Web Site Failed Request Tracing Settings dialog box in which you enable and configure failed request tracing settings for the Web site. This action is available only when you are connected to a server and you have selected a specific site.

View Trace Logs

Opens the trace log file directory. This action is available only when you are connected to a server.

Revert to Inherited

Resets the feature to inherit settings from the parent configuration. This deletes local configuration settings, including items from the list, for this feature. This action is not available at the server level.

View Ordered List

Displays the list in order of configuration. When you select the ordered list format, you can only move items up and down in the list. Other actions in the Actions pane do not appear until you select the unordered list format.

Move Up

Moves a selected item up in the list. This action is available only when viewing items in the ordered list format.

Note

When items in the list are reordered at a child level, the child will no longer inherit settings from the parent level (including any items that are added to or removed from the list at the parent level) after the list is reordered. If you want to inherit settings from a parent level, you must revert all of the changes at the child level by using the Revert to Inherited action in the Actions pane.

Move Down

Moves a selected item down in the list. This action is available only when viewing items in the ordered list format.

Note

When items in the list are reordered at a child level, the child will no longer inherit settings from the parent level (including any items that are added to or removed from the list at the parent level) after the list is reordered. If you want to inherit settings from a parent level, you must revert all of the changes at the child level by using the Revert to Inherited action in the Actions pane.

View Unordered List

Displays the list in an unordered format. When you select the unordered list format, you can sort and group items in the list, and perform actions in the Actions pane.

See Also

  • Configuring Tracing for Failed Requests in IIS 7.0 (online)


Specify Content to Trace Wizard Page

Use the Specify Content to Trace page of the Add Failed Request Tracing Rule Wizard to configure the content you want to trace with a tracing rule for failed requests.

UI Element List

Element Name | Description
All content (*) | Select this option to trace all files in a directory.
ASP.NET (*.aspx) | Select this option to trace all .aspx files in a directory.
ASP (*.asp) | Select this option to trace all .asp files in a directory.
Custom | Select this option and type a value, such as "xyz.exe" or "*.jpg", to trace a failure for a custom set of content. This value can contain, at most, one wildcard and must be local to the directory where the failed request definition is set. For example, the wildcard patterns *.aspx, and ind* will all match the URL www.contoso.com/index.aspx.

See Also

  • Configuring Tracing for Failed Requests in IIS 7.0 (online)


Define Trace Conditions Wizard Page

Use the Define Trace Conditions page of the Add Failed Request Tracing Rule Wizard or Edit Failed Request Tracing Rule Wizard to define a trace condition for a failed request tracing rule. This trace condition allows you to capture trace events for a failed request and log these trace events, as they occur, without having to reproduce the error.

If more than one trace condition is specified, the first condition that is met will generate the failed request trace log file. For example, if you configure a trace rule to log requests that generate status code 404 and requests that take four seconds or longer, the trace log will be generated when the first of the following conditions is met:

  • A request generates status code 404.

  • A request takes longer than four seconds.

UI Element List

Element Name Description

Status code(s)

Select this option when you want a trace event to be logged for responses that generate the specified HTTP status code (and optionally a substatus code). In the corresponding box, type the status code or codes you want to trace. Separate multiple status codes by using commas (,) between each code, or type a status code range by using a hyphen (-) between two codes. You can also refine your status codes by using substatus codes, such as 404.2 or 404.3.

Time taken (in seconds)

Select this option when you want to trace events that exceed the time interval allocated for the request to complete processing. In the corresponding box, type the maximum time, in seconds, that a request should take.

Event severity

Select this option when you want to trace events based on severity. In the corresponding list, select one of the following event severities on which to trace:

  • Error: Provides information about components that experience an error and cannot continue to process requests. These errors usually indicate a server-side problem.

  • Critical Error: Provides information about actions that can cause a process to exit.

  • Warning: Provides information about components that experience an error but that can continue to process the request.

See Also

  • Configuring Tracing for Failed Requests in IIS 7.0 (online)


Select Trace Providers Wizard Page

Use the Select Trace Providers page of the Add Failed Request Tracing Rules Wizard or Edit Failed Request Tracing Rules Wizard to define what to trace for a URL. This includes the trace provider(s), verbosity level, and area(s) for the provider to trace.

UI Element List

Element Name Description

Providers

Defines the functional area for tracing. You can select one or more of the following trace providers:

  • ASP - When you want to trace the start and completion of the execution of an ASP request.

  • ASP.NET - When you want to see transitions into and out of managed code. This includes all requests for .aspx files and any requests that are processed by managed modules, such as static files that are configured to use forms-based authentication.

  • ISAPI Extension - When you want to trace the transition of a request into and out of an ISAPI extension process.

  • WWW Server - When you want to trace requests through the IIS worker process.

Verbosity

Specifies how much data each provider reports to the trace log. Verbosity levels are inclusive, which means if you select Errors, for example, Errors, Critical Errors, and General events will be included in the log file. You can select one or more of the following verbosity levels:

  • General - Provides context information for the request activity, for example, IIS 7.0, IISGeneralEvents::GENERAL_REQUEST_START logs the URL and the verb for the request.

  • Critical Errors - Provides information about actions that can cause a process to end or that are about to cause a process to end.

  • Errors - Provides information about components that try to run on the server, encounter an error, and cannot continue to process requests. These errors are conditions that generally result in the end of request processing that is caused by some kind of error. An example of this would be an authorization event.

  • Warnings - Provides information about components that try to run on the server, encounter an error, but can continue to process requests.

  • Information - Provides general information about requests.

  • Verbose - Provides detailed information about requests.

Areas

Defines the areas for the provider to trace.

If the provider selected is the ASP.NET trace provider, select one or more of the following areas to trace:

  • Infrastructure - When you want to trace events that are primarily related to entering and leaving various parts of the ASP.NET infrastructure.

  • Module - When you want to trace events that are logged when a request enters and leaves various HTTP pipeline modules. This area is also used to capture trace events for managed modules.

  • Page - When you want to generate trace events that correspond to the execution of specific ASP.NET page-related events, such as Page_Load. This area is also used to capture ASP.net Page Trace.Write and Trace.Warn events.

  • AppServices - When you want to trace those events that are logged as part of the new application services functionality.

If the provider selected is the WWW Server trace provider, select one or more of the following areas to trace:

  • Authentication - When you want to trace authentication attempts, including the name of the authenticated user, the authentication scheme (Anonymous, Basic, or others), and the results of the authentication attempt (successful, failed, error, and so on).

  • Security - When you want to generate trace events when requests are rejected by the server running IIS for security-related reasons, for example, if a client request was denied access to a resource.

  • Filter - When you want to determine how long it takes an ISAPI filter to process requests.

  • StaticFile - When you want to trace how long it takes requests for static files to be completed or to see how filters might be changing the requests.

  • CGI - When a request is made for a CGI file and you want to generate trace events.

  • Compression - When a response is compressed and you want to generate trace events.

  • Cache - When you want to generate trace events for cache operations associated with the request.

  • RequestNotifications - When you want to capture all request notifications, both on entrance and on exit.

  • Module - When you want to trace events that are logged when a request enters and leaves various HTTP pipeline modules. This area is also used to capture trace events for managed modules.

See Also

  • Configuring Tracing for Failed Requests in IIS 7.0 (online)


Feature Delegation

This section contains the following topics:

Feature Delegation Page

Custom Site Delegation or Custom Application Delegation Page

Copy Delegation Dialog Box


Feature Delegation Page

Use the Feature Delegation feature page to configure the delegation state of IIS Manager features for sites and applications on your Web server in Windows Vista® and Windows Server® 2008. When you configure the delegation state of a feature from IIS Manager, you specify whether the feature's related configuration section is locked or unlocked in the server-level configuration files (ApplicationHost.config and root Web.config) for IIS 7.0. When you lock a feature, configuration can only be read from and written to the server-level configuration file for that feature. However, you can unlock a feature when you want configuration to be read from and written to lower-level configuration files, such as a Web.config file in your site or application.

Note

When you configure delegation state for features in IIS Manager, you control only the configuration sections and the corresponding levels at which settings can be set in the configuration files.

By using Web.config files to read and save configuration settings for any or all features in your sites and applications, you can easily copy configuration from one computer to another. For example, you might develop an application on a development or test computer, and specify certain features in that application to be written to Web.config. This lets you package all the application's content easily, including its configuration file, and transfer it to another computer.

Important

If you develop a site or an application for a production environment, you must ask someone who is an administrator on the production computer whether the features that you configure in the site's or application's Web.config can be unlocked in the production environment. If the feature you configure in Web.config is locked in the production environment, you may encounter runtime errors because your chosen configuration is invalid.

In Windows Server 2008, Feature Delegation pairs with the IIS Manager Users and IIS Manager Permissions features to enable non-administrative users to view and configure delegated features in their sites or applications by using IIS Manager. The delegation state of a feature determines whether users can configure the feature in their sites and applications. For example, if you want to let users configure data connection strings, select Connection Strings from the list on the Feature Delegation page, and then click Read/Write from the Actions pane or the right-click menu.

The Feature Delegation page affects all sites and applications on the Web server. The Feature Delegation settings that you configure at the server level are for all sites on the server; the settings that you configure at the site level are for all applications in that site. If you want to configure delegation states for features in a specific site or application, use the Custom Site Delegation and Custom Application Delegation pages.

Caution

If you have configured delegation states for features and you want to change those states later, you should review how the features have been delegated at lower levels in the configuration to make sure you understand how the changes will affect those features at the lower levels. For example, if you originally configured a feature to be Read Only for sites, and a user at the site level configured a more restrictive setting by removing delegation for that feature, you might inadvertently change the state that was set by the user if you configure the feature to be Read/Write at the parent level. As a best practice, you should use a test computer to test how changes to the delegation states affect your environment before you make changes to a production environment.

UI Element List

The following tables describe the UI elements that are available on the feature page and in the Actions pane.

Feature Page Elements

Element Name | Description
Name | Displays the name of the UI feature in IIS Manager. Select a feature and then click the delegation state that you want from the Actions pane or from the right-click menu.
Delegation | Displays the delegation state of the UI feature at lower levels.

Actions Pane Elements

The following table describes the delegation options available for IIS 7.0 features in IIS Manager and how the delegation options affect the configuration files and user interface (UI). These features are configuration-based features. If you extend IIS Manager to include third-party features, your delegation states might differ from this table if they are user-specified delegation states. Additionally, individual features that you configure on the Feature Delegation page might be protocol-specific and not applicable to all sites and applications.

Delegation Option Description for Windows Vista operating systems Description for Windows Server 2008 operating systems

Read/Write

When you select Read/Write for a feature, you unlock the feature's related configuration section(s) in the server-level configuration file. Configuration changes for that feature will then be read from and written to Web.config files in sites or applications.

When you select Read/Write for a feature, you unlock the feature's related configuration section(s) in the server-level configuration file. Configuration changes for that feature will then be read from and written to Web.config files in sites or applications.

Additionally, configuring a feature to be Read/Write enables non-administrative users to see and configure the feature in IIS Manager for sites or applications to which they are allowed to connect.

Read Only

When you select Read Only for a feature, you lock the feature's related configuration section(s) in the server-level configuration file. Configuration cannot be written to Web.config files in sites or applications.

Note

If you set configuration settings for a feature in a Web.config file, but the feature is Read Only, you will receive an error if you try to configure the feature at the site or application level, and you will receive runtime errors in your sites and applications.

When you select Read Only for a feature, you lock the feature's related configuration section(s) in the server-level configuration file. Configuration cannot be written to Web.config files in sites or applications.

Additionally, non-administrative users cannot configure the feature in IIS Manager for their sites or applications, but they can see the feature as Read Only in IIS Manager to see how the feature is configured in the server-level configuration file.

Note

If you set configuration settings for a feature in a Web.config file, but the feature is Read Only, you will receive an error if you try to configure the feature at the site or application level, and you will receive runtime errors in your sites and applications.

Not Delegated

When you select Not Delegated for a feature, you lock the feature's related configuration section(s) in the server-level configuration file. Configuration cannot be read from and written to Web.config files in sites or applications.

When you select Not Delegated for a feature, you lock the feature's related configuration section(s) in the server-level configuration file. Configuration cannot be read from and written to Web.config files in sites or applications.

Additionally, non-administrative users will not see the feature in IIS Manager and they will not be able to configure the feature at the site and application levels.

Reset to Inherited

When you select Reset to Inherited for a feature, the feature inherits the delegation state that is set at the parent level.

When you select Reset to Inherited for a feature, the feature inherits the delegation state that is set at the parent level.

Configuration Read/Write

When you select Configuration Read/Write for a feature, you unlock the feature's configuration section(s) in the server-level configuration file. Configuration changes for that feature will then be read from and written to Web.config files in sites or applications. This option is available only for features, such as .NET Users and .NET Roles, that have configuration in both a configuration file and a database.

Note

This setting does not affect the database permissions.

When you select Configuration Read/Write for a feature, you unlock the feature's configuration section(s) in the server-level configuration file. Configuration changes for that feature will then be read from and written to Web.config files in sites or applications. This option is available only for features, such as .NET Users and .NET Roles, that have configuration in both a configuration file and a database.

Note

This setting does not affect the database permissions.

Configuration Read Only

When you select Configuration Read Only for a feature, you lock the feature's configuration section(s) in the server-level configuration file. Configuration cannot be written to Web.config files in sites or applications; however, the application can continue to write to the database. This option is available only for features, such as .NET Users and .NET Roles, that have configuration in both a configuration file and a database.

Note

This setting does not affect the database permissions.

When you select Configuration Read Only for a feature, you lock the feature's configuration section(s) in the server-level configuration file. Configuration cannot be written to Web.config files in sites or applications; however, the application can continue to write to the database. This option is available only for features, such as .NET Users and .NET Roles, that have configuration in both a configuration file and a database.

Note

This setting does not affect the database permissions.

Reset All Delegation

Resets the delegation states of all the features to states set at the parent level. At the server level, this sets the delegation states to the states as specified in the overrideModeDefault settings in the server-level configuration file.

Resets the delegation states of all the features to states set at the parent level. At the server level, this sets the delegation states to the states as specified in the overrideModeDefault settings in the server-level configuration file.

Custom Site Delegation or Custom Application Delegation

Not available.

Opens the Custom Site Delegation feature page or the Custom Application Delegation feature page in which you can configure custom delegation states for an individual site or application.

See Also

  • Configuring Delegation for a Site or an Application in IIS 7.0 (online)


Custom Site Delegation or Custom Application Delegation Page

Use the Custom Site Delegation and Custom Application Delegation feature pages to configure the default delegation state of IIS Manager features for a specific site or application on your Web server. The delegation state of a feature determines whether non-administrative users who have been granted permission to a site or application can configure the feature in that site or application. For example, you can configure the delegation state of a feature, such as Connection Strings, as Read/Write when you want to allow users to configure that feature in their site or application.

The features that you configure on this page affect only the site or application that you select from the Sites or Applications drop-down lists. You can use Copy Delegation to open the dialog box and select additional sites or applications, or both, if you want to apply the same delegation states of features to other sites and applications. You can also configure the default delegation state of features for all sites and applications on the Web server by using the Feature Delegation page.

Caution

If you have configured delegation states for features and you want to change those states later, you should review how the features have been delegated at lower levels in your configuration to make sure that you understand how the changes will affect those features at the lower levels. For example, if you originally configured a feature to be Read Only for sites, and a user at the site level configured a more restrictive setting by removing delegation for that feature, you might inadvertently change the state that was set by the user if you configure the feature to be Read/Write at the parent level. As a best practice, you should use a test computer to test how changes to the delegation states affect your environment before you make changes to a production environment.

Sort the list by clicking one of the feature page column headings or select a value from the Group by drop-down list to group similar items.

UI Element List

The following tables describe the UI elements that are available on the feature page and in the Actions pane.

Feature Page Elements

Element Name Description

Sites or Applications

Select the site or application for which you want to configure the delegation state of UI features.

Note

To configure custom delegation for a site, you must be connected to a server in IIS Manager. To configure custom delegation for an application, you must be connected to a site in IIS Manager.

Copy Delegation

Click Copy Delegation to open the Copy Delegation dialog box and copy the custom delegation states to other sites or applications.

Name

Displays the name of the UI feature in IIS Manager. Select a feature and then click the delegation state that you want from the Actions pane or from the right-click menu.

Delegation

Displays the delegation state of the UI feature at lower levels.

Actions Pane Elements

The following table describes the delegation options available for IIS 7.0 features in IIS Manager and how the delegation options affect the configuration files and user interface (UI). These features are configuration-based features. If you extend IIS Manager to include third-party features, your delegation states might differ from this table if they are user-specified delegation states.

Element Name Description

Read/Write

Enables non-administrative users for a site or application to see and configure the selected feature at the site and application levels by using IIS Manager.

Read Only

Enables non-administrative users for a site or application to see, but not configure, the selected feature at the site and application levels by using IIS Manager.

Configuration Read/Write

Enables non-administrative users for a site or application to see and configure the selected feature at the site and application levels by using IIS Manager. This option is available only for features, such as .NET Users and .NET Roles, that have configuration in both a configuration file and a database.

Note

This setting does not affect the database permissions.

Configuration Read Only

Enables non-administrative users for a site or application to see, but not configure, the selected feature at the site and application levels by using IIS Manager. This option is available only for features, such as .NET Users and .NET Roles, that have configuration in both a configuration file and a database.

Note

This setting does not affect the database permissions.

Not Delegated

Removes the selected feature from being delegated. This feature will not be displayed in IIS Manager and cannot be configured by non-administrative users at the site and application levels.

Reset to Inherited

Resets the selected feature to the delegation state specified at the parent level.

Reset All Delegation

Resets the delegation states of all the features to the delegation states specified at the parent level.

Default Delegation

Opens the Feature Delegation page in which you can configure default delegation states for sites or applications.

See Also

  • Configuring Delegation for a Site or an Application in IIS 7.0 (online)


Copy Delegation Dialog Box

Use the Copy Delegation dialog box to select sites and applications to which you want to copy custom delegation states for features in IIS Manager. You can copy custom delegation states from one site to another when you are connected to a server in IIS Manager, and copy custom delegation states from one application to another when you are connected to a site in IIS Manager.

UI Element List

Element Name | Description
Site_name or application_name | Select the check box next to the site(s) or application(s) to which you want to apply the custom delegation state that you have configured on the Custom Site Delegation or Custom Application Delegation page.

See Also

  • Configuring Delegation for a Site or an Application in IIS 7.0 (online)


Handler Mappings

This section contains the following topics:

Handler Mappings Page

Add or Edit Managed Handler Dialog Box

Add or Edit Script Map Dialog Box

Add or Edit Wildcard Script Map Dialog Box

Add or Edit Module Mapping Dialog Box

Request Restrictions Dialog Box

Edit Feature Permissions Dialog Box


Handler Mappings Page

Use the Handler Mappings feature page to manage a list of handlers that process requests for specific file types.

Sort the list by clicking one of the feature page column headings or select a value from the Group by drop-down list to group similar items.

UI Element List

The following tables describe the UI elements that are available on the feature page and in the Actions pane.

Feature Page Elements

Element Name Description

Name

Displays the name of the handler mapping.

Path

Displays the file name or file name extension for which the handler will process a response. The value can be either a specific file name, such as WebResource.axd, or a wildcard (*) with a specific extension, such as *.exe.

State

Displays whether the handler is enabled or disabled based on the access policy set in the Edit Feature Permissions dialog box and the required access setting specified by the handler mapping. If a handler requires a type of access that is not enabled in the access policy at that level, the handler is disabled.

Path Type

Displays one of the following values for the type of path to which the handler is mapped:

  • Unspecified, if the mapping does not apply to a specific path type.

  • File, if the mapping applies to a file.

  • Directory, if the mapping applies to a directory.

  • File or Directory, if the mapping is for either a file or a directory.

Handler

Displays the module, such as IsapiModule, or managed type, such as System.Web.Handlers.TraceHandler, that responds to the request as specified in the mapping.

Entry Type

Displays whether the item is local or inherited. Local items are read from the current configuration file, and inherited items are read from a parent configuration file.

Actions Pane Elements

Element Name Description

Add Managed Handler

Opens the Add Managed Handler dialog box in which you can add a mapping to a managed code handler.

Add Script Map

Opens the Add Script Map dialog box in which you can add a mapping to a script processor.

Add Wildcard Script Map

Opens the Add Wildcard Script Map dialog box in which you can add a handler mapping to handle every file name extension.

Add Module Mapping

Opens the Add Module Mapping dialog box in which you can add a mapping to a module.

Edit

Opens an edit dialog box from which you can edit the selected handler mapping.

Rename

Enables the Name field so you can change the friendly name of the selected handler mapping.

Note

This action is available only at the server level.

Lock

Locks the selected handler mapping so it cannot be overridden at lower levels in configuration.

Note

This action is available only at the server level.

Unlock

Unlocks the selected handler mapping so it can be overridden at lower levels in configuration.

Note

This action is available only at the server level.

Remove

Removes the item that is selected from the list on the feature page.

Edit Feature Permissions

Opens the Edit Feature Permissions dialog box in which you can configure permissions that apply to the entire Handler Mappings feature.

Revert to Inherited

Reverts the feature to inherit settings from the parent configuration. This deletes local configuration settings, including items from the list, for this feature. This action is not available at the server level.

View Ordered List

Displays the list in order of configuration. When you select the ordered list format, you can only move items up and down in the list. Other actions in the Actions pane do not appear until you select the unordered list format.

Move Up

Moves a selected item up in the list. This action is available only when viewing items in the ordered list format.

Note

When items in the list are reordered at a child level, the child will no longer inherit settings from the parent level (including any items that are added to or removed from the list at the parent level) after the list is reordered. If you want to inherit settings from a parent level, you must revert all of the changes at the child level by using the Revert to Inherited action in the Actions pane.

Move Down

Moves a selected item down in the list. This action is available only when viewing items in the ordered list format.

Note

When items in the list are reordered at a child level, the child will no longer inherit settings from the parent level (including any items that are added to or removed from the list at the parent level) after the list is reordered. If you want to inherit settings from a parent level, you must revert all of the changes at the child level by using the Revert to Inherited action in the Actions pane.

View Unordered List

Displays the list in an unordered format. When you select the unordered list format, you can sort and group items in the list, and perform actions in the Actions pane.

See Also

  • Edit Feature Permissions Dialog Box
  • Configuring Handler Mappings in IIS 7.0 (online)


Add or Edit Managed Handler Dialog Box

Use the Add Managed Handler and Edit Managed Handler dialog boxes to add new or edit existing managed code handlers on the Web server. Managed handlers are written in managed code and respond to specific requests on the Web server. For example, the PageHandlerFactory-Integrated handler mapping specifies that the System.Web.UI.PageHandlerFactory handler process requests for .aspx files.

Note

By default, when you add a managed handler, the handler will run only in application pools configured to use Integrated mode. However, if you want to run the handler in application pools configured to use ISAPI mode, you must add the handler to the <httphandlers> section in System.web from a tool such as IIS 7.0 command-line tool.

UI Element List

Element Name | Description
Request path | Type a file name extension or file name with an extension for which you want the handler to process requests. For example, if you want the handler to process all requests made for files with the extension .abc, enter *.abc; or if you want the handler to run all requests made for a specific file, type the file name and its extension, such as Myfile.abc.
Type | Type the type name of the managed handler, such as System.Web.Handlers. When you add a managed handler, make sure that the assembly to which the class belongs is registered in the system.web/compilation section of your Web.config file. Otherwise you must type the assembly qualified class name of the managed handler. If the class is defined in the App_Code or bin directory you can specify just the class name.
Name | Type a descriptive friendly name for the handler mapping.
Request Restrictions | Opens the Request Restrictions dialog box from which you can specify additional, optional restrictions for the mapping.

See Also

  • Request Restrictions Dialog Box
  • Configuring Handler Mappings in IIS 7.0 (online)


Add or Edit Script Map Dialog Box

Use the Add Script Map and Edit Script Map dialog boxes to add new or edit existing native handlers on the Web server. Native handlers, also known as script engines, are native code .exe or .dll files that respond to specific requests.

Note

Script maps provide backward compatibility with earlier versions of IIS. Executables must be written to the CGI specification, and dynamic-link libraries must support the ISAPI extension interfaces.

If you map a type of request to an .exe file (the script engine), CgiModule will load the associated executable when a request enters the server and it matches the handler mapping. If you map a type of request to a .dll file (the script engine), IsapiModule will load the DLL when a request enters the server and it matches the handler mapping. For example, IIS 7.0 includes a handler mapping for Active Server Pages (ASP). All requests for .asp files are processed by the asp.dll script engine, which is loaded by IsapiModule because ASP.DLL is an ISAPI extension.

Note

If you configure script maps for executables, make sure that CgiModule is registered and enabled on the Modules page. Likewise, if you configure script maps for DLLs, make sure that IsapiModule is registered and enabled on the Modules page.

After you click OK to add or save the handler mapping, the executable must be added to the ISAPI and CGI Restrictions list to enable it to run.

UI Element List

Element Name Description

Request path

Type a file name extension or file name with an extension for which you want the handler to process requests. For example, if you want the handler to run all requests made for ASP files, enter *.asp; or if you want the handler to run all requests made for a specific file, enter the file name and its extension, such as Myfile.asp.

Note

If you want to configure a wildcard script map, use the Add Wildcard Script Map action on the Handler Mappings page.

Executable

Type the path to the CGI program or to the ISAPI extension in the physical file system.

Note

If you specify the path of a .exe file that has spaces in the path, enclose the path in double quote marks ("). You can also specify command-line parameters with .exe files. These instructions do not apply to .dll files.

…

Locate the .exe or .dll file in the physical file system.

Name

Type a descriptive name for the handler mapping.

Request Restrictions

Opens the Request Restrictions dialog box from which you can specify additional, optional restrictions for the mapping.

See Also

  • Request Restrictions Dialog Box
  • Configuring Handler Mappings in IIS 7.0 (online)


Add or Edit Wildcard Script Map Dialog Box

Use the Add Wildcard Script Map and Edit Wildcard Script Map dialog boxes to add or edit a wildcard mapping. The ISAPI extension that you configure for the mapping handles every file name extension, and intercepts every request before the requested page is sent to its mapped handler.

After you click OK to add or save the handler mapping, the executable must be added to the ISAPI and CGI Restrictions list to enable it to run.

UI Element List

Element Name Description

Request path

Displays an asterisk (*).

Note

If you want to configure a script map for a specific file name extension or file name with extension, use the Add Script Map action on the Handler Mappings page.

Executable

Type the path of the ISAPI extension in the physical file system.

…

Locate the .exe or .dll file in the physical file system.

Name

Type a descriptive name for the handler mapping.

See Also

  • Configuring Handler Mappings in IIS 7.0 (online)


Add or Edit Module Mapping Dialog Box

Use the Add Module Mapping and Edit Module Mapping dialog boxes to add new or edit existing module mappings on the Web server. You can map a specific file or file name extension to a native module on the Web server, so that when a user requests the file or a file that has the specified extension, the module will process the request. For example, IIS 7.0 maps all requests for .asp files to IsapiModule, so that module is called when a user requests a file that has the .asp file name extension.

UI Element List

Element Name Description

Request path

Type a file name extension or file name with an extension for which you want the handler to process requests. For example, if you want the handler to process all requests made for files with the extension .abc, enter *.abc; or if you want the handler to run all requests made for a specific file, enter the file name and its extension, such as Myfile.abc.

Module

Select the module that you want to process requests for resources specified in the Request path box.

Executable (optional)

Optionally, type a path to the .dll or .exe file when the module you selected in the Module box requires an executable to run, such as the FastCGI module.

Note

After you click OK to add or save the handler mapping, the executable must be added to the ISAPI and CGI Restrictions list to enable it to run.

If you specify a .exe file, you can also type optional command-line parameters after the path. Command-line parameters are not supported for .dll files.

Note

If you specify a path for a .exe file, and the path contains spaces, you must enclose the path with double quotation marks ("). For example, type "c:\files\handler files\handler.exe". This is not required for .dll files.

Name

Type a descriptive friendly name for the handler mapping.

Request Restrictions

Opens the Request Restrictions dialog box from which you can specify additional, optional restrictions for the mapping.

See Also

  • Request Restrictions Dialog Box
  • Configuring Handler Mappings in IIS 7.0 (online)


Request Restrictions Dialog Box

Use the Request Restrictions dialog box to specify optional restrictions, such as the requested resource type or HTTP verb, for which you want a handler to process requests. Configure restrictions only if you have a specific need to limit the conditions under which a handler processes requests. When you do not configure restrictions, handlers will process requests regardless of the resource type requested and the HTTP verbs specified.

UI Element List

Element Name Description

Mapping

Configure options on this tab if you want to restrict the handler mapping to requests for specific resource types, such as for a file or a folder. If you do not configure options on this tab, the handler will process requests regardless of the resource type specified in the request.

Invoke handler only if request is mapped to

Select this check box on the Mapping tab if you want the handler mapping to apply only to requests for a specific resource type, such as a request for a file or a folder. If you select this check box, you must also specify the resource type by selecting an option under this check box.

File

Select this option if you want the handler to process requests for a specific file name or file name extension. For example, the ASPClassic handler processes requests for requests made for .asp files. This option is available only if you select the Invoke handler only if request is mapped to check box.

Folder

Select this option if you want the handler to process requests for a folder. You may want this restriction if you have a folder with content that you want a specific handler to process. This option is available only if you select the Invoke handler only if request is mapped to check box.

File or folder

Select this option if you want the handler to process requests for files and folders. This option is available only if you select the Invoke handler only if request is mapped to check box.

Verbs

Configure options on this tab if you want to restrict a handler mapping to specific HTTP verbs that clients provide in HTTP headers when they make requests.

All verbs

Select this option if you want the handler to process requests regardless of the verbs that the client specifies. This option is selected by default.

One of the following verbs

Select this option if you want the handler to process requests only when a client provides a specific HTTP verb or specific HTTP verbs in a request. In the corresponding text box, type the HTTP verb or verbs to which you want the handler mapping to apply. For example, type GET if you want the handler to process requests when a client uses the GET verb.

Access

Select one of the options on this tab to configure the access that this handler requires to run in a virtual directory. This setting (together with the feature's access policy that is set on the Edit Feature Permissions dialog box) determines whether a handler can run.

Important

Make sure that the required access setting for a handler is correct or else it may be possible for the handler to run unintentionally. For example, if you change the handler's required access from Execute to Read for ISAPI-dll handler, ISAPI extensions will be able to run even if only Read is enabled in the feature's access policy.

Select one of the following options:

  • None: The handler will run even when no access policy options are enabled.

  • Read: The handler will run when Read is enabled in the access policy.

  • Write: The handler will run when Write is enabled in the access policy.

  • Script: The handler will run when Scripts is enabled in the access policy. This is the default selection.

  • Execute: The handler will run when Execute is enabled in the access policy.

See Also

  • Edit Feature Permissions Dialog Box
  • Configuring Handler Mappings in IIS 7.0 (online)


Edit Feature Permissions Dialog Box

Use the Edit Feature Permissions dialog box to configure the access policy that specifies the type of feature rights allowed for handlers at the Web server, site, application, directory, or file levels in IIS. The feature rights that you can enable or disable in the access policy are: read, scripts, and execute. The access policy, together with a handler's required access setting, determines whether a handler can run. If a handler requires a type of feature right that is not enabled in the access policy, the handler will be disabled and all requests that are processed by that handler (based on the handler mapping) will fail, unless there is another handler that can process the request.

When you select an option in the Edit Feature Permissions dialog box, the State column on the Handler Mappings page displays Enabled for the handlers that are enabled by the selection. Similarly, when you clear a selection in the Edit Feature Permissions dialog box, the State column on the Handler Mappings page displays Disabled for the handlers that are disabled by the selection. You can preview the handlers that are enabled or disabled by viewing the Handler Mappings page, and then clicking OK to dismiss the Edit Feature Permissions dialog box. If you click Cancel instead of OK, the changes that you make in the dialog box will not be saved.

Note

To configure the required access setting for a handler, you can edit the handler mapping and click Request Restrictions to configure the setting on the Access tab.

For example, you might enable Read and Scripts at the Web server level, but decide to disable Scripts for a specific site that serves only static content. This prevents the server from running scripts for that site if a user adds a handler mapping for a script or executable at the site level.

UI Element List

Element Name Description

Read

Select the Read check box to enable handlers that require read access to a virtual directory or clear the Read check box to disable handlers that require read access to a virtual directory. You should enable read in an access policy if you want to serve static content, or want to configure default documents and directory browsing. By default, read permissions are enabled.

Scripts

Select the Scripts check box to enable handlers that require script rights to a virtual directory or clear the Scripts check box to disable handlers that require script rights in a virtual directory.

Execute

Select the Execute check box to enable handlers that require execute rights in a virtual directory or clear the Execute check box to disable handlers that require execute rights in a virtual directory. The Execute check box is enabled only when the Scripts check box is selected. You should enable execute in an access policy only if you want to enable executable files, such as .exe, .dll, and .com files, to run in addition to scripts.

Important

For security and performance reasons, you should enable executable rights only for programs that you have tested and that your applications require.

See Also

  • Request Restrictions Dialog Box
  • Configuring Handler Mappings in IIS 7.0 (online)


HTTP Redirect Page

Use the HTTP Redirect feature page to enable redirection and to configure how incoming requests are redirected to a new destination.

UI Element List

The following tables describe the UI elements that are available on the feature page and in the Actions pane.

Feature Page Elements

Element Name Description

Redirect requests to this destination

Select this option to enable redirection and to specify the URL to which to redirect requests. Requests can be redirected to a virtual path, such as http://www.contoso.com/sales, or to a file, such as http://www.contoso.com/sales/default.aspx.

Redirect all requests to exact destination (instead of relative to destination)

Select this option when you want clients to be redirected to the exact URL as specified in the Redirect requests to this destination box.

When this option is not selected, the destination is relative to the value specified in Redirect requests to this destination. For example, if you configure the redirection destination to be http://www.contoso.com/sales, and an incoming request is http://www.contoso.com/marketing/default.aspx, IIS will redirect the request to http://www.contoso.com/sales/default.aspx.

Only redirect requests to content in this directory (not subdirectories)

Select this option when you want clients to be redirected to content in only the directory that is specified in the Redirect requests to this destination box.

When this option is not selected, requests are redirected to the location in the Redirect requests to this destination box, and to any subdirectories under that location. For example, if you configure the redirection destination to be http://www.contoso.com/sales, requests may be served from directories under /sales when the Redirect all requests to exact destination (instead of relative to destination) option is not also selected.

Status code

Select one of the following options to specify the redirect status code that is sent to clients:

  • Found (302): Tells the Web client to issue a new request to the location. This is the default option.

  • Permanent (301): Tells the Web client that the location for the requested resource has permanently changed.

  • Temporary (307): Prevents a Web browser from losing data when the browser issues an HTTP POST request.

Actions Pane Elements

Element Name | Description
Apply | Saves the changes that you have made on the feature page.
Cancel | Cancels the changes that you have made on the feature page.

See Also

  • Configuring HTTP Redirection in IIS 7.0 (online)


HTTP Response Headers

This section contains the following topics:

HTTP Response Headers Page

Add or Edit Custom HTTP Response Header Dialog Box

Set Common HTTP Response Headers Dialog Box


HTTP Response Headers Page

Use the HTTP Response Headers feature page to manage a list of name and value pairs that contain information about a requested page, and to configure common HTTP headers.

Sort the list by clicking one of the feature page column headings or select a value from the Group by drop-down list to group similar items.

UI Element List

The following tables describe the UI elements that are available on the feature page and in the Actions pane.

Feature Page Elements

Element Name | Description
Name | Displays the name part of an HTTP response header name-value pair.
Value | Displays the value part of an HTTP response header name-value pair.
Entry Type | Displays whether the item is local or inherited. Local items are read from the current configuration file, and inherited items are read from a parent configuration file.

Actions Pane Elements

Element Name | Description
Add | Opens the Add Custom HTTP Response Header dialog box in which you can add a header.
Set Common Headers | Opens the Set Common HTTP Response Headers dialog box in which you can configure the HTTP keep-alive and Web content expiration headers.
Edit | Opens the Edit Custom HTTP Response Header dialog box in which you can edit a header. This action is available only when an item is selected from the list on the feature page.
Remove | Removes the item that is selected from the list on the feature page.

See Also

  • Configuring HTTP Response Headers in IIS 7.0 (online)


Add or Edit Custom HTTP Response Header Dialog Box

Use the Add Custom HTTP Response Header and Edit Custom HTTP Response Header dialog boxes to add or edit name and value pairs that contain information about a requested page. For example, you can create a custom header named “author” that contains the name of the content author for a site.

UI Element List

Element Name | Description
Name | Type the name part of an HTTP response header name-value pair.
Value | Type the value part of an HTTP response header name-value pair.

See Also

  • Configuring HTTP Response Headers in IIS 7.0 (online)


Set Common HTTP Response Headers Dialog Box

Use the Set Common HTTP Response Headers dialog box to configure headers that enable HTTP keep-alive and specify when to expire Web content.

UI Element List

Element Name Description

Enable HTTP keep-alive

Select this option to keep a client/server connection open across multiple requests to the server. An open connection improves performance when a client makes multiple requests for Web page content because the server can more quickly return the content for each request.

Note

You must use HTTP keep-alive when you use integrated security or connection-based authentication services such as Integrated Windows authentication.

Expire Web content

Select this option to configure the expiration of Web content. A Web server returns this header value to a client browser in an HTML file header. The browser compares that value with the current date to determine whether to display a page that is cached on the client computer or to request an updated page from the server.

Then select one of the following options to specify when to expire the content:

  • Immediately - expires the content immediately after it is delivered. This setting is best for content that contains sensitive information that you do not want to be cached or that is updated very frequently.

  • After - sets the amount of time after which the content will be expired. This setting is best for content that is updated regularly, such as on a daily or weekly basis. Type a value in the corresponding box and select one of the following values from the list: Second(s), Minute(s), Hour(s), Day(s).

  • On (in Coordinated Universal Time (UTC)) - sets an exact date and time when the content will expire. This setting is best for content that is not expected to change frequently.

See Also

  • Configuring HTTP Response Headers in IIS 7.0 (online)


IIS Manager

This section contains the following topics:

Create New Connection

Advanced Settings Dialog Boxes

Content View Page

Defaults Dialog Boxes

Home Page

New Feature Available Dialog Box

Start Page


Create New Connection

This section contains the following topics:

Specify Server Connection Details Wizard Page

Specify Site Connection Details Wizard Page

Specify Application Connection Details Wizard Page

Provide Credentials Wizard Page

Specify a Connection Name Wizard Page

Certificate Name Mismatch Help Identifier Dialog Box

Certificate Verification Help Identifier Dialog Box


Specify Server Connection Details Wizard Page

Use the Specify Server Connection Details wizard page to specify the name of the server to which you want to connect in IIS Manager.

If you receive an error when you try to connect to the server, check for the following possible issues:

  • You mistyped a value, such as the server name or user credentials.

  • The Web server to which you are connecting is not running IIS 7.0. You cannot use IIS Manager in IIS 7.0 to connect to a Web server that runs a previous version of IIS.

  • The management service is not started on the Web server.

  • A Firewall rule is preventing the connection.

UI Element List

Element Name | Description
Server name | Type the name of the server to which you want to connect. If the server is using a port other than 8172 (the default port configured for the management service), type the server name and the port number separated by a colon (:). For example, type contoso:8080 to connect to a server named contoso with the management service configured to accept connections on port 8080. Alternately, you can type the IPv4 or IPv6 address in block braces ([]).

See Also

  • Internet Information Services (IIS) Manager (online)


Specify Site Connection Details Wizard Page

Use the Specify Site Connection Details wizard page to specify the site to which you want to connect in IIS Manager. The server administrator should give you the information that you must have to connect to the site.

If you receive an error when you try to connect to the server, check for the following possible issues:

  • You mistyped a value, such as the server name or user credentials.

  • The Web server to which you are connecting is not running IIS 7.0. You cannot use IIS Manager in IIS 7.0 to connect to a Web server that runs a previous version of IIS.

  • The management service is not started on the Web server.

  • A Firewall rule is preventing the connection.

UI Element List

Element Name | Description
Server name | Type the name of the server that hosts the site to which you want to connect. If the server is using a port other than 8172 (the default port configured for the management service), type the server name and the port number separated by a colon (:). For example, type contoso:8080 to connect to a server named contoso with the management service configured to accept connections on port 8080. Alternately, you can type the IPv4 or IPv6 address in block braces ([]).
Site name | Type the friendly name of the site to which you want to connect.

See Also

  • Internet Information Services (IIS) Manager (online)


Specify Application Connection Details Wizard Page

Use the Specify Application Connection Details wizard page to specify the application to which you want to connect in IIS Manager. The server administrator should give you the information that you must have in order to connect to the application.

If you receive an error when you try to connect to the server, check for the following possible issues:

  • You mistyped a value, such as the server name or user credentials.

  • The Web server to which you are connecting is not running IIS 7.0. You cannot use IIS Manager in IIS 7.0 to connect to a Web server that runs a previous version of IIS.

  • The management service is not started on the Web server.

  • A Firewall rule is preventing the connection.

UI Element List

Element Name | Description
Server name | Type the name of the server that hosts the application to which you want to connect. If the server is using a port other than 8172 (the default port configured for the management service), type the server name and the port number separated by a colon (:). For example, type contoso:8080 to connect to a server named contoso with the management service configured to accept connections on port 8080. Alternately, you can type the IPv4 or IPv6 address in block braces ([]).
Site name | Type the friendly name of the site that contains the application to which you want to connect.
Application name | Type the name of the application to which you want to connect.

See Also

  • Internet Information Services (IIS) Manager (online)


Provide Credentials Wizard Page

Use the Provide Credentials wizard page to specify credentials to connect to a server, site, or application by using IIS Manager. The credentials specified on this page can be either Windows user accounts or IIS Manager user accounts.

If you receive an error when you try to connect to the server, check for the following possible issues:

  • You mistyped a value, such as the server name or user credentials.

  • The Web server to which you are connecting is not running IIS 7.0. You cannot use IIS Manager in IIS 7.0 to connect to a Web server that runs a previous version of IIS.

  • The management service is not started on the Web server.

  • A Firewall rule is preventing the connection.

UI Element List

Element Name Description

User name

Type the user name of an account that is authorized to connect to the server, site, or application.

Note

Only server administrators can connect to a server by using IIS Manager.

Password

Type the password that is associated with the user name.

See Also

  • Internet Information Services (IIS) Manager (online)


Specify a Connection Name Wizard Page

Use the Specify a Connection Name wizard page to specify a friendly name for your connection in IIS Manager.

UI Element List

Element Name | Description
Connection name | Type a friendly name for the connection. This connection name appears in the tree in IIS Manager.

See Also

  • Internet Information Services (IIS) Manager (online)


Certificate Name Mismatch Help Identifier Dialog Box

This error message indicates that the server name that you entered does not match the name that appears on the server's certificate.

You might have caused this by entering the secure server's IP address when the DNS or NETBIOS name appeared on the server's certificate. If this occurs, it can appear as if you are being maliciously redirected to a server other than the one to which you had intended to connect.

To avoid seeing this message in the future, connect to the server by entering the address that appears on the secure server's certificate.


Certificate Verification Help Identifier Dialog Box

This message indicates that there may be a problem with the certificate issued to the server to which you are connecting. The certificate may not be trusted; it may have expired or been revoked. If this is the case, you must resolve these problems before you can connect to the server.

This message can also appear if you are connecting to the server by using a name that does not appear on the server's certificate. If this occurs, it can seem that you are being maliciously redirected to a server other than the one to which you had intended to connect. You are given the option to connect, but you should view the certificate to determine whether to connect to the server.

This message can also appear because of some combination of the errors listed above. If this happens, use the View details link to investigate the details of the problem and determine the best course of action.


Advanced Settings Dialog Boxes

Use the Advanced Settings dialog boxes to edit the properties for each of the following objects in IIS:

  • Application pool

  • Site

  • Application

  • Virtual directory

The Advanced Settings dialog box is useful when you want to edit a specific property or group of properties for an object without using an edit wizard or a dialog box, or when a property is not displayed in a wizard or dialog box.

Note

If you want to change a default value for all application pools, sites, applications, or virtual directories, you can do so on the appropriate Defaults dialog box for any of these objects.

For information about a specific property, select the property in the Advanced Settings dialog box and view the information that displays in the property description pane underneath the property grid. You can make the property description pane larger by clicking the bar between the property grid and the property description pane, and then dragging upward. You can also resize the entire Advanced Settings dialog box to see more properties at the same time.

See Also

  • Defaults Dialog Boxes
  • Application Pools
  • Sites
  • Applications
  • Virtual Directories
  • Internet Information Services (IIS) Manager (online)


Content View Page

Use the Content View page to view the contents of an item selected in the tree in the Connections pane. For example, select a site and click Content View to see the list of any applications, virtual directories, physical directories, and files in that site.

You can right-click an object in the Content list, and click Switch to Features View to go to the object's home page. From the Home page, you can configure features for the object, such as configuring authentication settings for an application.

Note

IIS Manager does not display files in the tree in the Connections pane. To configure features for individual files, you must right-click the file in Content View and then click Switch to Features View.

Sort the list by clicking one of the feature page column headings or select a value from the Group by drop-down list to group similar items. Search the list by typing search criteria in the Filter box, expand the Go list to select the field on which to search, and then click Go or press ENTER. Click Show All to remove the filter criteria.

UI Element List

The following tables describe the UI elements that are available on the feature page and in the Actions pane.

Feature Page Elements

Element Name | Description
Name | Displays the name of each object.
Type | Displays the object type, such as application or virtual directory.

Actions Pane Elements

The actions available in the Actions pane depend on the type of object that you select on the Content page. Additionally, when you are connected to a site or an application, the only actions available are Switch to Features View, Browse, and Refresh.

Element Name | Description
Advanced Settings | Opens the Advanced Settings dialog box from which you can configure advanced settings for the selected object.
Add Application | Opens the Add Application dialog box from which you can add an application.
Add Application Pool | Opens the Add Application Pool dialog box from which you can add an application pool to the Web server.
Add Virtual Directory | Opens the Add Virtual Directory dialog box from which you can add a virtual directory.
Add Web Site | Opens the Add Web Site dialog box from which you can add a Web site that uses the HTTP or HTTPS protocols for communication.
Browse | Opens the selected object in an Internet browser.
Convert to Application | Converts the directory into an application.
Edit Bindings | Opens the Site Bindings dialog box from which you can add, edit, and remove site bindings for the selected site.
Explore | Opens the physical directory (in Windows Explorer) that is mapped to the selected object.
Edit Permissions | Opens the Windows Properties dialog box for the physical directory that is mapped to the selected object.
Refresh | Refreshes the Content page.
Remove | Removes the item that is selected from the list on the page.
Remove Connection | Removes the selected connection.
Rename | Enables the Name field of the selected object so that you can rename it.
Restart | Stops and restarts the selected site. Restarting a site causes the site to be temporarily unavailable until the restart is complete.
Start | Starts the selected site.
Stop | Stops the selected site. Stopping a site causes the site to be unavailable until it is started.
Switch to Features View | Opens the Home page in Features View for the selected object.
View Applications | Opens the Applications feature page from which you can view the applications that belong to the selected site.
View Virtual Directories | Opens the Virtual Directories feature page from which you can view the virtual directories that belong to the selected site's root application.

See Also

  • Internet Information Services (IIS) Manager (online)


Defaults Dialog Boxes

Use the Defaults dialog boxes to edit the default values of properties that have default values, such as recycling settings for application pools, limits for sites, and the application pool in which applications run. The Defaults dialog boxes do not contain properties that are frequently unique, such as site bindings or the physical path of site, application, and virtual directory content.

Each of the following objects in IIS has a Default dialog box from which you can edit default values for all objects of that type:

  • Application pool

  • Site

  • Application

  • Virtual directories

When you change the default value of a property, all objects of that type will receive the new value when:

  • You create a new object of that type.

  • An existing object does not already have a specific value set that differs from the default value for the property.

    Note

    If you must change the value for a specific site or application, use the Advanced Settings dialog box.

For information about a specific property, select the property in the Defaults dialog box and view the information that is displayed in the property description pane underneath the property grid. You can make the property description pane larger by clicking the bar between the property grid and the property description pane, and then dragging upward. You can also resize the entire Defaults dialog box to see more properties at the same time.

See Also

  • Advanced Settings Dialog Boxes
  • Application Pools
  • Sites
  • Applications
  • Virtual Directories
  • Internet Information Services (IIS) Manager (online)


Home Page

Use the Home page to view and access the list of features that are available for configuration in IIS Manager.

Use the Group by drop-down list to group similar features, and use the View drop-down list to display the features in different formats, such as icons or details. If you select Details from the View list, you can sort the features by clicking one of the columns on the Home page.

The Home page is displayed when both of the following are true:

  • You have selected Features View.

  • You have clicked a Web server, site, application, virtual directory, or physical directory in the tree in the Connections pane, or you have selected a file in Content View and then clicked Switch to Features View.

See Also

  • Internet Information Services (IIS) Manager (online)


New Feature Available Dialog Box

Use the New Feature Available dialog box to download and install code to support any new IIS Manager features that are available on the server to which you are connecting. After you install a feature, you can use it in IIS Manager on subsequent connections to the same server or to any servers that have that same feature unless a server administrator removes delegation for the feature at a later time.

UI Element List

Element Name Description

Assembly

Displays the name of each .dll file that is available to download and install on your computer. Select the check box next to each assembly that you want to download and install, and then click OK.

Note

When the publisher of the code cannot be verified as having a valid digital signature, you will be prompted with a security warning before the code is downloaded to your computer. Click Run if you trust the publisher and want to continue with the download, or click Don't Run if you want to cancel the download.

Features

Displays the feature or features that are available with each .dll file.

Size

Displays the size of the .dll file.

Version

Displays the version of the .dll file.

See Also

  • Feature Delegation Page
  • Internet Information Services (IIS) Manager (online)


Start Page

Use the Start page to easily re-open recent connections and create new connections to Web servers, sites, and applications by using IIS Manager. You can also click links to online resources and review news about IIS.

UI Element List

Element Name Description

Recent connections

Displays a list of your recent connections to Web servers, sites, and applications. Double-click a connection in the list to re-open the connection. You might need to retype your account credentials to connect.

Connection tasks

Displays the following connection tasks:

  • Connect to localhost: Connects to the local computer by using the credentials of the Windows user who is currently logged on.

  • Connect to a server: Opens a wizard from which you can connect to a server by using a Windows administrator account.

  • Connect to a site: Opens a wizard from which you can connect to a site by using a Windows or IIS Manager user account that has permission to connect to the site.

  • Connect to an application: Opens a wizard from which you can connect to an application by using a Windows or IIS Manager user account that has permission to connect to the application.

Online resources

Displays a list of links to online resources about IIS.

IIS News

Displays recent IIS news. Click Enable IIS News in the IIS News bar to enable this feature.

See Also

  • Internet Information Services (IIS) Manager (online)


IIS Manager Permissions

This section contains the following topics:

IIS Manager Permissions Page

Allow User Dialog Box

Users Dialog Box - IIS Manager Permissions Feature


IIS Manager Permissions Page

Use the IIS Manager Permissions feature page to manage IIS Manager users, Windows users, and members of Windows groups that are allowed to connect to a site or an application. Users can configure delegated features in any sites and applications to which you grant them permission from the IIS Manager Permissions page.

This feature is available only for server connections. When you open the feature at the server level in IIS Manager, you can view the users who are granted permission to all sites and applications on the Web server, and you can select a user to remove the user's permission to a site or an application. To grant a user permission to a site or an application, you must select the site or application and then open the IIS Manager Permissions feature to configure the users who are allowed to connect to that site or application.

Sort the list by clicking one of the feature page column headings or select a value from the Group by drop-down list to group similar items.

UI Element List

The following tables describe the UI elements that are available on the feature page and in the Actions pane.

Feature Page Elements

Element Name Description

Name

Displays the user name that is used to connect to sites or applications in IIS Manager.

Path

Displays the path of the object that the administrator can manage. For example, the path might be a site name, such as Default Web Site, or the path of an application in the default Web site, such as Default Web Site/calendar.

Level

Displays the level of the administrator. The possible values are Site or Application.

Type

Displays the type of credentials that the administrator uses. The value can be:

  • Windows Group: if the user is a member of a Windows group on the server.

  • Windows User: if the user is a Windows user on the server.

  • IIS Manager User: if the user is not a Windows user or a member of any Windows groups on the server. IIS Manager credentials are specific to IIS, and they are not recognized by Windows or by any other applications on the server.

Actions Pane Elements

Element Name | Description
Allow User | Opens the Allow User dialog box in which you can select a user to grant them permission to connect to a site or an application.
Deny User | Removes the selected user from the IIS Manager Permissions list.
Show all users | Displays users at the current level and lower levels.
Show only site users or Show only application users | Displays users at only the current level.

See Also

  • Configuring User Accounts to Connect to Sites and Applications in IIS Manager (online)


Allow User Dialog Box

Use the Allow User dialog box to allow IIS Manager users, Windows users, or members of Windows groups to connect to a site or an application. Users can configure delegated features in any sites and applications to which you grant them permission.

UI Element List

Element Name Description

Windows

Select this option when you want to allow a Windows user or members of a Windows group to connect to the site or application. When you select this option, the Windows account must already be created on the Web server or the domain to which the server is joined.

IIS Manager

Select this option when you want to allow an IIS Manager user to connect to the site or application. When you select this option, the IIS Manager user account must already be created at the server level in IIS Manager.

Note

This option is enabled only when you configure the management service to accept connections from both Windows users and IIS Manager users.

Select

If you selected the Windows option, click Select to open the Select User or Group dialog box and search for a Windows user or group.

Note

To include Windows groups in a search, on the Select User or Group dialog box click Object Types, select Groups, and then click OK. Additionally, if your computer is joined to a domain and you want to search for users or groups on the domain, click Locations, select a location, and then click OK.

If you selected the IIS Manager option, click Select to open the Users dialog box and select one or more IIS Manager users.

See Also

  • Configuring User Accounts to Connect to Sites and Applications in IIS Manager (online)


Users Dialog Box - IIS Manager Permissions Feature

Use the Users dialog box to select an IIS Manager user who you want to allow to connect to a site or an application. Users can configure delegated features in any sites and applications to which you grant them permission.

UI Element List

Element Name | Description
Select user | Select the IIS Manager user name that you want to allow to connect to the site or application.

See Also

  • Configuring User Accounts to Connect to Sites and Applications in IIS Manager (online)


IIS Manager Users

This section contains the following topics:

IIS Manager Users Page

Add User Dialog Box and Change Password Dialog Box - IIS Manager Users Feature


IIS Manager Users Page

Use the IIS Manager Users feature page to manage user accounts that can be permitted to connect to sites or applications on the Web server. IIS Manager credentials are specific to IIS, and they are not recognized by Windows or by any other applications on the server.

Sort the list by clicking one of the feature page column headings or select a value from the Group by drop-down list to group similar items.

UI Element List

The following tables describe the UI elements that are available on the feature page and in the Actions pane.

Feature Page Elements

Element Name | Description
Name | Displays the user name that is used to connect to sites or applications in IIS Manager.
Status | Displays whether the user account is enabled or disabled. Only enabled users can use IIS Manager to connect to the sites and applications to which they are granted permission.

Actions Pane Elements

Element Name | Description
Add User | Opens the Add User dialog box in which you can add an IIS Manager user account.
Change Password | Opens the Change Password dialog box in which you can change the password of an IIS Manager user.
Enable | Enables the selected user. This action is available only when a disabled item is selected from the list on the feature page.
Disable | Disables the selected user. This action is available only when an enabled item is selected from the list on the feature page.
Remove | Removes the selected item from the list. This also removes any permissions that were granted to the selected user in sites and applications.

See Also

  • Configuring User Accounts to Connect to Sites and Applications in IIS Manager (online)


Add User Dialog Box and Change Password Dialog Box - IIS Manager Users Feature

Use the Add User dialog box to add a user account to IIS Manager. IIS Manager user credentials are valid only in IIS Manager, and these credentials are used to authenticate the user when the user connects to a site or an application by using IIS Manager. Users can configure delegated features in any sites and applications to which a server administrator grants them permission.

Use the Change Password dialog box to change the password of the selected IIS Manager user account.

UI Element List

Element Name Description

User name

Type a user name of your choice in the box.

Note

This box is not enabled when you are changing a user's password.

Password

Type a password in the box. To enhance security, you should type a strong password. Strong passwords have a minimum of six characters and contain a combination of uppercase and lowercase letters, numbers, and symbols.

Confirm password

Retype the password that you typed in the Password box.

See Also

  • Configuring User Accounts to Connect to Sites and Applications in IIS Manager (online)


IPv4 Address and Domain Restrictions

This section contains the following topics:

IPv4 Address and Domain Restrictions Page

Add Allow or Add Deny Restriction Rule Dialog Box

Edit IP and Domain Restrictions Dialog Box


IPv4 Address and Domain Restrictions Page

Use the IPv4 Address and Domain Restrictions feature page to define and manage rules that allow or deny access to content for a specific IP address, a range of IP addresses, or a domain name or names.

Sort the list by clicking one of the feature page column headings or select a value from the Group by drop-down list to group similar items.

UI Element List

The following tables describe the UI elements that are available on the feature page and in the Actions pane.

Feature Page Elements

Element Name | Description
Mode | Displays the type of rule. Values are either Allow or Deny. The Mode value indicates whether the rule is designed to allow or deny access to content.
Requestor | Displays a specific IP address, range of IP addresses, or domain name that is defined in the Add Allow Restriction Rule and Add Deny Restriction Rule dialog boxes. You can specifically allow or deny a requestor access to content.
Entry Type | Displays whether the item is local or inherited. Local items are read from the current configuration file, and inherited items are read from a parent configuration file.

Actions Pane Elements

Element Name Description

Add Allow Entry

Opens the Add Allow Restriction Rule dialog box from which you can define rules that allow access to content for a specific IP address, a range of IP addresses, or a DNS domain name.

Add Deny Entry

Opens the Add Deny Restriction Rule dialog box from which you can define rules that allow access to content for a specific IP address, a range of IP addresses, or a DNS domain name.

Remove

Removes the item that is selected from the list on the feature page.

Edit Feature Settings

Opens the Edit IP and Domain Restrictions Settings dialog box from which you can configure settings that apply to the entire IP and domain name restrictions feature.

Revert to Inherited

Reverts the feature to inherit settings from the parent configuration. This action deletes local configuration settings, including items from the list, for this feature. This action is not available at the server level.

View Ordered List

Displays the list in order of configuration. When you select the ordered list format, you can only move items up and down in the list. Other actions in the Actions pane do not appear until you select the unordered list format.

Move Up

Moves a selected item up in the list. This action is available only when viewing items in the ordered list format.

Note

When items in the list are reordered at a child level, the child will no longer inherit settings from the parent level (including any items that are added to or removed from the list at the parent level) after the list is reordered. If you want to inherit settings from a parent level, you must revert all of the changes at the child level by using the Revert to Inherited action in the Actions pane.

Move Down

Moves a selected item down in the list. This action is available only when viewing items in the ordered list format.

Note

When items in the list are reordered at a child level, the child will no longer inherit settings from the parent level (including any items that are added to or removed from the list at the parent level) after the list is reordered. If you want to inherit settings from a parent level, you must revert all of the changes at the child level by using the Revert to Inherited action in the Actions pane.

View Unordered List

Displays the list in an unordered format. When you select the unordered list format, you can sort and group items in the list, and perform actions in the Actions pane.

See Also

  • Configuring IPv4 Address and Domain Restrictions in IIS 7.0 (online)


Add Allow or Add Deny Restriction Rule Dialog Box

Use either the Add Allow Restriction Rule or the Add Deny Restriction Rule dialog box to define rules that allow or deny access to content for a specific IP address, a range of IP addresses, or a DNS domain name.

UI Element List

Element Name Description

Specific IPv4 Address

Add Allow Restriction Rule - Type an IPv4 address in the Specific IPv4 Address box in the Add Allow Restriction Rule dialog box when you want to allow access to content for a specific IPv4 address.

Add Deny Restriction Rule - Type an IPv4 Address in the Specific IPv4 Address box in the Add Deny Restriction Rule dialog box when you want to deny access to content for a specific IPv4 address.

IPv4 address range

Add Allow Restriction Rule - Type the lowest value of the range of IPv4 addresses that you have chosen to use in the IPv4 Address range box in the Add Allow Restriction Rule dialog box. Do this when you want to allow access to content for a range of IPv4 addresses. Next, enter the subnet mask.

Add Deny Restriction Rule - Type the lowest value of the range of IPv4 addresses that you have chosen to use in the IPv4 address range box in the Add Deny Restriction Rule dialog box. Do this when you want to deny access to content for a range of IPv4 address. Next, enter the subnet mask.

Mask

Add Allow Restriction Rule - Type a subnet mask in the Mask box in the Add Allow Restriction Rule dialog box. Do this when you want to allow access to content for a range of IPv4 address. When IIS evaluates this subnet mask with the IPv4 address entered in the IPv4 address range box, the upper and lower boundaries of an IPv4 address space are defined.

Add Deny Restriction Rule - Type the subnet mask associated with the range of IPv4 addresses in the Mask box in the Add Deny Restriction Rule dialog box. Do this when you want to deny access to content for a range of IPv4 address. When IIS evaluates this subnet mask with the IPv4 address entered in the IPv4 address range box, the upper and lower boundaries of an IPv4 address space are defined.

Domain name

Add Allow Restriction Rule - Type a fully qualified DNS domain name in the Domain name box in the Add Allow Restriction Rule dialog box when you want to allow access to content for a DNS domain.

Add Deny Restriction Rule - Type a fully qualified DNS domain name in the Domain name box in the Add Deny Restriction Rule dialog box when you want to deny access to content for a DNS domain.

To see the Domain name option, you must first enable domain name restrictions, using Edit Feature Settings.

See Also

  • Configuring IPv4 Address and Domain Restrictions in IIS 7.0 (online)


Edit IP and Domain Restrictions Dialog Box

Use the Edit IP and Domain Restrictions dialog box to define access restrictions for unspecified clients or to enable domain name restrictions for all rules.

UI Element List

Element Name | Description
Access for unspecified clients | Defines access restrictions for unspecified clients. This setting defines whether to allow or deny access to clients not specified by any other rule.
Enable domain name restrictions | Enables rules that restrict access by domain name. This rule significantly affects server performance because it requires a DNS lookup for every request.

See Also

  • Configuring IPv4 Address and Domain Restrictions in IIS 7.0 (online)


ISAPI and CGI Restrictions

This section contains the following topics:

ISAPI and CGI Restrictions Page

Add or Edit ISAPI or CGI Restriction Dialog Box

Edit ISAPI and CGI Restrictions Settings Dialog Box


ISAPI and CGI Restrictions Page

Use the ISAPI and CGI Restrictions feature page to manage a list of restrictions to ISAPI and CGI programs.

Sort the list by clicking one of the feature page column headings or select a value from the Group by drop-down list to group similar items.

UI Element List

The following tables describe the UI elements that are available on the feature page and in the Actions pane.

Feature Page Elements

Element Name | Description
Description | Lists the description of the ISAPI or CGI program.
Restriction | Shows whether the specific program is allowed to run.
Path | Shows the path of the .dll or .exe file.

Actions Pane Elements

Element Name | Description
Add | Opens the Add ISAPI or CGI Restriction dialog box from which you can manage restrictions to CGI (.exe) or ISAPI (.dll) programs.
Deny | Specifies the restriction setting for a CGI (.exe) or ISAPI (.dll) program. This action is available only when an item is selected from the list on the feature page.
Allow | Specifies the restriction setting for a CGI (.exe) or ISAPI (.dll) program. This action is available only when an item is selected from the list on the feature page.
Edit | Opens the Edit ISAPI or CGI Restriction dialog box from which you can manage restrictions to CGI (.exe) or ISAPI (.dll) programs. This action is available only when an item is selected from the list on the feature page.
Remove | Removes the item that is selected from the list on the feature page.
Edit Feature Settings | Opens the Edit ISAPI and CGI Restrictions Settings dialog box from which you can configure settings that apply to the entire ISAPI and CGI restrictions feature.

See Also

  • Configuring ISAPI and CGI Restrictions in IIS 7.0 (online)


Add or Edit ISAPI or CGI Restriction Dialog Box

Use the Add ISAPI or CGI Restriction and Edit ISAPI or CGI Restriction dialog boxes to manage restrictions for CGI (.exe) and ISAPI (.dll) programs.

UI Element List

Element Name | Description
ISAPI or CGI path | Type the physical path to the ISAPI extension or CGI program.
Description | Provide a brief description of the program.
Allow extension path to execute | Select this option to enable this program to run.

See Also

  • Configuring ISAPI and CGI Restrictions in IIS 7.0 (online)


Edit ISAPI and CGI Restrictions Settings Dialog Box

Use the Edit ISAPI and CGI Restrictions Settings dialog box to enable unspecified CGI or ISAPI modules to run. If you leave these settings unchanged, only the CGI or ISAPI modules specifically listed can run on this server.

Caution

Enabling either Allow unspecified CGI modules or Allow unspecified ISAPI modules is a security risk. Your server could become susceptible to computer viruses or worms that exploit CGI or ISAPI technologies. To reduce this risk, you should create specific restrictions for all ISAPI extensions or CGI files that must run on your server.

UI Element List

Element Name | Description
Allow unspecified CGI modules | Enables unspecified CGI modules to run on this server.
Allow unspecified ISAPI modules | Enables unspecified ISAPI modules to run on this server.

See Also

  • Configuring ISAPI and CGI Restrictions in IIS 7.0 (online)


ISAPI Filters

This section contains the following topics:

ISAPI Filters Page

Add or Edit ISAPI Filter Dialog Box


ISAPI Filters Page

Use the ISAPI Filters feature page to manage a list of .dll files that change or enhance the functionality provided by IIS. For example, an ISAPI filter can control which files are mapped to a URL, modify the response sent by the server, or perform other actions to modify the behavior of the server.

Note

ISAPI filters and extensions are being replaced by the new IIS 7.0 modules API. For more information about the IIS 7.0 modules API, see Native-Code HTTP Modules.

Sort the list by clicking one of the feature page column headings or select a value from the Group by drop-down list to group similar items.

UI Element List

The following tables describe the UI elements that are available on the feature page and in the Actions pane.

Feature Page Elements

Element Name | Description
Name | Displays the name of the ISAPI filter.
Executable | Displays the path of the ISAPI filter .dll file, for example, %SystemDrive%\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_filter.dll.
Entry Type | Displays whether the item is local or inherited. Local items are read from the current configuration file, and inherited items are read from a parent configuration file.

Actions Pane Elements

Element Name Description

Add

Opens the Add ISAPI Filter dialog box in which you can add an ISAPI filter.

Edit

Opens the Edit ISAPI Filter dialog box in which you can edit the selected ISAPI filter.

Rename

Enables the Name field of the selected ISAPI Filter so you can rename it.

Remove

Removes the item that is selected from the list on the feature page.

Note

If you are removing an ISAPI filter at the server level, you must restart WWW Service (W3SVC) for the changes to take effect.

Revert to Inherited

Reverts the feature to inherit settings from the parent configuration. This deletes local configuration settings, including items from the list, for this feature. This action is not available at the server level.

View Ordered List

Displays the list in order of configuration. When you select the ordered list format, you can only move items up and down in the list. Other actions in the Actions pane do not appear until you select the unordered list format.

Move Up

Moves a selected item up in the list. This action is available only when viewing items in the ordered list format.

Note

When items in the list are reordered at a child level, the child will no longer inherit settings from the parent level (including any items that are added to or removed from the list at the parent level) after the list is reordered. If you want to inherit settings from a parent level, you must revert all of the changes at the child level by using the Revert to Inherited action in the Actions pane.

Move Down

Moves a selected item down in the list. This action is available only when viewing items in the ordered list format.

Note

When items in the list are reordered at a child level, the child will no longer inherit settings from the parent level (including any items that are added to or removed from the list at the parent level) after the list is reordered. If you want to inherit settings from a parent level, you must revert all of the changes at the child level by using the Revert to Inherited action in the Actions pane.

View Unordered List

Displays the list in an unordered format. When you select the unordered list format, you can sort and group items in the list, and perform actions in the Actions pane.

See Also

  • Configuring ISAPI Filters in IIS 7.0 (online)


Add or Edit ISAPI Filter Dialog Box

Use the Add ISAPI Filter and Edit ISAPI Filter dialog boxes to add or edit a .dll file that changes or enhances the functionality of IIS.

UI Element List

Element Name | Description
Filter name | Type the name of the ISAPI filter.
Executable | Type the path of the ISAPI filter .dll file. For example, %SystemDrive%\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_filter.dll.

See Also

  • Configuring ISAPI Filters in IIS 7.0 (online)


Logging

This section contains the following topics:

Logging Page

W3C Logging Fields Dialog Box


Logging Page

Use the Logging feature page to configure how IIS logs requests made to the Web server and when new log files are created.

UI Element List

The following tables describe the UI elements that are available on the feature page and in the Actions pane.

Feature Page Elements

Element Name Description

One log file per

Specifies whether the Web server maintains one log file for the whole server or one log file for each site on the server.

When you select Site, the settings that you specify on the Logging page at the server level are default values for all sites on your server. You can then open the Logging page at the site level to configure specific settings for a site.

Format

Specifies the format of the log file that is created when a request is logged.

When you configure the Web server to have one log file, you can select one of the following log file formats:

Value Description

Binary

Configures IIS to use the binary centralized logging format. By using this format, IIS creates one log file for all sites on the Web server. Every site writes request hit log information as binary unformatted data to this log file. Because this kind of logging conserves valuable memory and CPU resources, it is appropriate for use in an ISP environment, where Web servers can host many sites, or in any high-traffic situation.

Note

To extract data from this log file format, you must use a tool, such as LogParser 2.2.

W3C

Configures IIS to use the centralized W3C log file format to log information about all sites on the server. This format is handled by HTTP.sys, and is a customizable ASCII text-based format, which means that you specify the fields that are logged. Specify the fields that are logged on the W3C Logging Fields dialog box by clicking Select Fields on the Logging page. Fields are separated by spaces, and time is recorded in Coordinated Universal Time (UTC).

When you configure the Web server to have one log file per site, you can select one of the following log file formats:

Value Description

IIS

Configures IIS to use the Microsoft IIS log file format to log information about a site. This format is handled by HTTP.sys, and is a fixed ASCII text-based format, which means that you cannot customize the fields that are logged. Fields are separated by commas, and time is recorded as local time.

The following list is a list of fields that are logged when you use the IIS log file format:

  • Client IP address

  • User name

  • Date

  • Time

  • Service and instance

  • Server name

  • Server IP address

  • Time taken

  • Client bytes sent

  • Server bytes sent

  • Service status code (A value of 200 indicates that the request was fulfilled successfully.)

  • Windows status code (A value of 0 indicates that the request was fulfilled successfully.)

  • Request type

  • Target of operation

  • Parameters (the parameters that are passed to a script.)

Not all fields will contain data. When a field does not contain data, a hyphen (-) appears as a placeholder. When a field contains a non-printable character, HTTP.sys replaces it with a plus sign (+) to preserve the log file format.

NCSA

Configures IIS to use the National Center for Supercomputing Applications (NCSA) Common log file format to log information about a site. This format is handled by HTTP.sys, and is a fixed ASCII text-based format, which means that you cannot customize the fields that are logged. Fields are separated by spaces, and time is recorded as local time with the Coordinated Universal Time (UTC) offset.

The following list is a list of fields that are logged when you use the NCSA Common log file format:

  • Remote host address

  • Remote log name (This value is always a hyphen.)

  • User name

  • Date, time, and UTC offset

  • Request and protocol version

  • Service status code (A value of 200 indicates that the request was fulfilled successfully.)

  • Bytes sent

Not all fields will contain data. When a field does not contain data, a hyphen (-) appears as a placeholder. When a field contains a non-printable character, HTTP.sys replaces it with a plus sign (+) to preserve the log file format.

W3C

Use the W3C Extended log file format to log information about a site. This format is handled by HTTP.sys, and is a customizable ASCII text-based format, which means that you specify the fields that are logged. Specify the fields that are logged on the W3C Logging Fields dialog box by clicking Select Fields on the Logging page. Fields are separated by spaces, and time is recorded in Coordinated Universal Time (UTC).

Custom

Configures IIS to use a custom format for a custom logging module. When you select this option, the Logging page becomes disabled, because custom logging cannot be configured in IIS Manager.

Select Fields

Opens the W3C Logging Fields dialog box in which you can select which fields to log. This button is available only when the W3C log file format is selected.

Directory

Specifies the physical path where the log file or files are stored. The default value is %SystemDrive%\inetpub\logs\LogFiles.

Encoding

Specifies how the log file or log files are encoded: UTF-8 or ANSI.

Select UTF-8 when you want to enable both single-byte and multibyte characters in one string. This encoding enables you to read text-based logs, for example, W3C Extended, IIS, and National Center for Supercomputing Applications (NCSA) Common formats, in a language other than English. Additionally, if your Web server serves URLs in a language or dialect other than the one supported by the server's default code page, you should enable UTF-8 encoding for log content.

By default, IIS tries to serve URLs in code pages other than the server's default code page. For security reasons, you might want to enable the UTF-8 format to reduce the effect of an attack that could cause UTF-8 URLs not to translate correctly to the default code page.

Schedule

Configures IIS to create new log files based one of the following values:

  • Hourly: a new log file is created each hour.

  • Daily: a new log file is created each day.

  • Weekly: a new log file is created each week.

  • Monthly: a new log file is created each month.

Maximum file size (in bytes)

Configures IIS to create a new log file when the file reaches a certain size (in bytes).

The minimum file size is 1048576 bytes. If this attribute is set to a value less than 1048576 bytes, the default value is implicitly assumed as 1048576 bytes.

Do not create new log files

Configures IIS to not create new log files. This means that there is a single log file that will continue to grow as information is logged.

Use local time for file naming and rollover

Specifies that log file naming and time for log file rollover uses the local server time. When this is not selected, Coordinated Universal Time (UTC) is used.

Note

Regardless of this setting, timestamps in the actual log file will use the time format for the log format that you select from the Format list. For example, NCSA and W3C log file formats use UTC time format for timestamps.

Actions Pane Elements

Element Name | Description
Apply | Saves the changes that you have made on the feature page.
Cancel | Cancels the changes that you have made on the feature page.
Disable | Disables the feature.
View Log Files | Opens the log file directory.

See Also

  • Configuring Logging in IIS 7.0 (online)


W3C Logging Fields Dialog Box

Use the W3C Logging Fields dialog box to select the information that you want to include in log files. This dialog box is available only when you select W3C from the Format drop-down list on the Logging feature page.

UI Element List

Element Name Description

Date (date)

Logs the date on which the request occurred. Selected by default.

Time (time)

Logs the time, in Coordinated Universal Time (UTC), at which the request occurred. Selected by default.

Client IP Address (c-ip)

Logs the IP address of the client that made the request. Selected by default.

User Name (cs-username)

Logs the name of the authenticated user who accessed the server. Anonymous users are indicated by a hyphen. Selected by default.

Service Name (s-sitename)

Logs the Internet service name and instance number that was running on the client at the time that the incident was logged.

Server Name (s-computername)

Logs the name of the server on which the log file entry was generated.

Server IP Address (s-ip)

Logs the IP address of the server on which the log file entry was generated. Selected by default.

Server Port (s-port)

Logs the server port number that is configured for the service. Selected by default.

Method (cs-method)

Logs the HTTP method, such as GET, that is used in the request. Selected by default.

URI Stem (cs-uri-stem)

Logs the Uniform Resource Identifier (URI) that is the target of the action, such as Default.htm. Selected by default.

URI Query (cs-uri-query)

Logs the query, if any, that the client was trying to perform. A URI query is necessary only for dynamic pages. Selected by default.

Protocol Status (sc-status)

Logs the HTTP status code. Selected by default.

Protocol Substatus (sc-substatus)

Logs the HTTP substatus code. Selected by default.

Win32 Status (sc-win32-status)

Logs the Windows status code. Selected by default.

Bytes Sent (sc-bytes)

Logs the number of bytes that the server sent.

Bytes Received (cs-bytes)

Logs the number of bytes that the server received.

Time Taken (time-taken)

Logs the length of time that the action took in milliseconds. Selected by default.

Protocol Version (cs-version)

Logs the protocol version, HTTP or FTP, that the client used.

Host (cs-host)

Logs the host header name, if any.

Note

The host name that you configure for your Web site might appear differently in the log files because HTTP.sys logs host names by using the punycode-encoded format.

User Agent (cs(User-Agent))

Logs the browser from which the request came. Selected by default.

Cookie (cs(Cookie))

Logs the content of the cookie sent or received, if any.

Referer (cs(Referer) )

Logs the site that the user last visited. This site provided a link to the current site.

See Also

  • Configuring Logging in IIS 7.0 (online)


Machine Key Page

Use the Machine Key feature page to configure encryption and decryption keys used to help protect Forms authentication cookie data and page-level view state data. Machine keys are also used to verify out-of-process session state identification.

Note

If you deploy your application in a Web farm, make sure that the configuration files on each server in the Web farm have the same value for the validation key and decryption keys, which are used for hashing and decryption respectively. Otherwise, you cannot guarantee which server will handle successive requests.

UI Element List

The following tables describe the UI elements that are available on the feature page and in the Actions pane.

Feature Page Elements

Element Name Description

Encryption method

Select one of the following options to specify the encryption method the machine key will use:

  • AES - Advanced Encryption Standard (AES) is relatively easy to implement and requires little memory. AES has a key size of 128, 192, or 256 bits. This method uses the same private key to encrypt and decrypt data, whereas a public-key method must use a pair of keys.

  • MD5 - Message Digest 5 (MD5) is used for digital signing of applications, for example, mail messages. This method produces a 128-bit message digest, which is a compressed form of the original data. MD5 can provide some protection against computer viruses and programs that mimic harmless applications but are actually destructive.

  • SHA1 - This is the default setting. SHA1 is considered to be more secure than MD5 because it produces a 160-bit message digest. You should use SHA1 encryption whenever possible.

  • TripleDES - Triple Data Encryption Standard (TripleDES) is a minor variation of Data Encryption Standard (DES). It is three times slower than regular DES but can be more secure because it has a key size of 192 bits. If performance is not your primary consideration, consider using TripleDES.

Decryption method

Select one of the following options to specify the decryption method the machine key will use:

  • Auto - This is the default setting. Auto works with whichever encryption method you specified.

  • AES - Advanced Encryption Standard (AES) is relatively easy to implement and requires little memory. AES has a key size of 128, 192, or 256 bits. This method uses the same private key to encrypt and decrypt data, whereas a public-key method must use a pair of keys.

  • TripleDES - Triple Data Encryption Standard (TripleDES) is a minor variation of DES. It is three times slower than regular DES but can be more secure because it has a key size of 192 bits. If performance is not your primary consideration, consider using TripleDES.

  • DES - Data Encryption Standard (DES) uses a 56-bit key to both encrypt and decrypt data. If your server, site, or application does not require the strongest security, consider using DES.

Validation key

Computes a Message Authentication Code (MAC) to confirm the integrity of the data. This key is appended to either the Forms authentication cookie or the view state for a specific page.

Select one of the following options to specify how the validation key is generated:

  • Automatically generate at runtime: Instructs ASP.NET to generate a random key at runtime.

  • Generate a unique key for each application: Isolates applications from one another by generating a unique key for each application based on the application ID of each application. If your application is deployed in a Web farm, duplicate your application's key across all servers in the farm.

Decryption key

Used to encrypt and decrypt Forms authentication tickets and view state.

Select one of the following options to specify how the decryption key is generated:

  • Automatically generate at runtime: Instructs ASP.NET to generate a random key at runtime.

  • Generate a unique key for each application: Isolates applications from one another by generating a unique key for each application based on the application ID of each application. If your application is deployed in a Web farm, duplicate your application's key across all servers in the farm.

Actions Pane Elements

Element Name | Description
Apply | Saves the changes that you have made on the feature page.
Cancel | Cancels the changes that you have made on the feature page.
Generate Keys | Generates a validation key and a decryption key in the corresponding boxes on the feature page.

See Also

  • Configuring Machine Keys in IIS 7.0 (online)


Management Service

This section contains the following topics:

Management Service Page

Add Allow or Deny Connection Rule Dialog Box


Management Service Page

Use the Management Service feature page to configure the management service for IIS Manager. The management service enables computer and domain administrators to remotely manage a Web server that uses IIS Manager. The service also enables non-administrative users to locally and remotely manage delegated features of sites and applications on a Web server that uses IIS Manager.

Note

Only administrators who use IIS Manager on the local computer can configure the management service.

UI Element List

The following tables describe the UI elements that are available on the feature page and in the Actions pane.

Feature Page Elements

Element Name Description

Enable remote connections

Select this option when you want to enable users to connect remotely to the Web server by using IIS Manager.

Windows credentials only

Select this option when you want to allow only users who have Windows accounts to connect to the Web server.

Windows credentials or IIS Manager credentials

Select this option when you want to allow users who have either Windows accounts or IIS Manager accounts to connect to the Web server.

IP address

Type or select an IPv4 or IPv6 address if you have a specific IP address that you want users to use when they connect to the Web server. When you do not want to specify an IP address, select All Unassigned.

Port

Type the port that you want the connection to use when users connect to the Web server. The default is port 8172.

SSL certificate

Select the certificate that you want to use for the Web server. You can use the Server Certificates feature if you want to add a new certificate.

Log requests to

Select this option if you want the Web server to log information when requestors try to connect to the Web server. Then configure the physical directory where the Web server logs files.

IPv4 Address Restrictions

Displays connection restrictions. Use the Allow and Deny buttons to add restrictions to the list, and the Delete button to delete a selected entry from the IPv4 Address Restrictions list.

Note

These options are available only when you enable remote connections.

Access for unspecified clients

Select Allow or Deny to specify whether to allow or deny requestors who do not match entries in the IPv4 Address Restrictions list. If you configure the management service to deny access for unspecified clients, but do not add any allow rules to the IPv4 Address Restrictions list, clients will be unable to connect to the server by using IIS Manager.

Allow

Opens the Add Allow Connection Rule dialog box from which you can add a rule to allow requestors based on an IPv4 address or a range of IPv4 addresses.

Deny

Opens the Add Deny Connection Rule dialog box from which you can add a rule to deny requestors based on an IPv4 address or a range of IPv4 addresses.

Delete

Deletes the selected entry in the IPv4 Address Restrictions list.

Actions Pane Elements

Element Name | Description
Apply | Saves the changes that you have made on the feature page.
Cancel | Cancels the changes that you have made on the feature page.
Restart | Restarts the management service.
Start | Starts the management service. You must start the management service to connect locally to sites and applications. If you also want to allow remote connections to sites and applications on the Web server, you must additionally enable remote connections.
Stop | Stops the management service. When the management service is stopped, you can configure settings for the management service. However, the service must be started before it can accept connections.

See Also

  • Configuring the Management Service in IIS 7.0 (online)


Add Allow or Deny Connection Rule Dialog Box

Use the Add Allow Connection Rule or Add Deny Connection Rule dialog box to add entries to the IPv4 Address Restrictions list that allow or deny remote connections to the Web server. You can allow or deny remote connections based on a specific IPv4 address or a range of IPv4 addresses.

Note

Only administrators who are using IIS Manager on the local computer can configure the Management Service.

UI Element List

Element Name | Description
Specific IPv4 address | Select this option when you want to allow or deny remote connections from a specific IPv4 address. After you select this option, type the IPv4 address in the corresponding box.
IPv4 address range | Select this option when you want to allow or deny remote connections from a range of IPv4 addresses. After you select this option, type a range of IPv4 addresses in the corresponding box.
Subnet mask | Type a subnet mask for the IPv4 address that you specified in the IPv4 address range box.

See Also

  • Configuring the Management Service in IIS 7.0 (online)


MIME Types

This section contains the following topics:

MIME Types Page

Add or Edit MIME Type Dialog Box


MIME Types Page

Use the MIME Types feature page to manage a list of Multipurpose Internet Mail Extensions (MIME) types so you can identify the types of content that can be served from a Web server to a browser or a mail client.

Sort the list by clicking one of the feature page column headings or select a value from the Group by drop-down list to group similar items.

UI Element List

The following tables describe the UI elements that are available on the feature page and in the Actions pane.

Feature Page Elements

Element Name | Description
Extension | Displays the file name extension, for example, .chm.
MIME Type | Displays the MIME type, for example, application/octet-stream.
Entry Type | Displays whether the item is local or inherited. Local items are read from the current configuration file, and inherited items are read from a parent configuration file.

Actions Pane Elements

Element Name | Description
Add | Opens the Add MIME Type dialog box from which you can add a MIME type.
Edit | Opens the Edit MIME Type dialog box from which you can edit the selected MIME type.
Remove | Removes the item that is selected from the list on the feature page.

See Also

  • Configuring MIME Types in IIS 7.0 (online)


Add or Edit MIME Type Dialog Box

Use the Add MIME Type and Edit MIME Type dialog boxes to create and edit Multipurpose Internet Mail Extensions (MIME) types. MIME types help clients handle new file name extensions appropriately. If IIS does not recognize the file name extension requested by the client, IIS sends the content as the default MIME type, which is Application. This MIME type signifies that the file contains application data, and it usually means that clients cannot process the file.

UI Element List

Element Name | Description
Extension | Type a file name extension. This is a static file name extension, for example, .chm.
MIME Type | Type a MIME type, for example, application/octet-stream.

See Also

  • Configuring MIME Types in IIS 7.0 (online)


Modules

This section contains the following topics:

Modules Page

Add or Edit Managed Module Dialog Box

Configure Native Modules Dialog Box

Register Native Module or Edit Native Module Registration Dialog Box


Modules Page

Use the Modules feature page to manage a list of native and managed code modules that perform specific tasks in the request-processing pipeline, such as authentication or compression.

Sort the list by clicking one of the feature page column headings or select a value from the Group by drop-down list to group similar items.

UI Element List

The following tables describe the UI elements that are available on the feature page and in the Actions pane.

Feature Page Elements

Element Name | Description
Name | Displays the name of the module.
Code | Displays the physical path of the native code file (.dll) or of the type in the managed library.
Module Type | Displays whether the module is implemented with native code or managed code. The value is either Native or Managed.
Entry Type | Displays whether the item is local or inherited. Local items are read from the current configuration file, and inherited items are read from a parent configuration file.

Actions Pane Elements

Element Name Description

Add Managed Module

Opens the Add Managed Module dialog box from which you can add a managed module.

Configure Native Module

Opens the Configure Native Module dialog box from which you can enable native modules by adding them to the list of modules. At the server level, you can also register, edit registration, and remove registration for native modules.

Edit

Opens the Edit Managed Module or Edit Native Module Registration dialog box from which you can edit the selected module.

Note

The ability to edit the registration of a native module is available only at the server level.

Lock

Locks the module so it cannot be overridden at lower levels in configuration.

Note

This action is available only at the server level.

Unlock

Unlocks the module so it can be overridden at lower levels in configuration.

Note

This action is available only at the server level.

Remove

Removes the item that is selected from the list on the feature page. When a managed module is selected, the module is removed from the Web server. When a native module is selected, the module is removed from the list of modules, which disables the module. However, it is still registered on the Web server. To remove the registration of a native module, click Configure Native Modules, select a module, and then click Remove.

Note

The ability to remove the registration of a native module is available only at the server level.

You can remove more than one module at a time by pressing the CTRL key when selecting each module that you want to remove.

Revert to Inherited

Reverts the feature to inherit settings from the parent configuration. This deletes local configuration settings, including items from the list, for this feature. This action is not available at the server level.

View Ordered List

Displays the list in order of configuration. When you select the ordered list format, you can only move items up and down in the list. Other actions in the Actions pane do not appear until you select the unordered list format.

Move Up

Moves a selected item up in the list. This action is available only when viewing items in the ordered list format.

Note

When items in the list are reordered at a child level, the child will no longer inherit settings from the parent level (including any items that are added to or removed from the list at the parent level) after the list is reordered. If you want to inherit settings from a parent level, you must revert all of the changes at the child level by using the Revert to Inherited action in the Actions pane.

Move Down

Moves a selected item down in the list. This action is available only when viewing items in the ordered list format.

Note

When items in the list are reordered at a child level, the child will no longer inherit settings from the parent level (including any items that are added to or removed from the list at the parent level) after the list is reordered. If you want to inherit settings from a parent level, you must revert all of the changes at the child level by using the Revert to Inherited action in the Actions pane.

View Unordered List

Displays the list in an unordered format. When you select the unordered list format, you can sort and group items in the list, and perform actions in the Actions pane.

See Also

  • Configuring Modules in IIS 7.0 (online)


Add or Edit Managed Module Dialog Box

Use the Add Managed Module and Edit Managed Module dialog boxes to add or edit managed modules that process requests made to the Web server. IIS includes several managed modules to process parts of requests, such as the FormsAuthentication module that performs authentication for users in applications that use Forms authentication.

UI Element List

Element Name | Description
Name | Type a friendly name for the managed module.
Type | Select or type the managed type for the module, such as System.Web.Security.FormsAuthentication. When you add a managed module, make sure that the assembly to which the class belongs is registered in the system.web/compilation section of your Web.config file. Otherwise you must type the assembly qualified class name of the managed module. If the class is defined in the App_Code or bin directory you can specify just the class name.
Invoke only for requests to ASP.NET applications or managed handlers | Select this check box if you want the managed module to process only requests made to ASP.NET applications or managed handlers. When you select this option, the module will not be invoked for requests to other types of content, such as HTML files.

See Also

  • Configuring Modules in IIS 7.0 (online)


Configure Native Modules Dialog Box

Use the Configure Native Modules dialog box to enable registered modules by adding them to the Modules list, add or edit registration for native modules, or remove native modules from the Web server. After you register a module, you must also add it to the Modules list in order for the native module to start processing requests.

UI Element List

Element Name Description

Select one or more registered modules to enable

Select the registered module or modules that you want to add to the Modules list on the Web server. Adding a module to the Modules list will enable the module to process requests that are made to the server.

Register

Opens the Register Native Module dialog box from which you can register a new native module.

Note

This button is available only at the server level.

Edit

Opens the Edit Native Module Registration dialog box from which you can edit a registered native module. This button is available only when a registered module is selected from the Select one or more registered modules to enable list.

Note

This button is available only at the server level.

Remove

Removes the selected module's registration from the Web server. This button is available only at the server level, and only when a registered module is selected from the Select one or more registered modules to enable list.

Note

When you remove a module from the list on the Modules feature page, the module is disabled but it is still registered on the Web server.

See Also

  • Configuring Modules in IIS 7.0 (online)


Register Native Module or Edit Native Module Registration Dialog Box

Use the Register Native Module and Edit Native Module Registration dialog boxes to add or edit native modules that process requests made to the Web server. IIS includes many native modules to process parts of requests, such as the BasicAuthenticationModule module that performs authentication for users in applications that use Basic authentication.

Note

After you register a native module from this dialog box, you must also add it to the Modules list on the Web server before the module can process requests; you can do this from the Add Native Module dialog box as soon as either the Add Native Module or the Edit Native Module Registration dialog box is closed.

UI Element List

Element Name | Description
Name | Type a friendly name for the native module.
Path | Type the path of the native module file on the physical file system, such as C:\Modules\MyModule.dll, or click the browse button (…) to browse for the file.

See Also

  • Configuring Modules in IIS 7.0 (online)


Output Caching

This section contains the following topics:

Output Caching Page

Add or Edit Output Cache Rule Dialog Box

Edit Output Cache Settings Dialog Box

Advanced Output Caching Settings Dialog Box


Output Caching Page

Use the Output Caching feature page to configure output caching settings and to configure rules that control caching of served content.

Sort the list by clicking one of the feature page column headings or select a value from the Group by drop-down list to group similar items.

UI Element List

The following tables describe the UI elements that are available on the feature page and in the Actions pane.

Feature Page Elements

Element Name Description

Extension

Displays the file name extension for which the caching rule applies.

User-Mode Policy

Displays the user-mode caching behavior for the rule:

  • Cache until change: content is cached until IIS receives a file or configuration change notification.

  • Cache for time period: content is cached for a specific duration unless a file or configuration change notification clears the cache before the duration elapses.

  • Prevent all caching: user-mode caching has been disabled.

  • Do not cache: user-mode caching has not been configured.

Kernel-Mode Policy

Displays the kernel-mode caching behavior for the rule:

  • Cache until change: content is cached until IIS receives a file or configuration change notification.

  • Cache for time period: content is cached for a specific duration unless a file or configuration change notification clears the cache before the duration elapses.

  • Prevent all caching: kernel-mode caching has been disabled.

  • Do not cache: kernel-mode caching has not been configured.

Entry Type

Displays whether the item is local or inherited. Local items are read from the current configuration file, and inherited items are read from a parent configuration file.

Actions Pane Elements

Element Name | Description
Add | Opens the Add Cache Rule dialog box in which you can add a new cache rule.
Edit | Opens the Edit Cache Rule dialog box in which you can edit the selected cache rule.
Remove | Removes the selected caching rule.
Edit Feature Settings | Opens the Edit Output Cache Settings dialog box in which you can configure settings that apply to the entire output caching feature.

See Also

  • Configuring Output Caching in IIS 7.0 (online)


Add or Edit Output Cache Rule Dialog Box

Use the Add Cache Rule or Edit Cache Rule dialog box to configure how IIS caches content for a specific file name extension. You can configure settings for both user-mode and kernel-mode caching.

UI Element List

Element Name Description

File name extension

Specifies the file name extension (such as .aspx) to which the caching rule applies. To apply the rule to all file name extensions, type an asterisk (*) in the box.

User-mode caching

Configures the rule to store content in the output cache, which is in user mode. Select an option under File Cache Monitoring to configure how or when the output cache is updated for any files that are cached because of this rule.

Using file change notifications (under the User-mode caching option)

Configures the files (that are cached because of this rule) to be removed from the output cache when IIS receives a file or configuration change notification.

At time intervals (hh:mm:ss) (under the User-mode caching option)

Configures the files (that are cached because of this rule) to be removed from the output cache after a specific duration unless a file or configuration change notification clears the cache before the duration elapses.

The value in the corresponding box specifies the length of time that content is stored in the output cache. The time is formatted as hh:mm:ss (where hh is hours, mm is minutes, and ss is seconds). The default duration is 30 seconds. Setting the value too low may affect server performance by forcing items to be updated more frequently than necessary.

Note

When you select both user-mode caching and kernel-mode caching, and configure each mode to use the At time intervals (hh:mm:ss) option, you must specify the same duration value for both modes. If the values are not the same, the duration that is specified for kernel-mode caching will be used.

Prevent all caching

Configures the files (that match the file name extension) not to be stored in the output cache.

This setting corresponds to the DisableCache setting in configuration, and differs from the DontCache setting that appears in configuration when you do not select the User-mode caching option in IIS Manager. The DontCache setting means that the output cache module does not set the user-mode caching policy, but if another module sets the caching policy, the output cache module will cache the response. The DisableCache setting means that the output cache will not cache the response even when another module tries to enable user-mode caching by setting the user-mode caching policy.

Advanced

Opens the Advanced Output Caching Settings dialog box in which you can configure the cache rule to cache different versions of a response based on query strings and headers. These options are available only for user-mode caching.

Kernel-mode caching

Configures the rule to store content in the kernel cache, which is in kernel mode. Select an option under File Cache Monitoring to configure how or when the kernel cache is updated for any files that are cached because of this rule.

Using file change notifications (under the Kernel-mode caching option)

Configures the files (that are cached because of this rule) to be removed from the kernel cache when IIS receives a file or configuration change notification.

At time intervals (hh:mm:ss) notifications (under the Kernel-mode caching option)

Configures the files (that are cached because of this rule) to be removed from the kernel cache after a specified time elapses.

The value in the corresponding box specifies the length of time that content is stored in the kernel cache. The time is formatted as hh:mm:ss (where hh is hours, mm is minutes, and ss is seconds). The default duration is 30 seconds. Setting the value too low may affect server performance by forcing items to be updated more frequently than necessary.

Note

When you select both user-mode caching and kernel-mode caching, and configure each mode to use the At time intervals (hh:mm:ss) option, you must specify the same duration value for both modes. If the values are not the same, the duration that is specified for kernel-mode caching will be used.

Prevent all caching notifications (under the Kernel-mode caching option)

Configures the files (that match the file name extension) not to be stored in the kernel cache.

This setting corresponds to the DisableCache setting in configuration, and differs from the DontCache setting that appears in configuration when you do not select the Kernel-mode caching option in IIS Manager. The DontCache setting means that the output cache module does not set the kernel-mode caching policy, but if another module sets the caching policy, the output cache module will cache the response. The DisableCache setting means that the kernel cache will not cache the response even when another module tries to enable kernel-mode caching by setting the kernel-mode caching policy.

See Also

  • Configuring Output Caching in IIS 7.0 (online)


Edit Output Cache Settings Dialog Box

Use the Edit Output Cache Settings dialog box to configure settings that affect the entire Output Caching feature. These settings affect all the output caching rules that you configure on the Output Caching feature page.

UI Element List

Element Name Description

Enable cache

Enables the IIS output cache, which stores cached responses in user mode.

Note

The IIS output cache is similar to the ASP.NET output cache. However, this IIS cache is a native output cache that offers increased performance over the managed output cache in ASP.NET.

Enable kernel cache

Enables the kernel cache, which stores cached responses in kernel mode. Performance is improved when responses are returned from the kernel cache without transitioning to user mode.

Maximum cached response size (in bytes)

Specifies the maximum size of a cached response for both the user-mode and kernel-mode caches. The default value is 262144 bytes. This field is enabled at the server level only; it is read-only at all other levels.

Cache size limit (in MB)

Configures the size limit of both the user-mode and kernel-mode caches. You can type a size (in MB) or type 0. If you type 0, IIS uses half of the available physical memory or virtual memory, whichever is less. This field is enabled at the server level only; it is read-only at all other levels.

See Also

  • Configuring Output Caching in IIS 7.0 (online)


Advanced Output Caching Settings Dialog Box

Use the Advanced Output Caching Settings dialog box to configure caching of different file versions based on query strings and headers. These settings are available only for the user-mode cache.

UI Element List

Element Name | Description
Query string | Type a query string or a comma-separated list of query strings to define the values that the Web server uses to vary cached responses to the URL. You can also type an asterisk (*) to configure the rule to vary cached responses for all query strings.
Headers | Type a header or comma-separated list of headers to define the values that the Web server uses to vary cached responses to the URL. You can also type an asterisk (*) to configure the rule to vary cached responses for all headers.

See Also

  • Configuring Output Caching in IIS 7.0 (online)


Pages and Controls

This section contains the following topics:

Pages and Controls Page

Controls Page

Add or Edit Custom Control Dialog Box and Add or Edit User Control Dialog Box


Pages and Controls Page

Use the Pages and Controls feature page to configure the settings of ASP.NET pages and controls. These settings control the behavior of ASP.NET pages, set how ASP.NET pages and controls will be compiled on the server, define the namespaces that are included for each page, and define the session state and validation services settings.

Use the Display list to select one of the following options that specifies how the settings are displayed: Friendly Names, Configuration Names, or Both Names.

UI Element List

The following tables describe the UI elements that are available on the feature page and in the Actions pane.

Feature Page Elements

Element Name | Description
Buffer [buffer] | Sets a value (true or false) that specifies whether .aspx pages and .ascx controls use response buffering. The default setting is True.
Master Page File [masterPageFile] | Specifies the master page path relative to the local configuration file.
Style Sheet Theme [styleSheetTheme] | Specifies the name of the "named theme" folder that will be used to apply the theme before control declarations. This differs from the theme attribute, which defines the theme to apply after the control declarations.
Theme [theme] | Specifies the name of the theme that is used for the pages that are in the scope of the configuration file. The specified theme must exist as either an application or a global theme. If the theme does not exist, an HttpException exception is thrown.
Enable Authenticated View State [enableViewStateMAC] | Sets a value (true or false) that specifies whether ASP.NET should run a message authentication code (MAC) on the page's view state when the page is posted back from the client. The default setting is True.
Enable View State [enableViewState] | Sets a value (true or false) that indicates whether view state is enabled, disabled, or read only. The default setting is True.
Maximum Page State Field Length [maxPageStateFieldLength] | Sets the maximum number of characters that a single view-state field can contain.
Base Type for Pages [pageBaseType] | Specifies the base type to use when the pages are stand-alone only. This is overridden by the inherits attribute in a stand-alone file.
Base Type for User Controls [userControlBaseType] | Specifies a code-behind class that user controls inherit by default.
Compilation Mode [compilationMode] | Specifies whether an ASP.NET page or control should be compiled at run time.
Namespaces [namespaces] | Defines a collection of import directives to use during assembly pre-compilation.
Enable Session State [enableSessionState] | Sets a value (true or false) that specifies whether the session state is enabled, disabled, or read-only. The default setting is True.
Validate Request [validateRequest] | Sets a value (true or false) that determines whether ASP.NET examines input from the browser for dangerous values. The default setting is True.

Actions Pane Elements

Element Name | Description
Apply | Saves the changes that you have made on the feature page.
Cancel | Cancels the changes that you have made on the feature page.
Register Controls | Opens the Controls feature page from which you can add and edit custom controls.

See Also

  • Configuring Pages and Controls in IIS 7.0 (online)


Controls Page

Use the Controls feature page to manage a list of user controls and custom controls.

Note

User controls are not available at the server level in IIS Manager.

Sort the list by clicking one of the feature page column headings or select a value from the Group by drop-down list to group similar items.

UI Element List

The following tables describe the UI elements that are available on the feature page and in the Actions pane.

Feature Page Elements

Element Name | Description
Tag | For custom controls, displays the tag prefix assigned to the control. For user controls, displays the tag prefix and tag name for the user control.
Source or Assembly | Displays the user control path or assembly name in which the custom control type is defined.
Entry Type | Displays whether the item is local or inherited. Local items are read from the current configuration file, and inherited items are read from a parent configuration file.

Actions Pane Elements

Element Name Description

Add Custom Control

Opens the Add Custom Control dialog box in which you can add a custom control.

Add User Control

Opens the Add User Control dialog box in which you can add a user control. This action is not available at the server level.

Edit

When a custom control is selected, this action opens the Edit Custom Control dialog box in which you can edit the custom control.

When a user control is selected, this action opens the Edit User Control dialog box in which you can edit the user control. You cannot edit a user control at the server level.

Remove

Removes the item that is selected from the list on the feature page.

See Also

  • Configuring Pages and Controls in IIS 7.0 (online)


Add or Edit Custom Control Dialog Box and Add or Edit User Control Dialog Box

Use the Add Custom Control and Edit Custom Control dialog boxes to specify or edit the tag prefix/namespace mapping for a custom control that will be used in multiple pages in an application. Use the Add User Control and Edit User Control dialog boxes to configure user controls, which are containers into which you can put markup and Web server controls.

For more information about user and custom controls, see ASP.NET User Controls Overview.

UI Element List

Element Name | Description
Tag prefix | Sets the tag prefix assigned to the control, for example, <aspSample: …>
Namespace | Defines the namespace to which the custom control belongs. This is the same namespace that was specified in the application code. This box is available only for custom controls.
Assembly | Sets the assembly name in which the custom control type is defined. This box is available only for custom controls.
Tag Name | Specifies the tag name of the user control. This box is available only for user controls.
User Control (.ascx) Path | Specifies the file path of the user control. This box is available only for user controls.

See Also

  • Configuring Pages and Controls in IIS 7.0 (online)


Providers

This section contains the following topics:

Providers Page

Add or Edit Provider Dialog Box


Providers Page

Use the Providers feature page to manage a list of providers.

Sort the list by clicking one of the feature page column headings or select a value from the Group by drop-down list to group similar items.

UI Element List

The following tables describe the UI elements that are available on the feature page and in the Actions pane.

Feature Page Elements

Element Name | Description
Feature | Select a feature from the list to display providers for that feature: .NET Roles, .NET Users, and .NET Profile.
Name | Displays the name of the provider. This is a friendly name that is assigned to the provider for easy identification and recognition.
Type | Displays the managed code type for the provider. All providers are implemented in managed code.
Entry Type | Displays whether the item is local or inherited. Local items are read from the current configuration file, and inherited items are read from a parent configuration file.

Actions Pane Elements

Element Name | Description
Add | Opens the Add Provider dialog box in which you can add a provider for the selected feature.
Edit | Opens the Edit Provider dialog box in which you can edit the selected provider.
Rename | Enables the Name field of the selected provider so that you can rename the provider.
Remove | Removes the item that is selected from the list on the feature page.
Connection Strings | Opens the Connection Strings feature page from which you can add a connection string that can be used by a provider.

See Also

  • Configuring Providers in IIS 7.0 (online)


Add or Edit Provider Dialog Box

Use the Add Provider and Edit Provider dialog boxes to add or modify a provider in IIS when you have an application that uses a provider-based service to store data in a database or other data store. The properties that are displayed in the dialog box depend on which type of provider you choose to add or edit.

The 3 different types of providers you can add or edit are:

  • Roles - provides an interface between the ASP.NET role management service (the "role manager") and role data sources.

  • Users - provides an interface between the ASP.NET membership service and membership data sources.

  • Profile - provides an interface between the ASP.NET profile service and profile data sources.

Note

The Add Provider and Edit Provider dialog boxes enable you to add or edit most of the properties for a provider, but not all of them. You can configure additional properties for each provider in the Web.config file of your Web application. For more information about providers see ASP.NET 2.0 Provider Model: Introduction to the Provider Model.

UI Element List

Element Name Description

Type

Sets the provider type.

Name

Defines the name of the provider.

Behavior

Sets some of the behaviors for Membership User providers. Setting the value of one or more of the following behaviors to True enables that behavior:

  • EnablePasswordReset - indicates whether passwords can be reset using the provider's ResetPassword method. The default setting is False.

  • EnablePasswordRetrieval - indicates whether passwords can be retrieved using the provider's GetPassword method. The default setting is False.

  • RequiresQuestionAndAnswer - indicates whether a password answer must be supplied when calling the provider's GetPassword and ResetPassword methods. The default setting is False.

  • RequiresUniqueEmail - indicates whether each registered user must have a unique e-mail address. The default setting is False.

  • StorePasswordInSecureFormat - indicates whether passwords should be hashed. The default setting is False.

Data

Configures the name of the connection string used to connect to the database. Enter the name of the connection string in the ConnectionStringName check box.

General

Defines general settings for the provider. These settings are optional and include:

  • ApplicationName - specifies the virtual path of the application in the ApplicationName box. If you do not specify a value in the ApplicationName box, the membership API defaults to HttpContext.Current.Request.ApplicationPath. This can be determined only at runtime.

  • Description - gives a description of the provider.

Misc

Enables you configure name and value pairs that are specific to the provider. To add and remove name and value pairs, click the … button next to the Provider Specific Settings field in the Misc section.

See Also

  • Configuring Providers in IIS 7.0 (online)


Server Certificates

This section contains the following topics:

Server Certificates Page

Request Certificate Wizard and Create Certificate Wizard - Distinguished Name Properties

Request Certificate Wizard - Cryptographic Service Provider Properties

Request Certificate Wizard - File Name

Create Certificate Wizard - Online Certification Authority

Complete Certificate Request Dialog Box

Select Certification Authority Dialog Box

Create Self-Signed Certificate Dialog Box

Export Certificate Dialog Box

Import Certificate Dialog Box

Renew an Existing Certificate Wizard Page


Server Certificates Page

Use the Server Certificates feature page to view the names of certificates, the fully qualified domain names (FQDNs) of hosts to which certificates have been issued, and the FQDNs of the servers that issued the certificates.

UI Element List

The following tables describe the UI elements that are available on the feature page and in the Actions pane.

Feature Page Elements

Element Name Description

Name

Displays the names of certificates that have been issued to clients that are running on either Internet or intranet hosts.

Note

Certificates are not required to have names. You may have to view other columns to obtain information about certificates.

Issued To

Displays the FQDNs of either the Internet or intranet hosts to which certificates have been issued.

Issued By

Displays the FQDNs of servers that have issued certificates to clients that are running on either Internet or intranet hosts.

Expiration Date

Displays the date that the certificate expires.

Certificate Hash

Displays binary data produced by using a hashing algorithm. Although this data uniquely identifies a certificate, the hash data cannot be used to trace a certificate because hashing is a one-way process.

Actions Pane Elements

Element Name | Description
Import | Opens the Import Certificate dialog box to restore a lost or damaged certificate that you previously backed up, or to install a certificate sent to you by another user or certification authority (CA).
Create Certificate Request | Opens the Distinguished Name Properties Wizard page to provide information about your organization to an external certification authority.
Complete Certificate Request | Opens the Complete Certificate Request dialog box to install the certificates that you receive from your certification authority.
Create Domain Certificate | Opens the Distinguished Name Properties Wizard page to provide information about your organization to an internal certification authority.
Create Self-Signed Certificate | Opens the Create Self-Signed Certificate dialog box to create certificates to use in server testing environments and for troubleshooting third-party certificates.
View | Opens the Certificate dialog box so that you can view details about a certificate. You must select a certificate to see this option.
Export | Opens the Export Certificate dialog box to export certificates from a source server when you want to apply the same certificate to a target server, or when you want to back up a certificate and its associated private key. You must select a certificate to see this option.
Remove | Removes the item that is selected from the list on the feature page. You must select a certificate to see this option.

See Also

  • Configuring Server Certificates in IIS 7.0 (online)


Request Certificate Wizard and Create Certificate Wizard - Distinguished Name Properties

Use the Distinguished Name Properties Wizard page to provide information about your organization to an internal or external certification authority.

UI Element List

Element Name | Description
Common name | Type a name for the certificate.
Organization | Type the name of the organization for which the certificate will be used.
Organizational unit | Type the name of the department or division in the organization in which the certificate will be used.
City/locality | Type the unabbreviated name of the city or locality where your organization or organizational unit is located.
State/province | Type the unabbreviated name of the state or province where your organization or organizational unit is located.
Country/region | Type the name of the country or region where your organization or organizational unit is located.

See Also

  • Configuring Server Certificates in IIS 7.0 (online)


Request Certificate Wizard - Cryptographic Service Provider Properties

Use the Cryptographic Service Provider Wizard page to select either Microsoft RSA SChannel Cryptographic Provider or Microsoft DH SChannel Cryptographic Provider to provide certificates that can encrypt transmissions between your server and clients. Additionally, you can adjust the level of security for your transmission by changing the bit length associated with the cryptographic service provider.

UI Element List

Element Name Description

Cryptographic service provider

Select either Microsoft RSA SChannel Cryptographic Provider or Microsoft DH SChannel Cryptographic Provider. The default cryptographic service provider is Microsoft RSA SChannel Cryptographic Provider.

Note

Select Microsoft DH SChannel Cryptographic Provider when you must exchange a secret key over a network that is not secure and you have had no prior communication with the other party.

Bit length

Select a bit length that the provider you selected will use. By default, the RSA SChannel provider uses a bit length of 1024, and the DH SChannel provider uses a bit length of 512.

Note

A longer bit length increases the level of encryption. However, it can decrease performance because it requires the transmission of additional bits.

See Also

  • Configuring Server Certificates in IIS 7.0 (online)


Request Certificate Wizard - File Name

Use the File Name Wizard page to name and then save your certificates to the appropriate storage location.

UI Element List

Element Name | Description
Specify a file name for certificate request | Type a file name in the Specify a file name for the certificate request field.
… | Navigate to a file name under which to store the certificate.

See Also

  • Configuring Server Certificates in IIS 7.0 (online)


Create Certificate Wizard - Online Certification Authority

Use the Online Certification Authority Wizard page to identify an online certification authority (CA) server in your Windows domain. Additionally, you must supply the CA server that you want to use with a Friendly name to complete the Create Domain Certificate Wizard.

UI Element List

Element Name Description

Specify Online Certification Authority

Type the path of a CA server that is in your Windows domain, or click Select to search for a CA server that is in your domain.

Note

Domain certificates are not appropriate for use with external clients that are not members of your internal Windows domain.

Friendly name

Type a name for the CA server that you want to use in the Friendly name box. You must type a name in the Friendly name box to complete the Create Domain Certificate Wizard.

See Also

  • Configuring Server Certificates in IIS 7.0 (online)


Complete Certificate Request Dialog Box

Use the Complete Certificate Request dialog box to install the certificates that you receive from your certification authority (CA). Additionally, you must provide a Friendly name for the certificate that you want to install to complete the certificate installation process.

UI Element List

Element Name Description

File name containing certification authority's response

Type the path of the file that contains the response from the certification authority in the File name containing certification authority's response box, or click Browse to navigate to the location in which the file from the certification authority is stored.

Important

You must complete this process to install a certificate on your server.

Friendly name

Type a name in the Friendly name box to complete the certificate installation process.

See Also

  • Configuring Server Certificates in IIS 7.0 (online)


Select Certification Authority Dialog Box

Use the Select Certification Authority dialog box to select the internal certification authority (CA) that you want to use.

UI Element List

Element Name | Description
Select a certification authority you want to use | Lists the friendly names of CA and the fully qualified domain name (FQDN) of the computer that hosts the CA. Select the CA that you want to use.

See Also

  • Configuring Certificates in IIS 7.0 (online)


Create Self-Signed Certificate Dialog Box

Use the Create Self-Signed Certificate dialog box to create certificates to use in server testing environments and for troubleshooting third-party certificates.

You can view the properties of your self-signed certificate on the Server Certificates Page.

UI Element List

Element Name Description

Specify a friendly name for the certificate

Type a friendly name in the Name box to create a self-signed certificate.

Note

The certificates you create with this feature are not from a trusted certification authority (CA) source. Therefore, you should use self-signed certificates only to help secure data transmissions between your server and clients inside a test environment.

See Also

  • Configuring Server Certificates in IIS 7.0 (online)


Export Certificate Dialog Box

Use the Export Certificate dialog box to export certificates from a source server when you want to apply the same certificate to a target server, or when you want to back up a certificate and its associated private key.

Note

If you associate a password with the certificate, whoever imports the certificate must know the password before the certificate can be applied to the target server.

UI Element List

Element Name | Description
Export to | Type a file name in the Export to box or click Browse to navigate to the name of a file in which to store the certificate for exporting.
Password | Type a password in the Password box if you want to associate a password with the exported certificate.
Confirm password | Retype the password in the Confirm password box and then click OK.

See Also

  • Configuring Server Certificates in IIS 7.0 (online)


Import Certificate Dialog Box

Use the Import Certificate dialog box to restore a lost or damaged certificate that you previously backed up, or to install a certificate sent to you by another user or certification authority (CA).

UI Element List

Element Name | Description
Certificate file (.pfx) | Type a file name in the Certificate file (.pfx) box or click Browse to navigate to the name of a file where the exported certificate is stored.
Password | Type the password in the Password field, if the certificate was exported with a password.
Allow this certificate to be exported | Select Allow this certificate to be exported if you want to be able to export the certificate, or clear Allow this certificate to be exported if you do not want to allow additional exports of this certificate.

See Also

  • Configuring Server Certificates in IIS 7.0 (online)


Renew an Existing Certificate Wizard Page

Use the Renew an Existing Certificate Wizard to renew a certificate that has expired or is about to expire.

UI Element List

Element Name | Description
Renew an existing certificate | Select this option to renew an existing certificate from an internal certification authority (CA) on your domain.
Create a renewal certificate request | Select this option to package your renewal information for later submission to a CA.
Complete certificate renewal request | Select this option to complete the certificate renewal request with the certificate you received from a CA.

See Also

  • Configuring Server Certificates in IIS 7.0 (online)


Session State Page

Use the Session State feature page to configure the behavior of information maintained across browser sessions.

UI Element List

The following tables describe the UI elements that are available on the feature page and in the Actions pane.

Feature Page Elements

Element Name Description

Not enabled

Disables session state.

In process

Stores session state data for a managed-code application in the worker process where the application runs. This is the default setting.

Custom

Configures IIS to use a custom provider to handle session state for ASP.NET applications.

State Server

Enables the Windows Aspnet_state.exe state service and stores session state outside the worker process where the application runs. The advantage of this configuration is that session state is preserved when the application's worker process recycles. Using a state server is recommended for medium-sized Web applications. The settings to configure are:

  • Connection string - sets the connection string that is used to connect to the state server.

  • Time-out (in seconds) - sets the time, in seconds, that the connection will be maintained. The default is 10 seconds.

Important

The Windows state service (Aspnet_state.exe) must be running for out-of-process session state to take effect. By default, this service is installed when ASP.NET is installed and is configured for manual start. You must change the start behavior to Automatic.

SQL Server

Configures IIS to use a SQL Server database to store session state data instead of storing it in the worker process where the application runs. The advantage of this configuration is that session state is preserved when the application's worker process recycles, or if either the Windows state service or the Web server goes down. The settings to configure are:

  • Connection string - sets the connection string that is used to connect to the state server.

  • Time-out (in seconds) - sets the time, in seconds, that the connection will be maintained. The default is 10 seconds.

Important

Before you configure a SQL Server for session state, you must run the InstallSqlState.sql script on the server. By default, this script is stored in systemroot\Microsoft.NET\Framework\V2.0.50727.

Enable custom database

Enables a custom SQL Server database for storing session state data.

Mode

Defines how cookies are used to store session state data. The options are:

  • Auto Detect - uses cookies if the browser supports cookies; otherwise, no cookies are used. For desktop browsers that are known to support cookies, ASP.NET tries to use cookies when cookie support is enabled in the browser. When you use the Auto-Detect cookie mode, you should require that expired session IDs be regenerated. Doing this lets a Web server expire and regenerate tokens, which gives a potential attacker less time to capture a cookie and gain access to Web server content. You should also consider changing the time-out value to less than the 20-minute default.

  • Use Cookies - associates session information with client information for the duration of a user's connection to a Web site. Cookies are passed on together with all requests between a client and a Web server in an HTTP header. Using cookies is a more efficient way to track session state than any of the methods that do not use cookies, because cookies do not require any redirection. Additionally, cookies let users bookmark Web pages, and they retain state if a user leaves one site to visit another and then returns to the original site.

Note

You should consider changing the time-out value to less than the 20-minute default so a potential attacker has less time to capture a cookie and gain access to Web site content.

  • Use Device Profile - uses cookies if the device profile supports cookies, otherwise, no cookies are used. If the device profile indicates support for cookies, they will be used regardless of whether the user has disabled cookie support. When you use the Use Device Profile cookie mode, you should require that expired session IDs be regenerated. Doing this lets a Web server expire and regenerate tokens, which gives a potential attacker less time to capture a cookie and gain access to Web server content. You should also consider changing the time-out value to less than the 20-minute default.

  • Use URI - embeds the session ID as a query string in the Uniform Resource Identifier (URI) request, and then the URI is redirected to the originally requested URL. The changed URI request is used for the duration of the session, so no cookie is necessary. When you use a URI, you should require that expired session IDs be regenerated. Doing this lets a Web server expire and regenerate tokens, which gives a potential attacker less time to capture a cookie and gain access to Web server content.

Name

Sets a name for the cookie. The default is ASP.NET_SessionID.

Time-out (in minutes)

Sets the time, in minutes, that a cookie will persist. The default is 20 minutes.

Regenerate expired session ID

Tells IIS to reject and reissue session IDs that do not have corresponding sessions active in the database. By default, this feature is supported only for cookieless session IDs, but this feature can be extended in order to manage cookie/arbitrary session IDs by implementing a custom session ID manager.

Use hosting identity for impersonation

Enables Windows authentication and the host process identity (either ASP.NET or a Windows service identity) for remote connections.

Actions Pane Elements

Element Name | Description
Apply | Saves the changes that you have made on the feature page.
Cancel | Cancels the changes that you have made on the feature page.

See Also

  • Configuring Session State in IIS 7.0 (online)


Shared Configuration

This section contains the following topics:

Shared Configuration Page

Export Configuration Dialog Box

Set Credentials Dialog Box - Shared Configuration Feature

Encryption Keys Password Dialog Box


Shared Configuration Page

Use the Shared Configuration feature page to share IIS configuration files and encryption keys between one or more IIS servers. You can also use this page to remove a computer from a group that was set up to share configuration settings.

UI Element List

The following tables describe the UI elements that are available on the feature page and in the Actions pane.

Feature Page Elements

Element Name Description

Enable shared configuration

Configures IIS to use shared configuration files.

Note

You must exit and restart IIS Manager after enabling or disabling this option.

Physical path

Describes the location from which to read configuration files and encryption keys. This can be a network path or a folder on the local computer.

User name

Specifies the user name IIS should use to access the location for configuration file storage.

Password

Specifies the password needed to authenticate the user name that IIS uses to access the location for configuration file storage.

Confirm password

Specifies that the user must retype the password.

Actions Pane Elements

Element Name | Description
Apply | Saves the changes that you have made on the feature page.
Cancel | Cancels the changes that you have made on the feature page.
Export Configuration | Opens the Export Configuration dialog box to export IIS configuration files and encryption keys between one or more IIS servers.

See Also

  • Configuring Shared Configuration in IIS 7.0 (online)


Export Configuration Dialog Box

Use the Export Configuration dialog box to export IIS configuration files and encryption keys to a specific location.

UI Element List

Element Name | Description
Physical path | Describes the location to export configuration files and encryption keys. This can be a network path or a folder on the local computer.
Connect As | Enables access to the Set Credentials dialog box. By default, you access the Physical path using whatever user account you are currently logged in with. To connect using a different user account, use the Set Credentials dialog box.
Encryption keys password | Specifies the password to encrypt the encryption keys.
Confirm password | Specifies that the user must retype the password.

See Also

  • Configuring Shared Configuration in IIS 7.0 (online)


Set Credentials Dialog Box - Shared Configuration Feature

Use the Set Credentials dialog box to connect to a physical path using a user account different from the user account that you are currently logged in with.

UI Element List

Element Name | Description
User name | Specifies the user name for the user account you want to use to access a physical path for shared configuration.
Password | Specifies the password needed to authenticate the User name.
Confirm password | Specifies that the user must retype the password.

See Also

  • Configuring Shared Configuration in IIS 7.0 (online)


Encryption Keys Password Dialog Box

Use the Encryption Keys Password dialog box to enter the password for the encryption keys archive.

UI Element List

Element Name | Description
Enter encryption key password | Specifies the password needed for IIS to decrypt the encrypted encryption keys. This password is set when you use IIS Manager to export configuration files.

See Also

  • Configuring Shared Configuration in IIS 7.0 (online)


Sites

This section contains the following topics:

Sites Page

Add Web Site Dialog Box

Edit Site Dialog Box

Select Application Pool Dialog Box - Sites and Applications

Connect As Dialog Box - Sites, Applications, and Virtual Directories

Set Credentials Dialog Box - Sites, Applications, and Virtual Directories

Site Bindings Dialog Box

Add or Edit Site Binding Dialog Box

Edit Web Site Limits Dialog Box

Edit Web Site Failed Request Tracing Settings Dialog Box


Sites Page

Use the Sites feature page to manage a list of sites on a Web server.

Sort the list by clicking one of the feature page column headings or select a value from the Group by drop-down list to group similar items. Search the list by typing search criteria in the Filter box, expand the Go list to select the field on which to search, and then click Go or press ENTER. Click Show All to remove the filter criteria.

UI Element List

The following tables describe the UI elements that are available on the feature page and in the Actions pane.

Feature Page Elements

Element Name | Description
Name | Displays the unique name of the site.
ID | Displays the unique ID of the site.
Status | Displays whether the site is started, or displays error information if the site has a problem and cannot start. When a site uses more than one protocol, the status will be displayed separately for each protocol, with the status followed by the protocol in parenthesis. For example, a site that uses the HTTP or HTTPS protocol will display Started (http) when it is started.
Binding | Displays the binding or bindings for the site.
Path | Displays the physical path of the directory that holds the site's content.

Actions Pane Elements

Some of the actions described in the following table are available for a site only when the site has an HTTP or HTTPS binding. These actions appear in the Actions pane under Manage Web Site.

Element Name Description

Add Web Site

Opens the Add Web Site dialog box from which you can add a Web site that uses the HTTP or HTTPS protocols for communication.

Set Web Site Defaults

Opens the Web Site Defaults dialog box from which you can set default values that apply to all Web sites that you add to the Web server.

Bindings

Opens the Site Bindings dialog box from which you can add, edit, and remove site bindings.

Basic Settings

Opens the Edit Site dialog box from which you can edit the settings that were specified when the selected site was created.

Note

You cannot edit bindings from the Edit Site dialog box. Open the bindings dialog box to edit the site's bindings.

Explore

Opens the physical directory (in Windows Explorer) for the site.

Edit Permissions

Opens the Windows Properties dialog box for the physical directory that is mapped to the root virtual directory for the selected site's root application.

Remove

Removes the item that is selected from the list on the feature page.

Rename

Enables the Name field of the selected site so that you can rename the site.

View Applications

Opens the Applications feature page from which you can view the applications that belong to the site.

View Virtual Directories

Opens the Virtual Directories feature page from which you can view the virtual directories that belong to the site's root application.

Restart

Stops and restarts the selected site. Restarting a site causes the site to be temporarily unavailable until the restart is complete.

Start

Starts the selected site.

Stop

Stops the selected site. Stopping a site causes the site to be unavailable until it is started.

Browse

Opens the selected site in an Internet browser. When the site has more than one binding, multiple browse links display.

Advanced Settings

Opens the Advanced Settings dialog box from which you can configure advanced settings for the selected site.

Failed Request Tracing

Opens the Edit Web Site Failed Request Tracing dialog box from which you can enable failed request tracing and configure related settings for the selected site.

Limits

Opens the Edit Web Site Limits dialog box from which you can configure bandwidth and connection limits for the selected site.

See Also

  • Managing Sites in IIS 7.0 (online)


Add Web Site Dialog Box

Use the Add Web Site dialog to add a new Web site to your Web server. Web sites have bindings that consist of a port number, an IP address, and an optional host name or names.

UI Element List

Element Name Description

Site name

Type a friendly name for your site. The friendly name appears in the tree of IIS Manager and can be changed later if you want to rename the site.

Note

The site name must be a unique name, because you cannot have sites that have the same name on an IIS 7.0 Web server.

Application pool

Displays the selected application pool for the site. When you type a Web site name, a new application pool will be created with the same name as the site (up to 64 characters maximum). The application pool will be configured to use .NET Framework version 2.0 and the integrated pipeline mode by default. You can edit the settings for this application pool later or select a different application pool for your site.

Select

Opens the Select Application Pool dialog box from which you can select the application pool in which the site will run.

Physical path

Type the physical path where the site content is stored. The content can reside on the local computer or come from a remote directory or share. If your content is stored on the local computer, type the physical path, such as C:\Content. If your content is stored in a remote share, type the Universal Naming Convention (UNC) path, such as \\Server\Share.

Optionally click Connect as to specify credentials to connect to the physical path. If you do not provide credentials, the Web server will use pass-through authentication. This means that content will be accessed by using the application user's identity, and configuration files will be accessed by using the application pool's identity.

…

Opens the Browse for Folder dialog box from which you can select the physical location of your site content.

Connect as

Opens the Connect As dialog box from which you can select how to connect to the path that you typed in the Physical path box. By default, Application user (pass-through authentication) is selected.

Test Settings

Opens the Test Settings dialog box from which you can view a list of test results to assess whether the path settings are valid.

Type

Select HTTP if you want the Web site to have an HTTP binding, or select HTTPS if you want the Web site to have a Secure Sockets Layer (SSL) binding.

IP address

Select an IP address from the IP address list or type an IP address that users can use to access this site.

Note

The percent symbol (%) is not a valid character for IP addresses. If you type an IPv6 address with this character, Windows Process Activation Service (WAS) will be unable to start the site because the binding is invalid. For example, the link-local IPv6 address ends with "%8". If you copy this address from an ipconfig query in a command window and paste it into the IP address box in IIS Manager, make sure to remove the "%8" portion of the IP address.

If you select All Unassigned, this site will respond to requests for all IP addresses on the port and optional host name that you specify for this site, unless another site on the server has a binding on the same port but with a specific IP address.

For example, the Default Web Site binding specifies All Unassigned for IP address, 80 for Port, and no host name. If the server has a second site named Contoso with a binding that specifies 172.30.189.179 for IP address on port 80 and no host name, Contoso will receive all HTTP requests to port 80 on IP address 172.30.189.179, and Default Web Site will continue to receive HTTP requests to port 80 on any IP address other than 172.30.189.179.

Port

Type the port on which HTTP.sys must listen for requests made to this Web site. If you select HTTP from the Type drop-down list, the default port is 80; if you select HTTPS from the drop-down list, the default port is 443. If you specify a port different from the default ports, clients must specify the port number in requests to the server or they will not connect to the Web site.

Host name

Type a host name if you want to assign one or more host names, also known as domain names, to one computer that uses a single IP address. If you specify a host name, clients must use the host name instead of the IP address to access the Web site.

If this Web site is available on the Internet, type the domain name of the Web site as users will type it in a browser, for example, www.contoso.com. If your Web site has more than one domain name, such as www.contoso.com and contoso.com, you must create a separate binding for each host name.

If your Web site is available on an intranet, you do not have to specify a host name if users will type the server name in a browser, for example, http://server_name. However, if the DNS server in your environment is configured to store other names for this Web server, you can create a separate binding for each host name so that users can use the other names stored by the DNS server.

Note

The host name that you configure for your Web site might appear differently in the log files because HTTP.sys logs host names by using the punycode-encoded format.

SSL certificate

Select the certificate that you want the Web site to use for SSL. The SSL certificate list appears only when you select HTTPS from the Type list.

Note

To add or configure server certificates, use the Server Certificates feature in IIS Manager.

View

Opens the Certificate dialog box from which you can view information about the selected certificate in the SSL certificate list. The View button appears only when you select HTTPS from the Type list and select a certificate from the SSL certificate list.

Start Web site immediately

Select this option to start the Web site immediately after it is created. When the Web site is started, it listens for requests. You may want to delay starting the Web site if you must make other configuration changes, such as changes to authentication or authorization, after the site is created.

Note

If you specify an invalid binding, the Web site will be created but will not be able to start until the binding is fixed.

See Also

  • Server Certificates
  • Managing Sites in IIS 7.0 (online)


Edit Site Dialog Box

Use the Edit Site dialog box to edit the properties of an existing site.

Note

To edit binding information for the site, use the Site Bindings dialog box.

UI Element List

Element Name Description

Site name

Displays the friendly name for your site.

Note

You cannot rename a site from the Edit Site dialog box. To rename a site, use the Rename action in the Actions pane on the Sites page.

Application pool

Displays the selected application pool for the site.

Select

Opens the Select Application Pool dialog box from which you can select the application pool in which the site will run.

Physical path

Type the physical path where the site content is stored. The content can reside on the local computer or come from a remote directory or share. If your content is stored on the local computer, type the physical path, such as C:\Content. If your content is stored in a remote share, type the Universal Naming Convention (UNC) path, such as \\Server\Share.

Optionally click Connect as to specify credentials to connect to the physical path. If you do not provide credentials, the Web server will use pass-through authentication. This means that content will be accessed by using the application user's identity, and configuration files will be accessed by using the application pool's identity.

…

Opens the Browse for Folder dialog box from which you can select the physical location of your site content.

Connect as

Opens the Connect As dialog box from which you can select how to connect to the path that you typed in the Physical path box. By default, pass-through authentication is selected.

Test Settings

Opens the Test Settings dialog box from which you can view a list of test results to assess whether the path settings are valid.

See Also

  • Site Bindings Dialog Box
  • Add or Edit Site Binding Dialog Box
  • Managing Sites in IIS 7.0 (online)


Select Application Pool Dialog Box - Sites and Applications

Use the Select Application Pool dialog box to select an application pool for your site or application. An application pool is configured to use one version of the .NET Framework, and one of two modes for processing managed code. Select an application pool that is configured to use the version of the .NET Framework and the managed-processing mode that the site or application requires. If your application does not require the .NET Framework, you can select an application pool that is configured for no managed code.

Note

To add an application pool, use the Add Application Pool dialog box on the Application Pools page.

UI Element List

Element Name Description

Application pool

Select the application pool that you want your site or application to use.

Properties

Displays the .NET Framework version and the pipeline mode that the application pool is configured to use.

Note

The pipeline mode is not displayed when the application pool is configured to use .NET Framework version 1.1.

See Also

  • Add Web Site Dialog Box
  • Edit Site Dialog Box
  • Add or Edit Application Pool Dialog Box
  • Managing Application Pools in IIS 7.0 (online)
  • Managing Sites in IIS 7.0 (online)


Connect As Dialog Box - Sites, Applications, and Virtual Directories

Use the Connect As dialog box to select the method that IIS uses to access content from the physical path that was specified for the site, application, or virtual directory. The physical path can be a path to a directory on the local computer or to a directory or share on a remote computer.

UI Element List

Element Name Description

Specific user

Select this option to provide credentials for a specific user account that has access to the physical path.

Set

Opens the Set Credentials dialog box from which you can type the user name and password for the user account that has access to the physical path. This user will be used to access all of the content in the specified physical path. This button is available only when you select the Specific user option in the Connect As dialog box.

Application user (pass-through authentication)

Select this option if you want to use pass-through authentication. With this option, IIS uses the credentials of the requesting user to access the physical path.

For anonymous requests, IIS uses the identity configured for the anonymous authentication to access the physical path. By default, this identity is the built-in IUSR account.

For authenticated requests, IIS uses the authenticated set of credentials from the requesting user to access the physical path. Make sure that the application pool identity that serves this application has Read access to the physical path, so that the authenticated user can access the content in the physical path.

See Also

  • Set Credentials Dialog Box - Sites, Applications, and Virtual Directories
  • Managing Sites in IIS 7.0 (online)
  • Managing Applications in IIS 7.0 (online)
  • Managing Virtual Directories in IIS 7.0 (online)


Set Credentials Dialog Box - Sites, Applications, and Virtual Directories

Use the Set Credentials dialog box to provide user credentials that can access content from the physical path that was specified for the site, application, or virtual directory. The physical path can be a path to a directory on the local computer or to a directory or share on a remote computer.

UI Element List

Element Name | Description
User name | Type the user name of a Windows user account that has access to the physical path.
Password | Type the password for the user account that you specified in the User name box.
Confirm password | Retype the password for the user account that you specified in the Password box.

See Also

  • Connect As Dialog Box - Sites, Applications, and Virtual Directories
  • Managing Sites in IIS 7.0 (online)
  • Managing Applications in IIS 7.0 (online)
  • Managing Virtual Directories in IIS 7.0 (online)


Site Bindings Dialog Box

Use the Site Bindings dialog box to configure bindings for a site.

UI Element List

Element Name Description

Type

Displays the protocol for each site binding.

Host Name

Displays the host name, if any, for each site binding.

Port

Displays the port number for each site binding.

IP Address

Displays the IP address for each site binding. If an IP address is not specified, the IP Address field displays an asterisk (*), which means that the binding is for all IP addresses.

Binding Information

Displays binding information for site bindings that use protocols other than:

  • HTTP

  • HTTPS

  • FTP

Add

Opens the Add Site Binding dialog box from which you add a binding to the site.

Edit

Opens the Edit Site Binding dialog box from which you can edit the selected binding.

Remove

Removes the selected binding from the site. This button is available only when a site has more than one binding.

Browse

Opens the site's default page in a Web browser using the selected binding.

Note

This action is available only for HTTP and HTTPS bindings.

Close

Closes the Site Bindings dialog box.

See Also

  • Managing Sites in IIS 7.0 (online)


Add or Edit Site Binding Dialog Box

Use the Add Site Binding and the Edit Site Binding dialog boxes to add bindings to a site or to edit an existing site binding. For example, your site might need an HTTPS binding on port 443 in order to use Secure Sockets Layer (SSL) in addition to an HTTP binding on port 80. You can access the Add Site Binding dialog box by clicking Add from the Site Bindings dialog box.

Note

If you add a duplicate binding to the Web server, only one site with that binding can run at a time. Additionally, if your duplicate binding is an HTTPS binding, any changes that are made to the certificate on one binding will affect the certificate on the other binding.

UI Element List

Element Name Description

Type

Select a value from the list to specify the protocol for the site binding.

IP address

Select an IP address from the IP address list or type an IP address that users can use to access this site.

Note

The percent symbol (%) is not a valid character for IP addresses. If you type an IPv6 address with this character, Windows Process Activation Service (WAS) will be unable to start the site because the invalid binding is invalid. For example, the link-local IPv6 address ends with "%8". If you copy this address from an ipconfig query in a command window and paste it into the IP address box in IIS Manager, make sure to remove the "%8" portion of the IP address.

If you select All Unassigned, this site will respond to requests for all IP addresses on the port and optional host name that you specify for this site, unless another site on the server has a binding on the same port but with a specific IP address.

For example, the Default Web Site binding specifies All Unassigned for IP address, 80 for Port, and no host name. If the server has a second site named Contoso with a binding that specifies 172.30.189.179 for IP address on port 80 and no host name, Contoso will receive all HTTP requests to port 80 on IP address 172.30.189.179, and Default Web Site will continue to receive HTTP requests to port 80 on any IP address other than 172.30.189.179.

Port

Type the port on which HTTP.sys must listen for requests made to this site. If you select HTTP from the Type drop-down list, the default port is 80; if you select HTTPS from the drop-down list, the default port is 443. If you specify a port different from the default ports, clients must specify the port number in requests to the server or they will not connect to the site.

Host name

Type a host name if you want to assign one or more host names, also known as domain names, to one computer that uses a single IP address. If you specify a host name, clients must use the host name instead of the IP address to access the site.

If this site is available on the Internet, type the domain name of the site as users will type it in a browser, for example, www.contoso.com. If your site has more than one domain name, such as www.contoso.com and contoso.com, you must create a separate binding for each host name.

If your site is available on an intranet, you do not have to specify a host name if users will type the server name in a browser, for example, http://server_name. However, if the DNS server in your environment is configured to store other names for this Web server, you can create a separate binding for each host name so that users can use the other names stored by the DNS server.

Note

The host name that you configure for your Web site might appear differently in the log files because HTTP.sys logs host names by using the punycode-encoded format.

SSL certificate

Select the certificate that you want the site to use for SSL. The SSL certificate list appears only when you select HTTPS from the Type list.

Note

To add or configure server certificates, use the Server Certificates feature in IIS Manager.

View

Opens the Certificate dialog box from which you can view information about the selected certificate in the SSL certificate list. The View button appears only when you select HTTPS from the Type list and select a certificate from the SSL certificate list.

See Also

  • Server Certificates
  • Managing Sites in IIS 7.0 (online)


Edit Web Site Limits Dialog Box

Use the Edit Web Site Limits dialog box to configure performance settings for your Web site based on bandwidth usage and connection limits. For example, by restricting either bandwidth or the number of connections, or both, on a low-priority Web site, you enable other, higher-priority sites to handle larger traffic loads. You can adjust these settings as network traffic and usage changes.

UI Element List

Element Name | Description
Limit bandwidth usage (in bytes) | Select this option to limit the amount of traffic allowed to a Web site based on bandwidth usage. In the corresponding box, enter a value (in bytes) at which you want to limit the Web site traffic. The value must be an integer between 1024 and 4294967295 (unlimited).
Connection time-out (in seconds) | Type a number in the box to set the length of time (in seconds) before the Web server disconnects an inactive user. This setting guarantees that all connections are closed if the HTTP protocol cannot close a connection.
Limit number of connections | Select this option to limit the number of connections allowed to a Web site. In the corresponding box, enter the number of connections to which you want to limit the Web site. The value must be an integer between 0 and 4294967295 (unlimited). Setting the number to be unlimited circumvents constant administration if your connections tend to fluctuate. However, system performance can be negatively affected if the number of connections exceeds your system resources. Restricting a Web site to a specified number of connections can keep performance stable.

See Also

  • Managing Sites in IIS 7.0 (online)


Edit Web Site Failed Request Tracing Settings Dialog Box

Use the Edit Web Site Failed Request Tracing Settings dialog box to change previously configured tracing rules for failed requests.

UI Element List

Element Name Description

Enable

Select this option to enable failed request trace logging for a specific site.

Directory

Type the path where you want to store the failed request trace log files.

Note

As a best practice, log files, such as log files for failed request tracing, should be stored in a directory other than systemroot.

Maximum number of trace files

Type the maximum number of failed request trace log files that you want to keep for the site. If no value is entered, the default maximum number of log files that will be stored is 50. When this limit is reached, new log files are created and older ones are removed.

See Also

  • Configuring Tracing for Failed Requests in IIS 7.0 (online)


SMTP E-mail

This section contains the following topics:

SMTP E-mail Page

Set Credentials Dialog Box - SMTP E-mail Feature


SMTP E-mail Page

Use the SMTP E-mail feature page to configure delivery of e-mail from applications that use the System.Net.Mail API. You can configure the sender e-mail address on outgoing e-mail, and decide to either deliver e-mail immediately to an online SMTP server or store e-mail on disk where it can be retrieved for later delivery.

UI Element List

The following tables describe the UI elements that are available on the feature page and in the Actions pane.

Feature Page Elements

Element Name | Description
E-mail address | Sets the e-mail address from which e-mail messages are sent.
Deliver e-mail to SMTP server | Configures System.Net.Mail to deliver e-mail messages immediately to an SMTP server.
SMTP Server | Defines the unique name of the SMTP server.
Use localhost | Sets the name of the SMTP server to LocalHost. Setting the name to LocalHost means that System.Net.Mail will send e-mail to the SMTP server on the local computer.
Port | Sets the TCP port that System.Net.Mail will use in trying to connect to the target SMTP server. Port 25 is the SMTP standard TCP port and is the default setting and the recommended setting.
Authentication Settings | Specifies the authentication mode and credentials if your SMTP server requires these.
Not required | Requires no user name or password from the user in order to connect to the SMTP server.
Windows | Uses the application identity. Use this option if you are setting up a smart host to relay messages in your network or if you are setting up a server to receive e-mail from internal sites, such as a company intranet.
Specify credentials | Requires a valid user name and password. Credentials are sent as clear text across the network. To specify credentials, click Set. You must enter the valid user name in the User name text box and the valid password in the Password text box. Re-enter the password in the Confirm Password text box and then click OK.
Store e-mail in pickup directory | Configures System.Net.Mail to store e-mail messages in a file location on disk for later delivery by an application such as an ASP.NET application, or by a user, such as an administrator.

Actions Pane Elements

Element Name | Description
Apply | Saves the changes that you have made on the feature page.
Cancel | Cancels the changes that you have made on the feature page.

See Also

  • Configuring SMTP E-mail in IIS 7.0 (online)


Set Credentials Dialog Box - SMTP E-mail Feature

Use the Set Credentials dialog box to configure IIS to use a Simple Mail Transfer Protocol (SMTP) server user name and password.

UI Element List

Element Name | Description
User name | Type the name of the account that you want IIS to use to access your SMTP server.
Password | Type the password associated with your SMTP server.
Confirm password | Retype the password associated with your SMTP server.

See Also

  • Configuring SMTP E-mail in IIS 7.0 (online)


SSL Settings Page

Use the SSL Settings page to manage data encryption of transmissions between your server and clients. Additionally, by selecting Ignore, Accept, or Require certificates you can require a client to be identified before gaining access to content.

UI Element List

The following tables describe the UI elements that are available on the feature page and in the Actions pane.

Feature Page Elements

Element Name Description

Require SSL

Select Require SSL (Secure Sockets Layer) to enable a 40–bit data encryption method that you can use to help secure transmissions between your server and clients. This option setting works in both intranet and Internet environments.

Require 128 Bit SSL

Select Require 128 bit SSL to provide stronger encryption than the 40–bit version. You can use 128–bit SSL to help secure transmissions between your server and clients in either an intranet or Internet environment.

Ignore

This is the default option. This setting does not accept client certificates if they are provided.

Note

This option does not require clients to verify their identity before gaining access to your content. Therefore, this is the least secure of these settings.

Accept

Select this setting if you want to accept client certificates (if they are provided), and to verify client identity before allowing the client to gain access to content.

Require

Select this option to require that certificates verify client identity before allowing the client to gain access to content.

Actions Pane Elements

Element Name | Description
Apply | Saves the changes that you have made on the feature page.
Cancel | Cancels the changes that you have made on the feature page.

See Also

  • Configuring Secure Sockets Layer in IIS 7.0 (online)


Virtual Directories

This section contains the following topics:

Virtual Directories Page

Add or Edit Virtual Directory Dialog Box


Virtual Directories Page

Use the Virtual Directories feature page to manage a list of virtual directories in an application.

Sort the list by clicking one of the feature page column headings.

UI Element List

The following tables describe the UI elements that are available on the feature page and in the Actions pane.

Feature Page Elements

Element Name | Description
Application Path | Displays the application that contains each virtual directory.
Virtual Path | Displays the virtual path that is used in a URL to access the virtual directory.
Physical Path | Displays the physical path of the directory that holds the virtual directory's content.
Identity | Displays the user name of the custom identity (if configured) that is used to access content from the physical directory that is mapped to the virtual directory. If the identity is left blank, pass-through authentication is used to access the content.

Actions Pane Elements

The following table describes the actions available when connected to a server. When you are connected to a site or an application and select a virtual directory on the Virtual Directories page, the only available action is Browse.

Element Name | Description
Add Virtual Directory | Opens the Add Virtual Directory dialog box in which you can add a virtual directory.
Set Virtual Directory Defaults | Opens the Virtual Directory Defaults dialog box in which you can configure default settings that apply to all virtual directories at the current level and below.
Explore | Opens the physical directory (in Windows Explorer) that is mapped to the selected virtual directory.
Edit Permissions | Opens the Windows Properties dialog box for the physical directory that is mapped to the selected virtual directory.
Remove | Removes the item that is selected from the list on the feature page.
Browse | Opens the selected virtual directory in an Internet browser.
Basic Settings | Opens the Edit Virtual Directory dialog box in which you can edit the settings that were specified when the selected virtual directory was created.
Advanced Settings | Opens the Advanced Settings dialog box in which you can configure advanced settings for the selected virtual directory.

See Also

  • Managing Virtual Directories in IIS 7.0 (online)


Add or Edit Virtual Directory Dialog Box

Use the Add Virtual Directory and Edit Virtual Directory dialog boxes to add and edit virtual directories in your sites and applications. Virtual directories are pointers to physical content stored on your local computer or in shares on remote computers. If you want to include content that does not physically reside in your site's or application's directory, you can create a virtual directory that includes content from elsewhere on your Web server or from another computer in your network.

UI Element List

Element Name | Description
Site name | Displays the name of the site that will contain the virtual directory.
Path | Displays the application that will contain the virtual directory. If you create a virtual directory at the site level, this box will display /. If you create a virtual directory at the application level, this box will display the name of the application, such as /myApp.
Alias | Type a name for the virtual directory that clients can use to access content from a Web browser. For example, if your site address is http://www.contoso.com/ and you create a virtual directory for this site called /marketing, users can access the virtual directory from their Web browser by typing http://www.contoso.com/marketing/.
Physical path | Type or navigate to the physical path where the virtual directory content is stored. The content can reside on the local computer or come from a remote share. If your content is stored on the local computer, enter the physical path, such as C:\Content. If your content is stored in a remote share, enter the UNC path, such as \\Server\Share. The path that you specify must exist, or you might receive a configuration error. Optionally, click Connect as to provide credentials for an account that is authorized to access content in the physical path.
… | Opens the Browse for Folder dialog box from which you can select the physical location of your virtual directory content.
Connect as | Opens the Connect As dialog box from which you can select how to connect to the path that you typed in the Physical path box. By default, Application user (pass-through authentication) is selected.
Test Settings | Opens the Test Settings dialog box from which you can view a list of test results to assess whether the path settings are valid.

See Also

  • Connect As Dialog Box - Sites, Applications, and Virtual Directories
  • Managing Virtual Directories in IIS 7.0 (online)


Worker Processes

This section contains the following topics:

Worker Processes Page

Requests Page


Worker Processes Page

Use the Worker Processes feature page to manage a list of worker processes running in application pools on a Web server. Sort the list by clicking one of the feature page column headings.

UI Element List

The following tables describe the UI elements that are available on the feature page and in the Actions pane.

Feature Page Elements

Element Name | Description
Application Pool Name | Displays the name of the application pool. In Web gardens or if you have a worker process that is shutting down at the same time another worker process is starting, the same application pool may be listed more than once in the grid to account for different worker processes running in that application pool.
Process ID | Displays the worker process identifier (ID) for that worker process.
State | Displays the state of a process, such as starting, running, or stopping.
CPU % | Displays the percentage of time that the worker process has used the CPU since the data was last updated. This corresponds to CPU Usage in Windows Task Manager.
Private Bytes (KB) | Displays the current size of memory committed by a worker process. This memory cannot be shared with other processes. This corresponds to Virtual Memory Size in Windows Task Manager.
Virtual Bytes (KB) | Displays the current size of the virtual address space for a worker process.

Actions Pane Elements

Element Name | Description
View Current Requests | Opens the Requests feature page in which you can view the requests currently processing in the selected application pool.

See Also

  • Monitoring Worker Processes and Currently Executing Requests in IIS 7.0 (online)


Requests Page

Use the Requests feature page to manage a list of currently running requests in a worker process. This information can help you determine where a problem occurs in a specific area of a site or application.

Sort the list by clicking one of the feature page column headings. Search the list by typing search criteria in the Filter box, expand the Go list to select the field on which to search, and then click Go or press ENTER. Click Show All to remove the filter criteria.

UI Element List

Element Name | Description
Web Site ID | Displays the site identifier (ID) for the specific request.
Url | Displays the requested URL.
Verb | Displays the HTTP verb used in the request.
Client IP | Displays the IP address of the client that made the request.
State | Displays the current pipeline module state that the request is in.
Module Name | Displays the current module that the request is in.
Time Elapsed | Displays the period of time that the request has been in process.

See Also

  • Monitoring Worker Processes and Currently Executing Requests in IIS 7.0 (online)


Common Administrative Tasks

This topic provides a list of procedures for completing common administrative tasks in IIS 7.0. Some of the tasks are new to this version of IIS, and others resemble tasks from earlier versions, but the procedures in the new version have changed.

In this section

Common administrative tasks in IIS 7.0 include the following:

Configuring a Web Server to Serve Content

  • Add a Site

  • Add an Application

  • Add a Virtual Directory

Configuring Request-Processing for a Web Server

  • Create an Application Pool

  • Start or Stop an Application Pool

  • Configuring Recycling Settings for an Application Pool

Configuring HTTP Settings

  • Add a Redirect Rule

  • Edit a Custom HTTP Error Response

  • Configure the Information to Display in a Directory Listing

Delegating Site and Application Management

  • Delegate Management of Features in Sites and Applications

  • Configure the Management Service

  • Configure User Accounts to Conenct to Sites and Applications in IIS Manager

Monitoring Activity on a Web Server

  • View Currently Executing Requests in a Worker Process

  • Enable Logging for a Site

  • Disable Logging

  • Enable Trace Logging for Failed Requests

  • Create a Tracing Rule for Failed Requests

Configuring Web Server Security

  • Configuring Authentication

  • Configuring Secure Sockets Layer

  • Configuring URL Authorization Rules


More Information About IIS 7.0

Use the following online resources to learn more about deploying, administering, and extending an IIS 7.0 Web server:

  • Web server content in the Windows Server 2008 Technical Library on Microsoft TechNet. Use the how-to and reference information to deploy, administer, and manage IIS 7.0 Web servers, sites, and applications.

  • Internet Information Services 7.0 SDK on Microsoft Developer Network (MSDN). Use the IIS 7.0 Web Administration Reference to learn about the configuration schema and Windows Management Instrumentation (WMI) provider. Use the Web Server Development Reference to learn about creating applications and extending IIS functionality.

  • IIS.NET. Use the technical resources, downloads, forums, and blogs to learn all about IIS 7.0 and earlier versions of IIS.