Internet Information Services

Internet Information Services (IIS) with the Microsoft® Windows® Server 2003 family provides integrated, reliable, scalable, secure, and manageable Web server capabilities over an intranet, the Internet, or an extranet. IIS is a tool for creating a strong communications platform of dynamic network applications. Organizations of all sizes use IIS to host and manage Web pages on the Internet or on their intranet, to host and manage FTP sites, and to route news or mail using the Network News Transport Protocol (NNTP) and the Simple Mail Transfer Protocol (SMTP). IIS 6.0 leverages the latest Web standards like Microsoft ASP.NET, XML, and Simple Object Access Protocol (SOAP) for the development, implementation, and management of Web applications. IIS 6.0 includes new features designed to help organizations, IT professionals, and Web administrators achieve their goals of performance, reliability, scalability, and security for potentially thousands of Web sites either on a single IIS server or on multiple servers.

important Important In order to take a more proactive stance against malicious users and attackers, IIS is not installed on members of the Microsoft® Windows® Server 2003 family by default. Furthermore, when you initially install IIS, the service is installed in a highly secure and "locked" mode. By default, IIS serves only static content — meaning features like ASP, ASP.NET, Server-Side Includes, WebDAV publishing, and FrontPage® Server Extensions do not work unless enabled. If you do not enable this functionality after installing IIS, IIS returns a 404 error. You can serve dynamic content and enable these features through the Web Service Extensions node in IIS Manager. Also, if an application extension is not mapped in IIS, IIS returns a 404 error. To map an extension, see Setting Application Mappings. For more information on how to troubleshoot 404 errors, including 404.2 and 404.3; issues related to a new installation of IIS 6.0; or an upgrade from a previous version of IIS, see Troubleshooting.

This version of IIS was designed to provide the following benefits and features:

Reliability | IIS 6.0 uses a new request-processing architecture and application isolation environment that enables individual Web applications to function within a self-contained worker process. This environment prevents one application or Web site from stopping another, and reduces the amount of time administrators spend restarting services to correct problems related to applications. The new environment also includes proactive application pool health monitoring.
Scalability IIS 6.0 introduces a new kernel-mode driver for HTTP parsing and caching, specifically tuned to increase Web server throughput and scalability of multiprocessor computers, thereby significantly increasing:
  • The number of sites a single IIS 6.0 server can host.
  • The number of concurrently-active worker processes.
  • Startup/shutdown times.
Also, by configuring worker processes start up and shutdown time limits, IIS allocates resources to active sites, as opposed to wasting resources on idle requests.
Security IIS 6.0 provides significantly improved security. To reduce the attack surface of systems, IIS is not installed by default on the operating systems in the Windows Server 2003 family. Administrators must explicitly select and install IIS. IIS installs by default in a locked down state, capable of serving only static content. Using the Web Service Extensions node, Web site administrators can enable or disable IIS functionality based on the individual needs of their organization. IIS 6.0 includes a variety of security features and technologies to ensure the integrity of your Web and FTP site content, as well as the data transmitted through your sites. IIS security features include the following security-related tasks:
  • Authentication.
  • Access control.
  • Encryption.
  • Certificates.
  • Auditing.
Manageability | To meet the needs of a diverse set of organizations, IIS provides a variety of manageability and administration tools. Administrators can configure an IIS 6.0 server using IIS Manager, administration scripts, or by directly editing the IIS plain-text configuration file. Administrators can also remotely administer IIS servers and sites.
Enhanced Development | The Windows Server 2003 family offers an improved developer experience with ASP.NET and IIS integration. ASP.NET recognizes most ASP code while providing greater functionality for building enterprise-class Web applications that can work as a part of the Microsoft .NET Framework. Using ASP.NET allows you to take full advantage of the features of the common language runtime, such as type safety, inheritance, language interoperability, and versioning. IIS 6.0 also offers support for the latest Web standards, including XML, SOAP and Internet Protocol Version 6.
Application Compatibility | IIS 6.0 is compatible with most existing applications, based on feedback from thousands of customers and independent software vendors (ISV). Also, to ensure maximum compatibility, IIS 6.0 can be configured to run in IIS 5.0 isolation mode.

The IIS 6.0 documentation set includes the following:

  • Getting Started: Describes key features in IIS 6.0, outlines the differences between this and earlier versions of IIS, and introduces basic concepts and tools, such how to install IIS and how to open IIS Manager.
  • Common Administrative Tasks: Includes a series of short procedural topics describing how to complete routine or common IIS 6.0 tasks.
  • Site Setup: Describes how to set up an initial Web, FTP, SMTP, or NNTP site.
  • Server Administration Guide: Includes conceptual and procedural information regarding administrative tasks performed on IIS servers and sites.
  • Programmatic Administration Guide: Describes how to administer your IIS server and sites using ADSI, WMI, or command-line administration scripts.
  • Web Application Guide: Describes how to develop and manage Web applications using ASP and ASP.NET.
  • Reference: Describes interfaces, objects, and data structures available for programming and administering IIS.
  • Glossary: Defines terms used in this documentation set.
  • Troubleshooting: Describes processes for resolving issues with your IIS 6.0 installation.

© 1997-2003 Microsoft Corporation. All rights reserved.


Getting Started

This section includes general information about key features and changes in this version of Internet Information Services (IIS). It also includes information on how to install IIS and access IIS Manager to administer IIS sites, as well as links to resources on the Web.

important Important In order to take a more proactive stance against malicious users and attackers, IIS is not installed on members of the Microsoft® Windows® Server 2003 family by default. Furthermore, when you initially install IIS, the service is installed in a highly secure and "locked" mode. By default, IIS serves only static content — meaning features like ASP, ASP.NET, Server-Side Includes, WebDAV publishing, and FrontPage® Server Extensions do not work unless enabled. If you do not enable this functionality after installing IIS, IIS returns a 404 error. You can serve dynamic content and enable these features through the Web Service Extensions node in IIS Manager. Also, if an application extension is not mapped in IIS, IIS returns a 404 error. To map an extension, see Setting Application Mappings. For more information on how to troubleshoot 404 errors, including 404.2 and 404.3; issues related to a new installation of IIS 6.0; or an upgrade from a previous version of IIS, see Troubleshooting.

This section includes the following information:

  • IIS 6.0 Features: Describes key features in this version of IIS.
  • What's Changed: Describes important differences between IIS versions 4.0, 5.0, 5.1 and 6.0.
  • IIS Manager: Describes how to access the IIS graphical user interface.
  • Frequently Asked Questions: Answers common questions about IIS.
  • Resources: Provides links to information on the Web.
  • Release Notes: Explains how to access late-breaking technical information, known problems, and information about how to get technical support for IIS.
  • Before Configuring IIS: Discusses server configurations that should be addressed before attempting to configure IIS.
  • Installing IIS: Describes various methods for installing IIS and how to add or remove components.


IIS 6.0 Features

IIS 6.0 includes new features designed to help businesses, IT professionals, and Web administrators achieve their goals of performance, reliability, scalability, and security for potentially thousands of Web sites either on a single IIS server or on multiple servers. This section describes new and notable features in IIS 6.0.

This sections includes the following information:

  • Reliability Features: Describes new modes of operation and World Wide Web Publishing Service (WWW service) processes.
  • Security Features: Describes new features designed to secure your Web sites, data, and your IIS server.
  • Performance Features: Describes performance and scalability features.
  • Web Application Technologies: Describes the IIS 6.0 implementation of Microsoft ASP.NET, ASP, and the ADSI provider.
  • Administrative Tools and Features: Describes metabase changes and new administrative tools.
  • Internet Standards: Describes support for Web and Internet standard protocols.


Reliability Features

IIS 6.0 is more reliable than previous versions due to a new request processing architecture that provides an application isolation environment which enables individual Web applications to function within their own, self-contained worker process. The following are just a few of the improvements that make IIS 6.0 a more reliable Web administration environment.

new Modes of Operation

You can configure IIS 6.0 to run in either worker process isolation mode, which runs all processes in an isolated environment, or IIS 5.0 isolation mode, in which you can run Web applications that are not compatible with worker process isolation mode. In worker process isolation mode, you can isolate anything — from an individual Web application to multiple sites — in its own self-contained World Wide Web Publishing Service (WWW service) worker process, preventing one application or site from stopping another. Separating applications or sites into separate processes simplifies a number of management tasks.

new Worker Processes

In worker process isolation mode, worker processes handle all user code and are completely isolated from the core WWW service, Inetinfo.exe. Because these ISAPI applications run separately from the WWW service, an application failure prevents all services hosted by the WWW service from failing. Only the worker process that hosts the ISAPI application is affected. Worker processes can be configured to run on specific CPUs, which allows you greater control of balancing system resources.

new Multiple Application Pools

Worker process isolation mode allows customers to create multiple application pools, where each application pool can have a unique configuration. Performance and reliability are enhanced because these application pools receive their requests directly from the kernel instead of from the WWW service.

new Application Pool Assignments

An application pool can be configured in worker process isolation mode to serve anything from one Web application, to multiple applications, to multiple sites. Assigning an application to an application pool allows you to further isolate applications, and is as easy as configuring what pool that application should be routed to in the metabase. Sites, by default, are considered to be a simple application, where the root namespace "/" is configured as an application.

new Application Pool Queue Length Limits

When running in worker process isolation mode, you can choose to limit the number of requests that should be queued for each application pool in the HTTP protocol stack (HTTP.sys). This allows you to fine-tune the environment in which your applications run by managing application pool requests and system resources.

new Web Garden Configuration on Multi-Processor Computers

A Web garden is an application pool that has multiple worker processes serving the requests routed to that pool. Each application pool is configured to associate with a specified worker process. Additionally, you can increase scalability of your Web applications in worker process isolation mode by establishing affinity between worker processes and processors, so that a lock on one process does not block any other processes on the multi-processor server.

new Kernel-Mode Queuing

The IIS 6.0 kernel-mode driver, HTTP.sys, places requests destined for application pools in a queue if a worker process in that pool fails. Because the WWW service manages the processes, the WWW service can initialize another process without causing an interruption in service to users. Requests are sent from the queue until the queue is empty or until the WWW service is stopped.

new Health Monitoring

In worker process isolation mode, the WWW service monitors the health of worker processes and, if the process is unresponsive, terminates the process and replaces it with another. Health monitoring helps keep processes running and provides users with more reliable service.

new Idle Process Timeout

You can control system resources by configuring application pools in worker process isolation mode to have their worker processes request a shutdown if the worker processes are idle for a configurable amount of time, such as minutes, hours, or days. You can then request a forced application startup when IIS receives a request for that application pool.

new Rapid-Fail Protection

You can configure IIS in worker process isolation mode to use rapid-fail protection to automatically disable an application pool when a particular application pool suffers consecutive multiple failures.

new Orphan Worker Process

A worker process that fails to respond to queries from the WWW Service Administration and Monitoring component can be configured in worker process isolation mode to "separate" from the application pool instead of being terminated, as a new worker process is started in its place. Because the process is still running, you can perform diagnostics on it. For more information, see Application Pool Health.

new Recycling Worker Processes

You can configure IIS, in worker process isolation mode, to periodically restart worker processes in an application pool. When a new process is initialized, it takes over any requests to that application pool while the former worker process finishes processing its requests from the queue. Recycling worker processes allows you to manage troublesome applications, such as those with memory leaks, without interrupting service to your users.


Security Features

IIS 6.0 includes a variety of security features and technologies to ensure the integrity of your Web and FTP site content, as well as data transmitted through your sites. IIS security features cover the following security-related tasks: authentication, access control, encryption, certificates, and auditing. This topic describes new and notable security features.

important Important In order to take a more proactive stance against malicious users and attackers, IIS is not installed on members of the Microsoft® Windows® Server 2003 family by default. Furthermore, when you initially install IIS, the service is installed in a highly secure and "locked" mode. By default, IIS serves only static content — meaning features like ASP, ASP.NET, Server-Side Includes, WebDAV publishing, and FrontPage® Server Extensions do not work unless enabled. If you do not enable this functionality after installing IIS, IIS returns a 404 error. You can serve dynamic content and enable these features through the Web Service Extensions node in IIS Manager. Also, if an application extension is not mapped in IIS, IIS returns a 404 error. To map an extension, see Setting Application Mappings. For more information on how to troubleshoot 404 errors, including 404.2 and 404.3; issues related to a new installation of IIS 6.0; or an upgrade from a previous version of IIS, see Troubleshooting.

Digest Authentication

Digest authentication allows secure and robust authentication of users across proxy servers and firewalls. In addition, Anonymous authentication, Basic authentication, and Integrated Windows authentication are still available.

new Advanced Digest Authentication

Advanced Digest authentication makes improvements over Basic authentication in that credentials are sent over the network as an MD5 hash and are stored as such in the Active Directory® of the domain controller. This mechanism makes it extremely difficult for intruders to discover users' passwords and does not require you to modify your applications.

Secure Communications

Secure Sockets Layer (SSL) 3.0 and Transport Layer Security (TLS) provide a secure way to exchange information between clients and servers. In addition, SSL 3.0 and TLS provide a way for the server to verify who the client is before the user logs on to the server. In IIS, client certificates are exposed to both ISAPI and Active Server Pages (ASP), so that programmers can track users through their sites. Also, IIS can map the client certificate to a Windows user account so that administrators can control access to system resources based on the client certificate.

Server-Gated Cryptography

Server-Gated Cryptography (SGC) is an extension of SSL that allows financial institutions with export versions of IIS to use strong 128-bit encryption. Although SGC capabilities are built into IIS, a special SGC certificate is required to use SGC.

new Selectable Cryptographic Service Provider

Secure Sockets Layer provides a secure way to exchange information between clients and servers. However, the CPU has to perform intensive cryptography, which degrades performance. IIS offers the Selectable Cryptographic Service Provider (CSP), which allows you to select a cryptographic provider that suits your needs. Each provider can create a public and private key for encrypting data sent to and from the Web server. The private key is stored at the server on hardware, a PCI card, a SmartCard, or in the registry — as it is for the two default providers that Microsoft installs. Storing the private key on hardware allows you to plug into hardware-based accelerator cards, that perform cryptographic computations, instead of the server. It is easy to select providers from IIS Manager to use Microsoft or installed third-party CryptoAPI providers. All CryptoAPIs implement the same methods so that you can switch between providers without having to change your code.

new Configurable Worker Process Identity

To thwart system attackers and malicious users, you can configure application pools, and therefore the worker process executing within, to run under an account with a lower level of permissions than LocalSystem. If you provide services to Internet users, you can allow your customers to upload static content and executable code. Erroneous code will not cause the World Wide Web Publishing Service (WWW service) or computer to fail. Only the application will fail.

Security Wizards

The following security wizards simplify server administration tasks:

  • The Web Server Certificate Wizard simplifies certificate administration tasks, such as creating certificate requests and managing the certificate life cycle.
  • The CTL Wizard helps you configure your certificate trust lists (CTLs). A CTL is a list of trusted certification authorities (CAs) for a particular directory. CTLs are especially useful for Internet service providers (ISPs) who have several Web sites on their server and need to have a different list of approved certification authorities for each site.

IP and Internet Domain Restrictions

You can assign or deny Web access to individual computers, groups of computers, or entire domains.

Kerberos V5 Authentication Protocol Compliance

IIS is fully integrated with the Kerberos V5 authentication protocol implemented in members of the Windows Server 2003 family, allowing you to pass authentication credentials among connected computers running Windows.

Certificate Storage

IIS certificate storage is now integrated with the Windows CryptoAPI storage. The Windows Certificate Manager provides a single point of entry that allows you to store, back up, and configure server certificates.


Performance Features

A new generation of applications puts a greater demand on performance and scalability attributes of Web servers. Increasing the speed at which HTTP requests can be processed and allowing more applications and sites to run on one server translates directly into fewer servers needed to host a site. The following are a few of the performance improvements included in IIS 6.0.

new HTTP.sys

The Hyper Text Transfer Protocol (HTTP) stack in members of the Windows Server 2003 family is implemented as a kernel-mode device driver called HTTP.sys. HTTP.sys is a new feature specific to the Windows Server 2003 family, and is a part of the networking subsystem. IIS is a user-mode process that runs in a completely different execution mode than kernel processing. HTTP.sys is a single point of contact for all incoming (server-side) HTTP requests that provides high performance connectivity for HTTP server applications. HTTP.sys is also responsible for overall connection management, bandwidth throttling, and text-based logging. HTTP.sys implements a flexible Universal Resource Identifier (URI) response cache, called flexible caching, which enables HTTP applications to cache static data and service cached HTTP requests completely in kernel mode with no transition to user mode. HTTP.sys implements a URI namespace mapping mechanism called application pools. With application pools, HTTP applications can claim portions of the URI namespace, which allows HTTP.sys to route HTTP requests directly to the appropriate HTTP applications. As a result of these changes, IIS has increased throughput and scalability of multiprocessor computers, which significantly increases:

  • The number of sites a single IIS 6.0 server can host.
  • The number of concurrently-active worker processes.
  • Startup/shutdown times.

new ASP Disk Caching

Active Server Pages (ASP) processes templates that contain ASP scripts, stores the processed templates in a cache, and serves the cached templates to clients. By default, 250 templates are cached in-memory. If a site uses ASP heavily, this in-memory template cache cannot store all the necessary templates. IIS includes a persistent cache, so templates are cached to disk if the in-memory cache does not have enough space. If the ASP page is requested again, Asp.dll doesn't need to recompile the source code and can load the compiled template from disk. Caching ASP templates enhances performance because cached ASP templates are not processed each time they are called. You can further improve performance by changing the number of cached templates for all applications with low (in process) application protection, medium (pooled) application protection, or individually for applications with high (isolated) application protection.

For more information, see Configuring ASP Applications.

new Asynchronous CGI

IIS handles the Common Gateway Interface (CGI) implementation asynchronously, thereby removing the potential for blocked CGI processing responses.

new Capacity Planning Tracing

The IIS tracing feature for capacity planning traces application workloads against ASP script resource usage, such as HTTP response/request times. You can collect and analyze event trace data under different workloads and different hardware configurations and then use this data to help you with capacity planning.

new Centralized Binary Logging

Centralized binary logging allows multiple sites to write to a single log file in a binary, unformatted manner. This logging format improves performance, as the data does not have to be formatted in any specific manner like W3C Extended, IIS, or NCSA formats. With Microsoft SQL Server™ support, multiple machines can deposit logs in one centralized database.

new Quality of Service

Quality of Service (QoS) encompasses the set of methods or processes that a service-based organization implements to maintain a specific level of quality. In the context of Windows, QoS is a set of service requirements that the network must meet to assure an adequate service level for data transmission. The goal of QoS is to ensure that particular sites or applications do not monopolize server resources, like memory or CPU cycles. As an administrator, you can control the level and quality of service for your users by using the IIS implementation of connection limits and timeouts, application pool queue length limits, bandwidth throttling, and process accounting.

Bandwidth Throttling

If the network or Internet connection used by your Web server is also used by other services such as e-mail or news, you may want to limit the bandwidth used by your Web server so that bandwidth is available for those other services. If your Web server hosts more than one Web site, you can individually throttle the bandwidth used by each site.

CPU Monitoring

CPU monitoring is a tool that monitors and automatically shuts down worker processes that consume large amounts of CPU resources. CPU monitoring is enabled for individual application pools. CPU monitoring can also help you determine which sites have malfunctioning scripts or CGI processes.

Large Memory Support for x86.0

IIS 6.0 can be configured to cache up to 64 GB on an x86 system.


Web Application Technologies

The WindowsServer 2003 family offers an improved developer experience with ASP.NET and IIS integration. Microsoft® ASP.NET recognizes most ASP code while providing greater functionality for building enterprise-class Web applications that can work as a part of the Microsoft .NET Framework. Using ASP.NET allows you to take full advantage of the features of the common language runtime, such as type safety, inheritance, language interoperability, and versioning. IIS 6.0 also offers support for the latest Web standards, including XML, Simple Object Access Protocol (SOAP) and Internet Protocol Version 6 (IPv6.0).

new ASP.NET

ASP.NET is a unified Web application platform that provides the services necessary to build and deploy enterprise-class Web applications and XML Web services. ASP.NET is available and is installed, by default, on the operating systems in the Windows Server 2003 family.

important Important This feature is not available on Windows XP 64-Bit Edition and the 64-bit versions of the Windows Server 2003 family. For more information, see Features unavailable on 64-bit versions of the Windows Server family.

ASP.NET offers a new programming model and infrastructure for more secure, scalable, and stable applications that can target any browser or device. ASP.NET is part of Microsoft .NET Framework, a computing environment that simplifies application development in the highly distributed environment of the Internet.

.NET Framework includes the common language runtime, which provides core services such as memory management, thread management, code security, and the .NET Framework class library, a comprehensive and object-oriented collection of types that developers can use to create applications. Note that ASP.NET is not supported by 64-bit systems.

Active Server Pages

You can create dynamic content by using server-side scripting and components to create browser-independent dynamic content. Microsoft Active Server Pages (ASP) provides an easy-to-use alternative to Common Gateway Interface (CGI) and ISAPI by allowing content developers to embed any scripting language or server component into their HTML pages. ASP provides access to all of the HTTP request and response streams, as well as standards-based database connectivity and the ability to customize content for different browsers.

ADSI 2.0

ADSI 2.0 provides administrators and application developers the ability to add custom objects, properties, and methods to the existing ADSI provider, giving administrators even more flexibility in configuring their sites.

Wildcard Application Mappings

Wildcard application mappings provide administrators the ability to configure a Web site or virtual directory to run an ISAPI application at the beginning of every request to that Web site or virtual directory, regardless of the extension of the requested file.

Related Topics
  • For more information on ASP.NET, see ASP.NET and Creating ASP.NET Web Applications.
  • For more information on Active Server Pages, see ASP.
  • For more information on ADSI 2.0, see Using the IIS ADSI Provider.
  • For more information on wildcard application mappings, see Installing Wildcard Application Mappings.


Administrative Tools and Features

To meet the needs of a diverse set of customers, IIS provides a variety of manageability and administrative tools. Administrators can configure a server running IIS 6.0 with IIS Manager, administration scripts, or by directly editing the IIS plain-text configuration file. Administrators can also remotely administer IIS servers and sites.

new Plain-Text Metabase

The metabase is a repository for most IIS configuration values. Metabase reengineering has lead to dramatic improvements in server startup and shutdown times, in addition to enhancing overall metabase performance and usability. This version of IIS includes a plain-text .XML metabase configuration file, which can be edited manually or programmatically. The metabase is stored in two plain-text .XML formatted-files:

  • MetaBase.xml contains the configuration values for IIS.
  • MBSchema.xml stores the XML metabase schema and enforces correct metabase configuration.

Because both the MetaBase.xml and MBSchema.xml files are stored as plain text, they can be read using any plain-text editor.

new Storing Metabase History

You can quickly revert to a previous version of the metabase, thereby preventing long service interruptions. Automatic tracking of changes to the metabase are written to disk by copying each version of the metabase file into a history folder. Each history file is identified with a unique version number, which is then available for the metabase restore processes. A new set of Admin Base Object (ABO), WMI, and ADSI methods are exposed, which allows users to enumerate and restore the metabase configuration programmatically.

new Edit Metabase File While IIS Is Running

You can edit the metabase file directly while IIS is running and the changes are immediately applied to the in-memory metabase. This capability, known as edit-while-running, is possible because MetaBase.xml is a text file. Direct editing can be accomplished using common text tools, like Microsoft Notepad, when the edit-while-running feature is enabled.

new Import and Export Site and Application Configuration

In order to propagate site and application configuration settings across multiple servers for any node level, IIS supports two Admin Base Object (ABO) methods, Import() and Export(). Using these methods, you can export one node, or an entire tree, to an XML file from any level of the metabase, along with the inherited configuration, and then import one node, or an entire tree, from an XML file, as well as the inherited configurations. In addition you can password-protect secure data with these ABO methods.

new Create Server-Independent Metabase Backups

Using the BackupWithPassword() and RestoreWithPassword() methods of the ADSI IIsComputer object, you can programmatically back up or restore the metabase with a password. The session key is encrypted with an optional user-supplied password during backup and is not based on the machine key.

new Metabase Reliability

Using the configuration backup/restore feature, you can create a secure or unsecured backup of your metabase. Administrators can also restore copies of the metabase to other computers through IIS Manager. These backup methods provide a way to restore only your metabase settings, not your content files.

new IIS WMI Provider

The Windows Server 2003 family of products features Windows Management Instrumentation (WMI), a scalable management infrastructure, as a means to improve management of Windows servers in your environment. The IIS WMI provider provides a level of manageability that is functionally equivalent to the IIS ADSI provider, while supporting an extensible schema. Furthermore, schema extensions developed using ADSI are imported into the IIS WMI provider, making the benefits of WMI even greater.

new FTP User Isolation

FTP user isolation is a solution for Internet service providers (ISP) and application service providers that need to offer their customers individual FTP directories to upload files and Web content. FTP user isolation prevents users from viewing or overwriting other users' Web content by restricting users to their own directory. A user cannot navigate higher up the directory tree because the user's top-level directory appears as the root of the FTP service. Within the user's specific site, the user still has the ability to create, modify, or delete files and folders.

new FrontPage 2002 Server Extensions

FrontPage Server Extensions (FPSE) provide Web-based and command-line administration for extending virtual servers. Extending virtual servers with FPSE enables the site owner to author the site in FrontPage and delegate site ownership and administration credentials.

FPSE 2002 is an update of FrontPage 2000 Server Extensions, and includes new security features, such as roles and rights, and new features for monitoring server health and Web site usage.

new Command-Line Administration Scripts

Command-line administration makes it easier to perform management tasks efficiently. IIS provides scripts for the following tasks:

  • Create, delete, start, stop, and list Web sites
  • Create, delete, start, stop, and list FTP sites
  • Create or delete Web virtual directories
  • Create or delete applications
  • Export or import IIS configuration
  • Back up or restore IIS configuration

new UTF-8 Logging Support

IIS supports log file recording in UTF-8 that allows administrators to log their URL hits in their native language instead of English. This setting, configurable on the Web-service level, instructs the HTTP protocol stack (HTTP.sys) in which format to write the log files: UTF-8 or the local code page.

Remote Administration

IIS includes a variety of tools to help you remotely administer your IIS Web servers. These tools include the Remote Administration (HTML) tool, Terminal Services, and programmatic features like ADSI, WMI, and a new set of command-line administration scripts.

The IIS Remote Administration (HTML) tool allows you to remotely administer IIS across the Internet or your intranet through your Web browser.

Terminal Services is a feature of the Windows Server 2003 family of products that allows you to run 32-bit Windows applications on terminals and terminal emulators running on personal computers and other computer desktops. This enables you to remotely administer Windows services, such as IIS, as if you were at the server console. You can administrate from older legacy PCs, or even from devices such as UNIX workstations with compatible client software. However, non-Windows-based client devices require third-party add-on software.

Centralized Administration

Administration tools for IIS use Microsoft Management Console (MMC). MMC hosts programs, such as IIS Manager, that administrators can use to manage their servers. You can use IIS Manager from a computer running a member of the Windows Server 2003 family to administer a computer on your intranet running IIS on a Windows server product.

new Remotable Certification Object

Using scripts, you can process Secure Sockets Layer (SSL) certificates on your local or a remote computer. A Component Object Model (COM) object allows you to perform the add, remove, back up, and restore functions, which circumnavigates the constraints imposed by MMC.

For more information, see Managing Server Certificates Programmatically.


Internet Standards

IIS 6.0 offers support for the latest Web standards, including HTTP 1.1, TCP/IP, FTP, SMTP, NNTP, and PICS ratings.

Standards Based

IIS 6.0 complies with the HTTP 1.1 standard, which includes features such as PUT and DELETE, the ability to customize HTTP error messages, and support for custom HTTP headers.

Multiple Sites, One IP Address

With support for host headers, you can host multiple Web sites on a single server running a member of the Windows Server 2003 family with only one IP address. This is useful for Internet service providers and corporate intranets hosting multiple sites.

new IIS Extensions to FTP

IIS extends FTP in two significant areas. The IIS FTP User Isolation feature allows you to contain users to their own FTP directory, thus preventing them from viewing or overwriting other users' Web content. In addition, IIS supports multiple character sets for FTP, which allows your users access to their native-language worldwide.

new UTF-8 Support

Support for Unicode and UTF-8 now extends to file names and URLs. Active Server Pages (ASP) can open any file name using the Unicode file name string. UTF-8 URLs are converted to a Unicode representation and presented to ASP.

Web Distributed Authoring and Versioning

Web Distributed Authoring and Versioning (WebDAV) enables remote authors to create, move, or delete files, file properties, directories, and directory properties on your server over an HTTP connection.

News and Mail

You can use News Network Transport Protocol (NNTP) and Simple Mail Transport Protocol (SMTP) services to set up intranet news and mail services that work in conjunction with IIS.

PICS Ratings

You can apply Platform for Internet Content Selection (PICS) ratings to sites that contain content for mature audiences.

FTP Restart

FTP Restart enables File Transfer Protocol (FTP) file downloads to be resumed without having to download the entire file again if an interruption occurs during data transfer.

HTTP Compression

HTTP Compression provides faster transmission of pages between the Web server and compression-enabled clients. It compresses and caches static files, and performs on-demand compression of dynamically generated files.


What's Changed

There are some notable and important differences in default behavior and settings between IIS 4.0, IIS 5.0, IIS 5.1, and IIS 6.0.

This topic includes the following information:

  • Core Functionality and Services
  • Metabase Configuration
  • Administration
  • Programmatic Administration
  • Active Server Pages (ASP)
  • ASP Hang Detection
  • Security
  • Performance
  • IIS Utility Components
  • IIS on 64-bit Versions of the Windows Server 2003 Family

The following table summarizes the important differences between versions of IIS.

 | IIS 4.0 | IIS 5.0 | IIS 5.1 | IIS 6.0
Platform | Windows® NT® 4.0 | Windows 2000 | Windows XP Professional | Windows Server 2003 family
Architecture | 32-bit | 32-bit | 32-bit and 64-bit | 32-bit and 64-bit
Application process model | TCP/IP kernel MTX.exe | TCP/IP kernel DLLhost.exe (multiple DLL hosts in medium- or high-application isolation) | TCP/IP kernel DLLhost.exe (multiple DLL hosts in medium- or high-application isolation) | HTTP.sys kernel When IIS is running in IIS 5.0 isolation mode: Inetinfo.exe (for in-process applications) or DLLhost.exe (for out-of-process applications) When IIS is running in worker process isolation mode: W3wp.exe (multiple worker processes)
Metabase configuration | Binary | Binary | Binary | XML
Security | Windows authentication SSL | Windows authentication SSL Kerberos | Windows authentication SSL Kerberos Security wizard | Windows authentication SSL Kerberos Security wizard Passport support
Remote administration | HTMLA | HTMLA | No HTMLA Terminal Services | Remote Administration Tool (HTML) Terminal Services
Cluster support | In Windows NT 4.0 | IIS clustering | Windows support | Windows support
WWW services | IIS on Windows NT 4.0 | Personal Web Manager on Windows 9x IIS on Windows 2000 | IIS optionally on Windows XP Professional | IIS on a member of the Windows Server 2003 family

Core Functionality and Services

IIS 6.0 has been redesigned to take advantage of the base Windows kernel, HTTP.sys. This allows for built-in response and request caching and queueing, as well as the ability to route application process requests directly to the worker processes, which improves reliability and performance.

IIS 6.0 introduces two modes of operation in order to configure your application environments: worker process isolation mode and IIS 5.0 isolation mode. The default isolation mode upon installing IIS 6.0 depends on whether you perform a clean installation or an upgrade.

  • After a clean install of IIS 6.0, IIS runs in worker process isolation mode.
  • After an upgrade from an earlier version of IIS 6.0, the isolation mode is the same as configured on the previously-installed version of IIS 6.0.
  • After an upgrade from IIS 5.0 or IIS 4.0, IIS 6.0 runs in IIS 5.0 isolation mode by default to maintain compatibility with your existing applications.

For information on switching from one isolation mode to the other, see Configuring Isolation Modes.

IIS 5.0 Isolation Mode

IIS 5.0 isolation mode manages application processes in a similar fashion to the process management in IIS 5.0: all in-process applications run inside Inetinfo.exe, and out-of-process applications run in separate DLL hosts. Some existing applications may not have been written to run concurrently, or to store session state separately from the application. Therefore, running processes in IIS 5.0 isolation mode ensures compatibility for most existing applications. The following illustration shows how application processes are handled in IIS 5.0 isolation mode.

Standard application mode.

Worker Process Isolation Mode

When configured to execute in worker process isolation mode, all application code runs in an isolated environment. This design removes some of the existing bottlenecks. Worker process isolation mode allows the administrator to isolate anything from an individual Web application to multiple sites in their own self-contained worker process. This prevents one application or site from stopping another. In addition, separating applications or sites into their own process space simplifies a number of management tasks, such as restarts (independent of all other sites or applications running on the system), changing a component used by the application, debugging, monitoring counters, throttling resources, and so forth. The following illustration shows how applications are managed by IIS in worker process isolation mode.

Worker process isolation application mode.

HTTP requests are routed to the correct application pool queue, which means that user mode worker processes serving an application pool pull the requests directly from the kernel and eliminate the unnecessary process hops encountered when sending a request to an out-of-process DLL host. In IIS 6.0, there is no longer the notion of in-process applications; all necessary HTTP application run-time services, such as ISAPI extension support, are equally available in any application pool. This design prevents a malfunctioning HTTP application or Web site from disrupting other HTTP applications (or other Web sites) served from other processes on that computer. Unloading components becomes easier because with isolated application processes, the process can, if necessary, be terminated to unload all resources, with no effect on other content or applications being served from other processes. It is also beneficial to be able to leverage other operating system services available at the process level (for example CPU throttling), per application pool.

Furthermore, critical portions of worker process isolation mode that maintain the overall functioning of World Wide Web Publishing Service (WWW service) run entirely outside of the worker processes. The IIS 6.0 kernel-mode driver, HTTP.sys, which is the universal HTTP processor for Windows, and the WWW Service Administration and Monitoring component isolate the critical portions of the core Web server. Both of these components are protected and do not allow third-party code to be loaded into them. This design prevents a malfunctioning HTTP application from disrupting WWW services on the server.

For more information on isolation modes, see IIS Isolation Modes.

Metabase Configuration

The metabase for IIS 6.0 is stored in an XML file instead of in binary format as in past versions. The location remains the same, but the ways it can be manipulated — updated, rolled back, restored, and extended have changed. There are two significant files instead of one: MetaBase.xml and MBSchema.xml.

For more information about the IIS metabase, see About the Metabase.

Administration

  • In IIS 4.0, applications could either be run in the same process as the Internet service or in a separate process. In IIS 5.0 and 5.1, applications can be grouped into pooled processes for increased performance and improved scalability. For more information, see About Applications. In IIS 6.0 worker process isolation mode, applications can grouped in any number of application pools.
  • The Application Mappings property sheet contains a list of Hypertext Transport Protocol (HTTP) verbs that are processed by an application that is mapped to certain file types. This list of verbs represents a change from IIS 4.0. In IIS 4.0, the list contained verbs that were excluded, or not processed. This change was made to accommodate new HTTP verbs as they are added to the protocol. For more information on application mappings, see Setting Application Mappings.
  • Clustering is not a feature of IIS 6.0 (IISsynche.exe is not supported). Clustering is a feature of the Windows Server 2003 family. For information on Windows Clustering (MSCS), see Windows Server 2003 family Help .
  • The location of custom error files has changed from IIS 4.0 to IIS 5.0. For more information, see Enabling Detailed Custom Error Messages.
  • New custom error files have been added to report more detailed errors, as well as errors related to new features. For a complete list of available custom error messages, see About Custom Error Messages.
  • The Web-based Internet Services Manager (HTML) has beeappliance by a Web applicance. To remotely administer IIS using the Internet Services Manager (HTML), see How to Administer Servers Remotely.

Programmatic Administration

In previous versions of IIS, programmatic administration of IIS was possible with Admin Base Objects (ABO) from compiled C++ applications, or with Active Directory Services Interfaces (ADSI) from C++ or script files. IIS 6.0 includes a provider for Windows Management Instrumentation (WMI), a technology that allows administrators to control all services and applications programmatically. For more information, see Using the IIS WMI Provider. For information on new ADSI methods, see Metabase Changes for IIS 6.0.

Active Server Pages

Beginning with IIS 6.0, Microsoft Active Server Pages (ASP) can be used along with Microsoft ASP.NET. For information on configuring IIS to run ASP.NET applications, see ASP.NET. For news on changes to ASP functionality in IIS 6.0, see Important Changes in ASP.

ASP Hang Detection

When an IIS Web site is busy, there may be instances when the maximum number of ASP threads has been spawned and some of the ASP threads are hung, resulting in degraded performance. IIS 6.0 has the ability to solve the problem of hung threads by recycling the worker process that hosts that particular instance of the ASP ISAPI extension, ASP.dll. When ASP threads are hung in IIS 6.0, ASP.dll calls the ISAPI server support function HSE_REQ_REPORT_UNHEALTHY, and the WWW service recycles the worker process that hosts ASP.dll, and make an entry in the event log.

For more information on ISAPI server support functions, see ServerSupportFunction in the ISAPI Extension Reference at MSDN® Online.

Security

One of the most important changes in IIS 6.0 addresses Web server security. In order to take a more proactive stance against malicious users and attackers, IIS is not installed by default on members of the Microsoft Windows Server 2003 family.

important Important In order to take a more proactive stance against malicious users and attackers, IIS is not installed on members of the Microsoft® Windows® Server 2003 family by default. Furthermore, when you initially install IIS, the service is installed in a highly secure and "locked" mode. By default, IIS serves only static content — meaning features like ASP, ASP.NET, Server-Side Includes, WebDAV publishing, and FrontPage® Server Extensions do not work unless enabled. If you do not enable this functionality after installing IIS, IIS returns a 404 error. You can serve dynamic content and enable these features through the Web Service Extensions node in IIS Manager. Also, if an application extension is not mapped in IIS, IIS returns a 404 error. To map an extension, see Setting Application Mappings. For more information on how to troubleshoot 404 errors, including 404.2 and 404.3; issues related to a new installation of IIS 6.0; or an upgrade from a previous version of IIS, see Troubleshooting.

With the Web Server Certificate Wizard and the CTL Wizard, you can synchronize Web and NTFS security settings, obtain and install server certificates, and create and modify certificate trust lists. You can also select a cryptographic service provider (CSP) for encrypting data with a certificate. For more information, see Using Certificate Wizards.

Other security changes in IIS 6.0 include the following:

  • Disabled on upgrades: The World Wide Web Publishing Service (WWW service) is disabled on Windows Server 2003 family upgrades, unless one of the following is true:
    • You have already run the IIS Lockdown Wizard on your Windows 2000 Server before starting the upgrade process. The IIS Lockdown Wizard reduces surface attack by disabling unnecessary features, and it allows you to decide which features to enable for your site. The IIS Lockdown Wizard is available at IIS Lockdown Tool.

      important Important If you use the WWW service, we strongly recommend that you run the IIS Lockdown Wizard on your Windows 2000 Server before upgrading to a product in the Windows Server 2003 family. The IIS lockdown Wizard will help secure your computer by disabling or removing unnecessary features that are present in your Windows 2000 Server installation. These features would otherwise have remained on your machine after upgrading, leaving your server vulnerable to attacks.

    • The registry key RetainW3SVCStatus has been added to the registry under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W3SVC. Under RetainW3SVCStatus, you can add any value and then assign a DWORD value to it. For example, you can create the key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W3SVC\RetainW3SVCStatus\do_not_disable with the DWORD value of 1.
    • In the unattended install case, an entry "DisableWebServiceOnUpgrade = false" exists in the unattended install script.
  • Disabling IIS through Group Policy: With members of the Windows Server 2003 family, domain administrators can prevent users from installing IIS on their machines.
  • Running as an account with a low level of access rights: IIS worker processes run in a user context of few access rights. This drastically reduces the effect of potential attacks.
  • Secure ASP: All ASP built-in functions always run as the account with very few access rights, IUSR_computername.
  • Restriction on running executables: In order to run most executables in the system folder (such as cmd.exe) you must be a member of the Administrators group, the LocalSystem, Interactive, or Service account. This restriction limits remote access to Administrators, so anonymous users cannot run executables.
  • Patch management: With patch management, administrators can get the latest security patches installed without interrupting service.
  • Known extensions: IIS serves requests only to files with known file name extensions. The server rejects requests for content where the file name extension is not mapped to a known extension.
  • Write protection for content: Anonymous users (running as IUSR_computername account) are denied write access to Web content by default.
  • Timeouts and limits: In IIS 6.0, settings are set to aggressive and secure defaults to minimize attacks due to timeouts and limits that were previously too generous.
  • Upload data limitations: Administrators can limit the data that can be uploaded to a server.
  • Buffer overflow protection: Worker processes detect and exit programs if a buffer overflow is detected.
  • File verification: IIS verifies whether the requested content exists before it gives the request to a request handler (ISAPI extension).
  • Index this resource: This permission is now enabled by default.
  • Script source access: This permission, which allows access to the source code of scripts in ASP pages and other scripts, is new and is disabled by default. It is available if either the Read or Write permission is selected.
  • Sub-authentication: This is no longer enabled by default on a new installation of IIS 6.0. For more information, see the "Using Sub-Authentication" section in Anonymous Authentication.
  • UNC authentication: In this version of IIS, the UNC authentication method checks for user credentials. For more information, see UNC Authentication.
  • New policy: The Prevent IIS from Installing policy has been added to the Windows Server 2003 family of products. This policy allows a domain administrator to control which computers in the domain can install IIS. For more information, see Group Policy in Windows Help.
  • Fortezza: Support for this has been removed.

Performance

To limit the amount of memory allocated to ASP pages, IIS has set the default value of AspScriptFileCacheSize to 250 ASP pages, and the default value of AspScriptEngineCacheMax to 125 script engines. The ASPScriptFileCacheSize can be set higher on sites with a large set of frequently requested ASP pages. This improves performance because ASP page compilation is substantially slower than retrieving pages from cache. On a site with only a small number of frequently requested ASP pages, memory can be saved by setting this number to a smaller value.

IIS Utility Components

  • Collaboration Data Objects for Windows NT Server (CDONTS): CDONTS has been removed from the Windows Server 2003 family. If your Web applications use CDONTS, you can convert them to Microsoft Collaboration Data Objects (CDO). Most methods in CDONTS have matching methods in CDO, but might be named differently. For reference material for CDO in the Platform Software Developer Kit (PSDK), see Overview of CDO at MSDN Online.
  • IIS utility components not installed: Ad Rotator, Browser Capabilities, Content Linker, Content Rotator, Counters, Logging Utility, My Info, Page Counter, Status, and tools are not installed with IIS 6.0. However, if you upgrade your Web server from a previous version of IIS, the utility components are not removed. You can obtain copies of the utility component DLL files from the IIS 6.0 Resource Kit.

IIS on 64-bit Versions of the Windows Server 2003 Family

On the 64-bit versions of the Windows Server 2003 family of operating systems, IIS runs as a 64-bit application. This means that 32-bit applications cannot be called from IIS on the 64-bit versions of the Windows Server 2003 family of operating systems . For example, the Jet database engine will not convert to a 64-bit application, so you cannot use ActiveX® Data Objects (ADO) to open a Microsoft Access database from an ASP page. However, you can still use ADO to access other drivers, like SQL and Exchange.


IIS Manager

IIS Manager is a graphical interface for configuring your application pools or your Web, FTP, SMTP, or NNTP sites. With IIS Manager, you can configure IIS security, performance, and reliability features. You can add or delete sites; start, stop, and pause sites; back up and restore server configurations; and create virtual directories for better content management, to name only a few of the administrative capabilities. In previous releases of IIS, this tool was called the Internet Service Manager.

important Important In order to take a more proactive stance against malicious users and attackers, IIS is not installed on members of the Microsoft® Windows® Server 2003 family by default. Furthermore, when you initially install IIS, the service is installed in a highly secure and "locked" mode. By default, IIS serves only static content — meaning features like ASP, ASP.NET, Server-Side Includes, WebDAV publishing, and FrontPage® Server Extensions do not work unless enabled. If you do not enable this functionality after installing IIS, IIS returns a 404 error. You can serve dynamic content and enable these features through the Web Service Extensions node in IIS Manager. Also, if an application extension is not mapped in IIS, IIS returns a 404 error. To map an extension, see Setting Application Mappings. For more information on how to troubleshoot 404 errors, including 404.2 and 404.3; issues related to a new installation of IIS 6.0; or an upgrade from a previous version of IIS, see Troubleshooting.

To start IIS Manager

  • From the Start menu, point to Administrative Tools, and then click Internet Information Services (IIS) Manager.

To start IIS Manager from the Run dialog box

  1. From the Start menu, click Run.
  2. In the Open box, type inetmgr, and click OK.

You can also access IIS from the Computer Management window. Accessing IIS in this way does not give you the range of administration options offered by IIS Manager; however, it does offer quick access and limited management options for your Web sites.

To start IIS Manager from the Computer Management window

  1. From the Start menu, right-click My Computer, and click Manage.
  2. In the console tree, expand the Services and Applications node.
  3. Click Internet Information Services. The names and states of your Web sites appear in the details pane.
  4. In the console tree, expand the Internet Information Services node and any subsequent Web site nodes to see a list of directories and virtual directories for that Web site.
Related Topics
  • For more information on using IIS Manager and administering IIS, see the Server Administration Guide.
  • For information on administering IIS remotely, see How to Administer Servers Remotely.


Frequently Asked Questions

  1. Why do features like FrontPage Server Extensions, WebDAV publishing, ASP, and server-side includes not work on IIS 6.0 by default?
  2. What is a Web service extension and how do I use the Web Service Extensions folder?
  3. How do I publish documents or Web pages?
  4. How do I create a virtual directory on a Web or FTP site?
  5. How do I create a Web site?
  6. How do I create multiple Web sites?
  7. How do I replicate Web content?
  8. How do I stop and restart Internet services?
  9. Where can I find information on accessibility features for disabled users?
  10. How do I get technical support for IIS?
  11. Can I change the name of my Web site and also redirect requests for the old site name to the new one?
  12. Can I use IIS Manager to remotely administer my site through a proxy server?
  13. How do I determine whether my drive is configured to use NTFS?
  14. How do I convert a drive or partition formatted for the file allocation table (FAT) file system to the NTFS file system?
  15. Can I set up an FTP site with different levels of access for different users?
  16. How can I confirm that a server certificate is attached to a Web site?
  17. Can I attach more than one server certificate to a Web site?
  18. Can I attach the same server certificate to more than one site?
  19. Can I attach a server certificate to an FTP site?
  20. Should I create a backup copy of my server certificate?
  21. How do I determine how many users are connected to my FTP service?

  1. Why do features like FrontPage Server Extensions, WebDAV publishing, ASP, and server-side includes not work on IIS 6.0 by default?

    In order to take a more proactive stance against malicious users and attackers, IIS is not installed on members of the Microsoft Windows Server 2003 family by default. Furthermore, when you initially install IIS, the service is installed in a highly secure and "locked" mode. By default, IIS serves only static content — meaning features like ASP, ASP.NET, server-side includes, WebDAV publishing, and FrontPage® Server Extensions do not work. You can serve dynamic content and "unlock" these features through the Web Service Extensions node in IIS Manager.

    For more information, see Security.

  2. What is a Web service extension and how do I use the Web Service Extensions folder?

    The Web Service Extensions folder is the user interface for the new IIS 6.0 lockdown feature. This feature is a manifest of ISAPI extensions and CGIs with user-specified permissions, meaning, administrators must set the permissions to allow specific ISAPIs and CGIs to run on your server. Administrators can also specify the names of ISAPIs or CGIs that are forbidden to run on your server. Before loading an ISAPI extension .dll file or CGI .exe file, IIS checks this manifest for the permissions on the file. If the file is permitted to run, then the request proceeds normally. If the file is not permitted to run, then IIS returns a 404.2 error response to the client machine. The HTML page for a 404.2 error looks like a standard 404 error page, so the client machine processes the request as though the file did not exist. IIS logs the 404.2 error, which administrators can view to assess problems or potential threats against the server. For more information, see Enabling and Disabling Dynamic Content.

  3. How do I publish documents or Web pages?
    1. Move your files to the \Inetpub\Wwwroot directory.
    2. Type http://servername/filename in the address bar of your Internet browser to see your published files.

    For more information, see Site Setup.

  4. How do I create a virtual directory on a Web or FTP site?

    You can use IIS Manager to create virtual directories on your Web site. For procedural information on how to accomplish this task, see Using Virtual Directories.

  5. How do I create a Web site?

    When you install IIS on a computer running a member of the Windows Server 2003 family, a default Web site is set up for you. You can publish your content here immediately.

    For more information, see Adding Web Sites to Your Server.

  6. How do I create multiple Web sites?

    To create multiple Web sites, you must first ensure that each site has unique identification. To accomplish this, you need to contact your network administrator to either obtain multiple IP addresses or to assign multiple host header names. For more information, see Domain Name Resolution.

  7. How do I replicate Web content?

    You can use the Content Deployment service (formerly known as the Content Replication System, or CRS) to replicate content and settings across servers in a Web cluster. Content Deployment is a feature of Microsoft Site Server. For more information about Content Deployment service, see Site Server Help.

  8. How do I stop and restart Internet services?

    Internet services are most effectively shut down and restarted differently from other Windows services. For information about stopping and restarting IIS, see Restarting IIS.

  9. Where can I find information on accessibility features for disabled users?

    For general information on accessibility for Windows, see Accessibility for People with Disabilities.

    For information on navigating the IIS Help viewer, see Using Help Viewer Keyboard Shortcuts.

  10. How do I get technical support for IIS?

    If IIS was pre-installed as part of an original equipment manufacturer (OEM) package, or if it was otherwise included with your personal computer purchase, you must contact the manufacturer of your computer or server for technical support. Refer to the documentation that came with your computer or server for the telephone number of the manufacturer.

    If you acquired this product separately at retail, and have a technical question that you cannot answer by using IIS Help, see the Microsoft Personal Online Support Web site.

  11. Can I change the name of my Web site and also redirect requests for the old site name to the new one?

    You can configure your Web site to respond to both the old name and the new name, provided your network correctly routes both requests to your computer. This way, visitors can still reach your site by using the old name, and will be informed of the new name. For instructions on how to assign names, see Naming Web Sites.

  12. Can I useIIS Manager to remotely administer my site through a proxy server?

    Yes. To learn about remote administration using IIS Manager and other tools, see How to Administer Servers Remotely.

  13. How do I determine whether my hard disk is configured to use the NTFS file system?

    1. In Windows Explorer, right-click the drive, and click Properties to open its property sheet.
    2. On the General tab, the file system type is listed.

  14. How do I convert a drive or partition formatted for the FAT file system to the NTFS file system?

    At the command prompt, type convert drive letter: /FS:NTFS.

    An NTFS drive cannot be converted back to FAT. For more information, see Windows Help.

  15. Can I set up an FTP site with different levels of access for different users?

    To limit access to only certain computers

    1. In IIS Manager, right-click the FTP site, and click Properties.
    2. Click the Directory Security tab, and click Edit.
      You can assign or deny access to all computers or subnets except those you specify.

    On an NTFS file system, you could also use a single virtual directory and set the NTFS permissions to assign or deny different types of access to different Windows user accounts. For more information, see Isolating FTP Users.

  16. How can I confirm that a server certificate is attached to a Web site?
    1. In IIS Manager, right-click the Web site, and click Properties.
    2. Click the Directory Security tab.
    3. Under Secure communications, if the View Certificate button is activated, there is a certificate attached to the Web site.
      If the button is not activated, you must attach a server certificate to the site to use the Secure Sockets Layer (SSL) features.

  17. Can I attach more than one server certificate to a Web site?

    No. Each Web site can have only one server certificate attached to it.

  18. Can I attach the same server certificate to more than one site?

    Yes. A server certificate can be attached to as many Web sites is needed.

  19. Can I attach a server certificate to an FTP site?

    No. FTP sites do not support Secure Sockets Layer (SSL) features.

  20. Should I create a backup copy of my server certificate?

    Yes. Your server certificate is a valuable investment, and is the key to your server's Secure Sockets Layer features. To create a backup copy of your server certificate, copy the entire certificate on to a floppy disk and store it in a safe place.

  21. How do I determine how many users are connected to my FTP service?
    1. In IIS Manager, right-click an FTP site, and click Properties.
    2. On the FTP Site tab, click Current Sessions.
      The FTP User Sessions dialog box appears indicating the number of connected users.

    For more information, see Performance Tuning.

(The following words are used by Search; they are not intended to be displayed on the page.) trouble, troubles, troubleshoot, fix, repair, quick, quick start, easy, shortcut, shortcuts, basic, basics, intro, introductory, introduction, overview, beginner, begin, start, novice, intermediate, faq, frequently asked questions, publish, web pages, create, virtual directory, create, new, add, host, web site, web sites, website, websites, multiple, many, several, browser, compatibility, compatible, browsers, different versions, design, disabled, accessibility, disabled persons, blind, paralyzed, dyslexic, voice, handicapped, tech support, product support, phone support, helpdesk, help, assistance, redirect, change, site name, older browsers, versions, host name headers, hostname header, http, request, remote, remotely, mmc, proxy server, browser-based, admin, across network, over internet, internet service manager, internet services manager, ism, html, ntfs, ntlm, fat, convert, partition, ftp, security, server certificate, certificates, readme, relnotes, rel notes, summary, common, usual, release notes, latest, late-breaking, recent, other, appendix, addenda, addendum, new, newer, newest, last-minute, doc, docs, corrections, documented, undocumented, known problems, problem, help me, get help, support, tech support, tech-support, product support, trouble, troubleshoot, troubleshooting, error, errors, crash, crashed, crashing, break, broken, doesn't work, keeps failing, fail, new, upgrade, old, bad, crashes, xml, extensible markup language, streaming media, audio, video, net stop w3svc, net stop iisadmin, net start w3svc, net start iisadmin, restarting IIS, IISReset.exe, IISReset


Resources

The following is a list of Web sites that can provide helpful supplemental information that isn't included in this documentation set. The links, including their content, are subject to change without notice.

  • Internet Information Services
  • Internet Information Services Software Development Kit
  • Microsoft
  • Microsoft Windows
  • Microsoft TechNet
  • Microsoft Service Providers
  • Microsoft Windows Update
  • MSDN Online
  • MSDN Active Server Pages Guide
  • ASP Reference
  • ASP.NET
  • Microsoft .NET Framework Community
  • Microsoft .NET Framework Software Development Kit
  • Microsoft Universal Data Access
  • Microsoft Press Online
  • Microsoft FrontPage
  • Microsoft Product Support Services
  • InterNIC List of Acccredited Domain Registrars
  • World Wide Web Consortium
  • ASP Reference Sites
  • IIS Answers
  • 15 Seconds
  • Internet Engineering Task Force
  • National Security Agency - Information Systems Security Organization
  • 25+ ASP Tips to Improve Performance and Style


Release Notes

The release notes for Internet Information Services (IIS) 6.0 are incorporated into the release notes for the Microsoft® Windows® Server 2003 family of products. For late-breaking technical information, known problems, and upgrade information, please refer to the following: readme.htm, relnotes.htm, read1st.txt, and \docs\*.txt.


Before Configuring IIS

Before configuring IIS, it is important to understand issues users sometimes face. By addressing these issues now, you can enjoy a smoother configuration process. This topic outlines these issues and also links you to additional information that you might want to review before beginning your IIS configuration.

This topic includes the following information:

  • Internet Connection Firewall
  • Remote Administration
  • IP Address and Domain Name Registration
  • Permissions and Access Control

Internet Connection Firewall

The Windows Server 2003 family provides a software-based firewall to prevent unauthorized connections to your server from remote computers. The Internet Connection Firewall is disabled by default; however, if you have enabled the firewall in its default configuration after installing a member of the Windows Server 2003 family and before installing IIS, clients will not be able to connect to your server. The following procedure configures Internet Connection Firewall to allow clients to initiate Web and other IIS-related connections to your server.

important Important You must be a member of the Administrators group on the local computer to perform the following procedure (or procedures), or you must have been delegated the appropriate authority. As a security best practice, log on to your computer using an account that is not in the Administrators group, and then use the Run as command to perform this procedure as an Administrator.

To configure Internet Connection Firewall for IIS

  1. From the Start menu, click Control Panel.
  2. Double-click Network Connections.
  3. Right-click the Local Area Connection, and click Properties.
  4. Click the Advanced tab.
  5. If you do not want to use the Internet Connection Firewall, make sure the Protect my computer and network by limiting or preventing access to this computer from the Internet check box is disabled, and click OK.
  6. If you do want to use the Internet Connection Firewall, make sure the Protect my computer and network by limiting or preventing access to this computer from the Internet check box is enabled, and click Settings.
  7. On the Services tab, enable a service to which you want to allow access to clients.
  8. In the Service Settings dialog box that appears after enabling a service, do one of the following:
    • If you are enabling a service on the same computer on which you are working, the correct computer name is already filled in. Click OK.
    • If you are enabling a service on a different computer on your network, type the name or IP address of the computer hosting the service you are enabling, and click OK.
  9. Repeat steps 7 and 8 until all the services you want accessible to clients are enabled.

Remote Administration

Many network administrators configure servers remotely, that is, from a computer other than the server being configured. If you are installing IIS on one server, and configuring and administering that IIS installation from a different computer, you should configure Remote Administration on the server running IIS. You can use the following tools for this purpose:

  • IIS Manager: You can use IIS Manager on your server to remotely connect to and administer an intranet server running IIS 4.0, IIS 5.0, or IIS 5.1 (IIS 3.0 is not supported).
  • Terminal Services: Terminal Services does not require you to install IIS Manager on the remote client computer because, once connected to the server running IIS, you use IIS Manager on the Web server as if logged on locally.
  • Remote Administration (HTML) Tool: You can use the Remote Administration (HTML) tool to administer your IIS Web server from any Web browser on your intranet. This version of the Remote Administration tool runs only on servers running IIS 6.0.

For information on how to configure remote administration, see How to Administer Servers Remotely.

IP Address and Domain Name Registration

If you are configuring IIS on a server connected directly to the Internet, that is, not within a corporate network or behind a router, you must have on hand the IP address and domain name of each site you will create in this IIS configuration. For more information, see Domain Name Resolution and Hosting Multiple Web Sites on a Single Server.

If you are configuring IIS on a server within a corporate network or behind a router, you must ask the network administrator for an IP address, and if applicable, to configure the router and/or firewall to allow traffic to flow to and from the IIS server. Registering a domain name is usually not necessary in these cases because IIS servers within a corporate network are typically for Intranet use only.

When obtaining IP addresses for your Web sites, make sure they are static IP addresses. Dynamic IP addresses are not suitable for any kind of IIS configuration.

Permissions and Access Control

If you are configuring IIS so that it will be relying on other servers or network components, such as routers, to serve content, make sure that the other servers or network components have been configured to allow access to the IIS server, and that you have the appropriate authentication information on hand before you begin configuring IIS. For more information, see Authentication and Access Control.
Related Topics
  • For a checklist of additional issues to consider before configuring IIS, see Application server role: Configuring an application server in Windows Help.


Installing IIS

This topic describes the following methods for installing IIS:

  • Using the Configure Your Server Wizard.
  • Using Add or Remove Programs from Control Panel.
  • Using unattended setup.

This topic also lists the directories created on install, describes the IIS initial configuration backup, and briefly describes IIS optional components.

important Important In order to take a more proactive stance against malicious users and attackers, IIS is not installed on members of the Microsoft® Windows® Server 2003 family by default. Furthermore, when you initially install IIS, the service is installed in a highly secure and "locked" mode. By default, IIS serves only static content — meaning features like ASP, ASP.NET, Server-Side Includes, WebDAV publishing, and FrontPage® Server Extensions do not work unless enabled. If you do not enable this functionality after installing IIS, IIS returns a 404 error. You can serve dynamic content and enable these features through the Web Service Extensions node in IIS Manager. Also, if an application extension is not mapped in IIS, IIS returns a 404 error. To map an extension, see Setting Application Mappings. For more information on how to troubleshoot 404 errors, including 404.2 and 404.3; issues related to a new installation of IIS 6.0; or an upgrade from a previous version of IIS, see Troubleshooting.

Microsoft strongly recommends installing IIS on an NTFS-formatted drive. NTFS is a more powerful and secure file system than FAT and FAT32. For more information, see NTFS Permissions.

important Important You must be a member of the Administrators group on the local computer to perform the following procedure (or procedures), or you must have been delegated the appropriate authority. As a security best practice, log on to your computer using an account that is not in the Administrators group, and then use the Run as command to perform this procedure as an Administrator.

To install IIS using the Configure Your Server Wizard

  1. From the Start menu, click Manage Your Server.
  2. Under Managing Your Server Roles, click Add or remove a role.
  3. Read the preliminary steps in the Configure Your Server Wizard and click Next.
  4. Under Server Role, click Application server (IIS, ASP.NET) and then click Next.
  5. Read the summary and click Next.
  6. Click Finish.

note Note The Configure Your Server Wizard enables ASP.NET by default, unlike the Add/Remove Windows components install method below.

For more information on the Configure Your Server Wizard, see Configuring Your Server Wizard in Windows Help.

To install IIS, add components, or remove components using Control Panel

  1. From the Start menu, click Control Panel.
  2. Double-click Add or Remove Programs.
  3. Click Add/Remove Windows Components.
  4. In the Components list box, click Application Server.
  5. Click Details.
  6. Click Internet Information Services Manager.
  7. Click Details to view the list of IIS optional components. For a detailed description of IIS optional components, see Optional Components in this topic.
  8. Select all optional components you wish to install.

    9. note Note The World Wide Web Publishing Service optional component includes important subcomponents like the Active Server Pages component and Remote Administration (HTML). To view and select these subcomponents, click World Wide Web Publishing Service and then click Details.

  9. Click OK until you are returned to the Windows Component Wizard.
  10. Click Next and complete the Windows Component Wizard.

Unattended Setup

To simplify the process of setting up IIS on multiple computers running a a member of the Windows Server 2003 family, you can run setup unattended. To do this, create and use an answer file, which is a customized script that automatically answers the setup questions. Then, run Winnt32.exe with the appropriate options for unattended setup. The IIS 6.0 options for unattended setup are:

Component | Unattended .inf parameter
Application Server | n/a (A parent object in OCM)
ASP.NET # | aspnet = on/off
Enable network COM+ Access | complusnetwork = on/off
Enable network DTC Network Access | dtcnetwork = on/off
Internet Information Services | n/a (A parent object in OCM)
BITS Server Extensions | n/a (A parent object in OCM)
BITS Server Extensions ISAPI | bitsserverextensionsisapi = on/off
BITS Server Extensions Snap-in | bitsserverextensionsmanager = on/off
Common Files | iis_common = on/off
File Transport Protocol (FTP) Services | iis_ftp = on/off
FrontPage 2002 Server Extensions | fp_extensions = on/off
IIS Manager | iis_inetmgr = on/off
NNTP Service | iis_nntp = on/off
SMTP Service | iis_smtp = on/off
World Wide Web Publishing Service | n/a (A parent object in OCM)
Active Server Pages | iis_asp = on/off
Internet Data Connector | iis_internetdataconnector = on/off
Remote Administration (HTML) *# | sakit_web = on/off
Remote Desktop Web Connection | tswebclient = on/off
Server-Side Includes | iis_serversideincludes = on/off
WebDAV Publishing | iis_webdav = on/off
WWW Service | iis_www = on/off
Application Server Console # | appsrv_console = on/off

* Must be installed through the Add/Remove Windows Components item in Control Panel after the operating system has been installed.

# Not available on Itanium-based computers running Windows XP 64-Bit Edition, the 64-bit version of Windows Server 2003, Enterprise Edition, or the 64-bit version of Windows Server 2003, Datacenter Edition.

Also note the following:

[InternetServer]

  • SvcManualStart = www and/or ftp
  • PathFTPRoot = path to FTProot
  • PathWWWRoot = path to WWWroot
  • ApplicationDependency = ApplicationName, GroupID, GroupID
  • ExtensionFile = access, path, UI deleteable, short description, long description
  • DisableWebServiceOnUpgrade = True/False; The default for this parameter is true. In order to reduce the attack surface, IIS is turned off after an upgrade. This unattended setup parameter can be used to keep IIS on after an upgrade.

To use an x86-based computer to view the command options available for Winnt32.exe

  1. On a computer running Windows 95, Windows 98, Windows Millennium Edition, Windows NT, Windows 2000, Windows XP, or a member of the Windows Server 2003 family, insert the Setup CD for a member of the Windows Server 2003 family in the CD-ROM drive.
  2. From the Start menu, click Run.
  3. In the Open box, type cmd, and click OK.
  4. At the command prompt, change to the CD-ROM drive, change to the I386 directory, type winnt32 /?, and press ENTER.

To use an Itanium-based computer to view the command options available for Winnt32.exe

  1. On an Itanium-based computer running Windows XP 64-Bit Edition, the 64-bit version of Windows Server 2003, Enterprise Edition, or the 64-bit version of Windows Server 2003, Datacenter Edition insert the Setup CD for the 64-bit version of the product into the CD-ROM drive.
  2. From the Start menu, click Run
  3. In the Open box, type cmd, and click OK.
  4. At the command prompt, change to the CD-ROM drive, change to the IA64 directory, type winnt32 /?, and press ENTER.

To install IIS using scripts after you have installed and set up a member of the Windows Server 2003 family, use Sysocmgr.exe with an unattended setup file and the unattended setup options listed above.

To install IIS using scripts after the operating system has already been installed

  1. From the Start menu, click Run.
  2. In the Open box, type cmd, and click OK.
  3. At the command prompt, type Sysocmgr.exe /i:sysoc.inf /u:%path_to_unattend_file%, and press ENTER.
  4. At the command prompt, type Sysocmgr.exe/?, and press ENTER to view Sysocmgr.exe Help.

IIS Directories

IIS installs the following directories:

  • \InetPub
  • systemroot\Help\IISHelp
  • systemroot\System32\InetSrv
  • systemroot\System32\InetSrv\MetaBack

These directories contain user content and cannot be moved. You can, however, select the location of your Wwwroot and Ftproot directories at installation by using a script during unattended setup. If you uninstall IIS, the IISHelp directory is removed. The InetPub and InetSrv directories remain on your computer.

IIS Initial Configuration Backup

When you first install IIS, a backup of the initial metabase configuration is automatically created in the systemroot\System32\InetSrv\MetaBack directory. This backup can be used to restore the IIS configuration to its state immediately following IIS installation. This is a useful tool for solving metabase corruption or configuration problems, and can help you recover a known good configuration without needing to reinstall IIS. This backup is not password protected, and can only be used to restore settings on the system on which it was created. SeeBacking Up and Restoring the Metabase for information about restoring the initial IIS configuration backup.

It is strongly recommended that following IIS installation, and before any configuration changes are made, you create a password-protected backup of the IIS configuration. Unlike the automatic initial configuration backup, a password-protected backup is system independent, and can be used to restore settings on other systems running IIS 6.0. SeeBacking Up and Restoring the Metabase for information about creating a password-protected backup of the IIS configuration.

Optional Components

IIS includes optional components that you can enable or disable at anytime through the Add or Remove Programs item in Control Panel, or using unattended setup. Descriptions of these components and the impact to your current IIS settings are described below.

Files for Active Server Pages (ASP), Internet Data Connector, server-side includes, and WebDav are installed, but disabled by default on a clean installation. All IIS functionality is enabled by default on an upgrade. When one of these components is selected or cleared from the Windows Components Wizard or by using an unattended file, the component is enabled or disabled in the WebSvcExtRestrictionList metabase property.

BITS Server Extensions

The Background Intelligent Transfer Service (BITS) is a background file transfer mechanism and queue manager, also known as a drizzle service. BITS throttles file requests to minimize bandwidth consumption and enhance the end-user experience. Enable BITS with IIS to maintain Web server quality of service. From the Windows Components Wizard, click Details to enable the following BITS Server components:

  • BITS Server Extensions ISAPI: Enable this option to drizzle IIS requests with the help of the BITS server.
  • BITS Server Extensions Snap-in: Enable this option to access and view the BITS graphical user interface (GUI).

Common Files

For the sake of added security in your server environment, you may choose to deselect some of the common files. However, if you deselect the Common Files option, all of the common files are subsequently deselected and IIS will not be installed on your machine. Therefore, if you want to install IIS on your computer, leave this option selected. If you want to limit the services and components installed with IIS, deselect the individual components that are listed below the Common Files component.

File Transfer Protocol (FTP) Server

The File Transfer Protocol (FTP) is used to copy files to and from remote computer systems on a network that uses Transmission Control Protocol/Internet Protocol (TCP/IP).

FrontPage 2002 Server Extensions

FrontPage 2002 Server Extensions allow you to view and manage a Web site in a graphical user interface using FrontPage as the authoring environment. FrontPage allows you to quickly create Web sites on your server, as well as, create, edit, and post Web pages to IIS remotely. While you are creating your site, FrontPage keeps a connection open to IIS, saving and changing the Web files so you can view your site. If you choose not to install the FrontPage Server Extensions, you will have to manually copy all of your Web content, configure your settings, and in some cases, manually register applications already registered in FrontPage. Microsoft FrontPage Server Extensions are not supported for resources in Microsoft Clustering.

Internet Information Services Manager

IIS Manager is a graphical user interface to administer your Web site. In previous releases of IIS, this tool was called the Internet Service Manager. Without IIS Manager, you can still manage your server, but you must use coded scripts that call on the IIS APIs to create sites, applications, virtual directories, and security settings.

NNTP Service

Use Network News Transfer Protocol (NNTP) to distribute network news messages to NNTP servers and to NNTP clients (news readers) on the Internet. NNTP provides for the distribution, inquiry, retrieval, and posting of news articles by using a reliable stream-based transmission of news on the Internet. NNTP is designed so that news articles are stored on a server in a central database, thus users can select specific items to read. Indexing, cross-referencing, and expiration of aged messages are also provided.

If you have NNTP installed, you can view Microsoft News (NNTP) Service Help by typing file:\\%systemroot%\help\news.chm in your browser address bar and pressing ENTER.

SMTP Service

Use Simple Mail Transfer Protocol (SMTP) to set up intranet mail services that work in conjunction with IIS. SMTP is a TCP/IP protocol for sending messages from one computer to another on a network. This protocol is used on the Internet to route e-mail.

If you have SMTP installed, you can view Microsoft Mail (SMTP) Service Help by typing file:\\%systemroot%\help\mail.chm in your browser address bar and pressing ENTER.

World Wide Web Publishing Service

IIS serves pages to the Internet and the World Wide Web. This component must be installed for IIS to perform its primary service. If you do not select this option, you disable IIS.

The World Wide Web Publishing Service (WWW service) includes the following subcomponents:

  • Active Server Pages: Select to enable ASP on your server. If this option is not selected, all .asp requests return a 404 error.
  • Internet Data Connector: Select to enable Internet Data Connector on your server. If this option is not selected, all .idc requests return a 404 error.
  • Remote Administration (HTML): Select to enable remote Web administration of your IIS Web server from any Web browser on your intranet. Once you install IIS and view your Web sites through IIS Manager, IIS creates a site called Administration.
  • Remote Desktop Web Connection: Select to enable connectivity to a computer’s desktop from a remote location and run applications as if you were sitting at the console.
  • Server-side includes: Select to enable server-side include files on your server. If this option is not selected, all .shtm, .shtml, and .stm requests return a 404 error.
  • WebDAV Publishing: Select to allow Web Distributed Authoring and Versioning (WebDAV) on your server. WebDAV is similar to File Transfer Protocol, with the exception being that WebDAV allows any WebDAV client to publish and change content in a WebDAV directory using HTTP.
  • Web Site Administration: Select to install the World Wide Web Publishing Service. If this option is not selected, IIS does not run on your server.
Related Topics
  • For information on unattended setup, see Planning for Unattended Setup.


Common Administrative Tasks

This section provides procedures and conceptual information for completing common administrative tasks. Some of the tasks are new to this version of IIS, others are similar to previous versions, but the procedures have changed. Some tasks remain unchanged, but may be unfamiliar to new administrators.

This section includes the following information:

  • How to Enable Web Service Extensions: Describes the state of the default installation and how to enable Web service extensions.
  • How to Create Web or FTP Sites: Describes how to create Web site configurations and how to install and use FTP services.
  • How to Create Virtual Directories: Describes how to create virtual directories within Web and FTP sites.
  • How to Set Authentication Settings: Describes how to set up and use user authentication methods.
  • How to Create Application Pools: Describes how to group Web applications into application pools.
  • How to Create and Isolate Applications: Describes how to create and manage applications.
  • How to Obtain and Back Up SSL Certificates: Describes how to set up and use Secure Sockets Layer (SSL) certification on your sites.
  • How to Back Up and Restore the Metabase: Describes how to back up your site configurations.
  • How to Redirect Web Sites: Describes how to automatically direct users to the correct page on your site.
  • How to Host Multiple Web Sites: Describes how to create and host multiple Web sites.
  • How to Assign Resources to Applications: Describes how to control the amount of resources an application uses.
  • How to Control Access to Applications: Describes how to secure your applications with permissions and restrictions.
  • How to Enable ASP.NET: Describes how to take advantage of dynamic content by enabling ASP.NET.
  • How to Enable ASP Pages: Describes how to "unlock" Active Server Pages.
  • How to Save Configurations: Describes how to save metabase and application configurations.
  • How to Start and Stop Services: Describes how to start and stop IIS services.
  • How to Configure Recycling: Describes how to periodically restart worker processes assigned to an application pool.
  • How to Administer Servers from the Command Line: Describes how to use powerful scripting and programming tools to access and configure settings.
  • How to Administer Servers Remotely: Describes the tools to use to administer your sites.


How to Enable Web Service Extensions

In order to take a more proactive stance against malicious users and attackers, IIS is not installed on members of the Microsoft® Windows® Server 2003 family by default. Furthermore, when you initially install IIS, the service is installed in a highly secure and "locked" mode. By default, IIS serves only static content — meaning features like ASP, ASP.NET, Server-Side Includes, WebDAV publishing, and FrontPage® Server Extensions do not work unless enabled. If you do not enable this functionality after installing IIS, IIS returns a 404 error. For more information on how to troubleshoot 404 errors, including 404.2 and 404.3; issues related to a new installation of IIS 6.0; or an upgrade from a previous version of IIS, see Troubleshooting.

important Important You must be a member of the Administrators group on the local computer to perform the following procedure (or procedures), or you must have been delegated the appropriate authority. As a security best practice, log on to your computer using an account that is not in the Administrators group, and then use the Run as command to run IIS Manager as an administrator. From the command prompt, type runas /user:administrative_accountname "mmc %systemroot%\system32\inetsrv\iis.msc".

To enable Web service extensions
  1. In IIS Manager, click the Web Service Extensions folder.
  2. In the details pane, select the Web service extension you wish to enable, and then click Allow.
  3. To see the properties of a Web service extension, select an extension, and then click Properties.
Related Topics
  • For more information on Web service extensions, see Enabling and Disabling Dynamic Content.


How to Create Web or FTP Sites

IIS creates a default Web site configuration on your hard disk at the time of installation. You can use the \Inetpub\Wwwroot directory to publish your Web content, or create any directory or virtual directory you choose. The File Transfer Protocol (FTP) service must be installed and started in order to create an FTP site. It is not installed by default.

Creating a Web or FTP site using IIS Manager does not create content, but merely creates a directory structure and configuration files from which to publish the content.

important Important You must be a member of the Administrators group on the local computer to perform the following procedure (or procedures), or you must have been delegated the appropriate authority. As a security best practice, log on to your computer using an account that is not in the Administrators group, and then use the Run as command to run IIS Manager as an administrator. From the command prompt, type runas /user:administrative_accountname "mmc %systemroot%\system32\inetsrv\iis.msc".

To use the default Web site
  1. In IIS Manager, expand the local computer, expand the Web Sites folder, right-click Default Web Site, and click Properties.
  2. On the Web Site tab, under Web site description, type the name of your Web site in the Description box.
  3. Click OK. The name of the new site appears in IIS Manager.
To create a new Web site
  1. In IIS Manager, expand the local computer, right-click the Web Sites folder, point to New, and then click Web Site. The Web Site Creation Wizard appears.
  2. Click Next.
  3. In the Description box, type the name of your site, and then click Next.
  4. Type or click the IP address (the default is All Unassigned), TCP port, and host header (for example, www.mysite.com) for your site, and then click Next.
  5. In the Path box, type or browse to the directory that contains, or will contain, the site content, and then click Next.
  6. Select the check boxes for the Web site access permissions you want to assign to your users, and then click Next.
  7. Click Finish.
  8. To change these and other settings later, right-click the Web site, and click Properties.
To install FTP services
  1. From the Start menu, click Control Panel.
  2. Double-click Add or Remove Programs.
  3. Click Add/Remove Windows Components.
  4. From the Components list box, click Application Server, and then click Details.
  5. From the Subcomponents of Application Server list box, click Internet Information Services (IIS), and then click Details.
  6. From the Subcomponents of Internet Information Services list box, select the File Transfer Protocol (FTP) Service check box.
  7. Click OK twice.
  8. Click Next. You might be prompted for the Windows Server 2003 family CD or the network install path.
  9. Click Finish, and then click Close.

    10. note Note IIS Manager creates a default FTP site during the FTP services installation. You can use the \Inetpub\Ftproot directory to publish your content, or you can create another.

To create a new FTP site
  1. In IIS Manager, expand the local computer, right-click the FTP Sites folder, point to New, and click FTP Site. The FTP Site Creation Wizard appears.
  2. Click Next.
  3. In the Description box, type the name of your site, and then click Next.
  4. Type or click the IP address (the default is All Unassigned) and TCP port for your site, and then click Next.
  5. Click the user isolation option you want, and then click Next.
  6. In the Path box, type or browse to the directory that contains or will contain shared content, and click Next.
  7. Select the check boxes for the FTP site access permissions you want to assign to your users, and then click Next.
  8. Click Finish.
  9. To change these and other settings later, right-click the FTP site, and then click Properties.
Related Topics
  • For more information on configuring Web sites, see Web Site Setup.
  • For more information on configuring FTP sites, see FTP Site Setup.


How to Create Virtual Directories

In most cases, the content you publish to your Web or FTP site is located in a root or home directory on your computer, such as C:\Inetpub\Wwwroot\. But there may be instances when the content is located somewhere else, or even on a remote computer.

To publish from any directory not contained within your home or root directory, you can create a virtual directory. A virtual directory is a directory that is not contained in the home directory but appears to client browsers as though it were.

important Important You must be a member of the Administrators group on the local computer to perform the following procedure (or procedures), or you must have been delegated the appropriate authority. As a security best practice, log on to your computer using an account that is not in the Administrators group, and then use the Run as command to run IIS Manager as an administrator. From the command prompt, type runas /user:administrative_accountname "mmc %systemroot%\system32\inetsrv\iis.msc".

To create a virtual directory

  1. In IIS Manager, expand the FTP Sites folder, expand the FTP site to which you want to add a virtual directory, right-click the site or folder within which you wish to create the virtual directory, point to New, and then click Virtual Directory. The Virtual Directory Creation Wizard appears.
  2. Click Next.
  3. In the Alias box, type a name for the virtual directory. This is the name the user types, and should be short and easy to type.
  4. Click Next.
  5. In the Path box, type or browse to the physical directory in which the virtual directory resides, and click Next.
  6. Under Allow the following permissions, select the check boxes for the access permissions you want to assign to your users, and click Next.

    note Note For security purposes, when selecting access permissions, consider allowing only the default Read permission. By restricting permissions in this way you can avoid attacks against your Web site by malicious users. For more information, see Securing Virtual Directories and Access Control in Windows Help.

  7. Click Finish. The virtual directory is created below the currently selected folder level.

If you are using the NTFS file system, you can also create a virtual directory.

To create a virtual directory with NTFS

  1. Open Windows Explorer.
  2. Right-click the folder you want to be a virtual directory, and click Sharing and Security.
  3. Click the Web Sharing tab.
  4. Click Share this folder.
  5. In theAlias box, type the name for the virtual directory.
  6. Click OK twice.
Related Topics
  • For an alternate way to create a Web virtual directory, see Creating Web Virtual Directories.
  • For an alternate way to create an FTP virtual directory, seeCreating FTP Virtual Directories.


How to Set Authentication Settings

You can require users to provide a valid Microsoft® Windows® user account name and password before they access any information on your server. This identification process is called authentication. Authentication, like many of the features in IIS, can be set at the Web site, directory, or file level. IIS provides the following authentication methods to control access to the content on your server.

Web Methods

  • Anonymous authentication: Gives users access to the public areas of your Web site without prompting them for a user name or password.
  • Basic authentication: Requires a previously assigned Windows account user name and password, also known as credentials.
  • Digest authentication: Offers the same functionality as Basic authentication, while providing enhanced security in the way that a user's credentials are sent across the network.
  • Advanced Digest authentication: Collects user credentials and stores them on the domain controller as an MD5 hash, or message digest.
  • Integrated Windows authentication: Collects information through a secure form of authentication where the user name and password are hashed before being sent across the network.
  • Certificate authentication: Adds Secure Sockets Layer (SSL) security through client and/or server certificates.
  • .NET Passport authentication: Provides a single sign-in service through SSL, HTTP redirects, cookies, JavaScript, and strong symmetric key encryption.

FTP Methods

  • Anonymous FTP authentication: Gives users access to the public areas of your FTP site without prompting them for a user name or password.
  • Basic FTP authentication: Requires users to log on with a user name and password corresponding to a valid Windows user account.
Related Topics
  • For an overview of Web authentication, see Web Site Authentication.
  • For an overview of FTP authentication, see FTP Site Authentication.


How to Create Application Pools

important Important This feature of IIS 6.0 is available only when running in worker process isolation mode.

With IIS 6.0 running in worker process isolation mode, you can group Web applications into application pools. Application pools allow specific configuration settings to be applied to groups of applications, and the worker processes servicing those applications. Any Web directory or virtual directory can be assigned to an application pool.

By creating new application pools and assigning Web sites and applications to them, you can make your server more efficient and reliable, and your other applications always available, even when the applications in the new application pool terminate.

important Important You must be a member of the Administrators group on the local computer to perform the following procedure (or procedures), or you must have been delegated the appropriate authority. As a security best practice, log on to your computer using an account that is not in the Administrators group, and then use the Run as command to run IIS Manager as an administrator. From the command prompt, type runas /user:administrative_accountname "mmc %systemroot%\system32\inetsrv\iis.msc".

To create a new application pool

  1. In IIS Manager, expand the local computer, right-click Application Pools, point to New, and then click Application Pool.
  2. In the Application pool ID box, type the name of the new application pool.
  3. Under Application pool settings, click either Use default settings for new application pool or Use existing application pool as template.
  4. If you selected Use existing application pool as template, from the Application pool name list box, click the application pool to be used as a template.
  5. Click OK.
Related Topics
  • For more information on creating application pools, see Configuring Application Pools.
  • For information on configuring worker processes, see Configuring Application Pool Identity.


How to Create and Isolate Applications

To create an application, you designate a directory as the starting point (application root) for the application. You can then set properties for the application. Each application can have a friendly name; this name appears in IIS Manager and gives you a way to distinguish between applications. The application name is not used anywhere else.

Web sites are root-level applications by default. When you create a Web site, a default application is created at the same time. You can use this root-level application, remove it, or replace it with a new application by removing it and creating a new application.

important Important You must be a member of the Administrators group on the local computer to perform the following procedure (or procedures), or you must have been delegated the appropriate authority. As a security best practice, log on to your computer using an account that is not in the Administrators group, and then use the Run as command to run IIS Manager as an administrator. From the command prompt, type runas /user:administrative_accountname "mmc %systemroot%\system32\inetsrv\iis.msc".

To create an application

  1. In IIS Manager, expand the local computer, right-click the directory that is the application starting point, and then click Properties.
  2. Click the Home Directory, Virtual Directory, or Directory tab.
  3. In the Application settings section, click Create. If you see the Remove button instead of the Create button, an application has already been created.
  4. In the Application name box, type a name for your application.
  5. Click OK.

Isolating applications means configuring them to run in a process (memory space) separate from the Web server and other applications. You can run IIS 6.0 in one of two isolation modes: worker process isolation mode or IIS 5.0 isolation mode. IIS cannot run in both modes simultaneously.

Worker process isolation mode is the default mode that the server runs in on a clean installation. In this mode, you can isolate an application by adding it to an application pool that includes isolation settings. For more information on creating and configuring application pools, see Configuring Application Pools.

To isolate an application in worker process isolation mode

  1. In IIS Manager, expand the local computer, expand the Web Sites folder, right-click the application you want to isolate, and click Properties.
  2. Click the Home Directory, Virtual Directory, or Directory tab (depending on the application).
  3. In the Application settings section, in the Application pool list box, click an application pool.
  4. Click Apply, and then click OK.

IIS 5.0 isolation mode allows you to run applications in IIS 6.0 that were developed for earlier versions of IIS.

To isolate an application in IIS 5.0 isolation mode

  1. In IIS Manager, expand the local computer, expand the Web Sites folder, right-click the application you want to isolate, and click Properties.
  2. Click the Home Directory, Virtual Directory, or Directory tab (depending on the application). If you are in the directory listed as the Starting Point directory, the Application name box is already filled in.
  3. From the Execute permissions list box, click the appropriate process option.
  4. Click OK. The Web server finishes processing any current requests for the application before creating a separate process. At the next request for the application, the application will run in the appropriate memory space.

note Note Server-side include (SSI) and Internet Database Connector (IDC) applications cannot be run in a memory space separate from the Web server.

Related Topics
  • For more information on creating applications, see Creating Applications.
  • For more information isolating applications, see Web Application Isolation.


How to Obtain and Back Up SSL Certificates

Secure Sockets Layer (SSL) certificates contain information used in establishing identities over a network, a process called authentication. Similar to conventional forms of identification, certificates enable Web servers and users to authenticate each other before establishing a connection.

Server certificates contain information about the server that allows the client to positively identify the server before sharing sensitive information. Client certificates contain personal information about the clients requesting access to your site that allow you to positively identify them before allowing them access to the site.

This topic is limited to obtaining, installing and backing up server certificates. For information on obtaining client certificates, see Obtaining Client Certificates.

There are two ways to obtain a server certificate. You can issue your own certificate, or you can obtain a certificate from a certification authority.

important Important You must be a member of the Administrators group on the local computer to perform the following procedure (or procedures), or you must have been delegated the appropriate authority. As a security best practice, log on to your computer using an account that is not in the Administrators group, and then use the Run as command to perform this procedure as an Administrator.

To issue your own server certificate

  • Use Microsoft Certificate Services 2.0 to create a customizable service for issuing and managing certificates. You can create server certificates for the Internet or for corporate intranets, giving your organization complete control over certificate management policies. For more information, see Microsoft Certificate Services Help.

    –or–

    Use the Web Server Certificate Wizard to request and install your server certificate.
To obtain a server certificate from a certification authority
  1. Find a certification authority that provides services that meet your business needs and then request a server certificate.

    –or–

    Use the Web Server Certificate Wizard to create a certificate request, which you can send to the certification authority.
  2. After the certificate has been processed and returned to you, use the Web Server Certificate Wizard to install the certificate.

It is important to safeguard the certificate and key pair; always back them up to a disk and keep the disk in a secure place.

To create a backup copy of your server certificate and private key
  1. Locate the correct certificate store. This is typically the Local Computer store in Certificate Manager.

    If you do not have Certificate Manager installed in Microsoft Management Console (MMC), you need to install it.

  2. Right-click the certificate in the Personal store, point to All Tasks, and click Export.
  3. Select Yes, export the private key.
  4. Follow the wizard default settings, and enter a password for the certificate backup file when prompted.

    Do not select Delete the private key if export is successful, because this will disable your current server certificate.

  5. Complete the wizard to export a backup copy of your server certificate.

If you already have Certificate Manager installed in MMC, it points to the correct Local Computer certificate store.

To add Certificate Manager to MMC

  1. From the Start menu, click Run.
  2. In the Open box, type mmc, and then click OK. The Microsoft Management Console appears.
  3. In the File menu, click Add/Remove Snap-in.
  4. On the Standalone tab, click Add.
  5. From the Available Standalone Snap-ins list box, click Certificates, and click Add.
  6. Click the Computer account option, and click Next.
  7. Click the Local computer (the computer this console is running on) option, and click Finish.
  8. Click Close, and then click OK.
Related Topics
  • For more information on certificates, see About Certificates.
  • For more information on obtaining a certificate, see Obtaining and Installing Server Certificates.
  • For more information on using the certificate wizard, see Using Certificate Wizards.


How to Back Up and Restore the Metabase

IIS administrators can create backup files using IIS Manager or a programmatic administration script. The backup files are copies of the metabase configuration file (MetaBase.xml) and the matching metabase schema file (MBSchema.xml). Using the metabase configuration backup and restore feature, the metabase can be restored from the backup files.

important Important You must be a member of the Administrators group on the local computer to perform the following procedure (or procedures), or you must have been delegated the appropriate authority. As a security best practice, log on to your computer using an account that is not in the Administrators group, and then use the Run as command to run IIS Manager as an administrator. From the command prompt, type runas /user:administrative_accountname "mmc %systemroot%\system32\inetsrv\iis.msc".

To create a secure backup (password required)
  1. In IIS Manager, right-click the local computer, point to All Tasks, and click Backup/Restore Configuration.
  2. Click Create Backup.
  3. In the Configuration backup name box, type a name for the backup file.
  4. Select the Encrypt backup using password check box, type a password into the Password box, and then type the same password in the Confirm password box.
  5. Click OK, and then click Close.

To create an unsecured backup (password not required)

  1. In IIS Manager, right-click the local computer, point to All Tasks, and click Backup/Restore Configuration.
  2. Click Create Backup.
  3. In the Configuration backup name box, type a name for the backup file.
  4. Click OK, and click Close.

To restore the metabase backup

  1. In IIS Manager, right-click the local computer, point to All Tasks, and click Backup/Restore Configuration.
  2. In the Backups list box, click the version of the Automatic Backup file that you want to restore, and click Restore. If prompted for a password, type the password you chose to secure the backup.
Related Topics
  • For information on metabase reliability, see Backing Up and Restoring the Metabase.
  • For more information on backing up and restoring the metabase, see Restoring the Metabase from Backup Files.
  • For more information on command-line administration scripts, see Using Command-Line Administration Scripts.


How to Redirect Web Sites

When a browser requests a page or program on your Web site, the Web server locates the page identified by the URL and returns it to the browser. When you move a page on your Web site, you can't always correct all of the links that refer to the old URL of the page. To make sure that browsers can find the page at the new URL, you can instruct the Web server to redirect the browser to the new URL.

You can redirect requests for files in one directory to a different directory, to a different Web site, or to another file in a different directory. When the browser requests the file at the original URL, the Web server instructs the browser to request the page by using the new URL.

important Important You must be a member of the Administrators group on the local computer to perform the following procedure (or procedures), or you must have been delegated the appropriate authority. As a security best practice, log on to your computer using an account that is not in the Administrators group, and then use the Run as command to run IIS Manager as an administrator. From the command prompt, type runas /user:administrative_accountname "mmc %systemroot%\system32\inetsrv\iis.msc".

To redirect requests to another Web site or directory

  1. In IIS Manager, expand the local computer, right-click the Web site or directory you want to redirect, and click Properties.
  2. Click the Home Directory, Virtual Directory, or Directory tab.
  3. Under The content for this source should come from, click A redirection to a URL.
  4. In the Redirect to box, type the URL of the destination directory or Web site. For example, to redirect all requests for files in the Catalog directory to the NewCatalog directory, type /NewCatalog.

To redirect all requests to a single file

  1. In IIS Manager, expand the local computer, right-click the Web site or directory you want to redirect, and click Properties.
  2. Click the Home Directory, Virtual Directory, or Directory tab.
  3. Under The content for this source should come from, click A redirection to a URL.
  4. In the Redirect to box, type the URL of the destination file.
  5. Select the The exact URL entered above check box to prevent the Web server from appending the original file name to the destination URL.

You can use wildcards and redirect variables in the destination URL to precisely control how the original URL is translated into the destination URL.

You can also use the redirect method to redirect all requests for files in a particular directory to a program. Generally, you should pass any parameters from the original URL to the program, which you can do by using redirect variables.

To redirect requests to a program

  1. In IIS Manager, expand the local computer, right-click the Web site or directory you want to redirect, and click Properties.
  2. Click the Home Directory, Virtual Directory, or Directory tab.
  3. Under The content for this source should come from, click A redirection to a URL.
  4. In the Redirect to box, type the URL of the program, including any redirect variables needed to pass parameters to the program. For example, to redirect all requests for scripts in a Scripts directory to a logging program that records the requested URL and any parameters passed with the URL, type /Scripts/Logger.exe?URL=$V+PARAMS=$P. $V and $P are redirect variables.
  5. Select the The exact URL entered above check box to prevent the Web server from appending the original file name to the destination URL.
Related Topics
  • For more information on redirect variables, see Redirect Reference.


How to Host Multiple Web Sites

To create and host multiple Web sites, you must first ensure that each site has a unique identification. To accomplish this, you will need to either obtain multiple IP addresses or assign multiple host header names to a single IP address. Host header names are the "friendly" names for Web sites, such as www.microsoft.com.

Obtaining and maintaining multiple IP addresses is usually a task reserved for large corporations and Internet service providers (ISPs), while assigning multiple host header names is a fairly simple procedure accomplished through IIS Manager. Your computer or network must be using a name resolution system (typically DNS) in order to use multiple host header names.

important Important You must be a member of the Administrators group on the local computer to perform the following procedure (or procedures), or you must have been delegated the appropriate authority. As a security best practice, log on to your computer using an account that is not in the Administrators group, and then use the Run as command to run IIS Manager as an administrator. From the command prompt, type runas /user:administrative_accountname "mmc %systemroot%\system32\inetsrv\iis.msc".

To assign a host header name

  1. In IIS Manager, expand the Web Sites folder, right-click the Web site, and click Properties.
  2. On the Web Site tab, click Advanced.
  3. Click Add.
  4. In the appropriate boxes, type an IP address, TCP port, and host header value for your Web site.

    Host headers do not function when you use Secure Sockets Layer (SSL) because host headers are included in the encrypted client request. However, you can have multiple server certificates, multiple IP addresses, and multiple SSL ports per server.

Related Topics
  • For information on hosting multiple Web sites with multiple IP addresses, see Creating Multiple Sites Using Multiple IP Addresses.
  • For more information on using host header names, see Hosting Multiple Web Sites on a Single Server.
  • For more information on name resolution, see Domain Name Resolution.


How to Assign Resources to Applications

There are several ways to assign, or limit, the amount of resources an application can use. You can use application property sheets to control performance, cache, and process options of individual applications, or you can use bandwidth throttling to limit resources for an entire site or application pool. A third alternative is to control access to your application through the NTFS file system and Web server security features.

important Important You must be a member of the Administrators group on the local computer to perform the following procedure (or procedures), or you must have been delegated the appropriate authority. As a security best practice, log on to your computer using an account that is not in the Administrators group, and then use the Run as command to run IIS Manager as an administrator. From the command prompt, type runas /user:administrative_accountname "mmc %systemroot%\system32\inetsrv\iis.msc".

To assign resources using property sheets

  1. In IIS Manager, expand the local computer, right-click the Web site or root directory of an application, and click Properties.
  2. Click the Home Directory, Virtual Directory, or Directory tab.
  3. In the Application settings section, click Configuration.
  4. On the Mappings and Options tabs, select the appropriate check boxes to enable or disable caching, buffering, and session states.

To globally assign resources using bandwidth throttling

  1. In IIS Manager, expand the local computer, right-click the Web Sites folder, and then click Properties.
  2. Click the Performance tab.
  3. Under Bandwidth throttling, select Limit the total network bandwidth available for all Web sites on this server check box.
  4. In the Maximum bandwidth box, click the up and down arrows or type the maximum number of kilobytes per second you want each site contained in the directory to use.
  5. Under Web site connections, select either Unlimited or Connections limited to:. If you select Connections limited to:, click the up and down arrows in the box or type the maximum number of kilobytes per second you want each site contained in the directory to use.

To assign resources using bandwidth throttling to an individual Web site

  1. In IIS Manager, expand the local computer, expand the Web Sites folder, right-click the Web site to which you want to assign resources, and click Properties.
  2. Click the Performance tab.
  3. Under Bandwidth throttling, select Limit the network bandwidth available to this Web site check box.
  4. In the Maximum bandwidth box click the up and down arrows or type the maximum number of kilobytes per second you want each site contained in the directory to use.
  5. Under Web site connections, select either Unlimited or Connections limited to:. If you select Connections limited to:, click the up and down arrows in the box or type the maximum number of Web site connections.
Related Topics
  • For more information on configuring servers for applications, see About Configuring Servers for Applications.
  • For more information on bandwidth throttling, see Throttling Bandwidth.
  • For more information on application configurations, see Configuring Applications.
  • For information on using the NTFS file system and Web server security features, see How to Control Access to Applications.


How to Control Access to Applications

You can control which users and computers are allowed access to your Web server and its resources. You can use both the NTFS file system and Web server security features to assign users specific access rights to directories and files. You can also use IP address restrictions to limit access by specific computers.

  • Securing your files with NTFS: With the NTFS file system, you can limit access to your Web server's files and directories. You can configure the file and directory permissions that set the access level assigned to a particular user account or user group. For example, you can configure your Web server to enable a specific user to view and execute a file, while excluding all other users from accessing that file.
  • Securing your site with Web site permissions: Web permissions, unlike NTFS permissions, apply to all users accessing your Web sites. NTFS permissions apply only to a specific user or group of users with a valid Windows account. NTFS controls access to physical directories on your server, whereas Web permissions control access to virtual directories on your Web site.
  • Securing your site with IP address restrictions: With IP address restrictions, you can configure your Web server to assign or deny specific computers, groups of computers, or domains access to Web sites, directories, or files. For example, if your intranet server is connected to the Internet, you can prevent Internet users from accessing your Web server by assigning access only to members of your intranet, and explicitly denying access to outside users.


How to Enable ASP.NET

Microsoft ASP.NET is a unified Web development platform that provides the services necessary for developers to build enterprise-class Web applications. While ASP.NET is largely syntax compatible with ASP, it also provides a new programming model and infrastructure for more secure, scalable, and stable applications. You can feel free to augment your existing ASP applications by incrementally adding ASP.NET functionality to them.

ASP.NET is a compiled, .NET-based environment; you can author applications in any .NET compatible language, including Microsoft Visual Basic® .NET, Microsoft Visual C#®, and Microsoft JScript® .NET. Additionally, the entire Microsoft .NET Framework is available to any ASP.NET application. Developers can easily access the benefits of these technologies, which include the managed common language run-time environment, type safety, inheritance, and so on.

important Important In order to take a more proactive stance against malicious users and attackers, IIS is not installed on members of the Microsoft® Windows® Server 2003 family by default. Furthermore, when you initially install IIS, the service is installed in a highly secure and "locked" mode. By default, IIS serves only static content — meaning features like ASP, ASP.NET, Server-Side Includes, WebDAV publishing, and FrontPage® Server Extensions do not work unless enabled. If you do not enable this functionality after installing IIS, IIS returns a 404 error. You can serve dynamic content and enable these features through the Web Service Extensions node in IIS Manager. Also, if an application extension is not mapped in IIS, IIS returns a 404 error. To map an extension, see Setting Application Mappings. For more information on how to troubleshoot 404 errors, including 404.2 and 404.3; issues related to a new installation of IIS 6.0; or an upgrade from a previous version of IIS, see Troubleshooting.

To enable ASP.NET

  1. In IIS Manager, expand the local computer, and then click Web Service Extensions.
  2. In the details pane, click ASP.NET, and then click Allow.

note Note If your applications require ISAPI, CGI, ASP, WebDAV, or other extensions to operate, you will need to enable those extensions as well.

Related Topics
  • For an introduction to ASP concepts, see ASP.
  • For information on developing ASP.NET applications, see the Web Application Guide.


How to Enable ASP Pages

Microsoft Active Server Pages (ASP) is a server-side scripting environment that you can use to create dynamic and interactive Web pages, and build powerful Web applications. When the server receives a request for an ASP file, it processes server-side script code contained in the file to build the HTML Web page that is sent to the browser. In addition to server-side script code, ASP files can contain HTML (including related client-side scripts), as well as calls to Component Object Model (COM) components that perform a variety of tasks, such as connecting to a database or processing business logic.

important Important In order to take a more proactive stance against malicious users and attackers, IIS is not installed on members of the Microsoft® Windows® Server 2003 family by default. Furthermore, when you initially install IIS, the service is installed in a highly secure and "locked" mode. By default, IIS serves only static content — meaning features like ASP, ASP.NET, Server-Side Includes, WebDAV publishing, and FrontPage® Server Extensions do not work unless enabled. If you do not enable this functionality after installing IIS, IIS returns a 404 error. You can serve dynamic content and enable these features through the Web Service Extensions node in IIS Manager. Also, if an application extension is not mapped in IIS, IIS returns a 404 error. To map an extension, see Setting Application Mappings. For more information on how to troubleshoot 404 errors, including 404.2 and 404.3; issues related to a new installation of IIS 6.0; or an upgrade from a previous version of IIS, see Troubleshooting.

To enable ASP pages

  1. In IIS Manager, expand the local computer, and then click Web Service Extensions.
  2. In the details pane, click Active Server Pages, and then click Allow.

note Note If your ASP pages require ISAPI, CGI, Microsoft ASP.NET, WebDAV, or other extensions to operate, you will need to enable those extensions as well.

Related Topics
  • For an introduction to ASP concepts, see ASP.
  • For information on creating ASP pages and developing Web applications, see the Web Application Guide.


How to Save Configurations

After you have your site and application up and running the way you want, you can save all or part of the configurations for a backup copy, or for import and export to other sites or computers.

IIS automatically makes a backup copy of the metabase configuration and schema files each time the metabase changes. Administrators can also create backup files on demand, or create backup copies of individual site or application configurations and then export and import them to and from other sites or computers.

Backup files contain only configuration data; they do not include your content (.asp files, .htm files, .dll files, etc.).

important Important You must be a member of the Administrators group on the local computer to perform the following procedure (or procedures), or you must have been delegated the appropriate authority. As a security best practice, log on to your computer using an account that is not in the Administrators group, and then use the Run as command to run IIS Manager as an administrator. From the command prompt, type runas /user:administrative_accountname "mmc %systemroot%\system32\inetsrv\iis.msc".

To save a metabase configuration

  1. In IIS Manager, right-click the local computer, point to All Tasks, and then click Backup/Restore Configuration.
  2. Click Create Backup.
  3. In the Configuration backup name box, type a name for the backup file.
  4. If you want to encrypt the backup file with a password, select the Encrypt backup using password check box, and in the Password and Confirm password boxes, type a password.
  5. Click OK, and then click Close.

To restore a metabase configuration

  1. In IIS Manager, right-click the local computer, point to All Tasks, and then click Backup/Restore Configuration.
  2. From the Backups list box, click a previous backup version, and click Restore.
  3. When a confirmation message appears, click Yes.
  4. Click OK, and then click Close.

To save a site or application configuration

  1. In IIS Manager, right-click the site or application you want to back up, point to All Tasks, and click Save Configuration to a File.
  2. In the File name box, type a file name.
  3. In the Path box, type or browse to the location where you want to save the file.
  4. Click OK.
Related Topics
  • For information on saving configurations using command-line tools, see Using Command-Line Administration Scripts.
  • For information on importing and exporting site and application configurations, see Metabase Import and Export.


How to Start and Stop Services

You may need to restart IIS before certain configuration changes take effect or when applications become unavailable. You can restart IIS using the Restart IIS command in IIS Manager or by using the IISReset command-line utility. Both methods allow you to stop, start, and restart IIS Internet services, as well as reboot your computer.

Restarting or stopping IIS, or rebooting your Web server, is a severe action. When you restart the Internet service, all sessions connected to your Web server (including Internet, FTP, SMTP, and NNTP) are dropped. Any data held in Web applications is lost. All Internet sites are unavailable until Internet services are restarted. For this reason, you should avoid restarting, stopping, or rebooting your server if at all possible. For a list of features designed to improve IIS reliability and remedy the need to restart IIS, see Alternatives to restarting IIS.

If the IISReset command-line utility is disabled, then the command-line or IIS Manager calls that require IISReset.exe will fail and return an error stating that IISReset is disabled. Actions that fail include the Restart IIS command in IIS Manager and Service Control Manager (SCM) recovery configuration actions that use the IISReset command-line utility (for example, the default IIS Admin SCM recovery path). However, SCM recovery actions that do not use the IISReset command-line utility continue to function (for example, the default World Wide Web Publishing Service SCM recovery path that restarts the WWW service).

important Important You must be a member of the Administrators group on the local computer to perform the following procedure (or procedures), or you must have been delegated the appropriate authority. As a security best practice, log on to your computer using an account that is not in the Administrators group, and then use the Run as command to run IIS Manager as an administrator. From the command prompt, type runas /user:administrative_accountname "mmc %systemroot%\system32\inetsrv\iis.msc".

To restart IIS services

  1. In IIS Manager, right-click the local computer, point to All Tasks, then click Restart IIS.
  2. In the What do you want IIS to do drop-down list, click Restart Internet Services on computer name . You can also choose to reboot the computer, stop the Internet service, or start the Internet service.
    IIS attempts to stop all services before restarting.

To restart individual sites

  • In IIS Manager, right-click the site you want to start, stop, or pause; and click Start, Stop, or Pause.
Related Topics
  • For more information on starting and stopping services, see Restarting IIS.
  • For information on using command-line administration, see Using Command-Line Administration Scripts.


How to Configure Recycling

important Important This feature of IIS 6.0 is available only when running in worker process isolation mode.

In worker process isolation mode, IIS can be configured to periodically restart worker processes assigned to an application pool, allowing you to recycle faulty Web applications. Recycling keeps problematic applications running smoothly, especially when it is not feasible to modify the application code. This ensures that those application pools remain healthy, and that system resources can be recovered.

You can configure worker processes to restart based on elapsed time, number of requests served, scheduled times, or memory usage; or you can configure them to start on demand.

important Important You must be a member of the Administrators group on the local computer to perform the following procedure (or procedures), or you must have been delegated the appropriate authority. As a security best practice, log on to your computer using an account that is not in the Administrators group, and then use the Run as command to run IIS Manager as an administrator. From the command prompt, type runas /user:administrative_accountname "mmc %systemroot%\system32\inetsrv\iis.msc".

To configure a worker process to be recycled after a set elapsed time

  1. In IIS Manager, expand the local computer, expand Application Pools, right-click the application pool, and click Properties.
  2. On the Recycling tab, select the Recycle worker processes (in minutes) check box.
  3. Click the up or down arrow to set the number of minutes you want to elapse before the worker process is recycled.
  4. Click OK.

To configure a worker process to be recycled after a set number of processing requests

  1. In IIS Manager, expand the local computer, expand Application Pools, right-click the application pool, and click Properties.
  2. On the Recycling tab, select the Recycle worker process (in requests) check box.
  3. Click the up or down arrow to set the number of requests to be processed before the worker process is recycled.
  4. Click OK.

To configure a worker process to be recycled at scheduled times

  1. In IIS Manager, expand the local computer, expand Application Pools, right-click the application pool, and click Properties.
  2. On the Recycling tab, select the Recycle worker processes at the following times check box.
  3. Click Add to add a time to the list, Remove to delete a time from the list, or Edit to change an existing time at which the worker process will be recycled.
  4. Click OK.

note Note When recycling is set to occur at scheduled times, it can occur off-schedule if the system time is altered. To avoid unintended changes in scheduled recycling times, recycle the scheduled worker processes right after the system time is changed.

To configure a worker process to be recycled after consuming a set amount of memory

  1. In IIS Manager, expand the local computer, expand Application Pools, right-click the application pool, and click Properties.
  2. On the Recycling tab, under Memory recycling, select the Maximum virtual memory (in megabytes) or Maximum used memory (in megabytes) check box.
  3. Click the up or down arrow to set memory limits.
  4. Click OK.
Related Topics
  • For more information on recycling worker processes, see Recycling Worker Processes.
  • For information on worker process isolation mode, see Worker Process Isolation Mode.


How to Administer Servers from the Command Line

Each system on your computer comes with a graphical user interface (GUI), such as IIS Manager, to configure and manage your settings. However, if administrators manage systems frequently, or access large amounts of data on multiple servers, then using each GUI is time consuming. It may be faster to use command-line scripts that can manage single or multiple systems programmatically.

IIS provides powerful scripting and programming tools that you can use to access and configure settings from within a command-line script or compiled application. You can use these tools to create, delete, start, stop, pause, and list various sites and applications, and to copy, import, and export configurations.

You can use command-line scripts for the following:

  • Managing Web sites: Describes how to create, delete, start, stop, pause, and list Web Sites on a local or remote computer.
  • Managing FTP sites: Describes how to create, delete, start, stop, pause, and list FTP Sites on a local or remote computer.
  • Managing Web virtual directories: Describes how to create, delete, and list Web virtual directories on a local or remote computer.
  • Managing FTP virtual directories: Describes how to create, delete, and list FTP virtual directories on a local or remote computer.
  • Managing IIS configurations: Describes how to back up, restore, delete, list, copy, import, and export IIS configurations.
  • Managing applications and Web service extensions: Describes how to enable and list applications; add and remove application dependencies; enable, disable, and list Web service extensions; and add, remove, enable, disable, and list individual files.


How to Administer Servers Remotely

You can administer your server remotely running IIS on an intranet or the Internet. You can use the following tools for this purpose:

  • IIS Manager: You can use IIS Manager on your server to remotely connect to and administer an intranet server running IIS 5.0, IIS 5.1, and IIS 6.0 (IIS 3.0 and IIS 4.0 are not supported).
  • Terminal Services: Terminal Services does not require you to install IIS Manager on the remote client computer because, once connected to the server running IIS, you use IIS Manager on the Web server as if logged on locally.
  • Remote Administration (HTML) Tool: You can use the Remote Administration (HTML) tool to administer your IIS Web server from any Web browser on your intranet. This version of the Remote Administration (HTML) tool runs only on servers running IIS 6.0.

important Important You must be a member of the Administrators group on the local computer to perform the following procedure (or procedures), or you must have been delegated the appropriate authority. As a security best practice, log on to your computer using an account that is not in the Administrators group, and then use the Run as command to run IIS Manager as an administrator. From the command prompt, type runas /user:administrative_accountname "mmc %systemroot%\system32\inetsrv\iis.msc".

To administer your intranet server remotely using IIS Manager

  1. Start IIS Manager on any computer on your network running a member of the Windows Server 2003 family.
  2. To connect to a remote IIS computer, right-click the local computer, and click Connect.
  3. In the Computer name box, type or browse to the computer you wish to connect to.
  4. Click OK.

note Note If you do not have TCP/IP and a name resolution server, such as Windows Internet Name Service (WINS) installed, you may not be able to connect to an IIS computer using the computer name. As an alternative, you can use the IP address of the IIS computer. For more information, see TCP/IP in Windows Help.

To administer your server remotely using Terminal Services

  1. Install the Terminal Services client on the computer you are using to connect.
  2. While the remote computer is running, start Terminal Services and identify the name of the remote computer.
  3. From the Terminal Services window, administer IIS as you would locally. You can start IIS Manager on any computer on your network running Windows, or open a Web-based server-management appliance. You can also run scripts from the Terminal Services window.

To enable the Remote Administration (HTTP) tool through Control Panel

  1. From the Start menu, click Control Panel.
  2. Double-click Add or Remove Programs.
  3. In the left pane, click Add/Remove Windows Components.
  4. Click Application Server, and then click Details.
  5. Click Internet Information Services (IIS) , and then click Details
    6. .
  6. Click World Wide Web Publishing Service, and then click Details.
  7. Select the Remote Administration (HTML) check box, and click OK.
  8. Click OK two more times, click Next, and then click Finish to complete the Windows Components Wizard.

To view the Remote Administration (HTML) tool from IIS Manager

  • Expand the local computer, expand the Web Sites folder, right-click the Administration Web site, and click Browse.

To administer an IIS Web server with the Remote Administration (HTML) tool

  • Open your intranet site from a Web browser and type the following in the address bar: https://hostname:8098 where hostname is the name of the computer you want to connect to and administer.

For more information on how to remotely manage servers using this tool, from the Help menu in the Remote Administration (HTML) tool, click Help Topics.


How to Enable Network File System Support

If IIS must access files on a UNIX or Linux system, file name case sensitivity can be an issue unless Network File System (NFS) support is enabled in IIS.

Unix and Linux both support mixed-case file names, and IIS fully supports requesting static files in a case-sensitive manner. An issue arises, however, when IIS makes a subsequent request for a file from its static file cache. Because all file names are converted to uppercase letters in the IIS cache, any request after the first request from the IIS static file cache might fail or return the wrong file.

The solution to this issue is to disable the IIS static file cache so that all file requests are issued fresh, thereby retaining correct file name case. The static file cache can be disabled for individual virtual directories on Web sites, or globally for all of IIS.

note Note Changing this setting has no effect on how ASP files and templates are cached.

To disable the static file cache for a particular Web site virtual directory

  • Edit the metabase and set the MD_VR_NO_CACHE property to 1. For example:

    LM/W3SVC/n/ROOT/vdir
  MD_VR_NO_CACHE=1

    If you subsequently want to enable the static file cache, set this property to 0.

To disable the static file cache for all of IIS

  • Edit the registry and add the binary value DisableStaticFileCache=1 to the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\InetInfo\Parameters key.

    If you subsequently want to enable the static file cache, set this value to 0.


Site Setup

This section describes how to complete a first-time basic setup of a Web server, FTP server, SMTP (e-mail) server, and NNTP (news) server. Additionally, publishing information to your Web and FTP sites is discussed.

Internet Information Services (IIS) makes no distinction whether the site you create is an internal-only site (intranet) or an Internet site. Setup, configuration, and administration procedures are the same for both kinds of sites. Differences exist only in the specific configuration information you supply to IIS.

When you install a member of the Microsoft® Windows® Server 2003 family, IIS creates a minimal configuration consisting of a default Web site in a highly secure mode limited to static content. Other IIS services and options, such as FTP, SMTP, and NNTP are not installed by default. This section also describes how to install these services.

This section includes the following information:

  • Web Site Setup: Describes the basics of managing a Web site's infrastructure, from setting a site home directory and default Web Page, to redirecting requests and dynamically altering Web pages.
  • FTP Site Setup: Describes installation of the FTP service, and changing default FTP settings globally and for specific FTP sites.
  • SMTP Server Setup: Describes installation of the SMTP service and the service's capabilities.
  • NNTP Server Setup: Describes installation of the NNTP service and how hosting a news server can be an effective tool for managing discussions.
  • Web Authoring with WebDAV: Describes the features of WebDAV and how to set up a WebDAV publishing directory on an IIS server.


Web Site Setup

Whether your site is on an intranet or the Internet, the principles of providing content are the same. You place your Web files in directories on your server so that users can establish an HTTP connection and view your files with a Web browser. But beyond simply storing files on your server, you must manage how your site is deployed, and more importantly, how your site evolves. Today, an engaging Web site is seldom a static collection of pages. Most successful Web administrators are kept busy accommodating ever changing Web content.

In this section you learn the basics of managing a Web site's infrastructure, from redirecting requests to dynamically altering Web pages.

This section includes the following information:
  • Setting Home Directories: Describes how to set or change the home directory of a Web site using IIS Manager or a command-line administration script.
  • Setting Up Default Documents: Describes the purpose of a default document and where it should be placed, as well as file naming restrictions.
  • Adding Footers to Web Pages: Describes how to automatically include HTML code in the bottom of Web pages.
  • Using Virtual Directories: Describes the concept of virtual directories and how to use them to keep published data compartmentalized on the server while remaining transparent to the user.
  • Domain Name Resolution: Describes the concept of name resolution, and how to register a domain name for your site.
  • Using FrontPage Server Extensions to Extend Web Sites: Describes the benefits of using FrontPage® Server Extensions for Web site management, and how to set up the extensions.


Setting Home Directories

Each Web site must have a home directory. The default Web site home directory is LocalDrive:\Inetpub\Wwwroot. You can change a Web site home directory using IIS Manager or by editing the MetaBase.xml file directly. Both methods are described in this topic.

important Important You must be a member of the Administrators group on the local computer to perform the following procedure (or procedures), or you must have been delegated the appropriate authority. As a security best practice, log on to your computer using an account that is not in the Administrators group, and then use the Run as command to run IIS Manager as an administrator. From the command prompt, type runas /user:administrative_accountname "mmc %systemroot%\system32\inetsrv\iis.msc".

To change the home directory of a Web site using IIS Manager
  1. In IIS Manager, expand the local computer, expand the Web Sites directory, right-click the Web site you wish to change, and click Stop.
  2. Use Windows Explorer, to rename the LocalDrive:\Inetpub\Wwwroot directory to the name of your choice. Alternatively, you can copy the entire \Wwwroot directory tree to a new location.
  3. In IIS Manager, right-click your Web site, and click Properties.
  4. Click the Home Directory tab, and under The content for this resource should come from, click A directory located on this computer, A share located on another computer, or A redirection to a URL, depending on where your home directory is located.
  5. In the Local path box, type the path name, share name, or URL of your directory.

    note Note If you select a directory on a network share, you might need to enter a user name and password to access the resource. IUSR_computername is the default account used if another account is not specified. If you use an account with administration credentials on the server, clients can gain access to server operations. This seriously jeopardizes the security of your network. For more information on security user rights see, Security Best Practices in Windows Help.

  6. In IIS Manager, expand the Web Sites folder, right-click the Web site you just changed, and click Start.

To change the home directory of a Web site by editing the MetaBase.xml file

  1. In IIS Manager, expand the Web Sites folder, right-click the Web site you wish to change, and click Stop.
  2. Use Windows Explorer to rename the \Wwwroot directory to the name of your choice. Alternatively, you can copy the entire \Wwwroot directory tree to a new location and then rename the directory.
  3. From the systemroot\System32\Inetsrv directory, open the MetaBase.xml file in a text editor.
  4. To change the Web home directory, search for "/W3svc/1/root" and change the Path= value to the new location of the Web home directory. Substitute the value 1 with the value corresponding to the Web site to change.
  5. In IIS Manager, expand the Web Sites folder, right-click the Web site you've just changed, and click Start.
Related Topics
  • For more information on the structure of the IIS metabase, see IIS Metabase.


Setting Up Default Documents

You can establish a default document for client requests to a Web site that does not specify a document name. Default documents can be a directory's home page or an index page. Before enabling the default document in IIS Manager, you must create the default document and place it in either the root directory or a virtual directory on the appropriate Web site.

You cannot use commas in a default document name (for example, my,file.html). Commas are used only to delimit multiple default documents in the metabase. If you include a comma in the name of a default document, IIS uses the comma to notate two default documents.

important Important You must be a member of the Administrators group on the local computer to perform the following procedure (or procedures), or you must have been delegated the appropriate authority. As a security best practice, log on to your computer using an account that is not in the Administrators group, and then use the Run as command to run IIS Manager as an administrator. From the command prompt, type runas /user:administrative_accountname "mmc %systemroot%\system32\inetsrv\iis.msc".

To set up or change the default document

  1. In IIS Manager, expand the local computer, expand the Web Sites directory, right-click the designated Web site, and select Properties.
  2. Click the Documents tab.
  3. Select the Enable default content page check box.
  4. Click Add to add a new default document to the list.
  5. Click the document you want to remove from the list and click Remove.
  6. Click a document from the list and click Move Up or Move down to change the order in which default documents are served to client requests.
  7. Click OK.


Adding Footers to Web Pages

You can configure the Web server to automatically insert an HTML-formatted file to the bottom of every Web page sent out by your Web server (appending footers or scripts to ASP pages is not supported). For example, your file can contain HTML formatting instructions to add a simple text message and logo image to your Web pages. Once enabled, IIS automatically appends the footer file to the designated Web page or file each time the Web page or file is accessed.

note Note Document footers can reduce Web server performance, especially if a Web page is frequently accessed.

A footer file should be not be a complete HTML document. It should contain only those HTML tags necessary for formatting the appearance of footer content. For example, a footer file that adds your organization's name to the bottom of every page should consist of text and the HTML tags necessary for formatting the font and color.

important Important You must be a member of the Administrators group on the local computer to perform the following procedure (or procedures), or you must have been delegated the appropriate authority. As a security best practice, log on to your computer using an account that is not in the Administrators group, and then use the Run as command to run IIS Manager as an administrator. From the command prompt, type runas /user:administrative_accountname "mmc %systemroot%\system32\inetsrv\iis.msc".

To add a footer to every Web page

  1. Create an HTML footer file and save it on your Web server's hard disk.
  2. In IIS Manager, expand the local computer, expand the Web Sites folder, right-click a Web site, directory, or file, and click Properties.
  3. Click the Documents tab, and select the Enable document footer check box.
  4. In the box below Enable document footer, type either the full local path to the footer file or click Browse to navigate to it.
  5. Click OK.


Using Virtual Directories

A virtual directory is a friendly name, or alias, either for a physical directory on your server hard drive that does not reside in the home directory, or for the home directory on another computer. Because an alias is usually shorter than the path of the physical directory, it is more convenient for users to type. The use of aliases is also secure because users do not know where your files are physically located on the server and therefore cannot use that information to modify your files. Aliases also make it easier for you to move directories in your site. Rather than changing the URL for the directory, you change the mapping between the alias and the physical location of the directory.

If your Web site contains files that are located in a directory other than the home directory, or on other computers, you must create virtual directories to include those files in your Web site. To use a directory on another computer, you must specify the directory's Universal Naming Convention (UNC) name, and provide a user name and password for access rights.

If you want to publish from any directory not contained within your home directory, you must create a virtual directory. For example, suppose you are setting up a Web site for your marketing team on your company's intranet. The following table shows the mapping between the physical location of the files and the URL that accesses the files.

Physical Location | Alias | URL
C:\Inetpub\wwwroot | home directory (none) | http://SampleWebSite
\\Server2\SalesData | Customers | http://SampleWebSite/Customers
D:\Inetpub\wwwroot\Quotes | None | http://SampleWebSite/Quotes
D:\Inetpub\wwwroot\OrderStatus | None | http://SampleWebSite/OrderStatus
D:\Marketing\PublicRel | PR | http://SampleWebSite/PR

Both virtual directories and physical directories (directories without an alias) appear in IIS Manager. A virtual directory is indicated by a gear icon. The following illustration shows the Web site example described above, where /Customers and /PR are virtual directories.

Example Web site as it would appear in IIS Manager with virtual directories marked by a gear

For a simple Web site, you might not need to add virtual directories. You can simply place all of your files in the site's home directory. If you have a complex site, or want to specify different URLs for different parts of your site, you can add virtual directories as needed. To make a virtual directory accessible from multiple sites, you must add the virtual directory to each site.

There are three ways to create or delete a virtual directory:
  • Using IIS Manager; either using the Virtual Directory Creation Wizard or by importing a configuration file.
  • Using Windows Explorer (this method requires that your hard drive is formatted with the NTFS file system).
  • Using the iisvdir.vbs administration script.

important Important You must be a member of the Administrators group on the local computer to perform the following procedure (or procedures), or you must have been delegated the appropriate authority. As a security best practice, log on to your computer using an account that is not in the Administrators group, and then use the Run as command to run IIS Manager as an administrator. From the command prompt, type runas /user:administrative_accountname "mmc %systemroot%\system32\inetsrv\iis.msc".

To create a virtual directory using the Virtual Directory Creation Wizard

  1. In IIS Manager, expand the local computer, expand the Web site or FTP site to which you want to add a virtual directory, right-click the Web Site or folder within which you wish to create the virtual directory, point to New, then click Virtual Directory.
  2. Click Next.
  3. In the Alias box, type a name for the virtual directory. This is the name the user types, and should be short and easy to type.
  4. Click Next.
  5. In the Directory box, type or browse to the physical directory in which the virtual directory resides.
  6. Click Next.
  7. In the Access Permissions dialog box, set the access permissions appropriate to your needs.
  8. Click Next, and then click Finish. The virtual directory is created below the currently selected level.

To create a virtual directory by importing a configuration file

  1. In IIS Manager, expand the Web site or FTP site to which you want to add a virtual directory, right-click the Web Site or folder within which you wish to create the virtual directory, point to New, then click Virtual Directory (from file).
  2. Click Next.
  3. In the Import configuration dialog, click Browse and navigate to the file containing the virtual directory configuration to import.
  4. Click Read File, click the virtual directory configuration to import, and click OK. The virtual directory is created below the currently selected level.

note Note The following method is available only if your server's hard disk is formatted with the NTFS file system.

To create a virtual directory using Windows Explorer

  1. In Windows Explorer, browse to the folder where to want to create a virtual directory for your site, right-click the directory, and click Sharing and Security.
  2. Click the Web Sharing tab, and in the Share on list box, click the site for which you are creating a virtual directory, and click Share this folder.
  3. In the Alias box, type an alias name for this virtual directory.
  4. Set the Access permissions and Applications permissions by clicking the appropriate settings.
  5. Click OK, and then click OK again. You can verify that the virtual directory was created by starting IIS Manager and expanding the Web site.

To create a virtual directory using the Iisvdir.vbs administration script

  1. From the Start menu, click Run.
  2. In the Open box, type cscript iisvdir.vbs /create "SampleWebSite" VirtualDirectoryName x:\path. Substitute your Web site name, virtual directory name, and path to the physical directory as appropriate.
  3. Click OK.

note Note Deleting a virtual directory does not delete the corresponding physical directory or files.

To delete a virtual directory using IIS Manager

  • In IIS Manager, expand the site containing the virtual directory you want to delete, right-click the virtual directory, click Delete, and then click Yes.

To delete a virtual directory using Windows Explorer

  1. In Windows Explorer, browse to the folder containing the virtual directory you want to delete, right-click the directory, and click Sharing and Security.
  2. Click the Web Sharing tab, click Remove, and then click Yes.
  3. Click OK. You can verify that the virtual directory was deleted by starting IIS Manager and expanding the Web site.

note Note The following method does not work for root virtual directories.

To delete a virtual directory using the Iisvdir.vbs administration script

  • From the Start menu, click Run.
  • In the Open box, type cscript iisvdir.vbs /delete "SampleWebSite" VirtualDirectoryName. Substitute your Web site name and virtual directory name as appropriate.
Related Topics
  • For detailed information on the iisvdir command-line administration script, search for "iisvdir.vbs" in Windows Help.
  • For information on Security for virtual directories, see Securing Virtual Directories and Access Control in Windows Help.


Domain Name Resolution

In order for users to reach your site on an intranet or the Internet, you must have a unique IP address that identifies your computer on the network. This address takes the form of a string of four numbers separated by periods (for example, 192.168.1.42). Because a numeric address is difficult for people to remember, text names, or domain names, are used (for example, www.example.com). Before a user can type a domain name into a Web browser and access a Web page, the name has to be assigned to a corresponding IP address. The process of translating a domain name to an IP address is called name resolution.

To make your site available from the Internet

  1. Establish a connection to the Internet. Lease a line from an Internet Service Provider (ISP) or a telephone company. Your provider installs a cable at your site that is plugged into the network adapter card in your computer. Usually a router is also installed between your computer and the ISP. When shopping for a provider, be sure to ask what type of connection is provided and whether the provider guarantees a minimum bandwidth. Also, check on the type of security offered.
  2. Obtain an IP address. Your ISP gives you an IP address, an Internet gateway (default gateway), and a subnet mask.
  3. Verify your computer's network identity. To verify your IP address, at the command prompt, type ipconfig, and then press ENTER. Your current IP address, subnet mask, and default gateway are displayed.
    To verify your computer's name, right-click the My Computer icon on your desktop, and click Properties. The Network Identification tab shows your computer name.
  4. Register a domain name. Many ISPs can register your domain name for you, or you can register it yourself. There are domain name registrars located around the world, available for the registration of domain names under many top-level domains (such as .com, .net, .org, as well as country/region code domains such as .us for the United States and .uk for the United Kingdom). These registrars charge a yearly fee to register and maintain your domain name. This fee varies from registrar to registrar, as do the services available. Your domain may be hosted by your ISP, the registrar you choose, or advanced users may choose to host it themselves.
Related Topics
  • For more information about name resolution, search for "dns" or "name resolution" in Windows Help.
  • For information on assigning identification information to Web sites; see Naming Web Sites.
  • For information on adding Web sites, see Adding Web Sites to Your Server.
  • For information about obtaining a domain name, see the Accredited Registrar Directory at the InterNIC Web site.


Using FrontPage Server Extensions to Extend Web Sites

FrontPage Server Extensions (FPSE) provides Web-based and command-line administration for extending virtual servers. Extending virtual servers with FPSE enables the site owner to author the site in FrontPage and delegate site ownership and administration credentials.

FPSE 2002 is an update of FrontPage 2000 Server Extensions, and includes new security features, such as roles and rights, and new features for monitoring server health and Web site usage.

If you build and maintain Web sites for customers and coordinate these efforts with multiple authors, then the features included in FPSE can help you accomplish the following tasks:

  • Manage Web sites either on the local server or remotely, by using HTML Administration pages or a quick command-line interface.
  • Secure Web sites and grant authoring, browsing, site management, or other user rights to authorized users.
  • Analyze site usage to find out who is viewing the site and how often.
  • Track errors on the server to help prevent site or server crashes.
  • Upgrade FrontPage Web site management functionality with features like forms, search tools, and usage analysis.

Extending a Web site means enabling various FrontPage Server Extensions (FPSE) features to improve how you manage the content development and security of your site. Extending a Web site adds another level of security to to the site, and after a Web site is extended, a FrontPage client can open the site and author it in FrontPage. A site that is not extended cannot be opened or authored in FrontPage.

caution Caution FTP Web sites or virtual directories that are configured to use Active Directory (AD) isolation or FTP load-balancing should not be mapped to physical directories that are used for FrontPage® Server Extensions (FPSE) Web sites. Doing so can allow users to view any files in that folder structure over the network.

Extending Web Sites

Before you can extend Web sites with FPSE, you must create a virtual server for every Web site you plan to extend. A virtual server is different than a virtual directory. A virtual server, in technical terms, is a virtual computer that resides on an HTTP server but appears to the user as a separate HTTP server. Several virtual servers can reside on one computer, each capable of running its own programs and each with individualized access to input and peripheral devices. Each virtual server has its own domain name and IP address and appears, to the user, to be an individual Web site. Some Internet service providers use virtual servers for clients who want to use their own domain names.

By default, IIS provides a working virtual server called Default Web Site. This virtual server points to the content directory systemroot\Inetpub\Wwroot. To create a new virtual server, you must create a content directory.

FPSE does not support unicode content directory names or WebDAV. New FPSE virtual servers should be assigned to the MSSharePointPool application pool. Also, do not make changes to the Microsoft SharePoint™ application pool configuration.

note Note If you have a Sharepoint™ Team Services (STS) Web site, the following types of pages do not work without excluding the virtual directory containing the pages from the STS ISAPI filter:

  • ASP pages.
  • ASP.NET pages.
  • PHP pages.
  • PerlScript pages.
To enable these types of pages to work on your STS Web site
  1. In the Central Administration Web site for STS, choose to Manage your virtual directory or Web site.
  2. Under Defined Managed Paths, type the path to the virtual directory that contains your excluded pages (such as <code>\MyASPPages</code>) and select Exclude.

Virtual servers should not be nested. FPSE does not "see" virtual servers nested within each other. For example, if you need to create two virtual servers, the first content directory could be located in systemroot\Inetpub\Test; and the second content directory could be located in systemroot\Inetpub\Test2. If the Test2 directory were located in the Test directory, all of the permissions in Test2 would be overwritten by Test.

important Important Never change permissions or Access Control Lists (ACLs) at the content directory level. To maintain a secure environment, always make permissions changes and other security-related changes using the FrontPage 2002 Server Administration tool.

After creating a virtual server, create the corresponding Web site in IIS. For more information on adding new Web sites, see Adding Web Sites to Your Server.

After creating the Web site in IIS, you are ready to extend the site. Note that a site created in FrontPage and added to IIS is already extended.

Before starting the procedure of extending your Web site, check to make sure you've enabled the FrontPage Server Extensions .dll files. The following .dll files must be installed on your machine before you can extend Web pages.

  • systemroot\Program Files\Common Files\Microsoft Shared\Web Server Extensions\50\Isapi\_vti_adm\Fpadmdll.dll
  • systemroot\Program Files\Common Files\Microsoft Shared\Web Server Extensions\50\Isapi\Shtml.dll
  • systemroot\Program Files\Common Files\Microsoft Shared\Web Server Extensions\50\Isapi\Owssvr.dll
  • systemroot\Program Files\Common Files\Microsoft Shared\Web Server Extensions\50\Isapi\_vti_adm\Admin.dll
  • systemroot\Program Files\Common Files\Microsoft Shared\Web Server Extensions\50\Isapi\_vti_aut\Author.dll

important Important You must be a member of the Administrators group on the local computer to perform the following procedure (or procedures), or you must have been delegated the appropriate authority. As a security best practice, log on to your computer using an account that is not in the Administrators group, and then use the Run as command to run IIS Manager as an administrator. From the command prompt, type runas /user:administrative_accountname "mmc %systemroot%\system32\inetsrv\iis.msc".

To extend a site using the FrontPage 2002 Server Administration tool

  1. From the Start menu, point to All Programs, point to Administrative Tools, and click Microsoft SharePoint Administrator. If IIS returns a 404 error, "The page cannot be found," check to make sure the FrontPage 2002 Server Extensions optional component is enabled in the Windows Components Wizard in the Add or Remove Programs item of the Control Panel.
  2. On the FrontPage 2002 Server Administration site, check to see that the virtual server and corresponding Web site you created earlier are listed in the Virtual Servers section.
  3. To extend the Web site, click the Extend link beside the virtual server name.
  4. Click Submit. The FrontPage 2002 Server Administration tool adds FPSE template directories to the content directory of your virtual server, as well as other files that contain metadata.

Related Topics

  • For more information on extending and administering sites with FrontPage 2002 Server Extensions , including sample scripts, see the SharePoint Team Services Administrator's Guide.
  • For more information about administering FPSE programmatically, see FrontPageWeb.
  • For more information about these features, see the FrontPage Server Extensions home page.


FTP Site Setup

IIS includes the File Transfer Protocol (FTP) service for publishing and managing files. This version of IIS includes FTP user isolation to help administrators (particularly Internet hosting providers) efficiently secure and commercialize FTP services for their customers.

The FTP service is not installed by default. To set up an FTP site, you must first install the FTP service through the Control Panel. Installing the FTP service creates a default FTP site, which you can then customize to your needs using IIS Manager.

important Important You must be a member of the Administrators group on the local computer to perform the following procedure (or procedures), or you must have been delegated the appropriate authority. As a security best practice, log on to your computer using an account that is not in the Administrators group, and then use the Run as command to run IIS Manager as an administrator. From the command prompt, type runas /user:administrative_accountname "mmc %systemroot%\system32\inetsrv\iis.msc".

To install the FTP service

  1. From the Start menu, click Control Panel.
  2. Double-click Add or Remove Programs.
  3. From the left pane, click Add/Remove Windows Components.
  4. From the Components list, click Application Server, and then click Details.
  5. From the Subcomponents of Application Server list, click Internet Information Services (IIS), and then click Details.
  6. From the Subcomponents of Internet Information Services (IIS) list, select the File Transfer Protocol (FTP) Service check box.
  7. Click OK.
  8. Click Next. You might be prompted for the Windows Server 2003 family CD or the network install path.
  9. Click Finish.

caution Caution FTP Web sites or virtual directories that are configured to use Active Directory (AD) isolation or FTP load-balancing should not be mapped to physical directories that are used for FrontPage® Server Extensions (FPSE) Web sites. Doing so can allow users to view any files in that folder structure over the network.

When you install the FTP service, a default FTP directory is created at LocalDrive:\Inetpub\Ftproot.

Setting up the FTP service for the first time involves first setting global FTP settings, then settings for the default FTP site, and finally adding the content to the FTP site. IIS uses an inheritance model, which means that settings on higher levels are automatically inherited by lower levels. Settings at lower levels can be edited individually to override inherited settings from the next level up.

If you change a setting at a lower level, then later change a setting at a higher level that conflicts with the lower-level setting, you will be prompted to choose whether you want to change the lower-level setting to match the new higher-level setting.

Before setting up the FTP service, see Securing FTP Sites for clarification on security issues associated with the FTP service.

To globally change FTP settings

  1. In IIS Manager, expand the local computer, right-click the FTP Sites folder, and click Properties.
  2. Change the default settings on the property pages as needed. The changes are inherited by all FTP sites on your computer. For information about individual settings, click Help.

To change settings for the default FTP site

  1. In IIS Manager, expand the local computer, expand the FTP Sites folder, right-click Default FTP site, and click Properties.
  2. Change the default settings on the property pages to replace any inherited settings as needed. For information about individual settings, click Help.

To publish content on your FTP site

  • Copy or move your content files into the default FTP publishing directory.

note Note If your network has a name resolution system, for example, DNS, visitors can type ftp:// followed by your computer name in the address box of their browsers to reach your site. If your network does not have a name resolution system, visitors must type ftp://, followed by the numerical IP address of your computer.

Related Topics
  • For information on administering or adding an FTP site, see FTP Site Administration.
  • For conceptual information describing hosting multiple sites on one computer, see Hosting Multiple Web Sites on a Single Server.
  • To add virtual directories to an FTP site, see Using Virtual Directories.
  • To customize the appearance of your FTP site, see Setting FTP Messages and Directory Output Style.
  • For information on isolating FTP users and the additional security it can provide, see Isolating FTP Users.


SMTP Server Setup

The Simple Mail Transfer Protocol (SMTP) service provided by IIS is a simple component for delivering outgoing e-mail messages. Delivery of a message is initiated by transferring the message to a designated SMTP server. Based on the domain name of the recipient e-mail address, the SMTP server initiates communications with a Domain Name System (DNS) server, which looks up and then returns the host name of the destination SMTP server for that domain.

Next, the originating SMTP server communicates with the destination SMTP server directly through Transmission Control Protocol/Internet Protocol (TCP/IP) on port 25. If the user name of the recipient e-mail address matches one of the authorized user accounts on the destination server, the original e-mail message is transferred to that server, waiting for the recipient to pick up the message through a client program.

In the case where the originating SMTP server cannot communicate directly with the destination server, the SMTP service can transfer messages through one or more intermediate relay SMTP servers. A relay server receives the original message and then delivers it to the destination server, or redirects it to another relay server. This process is repeated until the message is delivered or a designated timeout period passes.

The SMTP service is not installed by default. You must install the SMTP service using the Control Panel. Installing the SMTP service creates a default SMTP configuration which you can then customize to your needs using IIS Manager.

Many articles about deploying and configuring the SMTP service are available by searching for "smtp" on the Microsoft Developer Network (MSDN) Web site.

important Important You must be a member of the Administrators group on the local computer to perform the following procedure (or procedures), or you must have been delegated the appropriate authority. As a security best practice, log on to your computer using an account that is not in the Administrators group, and then use the Run as command to run IIS Manager as an administrator. From the command prompt, type runas /user:administrative_accountname "mmc %systemroot%\system32\inetsrv\iis.msc".

To install the SMTP service

  1. From the Start menu, click Control Panel.
  2. Double-click Add or Remove Programs.
  3. From the left pane, click Add/Remove Windows Components.
  4. From the Components list, click Application Server, and then click Details.
  5. From the Subcomponents of Application Server list, click Internet Information Services (IIS), and then click Details.
  6. From the Subcomponents of Internet Information Services (IIS) list, select the SMTP Service check box.
  7. Click OK.
  8. Click Next. You might be prompted for the Windows Server 2003 family CD or the network install path.
  9. Click Finish.

When you install the SMTP service, a default SMTP server configuration is created with a message store in LocalDrive:\Inetpub\Mailroot.

When setting up the SMTP service for the first time, you can configure global settings for a SMTP virtual server, as well as settings for individual components of the virtual server.

To configure global SMTP settings

  1. In IIS Manager, expand the local computer, right-click Default SMTP Virtual Server, and click Properties.
  2. Change the default settings on the property pages as needed. For information about individual settings, click Help.

To configure SMTP virtual server components settings

  1. In IIS Manager, expand the local computer, expand Default SMTP Virtual Server, right-click the component you want to configure, and click Properties.
  2. Change the default settings on the property pages as needed. For information about individual settings, click Help.
Related Topics
  • For information on administering the SMTP service, see SMTP Administration.


NNTP Server Setup

Using a mail-based mechanism for hosting discussions of interest to a variety of people can become inefficient as the number of discussion participants grows. Sending a separate copy of the message to each of the interested parties consumes large quantities of bandwidth, CPU resources, and disk space among the many recipients and mail servers hosting them.

Significant resources can be saved if popular messages are hosted in a single database. This single database is known as a news server and the messages on such a server are called news items or articles. Using the Network News Transfer Protocol (NNTP) service, you can create your own news server to host discussions. NNTP is the protocol for the distribution, inquiry, posting, and retrieval of news items between a news server and client.

Access to the news server can be open to everyone, or it can require user authentication. The NNTP service allows fine tuning of security policies and is capable of handling a large number of virtual domains and independent server instances on a single computer.

The NNTP service is not installed by default. You must install the NNTP service using the Control Panel. Installing the NNTP service creates a default NNTP configuration, which you can then customize to your needs using IIS Manager.

Many articles about deploying and configuring the NNTP service are available by searching for "nntp" on the Microsoft Developer Network (MSDN) Web site.

important Important You must be a member of the Administrators group on the local computer to perform the following procedure (or procedures), or you must have been delegated the appropriate authority. As a security best practice, log on to your computer using an account that is not in the Administrators group, and then use the Run as command to run IIS Manager as an administrator. From the command prompt, type runas /user:administrative_accountname "mmc %systemroot%\system32\inetsrv\iis.msc".

To install the NNTP service

  1. From the Start menu, click Control Panel.
  2. Double-click Add or Remove Programs.
  3. From the left pane, click Add/Remove Windows Components.
  4. From the Components list, click Application Server, and then click Details.
  5. From the Subcomponents of Application Server list, click Internet Information Services (IIS), and then click Details.
  6. From the Subcomponents of Internet Information Services (IIS) list, select the NNTP Service check box.
  7. Click OK.
  8. Click Next. You might be prompted for the Windows Server 2003 family CD or the network install path.
  9. Click Finish.

When you install the NNTP service, a default NNTP virtual server configuration is created with a message store in LocalDrive:\Inetpub\Nntpfile\Root.

When setting up the NNTP service for the first time, you can configure global settings for an NNTP virtual server, as well as settings for individual components of the virtual server.

To configure global NNTP settings

  1. In IIS Manager, expand the local computer, right-click Default NNTP Virtual Server, and click Properties.
  2. Change the default settings on the property pages as needed. For information about individual settings, click Help.

To configure NNTP virtual server component settings

  1. In IIS Manager, expand the local computer, expand Default NNTP Virtual Server, right-click the component you want to configure, and click Properties.
  2. Change the default settings on the property pages as needed. For information about individual settings, click Help.
Related Topics
  • For information on administering the NNTP service, see NNTP Administration.


Web Authoring with WebDAV

Web Distributed Authoring and Versioning (WebDAV) extends the HTTP/1.1 protocol to allow clients to publish, lock, and manage resources on the Web. This section describes how to set up a WebDAV publishing directory on an IIS server, and how clients can connect to the server to edit and manipulate files.

important Important In order to take a more proactive stance against malicious users and attackers, IIS is not installed on members of the Microsoft® Windows® Server 2003 family by default. Furthermore, when you initially install IIS, the service is installed in a highly secure and "locked" mode. By default, IIS serves only static content — meaning features like ASP, ASP.NET, Server-Side Includes, WebDAV publishing, and FrontPage® Server Extensions do not work unless enabled. If you do not enable this functionality after installing IIS, IIS returns a 404 error. You can serve dynamic content and enable these features through the Web Service Extensions node in IIS Manager. Also, if an application extension is not mapped in IIS, IIS returns a 404 error. To map an extension, see Setting Application Mappings. For more information on how to troubleshoot 404 errors, including 404.2 and 404.3; issues related to a new installation of IIS 6.0; or an upgrade from a previous version of IIS, see Troubleshooting.

This section includes the following information:

  • About WebDAV: Describes how WebDAV can create directories from which remote users can publish and manipulate files.
  • Creating Publishing Directories: Describes how to set up a WebDAV publishing directory.
  • Managing WebDAV Security: Provides tips on how to optimize IIS and Windows Server 2003 family security to secure your WebDAV site.
  • Searching WebDAV Directories: Describes how to configure a WebDAV directory so that users can search it for content and document properties.
  • WebDAV Redirector: Describes how WebDAV Redirector treats files on the Web like they were a mapped network drive.

note Note WebDAV is an implementation of the HTTP 1.1 proposed draft and is therefore not available for non-HTTP services, such as FTP sites. Also, this implementation is for IIS 5.0, 5.1, and 6.0 only.

Related Topics
  • For more information on file and directory security, see Encrypting File System (EFS). EFS is a new feature in Microsoft® Windows® Server 2003, Standard Edition. Also, see NTFS Permissions.


About WebDAV

important Important In order to take a more proactive stance against malicious users and attackers, IIS is not installed on members of the Microsoft® Windows® Server 2003 family by default. Furthermore, when you initially install IIS, the service is installed in a highly secure and "locked" mode. By default, IIS serves only static content — meaning features like ASP, ASP.NET, Server-Side Includes, WebDAV publishing, and FrontPage® Server Extensions do not work unless enabled. If you do not enable this functionality after installing IIS, IIS returns a 404 error. You can serve dynamic content and enable these features through the Web Service Extensions node in IIS Manager. Also, if an application extension is not mapped in IIS, IIS returns a 404 error. To map an extension, see Setting Application Mappings. For more information on how to troubleshoot 404 errors, including 404.2 and 404.3; issues related to a new installation of IIS 6.0; or an upgrade from a previous version of IIS, see Troubleshooting.

Web Distributed Authoring and Versioning (WebDAV) extends the HTTP/1.1 protocol to allow clients to publish, lock, and manage resources on the Web.

Integrated into IIS, WebDAV allows clients to do the following:

  • Manipulate resources in a WebDAV publishing directory on your server. For example, users who have been assigned the correct rights can copy and move files around in a WebDAV directory.
  • Modify properties associated with certain resources. For example, a user can write to and retrieve a file's property information.
  • Lock and unlock resources so that multiple users can read a file concurrently. However, only one person can modify the file at a time.
  • Search the content and properties of files in a WebDAV directory.

Setting up a WebDAV publishing directory on your server is as straightforward as setting up a virtual directory through IIS Manager. After you have set up your publishing directory, users who have been assigned the correct rights can publish documents to the server and manipulate files in the directory. Before you can set up a WebDAV directory, you must install Windows XP Professional or a member of the Windows Server 2003 family.

WebDAV Clients

You can access and publish to a WebDAV directory through one of the following Microsoft products or through any other client that supports the industry standard WebDAV protocol. For the specific procedure on how to access and publish through these Microsoft products, consult the specific product's Help.

  • Windows clients (Windows 2000 and Windows XP): Connect to a WebDAV directory by adding the directory to the list of Network Places and display the contents as if it were part of the same file system on your local computer. Once connected, you can drag and drop files, retrieve and modify file properties, and complete many other file-system tasks. You can also connect using the command-line client (known as WebDAV Redirector). This client allows you to use existing applications across the Web and share files through firewalls and proxy servers.
  • Internet Explorer (versions 5.0 and 6.0): Connect to a WebDAV directory by opening the target directory as a Web folder and complete the same file-system tasks as Windows clients.
  • Microsoft Office products (Office 2000 and Office XP): Create, publish, edit, and save documents directly into a WebDAV directory through any application in Office 2000 or Office XP.

note Note Even if users connect from behind a firewall, they can still publish on a WebDAV directory if they have the correct permissions and if the firewall is configured to allow publishing.

When enabling WebDAV publishing on your intranet, ensure that all WebDAV clients are running the WebClient service.

To check the status, or to enable the WebClient service on a WebDAV client machine

  1. From the Start menu, point to Administrative Tools, and click Computer Management .
  2. In the details pane, double-click Services and Applications.
  3. Double-click Services.
  4. Scroll down, right-click WebClient, and click Properties.
  5. In the Startup type list box, click Automatic.
  6. Click Apply.
  7. In the Service status section, click Start.
  8. Click OK.

Searching in WebDAV

Once connected to a WebDAV directory, you can quickly search the files on that directory for content as well as properties. For example, you can search for all files that contain the word table or for all files written by Fred.

Integrated Security

WebDAV is integrated with the Windows Server 2003 family and IIS, which means WebDAV takes advantage of the security features offered by the platform and the Web server, including permissions control and discretionary access control lists (DACLs) in the NTFS file system. For information about IIS security, see Security.

Clients with proper user rights can write to a WebDAV directory, so it is vital that you control who accesses your directory. IIS has reinforced Integrated Windows Authentication by building in support for the Kerberos V5 security protocol. (Note that Integrated Windows authentication and Kerberos V5 are not the same thing. Integrated Windows authentication now supports Kerberos V5.) By selecting Integrated Windows authentication, you can make sure that only clients with the correct user rights can access and write to the WebDAV directory on your intranet. For information about how the Kerberos V5 protocol works, see "Kerberos V5 protocol" in Windows Server 2003 family Help.

In addition, IIS supports Digest authentication and Advanced Digest authentication. Created for Windows domain servers, Digest and Advanced Digest authentication offer tighter security for passwords and for transmitting information across the Internet. For information about Digest authentication, see Digest Authentication. For information about Advanced Digest authentication, see Advanced Digest Authentication.

Related Topics
  • For more information on file and directory security, see Encrypting File System (EFS). EFS is a new feature in Windows Server 2003 family.


Creating Publishing Directories

Before setting up your WebDAV publishing directory, ensure that your publishing directory resides in an NTFS partition and be sure the WebDAV extension is enabled in IIS Manager.

WebDAV publishing and file management requires the following permissions on the NTFS directory:

  • Read: Enables users to read the contents of a file.
  • Read and Execute: Enables user to read a file and run scripts or Common Gateway Interfaces (CGIs).
  • List: Enables users to view the contents of the directory.
  • Write: Enables users to access and change the source of a script and to publish files.
  • Modify: Enables users to rename or delete a directory or file.

note Note Assigning Write access does not give clients the ability to modify Active Server Pages (ASP) or any other script-mapped files. To allow these files to be modified, you must assign Write permission and Script source access after creating the virtual directory. For information about setting these permissions, see Securing Sites with Web Site Permissions.

WebDAV publishing and file management requires the following permissions on the IIS virtual directory:

  • Read: Enables users to read the contents of a file.
  • Directory Browsing: Enables users to view the contents of the directory.
  • Write: Enables users to access and change the source of a script and to publish files.
  • Indexing (optional): Enables users to search a directory.

important Important You must be a member of the Administrators group on the local computer to perform the following procedure (or procedures), or you must have been delegated the appropriate authority. As a security best practice, log on to your computer using an account that is not in the Administrators group, and then use the Run as command to run IIS Manager as an administrator. From the command prompt, type runas /user:administrative_accountname "mmc %systemroot%\system32\inetsrv\iis.msc".

To set up a publishing directory

  1. Create a directory on your Web server and set the desired NTFS permissions. You can create this directory anywhere on your Web server.
  2. In IIS Manager, create a virtual directory and set the desired virtual directory permissions. For instructions, see Using Virtual Directories.
  3. Type WebDAV as the alias for this virtual directory, and link it to the physical directory you created in Step 1.

After you finish setting up a WebDAV virtual directory, you can allow clients to publish to it. For information on how users can connect to the directory through any of the Microsoft WebDAV clients, see About WebDAV.

Related Topics
  • For more information about NTFS and IIS user rights, see Access Control.


Managing WebDAV Security

This topic provides a brief overview of recommended security practices for remote publishing. It briefly describes how to protect your server and content by authenticating client connections to your server and by controlling access to content on your server. Included in this topic are descriptions of the following:

  • Authenticating Clients
  • Controlling Access

note Note For security reasons and to to enable DAV custom properties, ensure that your publishing directory resides on an NTFS partition. To learn more about NTFS partitions, see Windows Server 2003 family Help.

Authenticating Clients

The best way to configure a WebDAV directory depends on the kind of publishing you want to do.when you create a virtual directory through IIS, Anonymous and Integrated Windows authentication are both turned on. Although this default configuration works well for clients connecting to your server, reading content on a Web page, and running scripts, it does not work well with clients publishing to a directory and manipulating files in that directory.

IIS offers the following authentication methods:

  • Kerberos is the primary security protocol for authentication within a domain. Kerberos is the best option for WebDAV client authentication and file security.
  • Anonymous authentication grants anyone access to the directory. You should turn off anonymous access to your WebDAV directory. Without controlling who has access, your directory could be attacked by unknown clients.
  • Basic authentication sends passwords over the connection in clear text. Clear text passwords can be intercepted and read. Turn on Basic authentication only if you encrypt passwords through Secure Sockets Layer.
  • Digest authentication is a good choice for publishing information on a server that is accessed over the Internet and through firewalls because the passwords are sent over the network as an MD5 hash. However, passwords are stored as plain text in Active Directory®.
  • Advanced Digest authentication is an improvement over Digest authentication because in addition to sending passwords over the network as an MD5 hash, the passwords are also stored in Active Directory as an MD5 hash rather than plaintext. This makes Advanced Digest the best choice for publishing information on a server that is accessed over the Internet and through firewalls.
  • Integrated Windows authentication works best when you are setting up a WebDAV directory on an intranet.
  • .NET Passport authentication uses cookies to validate user credentials.

Controlling Access

This section describes how you can control access to your WebDAV directory by coordinating IIS and Windows Server 2003 permissions, and how you can protect your script files.

Configuring Web Permissions

The following are various ways to configure Web permissions based on the purpose of the material you are publishing:

  • Read, Write, and directory browsing enabled: Turning on these permissions allows clients to see a list of resources, modify them (except for those resources without Write permission), publish their own resources, and manipulate files.
  • Write enabled; and Read and directory browsing disabled: If you want clients to publish private information on the directory, but do not want others to see what has been published, set Write permission and do not set Read or directory browsing permission. This configuration works well if clients are submitting ballots or performance reviews.
  • Read and Write enabled; and directory browsing disabled: Set this configuration if you want to rely on obscuring file names as a security method. However, be aware that security by obscurity is a low-level security precaution because an attacker could guess file names by trial and error.
  • Index this resource enabled: Be sure to enable Indexing Service if you plan to let clients search directory resources.

Controlling Access with DACLs

When setting up a WebDAV publishing directory on an NTFS file system drive, make sure the Everyone group has Read permission only. Then assign Write permission to specific individuals or groups.

Protecting Script Code

If you have script files in your publishing directory that you do not want to expose to clients, you can deny access to these files by verifying that Script source access permission is not assigned. Executable files are treated as static HTML files unless Scripts and Executables is enabled for the directory.

To prevent .exe files from being downloaded and viewed as HTML files, but to allow .exe files to run, on the Virtual Directory property sheet of the publishing directory, change the Execute Permissions to Scripts and Executables.

This level of permission makes all executable files subject to the Script source access setting. When Script source access is selected, clients with Read permission can see all executables; and clients with Write permission can edit them, as well as run them.

With the following permissions, clients can write to an executable file that does not appear in the Application Mapping:

  • Write permission is assigned.
  • Execute Permissions is set to Scripts only.

With the following permissions, clients can write to any executable file, regardless of whether it appears in the Application Mapping:

  • Script source access is assigned.
  • Execute Permissions is set to Scripts and Executables.
Related Topics
  • For more information about Web permissions, see Web Site Permissions.


Searching WebDAV Directories

After you create a WebDAV publishing directory, you may want to allow users to search for content and file properties.

important Important You must be a member of the Administrators group on the local computer to perform the following procedure (or procedures), or you must have been delegated the appropriate authority. As a security best practice, log on to your computer using an account that is not in the Administrators group, and then use the Run as command to run IIS Manager as an administrator. From the command prompt, type runas /user:administrative_accountname "mmc %systemroot%\system32\inetsrv\iis.msc".

To set up your publishing directory for searching

  1. If you want to let clients search for resource properties, make sure the directory is on a drive formatted with the NTFS file system. If you put the directory on a drive formatted for the file allocation table (FAT) file system, clients can search for resource content but cannot search for resource properties.
  2. To ensure that Indexing Service is running on your server, type the following at the command prompt:
    net start cisvc
    If the Indexing Service does not start, check to see that you have enabled the Indexing Service in the Windows Components Wizard and through the Web Service Extensions node in IIS Manager.
  3. In IIS Manager, expand the local machine, right-click your WebDAV directory, and click Properties.
  4. Click the Virtual Directory tab and make sure Index this resource and Read access options are selected. If Index this resource is not selected, Indexing Service will not create a catalog for that directory, and therefore, no one will be able to search it. If Read access has not been selected, a client can search the directory, but will not be able to see the results of the search.
Related Topics
  • For information on how to enable the Indexing Service in the Windows Component Wizard, see Installing IIS.
  • For information on how to enable the Indexing Service through the Web Service Extensions node in IIS Manager, see Enabling and Disabling Dynamic Content.
  • For details on setting IIS permissions for a virtual directory, see Securing Sites with Web Site Permissions.


WebDAV Redirector

WebDAV Redirector is a remote file system over the WebDAV protocol that allows Windows XP client machines to connect to your WebDAV publishing directory through the command line. Once connected, all existing Win32® applications (without any modification) can create, modify, and save files on Web shares (IIS virtual directories). The WebDAV Redirector enables you to manipulate files on the Web as though the files exist on a mapped network drive.

Your WebDAV Web site (the site that contains the virtual directory mapped to your WebDAV publishing directory) must be set up exclusively as a WebDAV site. Therefore, you must delete all FrontPage custom headers. If your WebDAV Web site is set up as both a DAV and FrontPage site, IIS defaults to the FrontPage custom header and blocks DAV command-line connections.

important Important You must be a member of the Administrators group on the local computer to perform the following procedure (or procedures), or you must have been delegated the appropriate authority. As a security best practice, log on to your computer using an account that is not in the Administrators group, and then use the Run as command to run IIS Manager as an administrator. From the command prompt, type runas /user:administrative_accountname "mmc %systemroot%\system32\inetsrv\iis.msc".

To enable WebDAV Redirector on your Web server

  1. In IIS Manager, expand the local computer, right-click your WebDAV Web site (the site that contains the virtual directory mapped to your WebDAV publishing directory) and click Properties.
  2. Click the HTTP Headers tab.
  3. Remove any headers listed in the Custom HTTP headers list box.
  4. Click Apply.
  5. Click OK.

After you have set up your WebDAV publishing directory, you can connect to that directory through the command prompt using Windows XP clients. Once connected, all existing Win32 applications (without any modification) can create, modify, and save files on Web shares (IIS virtual directories).


Server Administration Guide

This section describes how to administer your server and Web sites by using the many tools and features developed in Internet Information Services (IIS) 6.0 to improve server management, performance, reliability, and security. This section also includes conceptual information regarding some of the key changes to the IIS architecture and to the metabase.

important Important In order to take a more proactive stance against malicious users and attackers, IIS is not installed on members of the Microsoft® Windows® Server 2003 family by default. Furthermore, when you initially install IIS, the service is installed in a highly secure and "locked" mode. By default, IIS serves only static content — meaning features like ASP, ASP.NET, Server-Side Includes, WebDAV publishing, and FrontPage® Server Extensions do not work unless enabled. If you do not enable this functionality after installing IIS, IIS returns a 404 error. You can serve dynamic content and enable these features through the Web Service Extensions node in IIS Manager. Also, if an application extension is not mapped in IIS, IIS returns a 404 error. To map an extension, see Setting Application Mappings. For more information on how to troubleshoot 404 errors, including 404.2 and 404.3; issues related to a new installation of IIS 6.0; or an upgrade from a previous version of IIS, see Troubleshooting.

This section includes the following information:

  • IIS 6.0 Architecture: Describes the IIS 6.0 architecture, including IIS 5.0 application isolation mode and worker process isolation mode.
  • IIS Metabase: Describes the IIS 6.0 Extensible Markup Language (XML) metabase, a hierarchical repository for most IIS configuration values.
  • Web Site Administration: Describes how to manage Web site infrastructure, including how to manage multiple Web sites, redirect requests, and restart IIS.
  • FTP Site Administration: Describes how to manage File Transfer Protocol (FTP) site infrastructure, including multiple FTP sites, data transmission, and user isolation.
  • NNTP Administration: Describes how to manage Network News Transfer Protocol (NNTP) site infrastructure, including restricting access to newsgroups, configuring expiration policies, and NNTP security.
  • SMTP Administration: Describes how to manage Simple Mail Transfer Protocol (SMTP) site infrastructure, including setting connections, protocol logging, and SMTP security.
  • Configuring Applications: Describes how to configure IIS Manager so that various applications—including Microsoft® Active Server Pages (ASP), Internet Service API (ISAPI), and Common Gateway Interfaces (CGI)—run on your IIS server.
  • Configuring Servers for Applications: Describes how to enable IIS to run in either IIS 5.0 application isolation mode or worker process isolation mode. Also describes how to enable dynamic content in IIS 6.0.
  • Security: Describes how to configure IIS and Microsoft Windows® to secure your sites. Also describes how to use security features like Secure Sockets Layer (SSL) and encryption.
  • Performance Tuning: Describes how to monitor and tune server performance in order to maximize throughput and minimize Web application response times, thus creating a better experience for clients that are trying to access your Web server.
  • Quality of Service: Describes features that help administrators control how individual aspects of IIS use hardware resources.
  • Logging Site Activity: Describes how to capture user activity information, including who has visited your site, what the visitor viewed, and when the information was last viewed. You can use the logs to assess content popularity or to identify information bottlenecks.
  • Custom Error Messages: Describes how to configure IIS to send custom error messages instead of the default HTTP 1.1 error messages.
  • Restarting IIS: Describes methods for restarting IIS, including how to use the Automatic Restart feature.
  • Internet Protocol Version 6: Describes how to set up IIS to accept Internet Protocol version 6 (IPv6) requests.


IIS 6.0 Architecture

Today's Web applications require a fast, scalable, reliable Web service that is manageable and secure. Internet Information Services (IIS) 6.0 meets these requirements by incorporating a new architecture that delivers performance and reliability in the application isolation mode, which you select to suit the requirements of your Web applications. This section provides an overview of the new design and the new features of IIS 6.0.

This section includes the following information:

  • IIS Services: Describes the basic services that are provided by IIS.
  • IIS Core Components: Describes the four core components of IIS: HTTP.sys, WWW Service Administration and Monitoring component, worker processes, and Inetinfo.exe.
  • IIS Isolation Modes: Describes the application isolation modes that are available in IIS 6.0.
  • Web Application Isolation: Describes how IIS manages applications in isolated application pools when the server is running in worker process isolation mode.
  • ASP.NET and IIS 6.0: Describes how IIS 6.0 handles the configuration of ASP.NET differently for each of the two application isolation modes.
Related Topics
  • For information on security features that are built into IIS 6.0, see Security.


IIS Services

IIS provides the basic services that publish information, transfer files, support user communication, and update the data stores upon which these services depend. This section introduces the services that IIS 6.0 provides.

The following table lists the IIS services, as well as their primary components and service hosts.

Service | Primary Component | Hosted by
World Wide Web Publishing service(WWW service) | Iisw3adm.dll | Svchost.exe
File Transfer Protocol service (FTP service) | Ftpsvc.dll | Inetinfo.exe
Simple Mail Transfer Protocol service (SMTP service) | Smtpsvc.dll | Inetinfo.exe
Network News Transfer Protocol service (NNTP service) | Nntpsvc.dll | Inetinfo.exe
IIS Admin service | Iisadmin.dll | Inetinfo.exe

World Wide Web Publishing Service

World Wide Web Publishing Service (WWW service) provides Web publishing to IIS end users, connecting client HTTP requests to Web sites that are running in IIS. WWW service manages the IIS core components that process HTTP requests and that configure and manage Web applications.

WWW service runs as Iisw3adm.dll and is hosted by Svchost.exe.

File Transfer Protocol Service

Through the File Transfer Protocol service (FTP service), IIS provides full support for managing and serving files. The service uses the Transmission Control Protocol (TCP), which ensures that file transfers are complete and that the data transferred is accurate. This version of FTP supports isolating users at the site level to help administrators secure and commercialize their Internet sites.

FTP service runs as Ftpsvc.dll and is hosted by Inetinfo.exe.

Simple Mail Transfer Protocol Service

IIS can send or receive e-mail by using the Simple Mail Transfer Protocol service (SMTP service). For example, you can program the server to send mail automatically in response to events, in order to confirm successful forms submissions by users. Also, you can use the SMTP service to receive messages that collect feedback from Web site customers. SMTP service does not provide full e-mail services. To deliver full e-mail services, use Microsoft® Exchange Server.

SMTP service runs as Smtpsvc.dll and is hosted by Inetinfo.exe.

Network News Transfer Protocol Service

You can use the Network News Transfer Protocol service (NNTP service) to host NNTP local discussion groups on a single computer. Because this feature complies fully with the NNTP protocol, users can use any news reader client to participate in the newsgroup discussions. Through the Rfeed script, found in the inetsrv folder, the IIS NNTP service now supports newsfeeds. NNTP service does not support replication. To employ news feeds or to replicate a newsgroup across multiple computers, use Exchange Server.

NNTP service runs as Nntpsvc.dll and is hosted by Inetinfo.exe.

IIS Admin Service

IIS Admin service manages the IIS metabase and updates the Microsoft Windows® operating system registry for the WWW service, FTP service, SMTP service, and NNTP service. The metabase is a data store that holds IIS configuration data. IIS Admin service exposes the metabase to other applications, including the core components of IIS, applications that are built on IIS, and third-party applications that are independent of IIS, such as management or monitoring tools.

IIS Admin service runs as Iisadmin.dll and is hosted by Inetinfo.exe

Related Topics
  • For information on IIS core components, see IIS Core Components.
  • For information on how to manage FTP sites, see FTP Site Administration.
  • For information on how to configure and use SMTP service, see SMTP Administration.
  • For information on how to configure and use NNTP service, see NNTP Administration.
  • For more information on the IIS metabase, see IIS Metabase.


IIS Core Components

IIS 6.0 core components consist of kernel-mode processes and user-mode processes. This topic includes information on the following individual core components, and how they interact:

  • HTTP.sys is a kernel-mode device driver that routes HTTP requests to user-mode applications.
  • WWW Service Administration and Monitoring Component configures the World Wide Web Publishing Service (WWW service) and manages worker processes.
  • Worker Processes process requests submitted to Web applications that are assigned to them.
  • Inetinfo.exe hosts the metabase and non-Web services.

HTTP.sys

The Hypertext Transfer Protocol (HTTP) listener is implemented as a kernel-mode device driver named HTTP.sys. HTTP.sys is part of the networking subsystem of Windows. However, HTTP.sys is utilized as a core component of IIS 6.0.

By running HTTP.sys as a kernel-mode component, IIS 6.0 delivers the following two performance enhancements, which are not included when running HTTP listener as a user-mode component:

  • By dispatching directly to the correct process from the kernel, requests are served with less context-switching overhead.
  • By enabling the kernel-mode cache, requests for cached returns can be served without switching to user mode.

How HTTP.sys Works

When you create a Web site in IIS, the site is registered with HTTP.sys, which then routes Web requests to the user-mode process that is running the Web site. HTTP.sys also sends responses back to the client. Other than retrieving a stored response from its internal cache, HTTP.sys does not process the requests it receives. Therefore, no application-specific code is ever loaded into kernel mode. As a result, application-specific code bugs cannot affect kernel-mode processes or lead to system failures.

HTTP.sys provides other services that IIS uses, including the following:

  • Managing Transmission Control Protocol (TCP) connections.
  • Routing HTTP requests to the correct request queue.
  • Caching of responses in kernel mode.
  • Performing all text-based logging for the WWW service.
  • Implementing Quality of Service (QoS) functionality, which includes connection limits, connection time-outs, queue-length limits, and bandwidth throttling.

WWW Service Administration and Monitoring Component

WWW Service Administration and Monitoring is a new component of the World Wide Web Publishing Service (WWW service). It is responsible for administrative tasks and process management. In its administrative role, WWW Service Administration and Monitoring implements the service control functions of the WWW service; interacts with the metabase to obtain the configuration data that is either passed into HTTP.sys, or used when managing a worker process; and supports the remaining run-time administration of the service. In its management role, WWW Service Administration and Monitoring is responsible for managing the worker processes, which includes starting them and maintaining information on them while they are running.

WWW Service Administration and Monitoring runs in user mode in a non-shared svchost.exe, and runs as LocalSystem.

Worker Processes

A worker process is an application that runs in user mode. Its typical roles include processing requests to return a static page, invoking an Internet Server API (ISAPI) extension or filter, or running a Common Gateway Interface (CGI) handler. A worker process is physically implemented as an executable file named W3wp.exe and is controlled by WWW Service Administration and Monitoring.

By default, worker processes run as NetworkService, which has the strongest security (least access) that is compatible with the functionality required. Worker processes use HTTP.sys for sending requests and receiving responses over the Web. The worker process also runs application code, such as Microsoft ASP.NET applications. Depending on how IIS is configured, there can be multiple worker processes running, serving different Web applications concurrently. This design separates applications by process boundaries, and it helps achieve maximum Web server reliability.

Inetinfo.exe

Inetinfo.exe is a user-mode component that hosts the components of IIS 6.0, other than the WWW service. These components include File Transfer Protocol service (FTP service) , Simple Mail Transfer Protocol service (SMTP service) , Network News Transfer Protocol service (NNTP service), and the IIS metabase. Inetinfo.exe also hosts the single worker process that runs when IIS 6.0 is in IIS 5.0 isolation mode.

important Important In IIS 6.0, the services that run in Inetinfo.exe run as DLLs with LocalSystem identity (the account the services run as). Because this account can be used to gain access to virtually every resource on the local computer, the LocalSystem account should be used with caution, especially on computers that provide services on the Internet.

Related Topics
  • For information on how to log user activity information and use it to assess content popularity or to identify information bottlenecks, see Logging Site Activity.
  • For more information on the application isolation modes that are available in IIS 6.0, see IIS Isolation Modes.


IIS Isolation Modes

IIS 6.0 runs in one of two distinct modes of operation, which are called application isolation modes (isolation modes): worker process isolation mode and IIS 5.0 isolation mode. Both isolation modes rely on HTTP.sys as the Hypertext Transfer Protocol (HTTP) listener; however, their internal workings are fundamentally different.

Worker process isolation mode takes advantage of the redesigned architecture for IIS 6.0 and uses the worker process core component. IIS 5.0 isolation mode is provided for applications that depend on specific features and behaviors of IIS 5.0. The isolation mode is specified by the IIs5IsolationModeEnabled metabase property.

The IIS application isolation mode that you choose impacts performance, reliability, security, and feature availability. Worker process isolation mode is the recommended mode of operation for IIS 6.0 because it provides a more robust platform for applications. Worker process isolation mode also provides a higher level of security because the default identity of applications running in worker processes is NetworkService.

The default identity of applications running in IIS 5.0 isolation mode is LocalSystem, which enables access to and the ability to alter nearly all of the resources on the computer.

Although worker process isolation mode offers increased isolation, reliability, availability, and performance, some applications may have compatibility issues when running in this mode. If you encounter compatibility problems, use IIS 5.0 isolation mode.

When deciding which isolation mode to use, consider the following:

  • Unless you are required to use IIS 5.0 isolation mode due to a specific compatibility issue, use worker process isolation mode.
  • Web sites with static content and simple Microsoft Active Server Pages (ASP) applications should be able to run with little or no modification in worker process isolation mode.
  • If applications are running correctly on IIS 5.0, they should run correctly in IIS 5.0 isolation mode.

note Note IIS 6.0 cannot run both application isolation modes simultaneously. Therefore, it is not possible to run some Web applications in worker process isolation mode and others in IIS 5.0 isolation mode on the same IIS server. If you have applications that require separate modes, you must run them on separate computers.

This topic includes the following information:

  • Worker Process Isolation Mode
  • IIS 5.0 Isolation Mode
  • Comparing Functions in IIS 6.0 Modes
  • Isolation Mode Defaults
  • HTTP Filter

Worker Process Isolation Mode

Worker process isolation mode leverages all of the new IIS 6.0 core components. Using worker process isolation mode enables application pooling, recycling, and health detection features, which are described later in this topic.

The following diagram illustrates the architecture of IIS 6.0 running in worker process isolation mode.

IIS 6.0 running in worker process isolation mode.

In the diagram, you can see that application-specific code is loaded into the worker process only. Examples of application-specific code are ASP and ASP.NET applications, because the run-time engines for these programming platforms are implemented as Internet Server API (ISAPI) extensions.

This architecture makes IIS very reliable because the World Wide Web Publishing Service (WWW service), IIS Admin service, and HTTP.sys are able to stay up and running continually, despite any service interruptions that can occur in a worker process. Also, Web sites running in the worker processes are not affected by failures in other worker processes because they are isolated from each other through process boundaries.

The following steps illustrate how a request is processed in worker process isolation mode:

  1. A request arrives at HTTP.sys.
  2. HTTP.sys determines if the request is valid. If the request is not valid, it sends a code for an invalid request back to the client.
  3. If the request is valid, HTTP.sys checks to see if the response is located in its kernel-mode cache.
  4. If the response is in the cache, HTTP.sys returns the response immediately.
  5. If the response is not cached, HTTP.sys determines the correct request queue, and places the request in that queue.
  6. If the queue has no worker processes assigned to it, HTTP.sys signals the WWW service to start one.
  7. The worker process pulls the request from the queue and processes the request.
  8. The worker process sends the response back to HTTP.sys.
  9. HTTP.sys sends the response back to the client and logs the request, if configured to do so.

IIS 5.0 Isolation Mode

IIS 5.0 isolation mode ensures compatibility for applications that were developed for IIS 5.0. The request processing of IIS 6.0 running in IIS 5.0 isolation mode is nearly identical to the request processing in IIS 5.0. In IIS 5.0 isolation mode, application pools, recycling, and health detection features are not available.

The following diagram illustrates IIS running in IIS 5.0 isolation mode.

IIS running in IIS 5.0 isolation mode.

In IIS 5.0 isolation mode, HTTP.sys is used in the same way as it is in worker process isolation mode. The only exception is that it routes requests only to a single request queue that is maintained by the WWW service. Depending on how the isolation mode is configured—either in-process, pooled, or out–of–process—the request will be processed in either Inetinfo.exe or DLLHost.exe.

Comparing Functions in IIS 6.0 Modes

Use the following table as a reference for understanding the roles of IIS 6.0 functions when running in IIS 5.0 isolation mode, as well as worker process isolation mode.

IIS Function | IIS 5.0 Isolation Mode Host/Component | Worker Process Isolation Mode Host/Component
Worker process management | N/A | Svchost.exe/WWW service
Worker process | N/A | W3wp.exe/Worker process
Running in-process ISAPI extensions | Inetinfo.exe | W3wp.exe
Running out-of-process ISAPI extensions | DLLHost.exe | N/A (all ISAPI extensions are in-process)
Running ISAPI filters | Inetinfo.exe | W3wp.exe
HTTP.sys configuration | Svchost.exe/WWW service | Svchost.exe/WWW service
HTTP protocol support | Windows kernel/HTTP.sys | Windows kernel/HTTP.sys
IIS metabase | Inetinfo.exe | Inetinfo.exe
FTP | Inetinfo.exe | Inetinfo.exe
NNTP | Inetinfo.exe | Inetinfo.exe
SMTP | Inetinfo.exe | Inetinfo.exe

Isolation Mode Defaults

When you install IIS 6.0 on a computer that does not have a previous version of IIS installed, the isolation mode is automatically set to worker process isolation mode. If you upgrade from a previous version of IIS, the isolation mode is set to IIS 5.0 isolation mode.

The following table specifies the default isolation mode settings upon installing IIS 6.0.

Installation | Isolation Mode
New installation of IIS 6.0 | Worker process isolation mode
Upgrade from earlier version of IIS 6.0 | No change in isolation mode
Upgrade from IIS 5.0 | IIS 5.0 isolation mode
Upgrade from IIS 4.0 | IIS 5.0 isolation mode

HTTP Filter

Secure Sockets Layer (SSL) requests are encrypted, and the kernel-mode HTTP service lacks the ability to either decrypt the requests or to encrypt the responses. The problem is solved efficiently with a user-mode service, HTTP filter, that is designed to decrypt SSL requests and encrypt the returns. The HTTP filter service runs in both IIS operating modes, as follows:

  • When IIS 6.0 is running in worker process isolation mode, Isass.exe hosts HTTP filter.
  • When IIS 6.0 is running in IIS 5.0 isolation mode, Inetinfo.exe hosts HTTP filter.
Related Topics
  • For instructions on how to set IIS isolation modes, see Configuring Isolation Modes.
  • For information on configuring worker process isolation mode features, see Worker Process Isolation Mode.
  • For information on configuring IIS 5.0 isolation mode features, see IIS 5.0 Isolation Mode.
  • For more information on SSL, see Secure Sockets Layer.


Web Application Isolation

Application isolation is the separation of applications by process boundaries that prevent the applications from affecting one another. Application isolation is configured differently for each of the two IIS isolation modes.

This topic includes the following information:

  • Web Application Isolation in Worker Process Isolation Mode
  • Web Application Isolation in IIS 5.0 Isolation Mode

Web Application Isolation in Worker Process Isolation Mode

With IIS 6.0 running in worker process isolation mode, you can group Web applications into application pools. Application pools allow specific configuration settings to be applied to groups of applications, and the worker processes servicing those applications. Any Web directory or virtual directory can be assigned to an application pool.

Every application within an application pool shares the same worker process. Because each worker process operates as a separate instance of the worker process executable, W3wp.exe, the worker process that services one application pool is separated from the worker process that services another. This ensures that if a Web application fails, it will not affect the applications that are running in other application pools.

You can configure and manage application pools to take advantage of the following features:

  • Application Pool Health Detection
  • Worker Process Recycling
  • Web Gardens
  • Processor Affinity
  • Application Pool Identity
  • IIS_WPG Group
  • Predefined Accounts
  • Configurable Accounts

Application Pool Health Detection

By detecting the degree of stability (or, health) of an application pool, IIS determines whether corrective action is required. The World Wide Web Publishing Service (WWW service) can detect an unhealthy worker process that has terminated abnormally if all of the available IIS threads in the worker process assigned to the application pool are blocked, or if the worker process notifies IIS that a problem exists.

Worker Process Recycling

Worker process recycling is the automatic refreshing of Web applications by restarting the worker processes assigned to them. Recycling keeps problematic applications running smoothly, especially when it is not feasible to modify the application code. When a recycling event occurs, the worker process that is currently serving the application pool terminates and the WWW service restarts a new worker process to replace it.

Web Gardens

Web gardens are application pools that are configured to run multiple worker processes. The worker processes in a Web garden share the requests that arrive for that particular application pool, thus enhancing performance and reliability of the applications in the application pool.

Processor Affinity

Processor affinity is an application pool property that forces worker processes to run on specific microprocessors, or CPUs. It applies to all worker processes serving a particular application pool. Advanced configurations using Web gardens and processor affinity can be used on multi-processor computers where clusters of CPUs can be dedicated to specific application pools. This configuration can be taken a step further by setting the affinity of specific network interface cards to the specific CPUs.

Application Pool Identity

Application pool identity is the user account that the worker processes servicing the application pool use as their process identity. Process identity is an operating system term used to denote the account that a process runs under. Every running process on a Microsoft® Windows NT®-based operating system has a process identity that is used to control access to resources on the system. Application pool identity can be assigned a pre-defined account, or an account that is user-configurable.

Selecting an Identity

When selecting an application pool identity, you should choose one with the least number of privileges required by your application. An Internet Server API (ISAPI) extension can easily run as the worker process identity, if coded to do so. In this case, actions taken by the ISAPI extension are in the context of the worker process identity. In the case where the worker process identity is set to an account with high privileges, like LocalSystem, the result may be that the application is given permissions beyond the scope of the authenticated user. Consequently, consider setting the worker process identity to an account with low privileges to prevent an ISAPI extension from elevating its privilege in this manner. Doing this can deter a security breach by the application.

Relationship of Application Pool Identity to the Impersonated User

Impersonation allows a process to run using security credentials that are different from its base identity. Because the two are commonly confused, it is important to understand how the worker process identity that is established by the application pool identity is related to the impersonated user.

When a worker process is created by the WWW service, it is created with a process token that is associated with the application pool identity. This establishes the process identity of the worker process. By default, all actions taken by the worker process are completed in the context of this worker process identity account. However, when a client request is processed, the thread processing the request uses a token associated with the client, also known as the authenticated user's token, during the duration of the request. This is known as impersonation.

The behavior in an application is as follows:

  • If the request is anonymous, the authenticated user's token is associated with the configured anonymous user (by default, this is the IUSR_machinename account).
  • If the request is not anonymous, the authenticated user's token is associated with the user's authenticated account.

Before IIS serves a URL, the authenticated user's token is verified against the access control list (ACL) of the resource that is being requested. Additionally, if the request is for an ISAPI extension, such as ASP, the worker process applies the authenticated user's token as an impersonation token to the thread that calls the ISAPI extension. When the ISAPI extension begins processing the request, this impersonation token applies to the actions it takes. Consequently, the actions taken by an ISAPI extension are associated with the authenticated user, not the process identity.

IIS 6.0 Identity vs. IIS 5.0 Identity

Worker processes use a process identity that is different from the identity used in IIS 5.0. This affects applications that have been migrated from IIS 5.0 and expect the process identity to run as a specific account such as IWAM_ComputerName. Also, for Web applications that are created in IIS&bnsp;5.0, identity is configured by Component Services; while in IIS 6.0 running in worker process isolation mode, identity is configured in IIS Manager.

IIS_WPG Group

The IIS_WPG group is a user group provided by IIS 6.0. The IIS_WPG group provides the minimum set of privileges that are required by IIS, and it provides a convenient way to use a specific user for the identity account without having to manually assign the privileges to that identity. In cases where the account is not in the IIS_WPG group and does not have the appropriate permissions, the worker process will fail to start.

Predefined Accounts

Predefined accounts are known as service-user accounts and are created by the operating system. IIS allows users to select the following predefined accounts for the application pool identity:

  • NetworkService
  • LocalSystem
  • LocalService

By default, these accounts are members of the IIS_WPG group, and the application pool identity is set to the NetworkService account, which has the lowest privileges of the three accounts. It is recommended that you compare your applications' security requirements with the permission levels of the pre-defined accounts before configuring and placing them into production.

Configurable Accounts

When this option is used, you must specify a local machine, or domain user name and password, for the application pool identity. The account that is specified should be a member of the IIS_WPG user group. Although not recommended, if the user account is not in the IIS_WPG group, the setting of ACLs on the proper resources required by the worker process must be applied manually.

Web Application Isolation in IIS 5.0 Isolation Mode

When running in IIS 5.0 isolation mode, you can configure isolation by using the AppIsolated property setting for each application. Your options for isolation are similar to running IIS 5.0, as follows:

  • Low (IIS Process) Applications run in-process as DLLS in Inetinfo.exe and are not protected from other applications running in-process. The default application identity (account the application runs as) is LocalSystem.
  • Medium (Pooled) All pooled applications run as DLLs in one instance of DLLHost.exe and are protected from the impacts of applications running in Low or High isolation. However, because all pooled applications run in the same process, they are not protected from each other. The default application identity is IWAM_ComputerName.
  • High (Isolated) Applications run as DLLs in DLLHost.exe and are protected from impacts of other applications. Also, all other applications run on the same computer are protected from the impacts of applications run in high-isolation. The default application identity is IWAM_ComputerName.

Security Considerations

When running IIS 6.0 in IIS 5.0 isolation mode, Web applications set to low isolation run with LocalSystem identity. The LocalSystem account has access to all of the resources that are on the computer. This means that if an attack by a malicious user succeeds in taking over a Web application set to Low isolation, all of the assets of the local computer are exposed to the attacker.

Web applications with isolation set to Medium or High run with IWAM_ComputerName as the default identity.

Performance Considerations

When IIS is running in IIS 5.0 isolation mode, there is a performance penalty when running applications in a highly isolated configuration. This is due to the remote procedure call (RPC) mechanism used by the Common Object Model (COM), which occurs during the following actions:

  • When a request is sent to an application running in High isolation, and the response is sent back.
  • When a Web application running in High isolation communicates with the Web server during the processing of a request.

In contrast, when IIS 6.0 runs in worker process isolation mode, applications are loaded in-process to W3wp.exe. Therefore, there is no performance penalty.

Related Topics
  • For information on configuring IIS for application pool health monitoring, see Configuring Worker Process Health Monitoring.
  • For information on when to use worker process recycling and how to configure worker processes for recycling, see Recycling Worker Processes.
  • For more information on Web gardens, including how to create them, see Configuring Web Gardens.
  • For information on how to configure the identity of an application pool, see Configuring Application Pool Identity.
  • For detailed information on the privileges of the service user accounts, see Platform SDK Help for Windows Base Services.


ASP.NET and IIS 6.0

When running ASP.NET applications on IIS 6.0, it is important to understand how ASP.NET functions when running the two IIS 6.0 application isolation modes. When ASP.NET runs on IIS 4.0, IIS 5.0, or IIS 6.0 in IIS 5.0 isolation mode, it uses its own process model and configuration settings in the Machine.config file. If IIS is running in worker process isolation mode, ASP.NET disables its own process model and utilizes the worker process architecture of IIS 6.0.

The ASP.NET Internet Server API (ISAPI) extension implements a process model that is similar to worker process isolation mode and contains similar worker process management capabilities as the World Wide Web Publishing Service (WWW service). ASP.NET also provides functionality in the form of recycling, health detection, and the ability to force a worker process to have affinity to a particular CPU.

ASP.NET <processModel> Configuration Section

If your ASP.NET application has specific configuration settings in the <processModel> section of the Machine.config file, they will not be used when the application is running in worker process isolation mode, with the exception of maxIOThreads and maxWorkerThreads. IIS reads these configuration values, and sets the following:

  • maxIOThreads controls the number of threads the worker process uses to receive asynchronous requests from HTTP.sys.
  • maxWorkerThreads sets the number of application threads in the ASP.NET ISAPI extension.

If developers write applications that have specific <processModel> configurations in ASP.NET other than the values mentioned above, they must be manually converted to the appropriate application pool settings when the application is deployed on IIS 6.0. Additionally, any health detection and recycling features do not automatically transfer over from an ASP.NET configuration to IIS 6.0.

Related Topics
  • For more information on enabling and configuring the ASP.NET process model in IIS 6.0, see Using the ASP.NET Process Model.
  • For reference information on the <processModel> element, see <processModel> Element.


IIS Metabase

The metabase is a repository for most Internet Information Services (IIS) configuration values. The metabase is a plain-text .XML file and can be edited manually or programmatically. The metabase is also extensible in a highly efficient manner. As your IIS deployment grows, so does the metabase; however, by using an inheritance model, explicit declarations of duplicate values is avoided, reducing overhead when configuration values need to be read form the metabase.

This section includes the following information:

  • About the Metabase: Provides an overview of the IIS metabase.
  • Metabase Structure: Describes the hierarchical structure of the metabase, the inheritance of property values, and the metabase schema.
  • Configuring the Metabase: Presents various methods for configuring the metabase, including a discussion of history files, how to edit the MetaBase.xml file while IIS is running, and an explanation of extending the XML metabase schema.
  • Metabase Security: Describes file-level security for the metabase files, encrypted metabase properties, and auditing. This section also discusses programmatic access to metabase nodes and renaming or relocating the MetaBase.xml file.
  • Backing Up and Restoring the Metabase: Discusses backing up and restoring the metabase.
  • Metabase Import and Export: Describes site cloning, application cloning, and creating a metabase template to import from other servers running IIS.
  • Metabase Changes for IIS 6.0: Provides an overview of the metabase properties that have changed in IIS 6.0.
Related Topics
  • For information on each property in the metabase, see Metabase Property Reference.


About the Metabase

This topic includes the following information:

  • What is the IIS Metabase?
  • Benefits of Plain Text, XML-Formatted Files
  • Starting or Stopping IIS
  • Metabase Features

What Is the IIS Metabase?

The metabase is a hierarchical store of configuration information and schema that are used to configure IIS. The metabase configuration and schema for IIS 4.0 and IIS 5.0 were stored in a binary file, which was not easily readable or editable. IIS 6.0 replaces the single binary file (MetaBase.bin), with plain text, Extensible Markup Language (XML)-formatted files named MetaBase.xml and MBSchema.xml. These files are stored on your computer in the systemroot\System32\Inetsrv folder. Only users who are members of the Administrators group can view and modify these files.The benefits of the plain text, XML-formatted metabase files are discussed later in this topic.

In physical terms, the metabase is a combination of the MetaBase.xml and MBSchema.xml files and the in-memory metabase. The IIS configuration information is stored in the MetaBase.xml file, while the metabase schema is stored in the MBSchema.xml file. When IIS is started, these files are read by the storage layer and then written to the in-memory metabase through Admin Base Objects (ABO), as shown in the following illustration.

Shows the interfaces to the In-memory metabase.

The metabase configuration and schema are stored in separate nodes in the in-memory metabase. The in-memory metabase itself resides in the IIS file cache in the random access memory (RAM) of your computer. For information about starting or restarting IIS, see Starting IIS. While IIS is running, changes that are made to the in-memory metabase are periodically saved to disk. The in-memory metabase also is saved to disk when IIS is stopped. For information about stopping IIS, see Stopping IIS.

Benefits of Plain-Text, XML-Formatted Files

Plain-text, XML-formatted metabase files offer the following benefits:

  • Metabase files can be edited directly using common text editors.
    The metabase configuration file, MetaBase.xml, can be easily read and edited using common text editors, such as Microsoft® Notepad. Editing the metabase configuration file directly is primarily for administrators who do not want to use scripts or code to administer IIS. Also, editing the metabase configuration file directly is faster than using IIS Manager when administering IIS over a slow network connection. For information about editing the metabase configuration file, see About the Metabase Edit-While-Running Feature.

    • important Important Editing the MBSchema.xml file directly is not supported. Changes that are made to metabase schema must be made programmatically using Active Directory Service Interfaces (ADSI) or using ABO in a compiled C++ program.

  • Improved metabase corruption recovery and troubleshooting.
    The metabase makes diagnosis of potential metabase corruption easier because the metabase is stored in a plain-text file and it can be analyzed using tools such as the Windows Resource Kit utility, Windiff. As the metabase is edited and saved to disk, IIS makes copies of each version of the MetaBase.xml and MBSchema.xml files in the history folder. Think of the metabase history feature as an automatic backup mechanism. You can use these plain text history files to compare changes that are made to MetaBase.xml and MBSchema.xml files. For more information, see Metabase History Feature.
  • Improved metabase backup and restore capabilities on computers that may experience critical failures.
    By using the backup and restore capabilities, administrators can back up the metabase and encrypt it with any password. If a critical failure occurs, the metabase can be restored on a different computer or on a different installation of a member of the Microsoft Windows Server 2003 family. Additionally, the metabase can be restored with a previous version of the MetaBase.xml and MBSchema.xml file from the history folder. For more information, see Backing Up and Restoring the Metabase.

Starting or Stopping IIS

Starting IIS

When IIS is started or restarted, the metabase configuration that is stored in MetaBase.xml and the schema information that is stored in MBSchema.xml is read by the storage layer and then written to the in-memory metabase through ABOs, as shown in the illustration at the top of this page.

Administrators can modify the MBSchema.xml file when IIS is not running, using programmatic interfaces only. Editing the MBSchema.xml file directly, using a text editor, is not supported. For information about modifying the MBSchema.xml file, see Extending the Metabase Schema.

When IIS is started, the metabase storage layer reads all information from the MetaBase.xml and MBSchema.xml files and copies it to the in-memory metabase through the ABOs.

If the MetaBase.xml file cannot be parsed when IIS is started or restarted, the following happens:

  • An error is sent to the event log.
  • IIS does not start.

The reasons that MetaBase.xml might not be parsed correctly include, but are not limited to, missing XML tags, misspelled property names, or corruption of the MetaBase.xml file. In an attempt to determine the cause of failure, an administrator can use the last history file to determine what has changed in the MetaBase.xml file. If the metabase cannot be parsed, you can also restore it to a previous version using the last manual backup or an automatically-generated history file. For more information, see Backing Up and Restoring the Metabase.

Stopping IIS

When IIS is stopped, it checks to determine whether the configuration node or the schema node have changed in the in-memory metabase since the last time the in-memory metabase was written to disk. The configuration node contains the metabase configuration, which is stored in the MetaBase.xml file. The schema node contains the metabase schema, which is stored in the MBSchema.xml file.

To minimize the amount of time that is required to stop IIS, the MetaBase.xml file is not written to disk if the configuration node in the in-memory metabase has not changed. If the configuration node in the in-memory metabase has changed since the last time the in-memory metabase was saved to disk, the MetaBase.xml file is overwritten with the contents of the configuration node, and a new history file is created named in the following format.

MetaBase_<majorversion>_<minorversion>.xml

where <majorversion> is set to the next available major version number and <minorversion> is set to zero.

To minimize the amount of time that is required to stop IIS, the MBSchema.xml file is not written to disk if the schema node in the in-memory metabase has not changed. If the schema node in the in-memory schema has changed since the last time the in-memory metabase was saved to disk, the MBSchema.xml file is overwritten with the contents of the schema node and a new history file is created named in the following format.

MBSchema_<majorversion>_<minorversion>.xml

where the major and minor version numbers are the same as the MetaBase_<majorversion>_<minorversion>.xml history file.

Metabase Features

The metabase includes the following features:

  • The metabase schema can be modified by an administrator.
    The metabase schema enforces which properties can be written at a particular key in the metabase. The schema also enforces the data types that can be used for a particular property attribute. You can modify the metabase schema using ADSI to customize this enforcement, or to allow properties that are not well known to be written in the metabase. For detailed information about the well-known properties, see the Metabase Property Reference. For more information about metabase schema, see Metabase Schema.
  • The metabase is 100 percent compatible with IIS 5.0 metabase APIs and ADSI.
    Because the XML metabase is fully compatible with IIS 5.0 metabase APIs and ADSI, existing scripts and code will continue to work. For more information about the interfaces to the metabase, see About Configuring the Metabase.
  • Metabase performance and scalability are improved.
    The metabase improves performance and scalability over previous versions of IIS in the following ways:
    • Comparable or better disk footprint size compared to the IIS 5.0 metabase.
    • Faster read times on Web server startup than the IIS 5.0 binary metabase.
    • Equivalent write performance to the IIS 5.0 binary metabase.
  • The metabase incorporates rich functionality.
    The metabase incorporates rich functionality with the following features:
    • Property inheritance.
    • Data typing of property values.
    • Change notification when metabase properties change.
    • Security features.
    • Backing up and restoring your IIS configuration is easier.
    • Importing and exporting individual nodes to other computers is easier.

Related Topics

  • For information on metabase security considerations, see Metabase Security.
  • For information on configuring access to files and folders, see Access Control.
  • For more information about editing the metabase configuration file, see About the Metabase Edit-While-Running Feature.
  • For more information about the history feature, see Metabase History Feature.
  • For more information about metabase backup and restore, see Backing Up and Restoring the Metabase.
  • For more information about metabase schema, see Metabase Schema.
  • For more information about the interfaces to the metabase, see About Configuring the Metabase.


Metabase Structure

Internet Information Services (IIS) stores the metabase configuration and schema in plain-text, Extensible Markup Language (XML)-formatted files, unlike previous versions of IIS that used a single binary file. The advantage of using XML-formatted files is that they are readable with common editing tools, such as Microsoft Notepad. This section describes the purpose and structure of the metabase configuration and schema files, as well as metabase property inheritance.

This section includes the following information:

  • Metabase Configuration File: Describes the hierarchical structure of the MetaBase.xml file.
  • Metabase Schema: Explains the function of the metabase schema and the structure of MBSchema.xml.
  • Property Inheritance: Explains how properties are inherited from higher-level metabase keys.


Metabase Configuration File

The metabase configuration file, named MetaBase.xml by default, stores the IIS configuration settings. The MetaBase.xml file is organized in a hierarchical structure, which can vary depending on the choices that are made when IIS is installed and, if applicable, later reconfigured. When IIS is started or restarted, the configuration settings are read from MetaBase.xml and copied into the IIS cache in memory, which is referred to as the in-memory metabase. When IIS Manager or programmatic interfaces are used to change IIS configuration, the changes are made to the in-memory metabase and persisted to MetaBase.xml after a previously configured number of changes or according to regular time intervals.

Because MetaBase.xml is a plain-text file, you can read and configure it using common editing tools, such as Microsoft Notepad. It is recommended that you become familiar with the structure of MetaBase.xml before attempting to configure IIS by changing the MetaBase.xml file.

Terminology Specific to XML

Because MetaBase.xml is an Extensible Markup Language (XML) file, familiarity with XML terminology and metabase terminology helps in understanding the structure of the MetaBase.xml file. The following tables define both terminologies. The structure of the MetaBase.xml file is presented with the associated terminology in the MetaBase.xml code sample.

XML Terminology

The MetaBase.xml file is constructed with XML elements. The following table identifies and defines the XML terms and relates them to their use in MetaBase.xml.

Table 1: XML Terminology and Relation to MetaBase.xml

Term | XML Description | Relation to MetaBase.xml
XML declaration | A processing instruction at the start of an XML document, such as <?xml version ="1.0"?>, that declares the file to be XML code. | The first line in MetaBase.xml is an XML declaration.
Element | A logical unit of information. Elements are surrounded by <element name> and </element name> tags, where element name is the name of the element. Elements can contain attributes. | Keys and custom properties are written using XML elements.
Root element | A single element that contains all the other elements and character data that make up an XML document; also known as a document element. | MetaBase.xml contains a root element called <configuration>.
Start tag | A tag that marks the start of an element, such as <element name>, where element name is the name of the element. | In MetaBase.xml, start tags are used to identify the start of a key or custom property.
End tag | A tag that marks the end of an element, such as </element name>, where element name is the name of the element. | In MetaBase.xml, end tags are used to identify the end of a key or custom property.
Element type | Indicated by the name that occurs in its start tag and end tag. | In MetaBase.xml, the element type for metabase keys is actually the value of the KeyType property. For example, IIsWebService is the KeyType that is used to identify the World Wide Web Publishing Service (WWW service) key. Custom properties use the name Custom as the element type.
Attribute | A name and value pair that is associated with an element and that provides more information about the content of that element. | Metabase properties contain several attributes that describe the characteristics of the property, such as the data type or value. Keys also contain attributes, such as the Location attribute or the DefaultDoc attribute found within the IIsWebService key.
Comment | A piece of text, separated by <!-- and --> tags, containing words that are not to be treated as part of the document. | In MetaBase.xml, comments are separated by <!-- and --> tags, and must be written above the key to which they pertain. If you put comments inside an XML node, it will be removed. Also no comments are allowed above IIS_Global node.

Metabase Terminology

MetaBase.xml is structured using keys. Keys are analogous to file folders in a file system or registry keys in the registry. Each key contains a Location attribute, which specifies its hierarchical location in the metabase. Properties, which define the values for configuring IIS, are contained in keys. Because MetaBase.xml is structured hierarchically, a particular property can be configured differently at different keys. Properties contain attributes, such as the Value attribute. Some properties, such as the AccessFlags property, also contain flags. For a more detailed list of all properties and their attributes that are defined in-schema, see the Metabase Property Reference.

The following table summarizes the metabase terminology that is used to describe the structure of MetaBase.xml. These terms are discussed in more detail later in this topic.

Table 2: MetaBase.xml Terminology

Term | Description
Key | A hierarchical container in MetaBase.xml that is used to contain properties. Each key contains the Location attribute within the start tag of the key, specifying the hierarchical position of the key in MetaBase.xml. A metabase key is analogous to a file folder or registry key.
Location | Each key contains a Location attribute, which is a sequence of location names, separated by a forward slash (/), that uniquely identifies the hierarchical position of the key in MetaBase.xml. For example "/LM" is the location name of the IIsComputer key, and "/LM/W3SVC" is the location of the IIsWebService key. The latter is a child key of the "LM" location. A child key is a key that is contained by another key.
Property or Custom Property | A property or custom property defines values that are used to configure IIS. Properties contain attributes, and some properties, such as AccessFlags, also contain flags. Properties are contained by keys and can be written, in MetaBase.xml, as in-schema or custom.
Attribute | Metabase properties contain several attributes that describe the characteristics of the property, such as the data type or value. Keys also contain attributes, such as the Location attribute or the DefaultDoc attribute found within the IIsWebService key.
Flag | A flag is a particular bit within the DWORD value of a property that contains flags. Each flag within a property is used to configure particular functionality of the property, such as read or write access. The sum of the flag values for a property becomes the sum of the value attribute for that property.

For more information about properties, attributes, and flags, see the Metabase Schema topic. For more information about writing properties to MetaBase.xml as in-schema or custom, see Writing Changes to MetaBase.xml.

Keys and Locations

Metabase keys are analogous to registry keys or a directory in a file system. Each metabase key is identified by its name and location, which are defined within the start tag of the key. The following example shows two keys, IIsConfigObject and IIsLogModules, each having a unique location as defined by the value of its respective Location attribute:

note Note Comments in the following example are placed for ease of reading and do not follow the metabase rules for proper comment placement or formatting in the metabase. For information on metabase comments, see Adding Metabase Comments.

<IIsConfigObject Location="/LM/IISADMIN"
(comment) Properties are defined here
>
<IIsLogModules  Location="/LM/Logging"
(comment) Properties are defined here
</IIsLogModules>

Most keys are named using the value of the KeyType property, also known as the Admin Base Object (ABO) class name, which relates to the type of key being defined. The IIsLogModules key, seen in the example above, is named this way. If you change the KeyType value of a metabase key programmatically, the name of the key changes in MetaBase.xml when the in-memory metabase is saved. This KeyType value is important because the collection in-schema that is named using the same KeyType enforces which properties the key can contain.

Keys named IIsConfigObject are special because they are not named using a KeyType value. Because all properties are defined in-schema in the IIsConfigObject collection, keys in MetaBase.xml that are named IIsConfigObject can contain any property. You can specify a KeyType value for a key named IIsConfigObject by writing the KeyType property in the key as a custom property.

Unlike key names, which are not unique for all keys, the value of the Location attribute must be unique for each key. The Location attribute defines the hierarchical position of a key in MetaBase.xml. The value of the Location attribute, with only two exceptions, is a sequence of location names, separated by a forward slash (/), that uniquely identifies the hierarchical position of the key in MetaBase.xml.

The exceptions are the IIS_Global key, which has the highest hierarchical position in MetaBase.xml (Location ="."), and the IIS_ROOT key, which has the next-highest hierarchical position in MetaBase.xml (Location ="/"). The next-highest hierarchical position is the IIsComputer key (Location ="/LM"). All remaining keys in MetaBase.xml are contained by the IIsComputer key; therefore, their location always begins with /LM/location name, where location name is the name of the location.

The hierarchical position of any metabase key can be determined by looking at its Location attribute. For example "/LM" is the location of the IIsComputer key, and "/LM/W3SVC" is the location of the IIsWebService key. Because the "/LM/W3SVC" location begins with "/LM" followed by a forward slash character (/) and another location name (W3SVC), the IIsWebService key at location "/LM/W3SVC" is a child of the IIsComputer key. A child key is a key that is contained by another key. A key that contains another key is sometimes referred to as a parent key.

Metabase Structure

The metabase keys and elements that are described in this section are illustrated in the MetaBase.xml sample later in this topic.

As with any other XML file, the XML declaration <?xml version ="1.0"?> occupies the first line in MetaBase.xml and indicates that the file is formatted as XML. The root element, which is named <configuration>, contains all other elements.

The IIS_Global key is the key at the highest level key in the metabase that contains properties. Consider the IIS_Global key to be read-only; do not configure its properties.

The IIS_ROOT key (Location ="/") is the highest key in which you can configure properties. Properties that are configured at the IIS_ROOT key affect the way that IIS runs overall.

The IIsComputer key (Location ="/LM") contains all remaining metabase locations. Table 3 lists, in hierarchical order, child locations that can exist within the namespace of the /LM location. The File Transfer Protocol (FTP), Network News Transfer Protocol (NNTP), and Simple Mail Transfer Protocol (SMTP) components are not installed by default. Therefore, the /LM/EventManager, /LM/NNTPSVC, and /LM/SmtpSvc locations do not exist in MetaBase.xml unless their respective components are installed.

The Local Machine Namespace

The local machine ("LM") namespace is the parent location in the hierarchical structure of keys where all services and sites are organized. These keys, each of which contain their own unique location, are organized in the following format:

/LM/Service/Site/ROOT/Virtual Directory/Directory/File

Where the replaceable parameters are:

Service = MSFTPSVC, NNTPSVC, SmtpSvc, or W3SVC
SiteIdentifier = unique number identifier for the FTP, NNTP, SMTP,
or Web, site
ROOT = root virtual directory of the site
Virtual Directory = virtual directory
Directory = physical directory
File = file

Each site is a server instance, and it is referred to by the number that is used in its namespace. For example, /LM/W3SVC/1 specifies the location of the key that contains the first Web site, and /LM/MSFTPSVC/3 specifies the location of the key that contains the third FTP site.

The following table lists the locations of the parent keys that are contained in the "LM" namespace. Because their child keys are too numerous, they are not listed here. For a list of all locations where a particular property can be configured, see the Metabase Property Reference.

Table 3: Local Machine Locations

Location | Description
/LM/EventManager | The /LM/EventManager location and its child locations configure Microsoft Exchange. You should not configure keys at the /LM/EventManager location or its child keys by editing the MetaBase.xml file.
/LM/IISADMIN | The /LM/IISADMIN location and its child locations record distributed COM (DCOM) extensions to IIS. Because the /LM/IISADMIN location is internally configured by IIS, you should not configure /LM/IISADMIN or its child locations.
/LM/Logging | The /LM/Logging location and its child locations configure IIS logging.
/LM/MimeMap | The /LM/MimeMap location configures the MimeMap property.
/LM/MSFTPSVC | The /LM/MSFTPSVC location and its child locations configure the FTP service and sites.
/LM/NNTPSVC | The /LM/NNTPSVC location and its child locations configure the NNTP service and sites.
/LM/SmtpSvc | The /LM/SmtpSvc location and its child locations configure the SMTP service and sites.
/LM/W3SVC | The /LM/W3SVC location configures properties that are global to the WWW service.
/LM/W3SVC/1 | The /LM/W3SVC/1 location and its child locations configure properties that are specific to the first Web site.
/LM/W3SVC/AppPools | The /LM/W3SVC/AppPools location configures properties that are global to all application pools. Child locations, such as /LM/W3SVC/AppPools/DefaultAppPool, configure properties that are specific to a particular application pool.
/LM/W3SVC/Filters | The /LM/W3SVC/Filters location and its child locations configure Internet Server API (ISAPI) filters and compression schemes.
/LM/W3SVC/Info | The /LM/W3SVC/Info location configures properties that are global to all Web sites.
/LM/W3SVC/Info/Templates | The /LM/W3SVC/Info/Templates location and its child locations were used by the IIS Permissions Wizard in previous versions of IIS. It remains solely for legacy compatibility. You should not configure keys at the /LM/W3SVC/Info/Templates location by editing the MetaBase.xml file.

MetaBase.xml Sample

The following code sample illustrates the structure of the MetaBase.xml file. XML comments precede each line that they pertain to, describing the metabase structure. In the XML comments, the metabase terminology is shown in bold, and the XML terminology is shown in italic.

Note that in this sample there are two instances of the IIsWebServer key, and both instances have a unique location. The first, which is /LM/W3SVC/1, is the key where the default Web site is configured. The second, which is /LM/W3SVC/2, is the key where the second Web site is configured. In actual use, the Default Web site is numbered 1, but any additional Web sites created are assigned a random number.

note Note Comments in the following example are placed for ease of reading and do not follow the metabase rules for proper comment placement or formatting in the metabase. For information on metabase comments, see Adding Metabase Comments.

(comment) The XML declaration
<?xml version ="1.0"?>

(comment) The Root Element
<configuration xmlns="urn:microsoft-catalog:XML_Metabase_V2_0">

(comment) Element
<MBProperty>

(comment) Key, Start tag containing a location attribute
<IIS_Global Location ="."
     (comment) Property (in-schema)
     BINSchemaTimeStamp="c0ed73cdbcd8c001"

     (comment) Property (in-schema)
     ChangeNumber="888"

     (comment) Property (in-schema)
     HistoryMajorVersionNumber="154"
>

(comment) End tag
</IIS_Global>

(comment) Key, Start tag containing a location attribute
<IIS_ROOT  Location ="/"

     (comment) Property (in-schema)
     AdminACL="A really long number"
>

(comment) End tag
</IIS_ROOT>

(comment) Key, Start tag containing a location attribute
<IIsComputer Location="/LM"

     (comment) Property (in-schema)
     MaxBandwidth="4294967295"

     (comment) Property (in-schema)
     EnableEditWhileRunning="0"
     >
(comment) End tag
</IIsComputer>

(comment) Key, Start tag containing a location attribute
<IIsWebService Location="/LM/W3SVC"

     (comment) Property (in-schema)
     AllowKeepAlive="TRUE"

     (comment) Property (in-schema)
     AnonymousPasswordSync="TRUE"
     >

(comment) End tag
</IIsWebService>

(comment) Key, Start tag containing a location attribute
<IIsWebServer Location="/LM/W3SVC/1"

     (comment) Property (in-schema)
     AppPool

     (comment) Property (in-schema)
     DefaultDoc="Default.htm,Default.asp"

     (comment) Property (in-schema)
     ServerComment="Default Web Site"
     >

     (comment) Property (custom)
     <Custom

(comment) Attributes
     Name="SecureBindings"

     Value=":443:"
     Type="MULTISZ"
     UserType="IIS_MD_UT_SERVER"
     Attributes="NO_ATTRIBUTES"
     />

(comment) End tag
</IIsWebServer>

(comment) Key, Start tag containing a location attribute
<IIsWebServer Location ="/LM/W3SVC/2"

     (comment) Property (in-schema)
     SecureBindings=""

     (comment) Property (in-schema)
     ServerBindings=":6186:"

     (comment) Property (in-schema)
     ServerComment="My 2nd Web Site"
>

(comment) End tag
</IIsWebServer>

(comment) End tag
</MBProperty>

(comment) End tag
</configuration>

Related Topics

  • For a more detailed list of all properties and their attributes that are defined in-schema, see the Metabase Property Reference.
  • For information on properties, attributes, and flags, see Metabase Schema.
  • For information on writing properties to MetaBase.xml as in-schema or custom, see Writing Changes to MetaBase.xml.
  • For information on configuring MetaBase.xml, see Configuring the Metabase.
  • For information on metabase comments, see Adding Metabase Comments.


Metabase Schema

The metabase schema file defines what properties can exist in the metabase configuration file. The metabase schema also enforces which properties can be set at which keys. The schema provides this enforcement only for properties that are written as in-schema properties. Properties that are written to the metabase configuration that adhere to the rules of metabase schema are considered to be written in-schema. Properties that are not defined in-schema can be written in the metabase configuration as custom properties. Custom properties can be used in the metabase configuration to override schema enforcement or to configure a property with values other than the default values that are defined by the schema. For more information about in-schema and custom properties, see Writing Changes to MetaBase.xml.

The metabase schema is stored in an Extensible Markup Language (XML) file named MBSchema.xml, which is written into the in-memory metabase when IIS is started or restarted. By default, the MBSchema.xml file is located in the systemroot\System32\Inetsrv folder. For more information about how the MBSchema.xml file is written to the in-memory metabase, see Starting IIS.

Collections

The structure of the metabase schema is organized using containers called collections. The following sections discuss the different types of collections and their purposes. Collections are defined in MBSchema.xml using <Collection> start and end tags, and they are written in the following format:

<Collection>
     InternalName ="CollectionName"
     AttributeName="AttributeValue">
</Collection>

CollectionName is the name of the collection, AttributeName is the name of a collection attribute, and AttributeValue is the value of the collection attribute.

All collections exist at the same hierarchical level in MBSchema.xml; therefore, no collection is a parent of another. Reading the MBSchema.xml file from top to bottom, the first collection, named MetabaseBaseClass, defines global settings in the schema.

The following code example is taken from the metabase schema file to illustrate how collections are defined. Spacing has been changed to display properly on this page.

<Collection InternalName="MetabaseBaseClass" MetaFlagsEx="NOTABLESCHEMAHEAPENTRY"  MetaFlags="HIDDEN">
     <Property InternalName="Location" Type="WSTR"  MetaFlags="PRIMARYKEY"/>
</Collection>

The collection directly below MetabaseBaseClass is named IIsConfigObject. The IIsConfigObject collection is unique, because it is the collection in which all properties are defined. Only properties that are defined in the IIsConfigObject collection can be written to the metabase configuration as in-schema properties.

Properties

Properties are configuration objects that are associated with IIS Admin Objects and their corresponding Admin Base Objects (ABO). All properties that are defined in the IIsConfigObject collection contain attributes. The default values of these attributes for each property are also defined.

note Note The default values that are assigned to property attributes in the IIsConfigObject collection are not necessarily the values that are written to the metabase configuration when IIS is installed. The default values of attributes, defined by the IIsConfigObject collection, are used when you write a property as in-schema to the metabase configuration after IIS is installed.

Each property defined in the IIsConfigObject collection contains the following attributes: ID, Type, UserType, Attributes, InternalName, and DefaultValue. Some properties also contain the following attributes: MetaFlags, MetaFlagsEx, StartingNumber, and EndingNumber. Property attributes are contained in the <Property> start tag. The following sample from the IIsConfigObject collection illustrates how a property is defined

<Property InternalName="ServerComment"

     Type="STRING"
     UserType="IIS_MD_UT_SERVER"
     Attributes="INHERIT"
     MetaFlagsEx="CACHE_PROPERTY_MODIFIED | WAS_NOTIFICATION"
     DefaultValue=""/>

Flags

In addition to attributes, some properties also contain flags. Each flag configures a unique functionality of the property, such as read or write access. Each flag is identified by the ABO using the flag's unique bitmask identifier. For more information about bitmask identifiers and their uses, see the Metabase Property Reference.

Flags contain attributes named Value and ID. Flags are defined in the property's start and end tags, and they are identified using <Flag> tags. The sum value of all flags that are set for a property determines the value of the property's DefaultValue attribute, which is also referred to as the property's default value. The following sample illustrates a property that contains flags.

<Property InternalName="PasswordChangeFlags"

     Type="DWORD"
     UserType="IIS_MD_UT_SERVER"
     Attributes="INHERIT"
     MetaFlagsEx="CACHE_PROPERTY_MODIFIED"
     DefaultValue="0"
     EndingNumber="0">
      <Flag InternalName="AuthChangeUnsecure"   Value="1" />
      <Flag InternalName="AuthChangeDisable"    Value="2" />
      <Flag InternalName="AuthAdvNotifyDisable" Value="4" />
</Property>

note Note Flags and their attributes are written in the property's start and end tags. Properties that do not contain flags are encapsulated in the properties' start tags, and they do not use end tags.

Remaining Collections

All remaining collections, which are below the IIsConfigObject collection, are organized by key type. These collections enforce at which keys in the metabase configuration a property can be written as an in-schema property. For example, if a collection named IIsWebServer contains the ServerComment property, IIS allows the ServerComment property to be written in any key in the metabase configuration using the IIsWebServer key type. Therefore, only properties that are contained in these remaining collections can be written (as in-schema properties) in a metabase key of the same key type in MetaBase.xml.

The exception to this rule is the IIsConfigObject key type, described earlier. Because all properties are contained in the IIsConfigObject collection, all properties can be written to any key in the metabase configuration of the IIsConfigObject key type.

Properties are written in these remaining collections in the following format:

<Property InheritsPropertiesFrom="IIsConfigObject:PropertyName"/>

where PropertyName is the name of the property.

All properties that are contained by these remaining collections inherit their default values from the IIsConfigObject collection, because the IIsConfigObject collection is where all properties are defined.

You cannot use Active Directory® Service Interfaces (ADSI) or Windows Management Instrumentation (WMI), which are not defined in metabase schema, to update properties in the metabase configuration. Changes that are written directly to the MetaBase.xml file by using a text editor (such as Microsoft Notepad) that do not comply with metabase schema rules might not get written to the in-memory metabase. If this occurs, an error or warning is sent to the Windows Events log.

Configuring the Schema

You can configure the schema by defining your own properties or by removing unwanted properties from the IIsConfigObject collection. This is also referred to as extending the schema. You also can add properties to, or remove properties from, collections to define your own enforcement of rules as to which keys in the metabase configuration a particular property can be written.

important Important Before configuring the metabase schema, you should first ensure that the changes you intend to make will not adversely affect your metabase configuration. Before removing properties from the IIsConfigObject collection, for example, ensure that the property that you intend to remove from the schema does not exist in the metabase configuration.

Editing the MBSchema.xml file directly, by using a text editor such as Notepad, is not supported. Changes to metabase schema must be made programmatically. For more information about extending the schema, see Extending the Metabase Schema.

Related Topics
  • For information on extending the schema, see Extending the Metabase Schema
    • .
  • For information on bitmask identifiers and their uses, see the Metabase Property Reference
    • .
  • For information on the Windows Event log, see Event log in Windows Help
    • .
  • For information on in-schema and custom properties, see Writing Changes to MetaBase.xml.


Property Inheritance

Property inheritance configures IIS using as few property settings as possible. The benefits of using a minimal number of property settings to configure IIS are as follows:

  • Faster IIS cache performance, because less configuration information exists in the IIS cache while IIS is running.
  • Reduced memory consumed by IIS.
  • Reduced time required for IIS administration.

Metabase properties are used to provide detailed control of IIS functionality. All metabase properties contain attributes, such as the DefaultValue attribute, which specify the configuration of a property. Most metabase properties are inheritable, and they are specified as inheritable in MBSchema.xml. Only properties that are defined in MBSchema.xml, using the string value "INHERIT" as part of the value of the Attributes attribute, can be inherited. The following sample shows the default attributes for the HttpErrors property in MBSchema.xml:

<Property InternalName="HttpErrors"  Type="MULTISZ" UserType="IIS_MD_UT_FILE"
Attributes="INHERIT" MetaFlagsEx="CACHE_PROPERTY_MODIFIED" DefaultValue=""/>

Each metabase property is described in detail in the Metabase Property Reference. This reference includes information about whether a property is inheritable, as well as the locations in which properties can be set in MetaBase.xml.

Hierarchical Relationship of Keys

The metabase is designed so that properties can be set differently at different keys. To understand how property inheritance works, it is necessary to first understand the hierarchical relationship of keys in the MetaBase.xml file. A key, in relation to other keys, can be located in MetaBase.xml at a higher level, lower level, or the same level. The location attribute of each key determines the level in which a key exists in the hierarchical structure. For more information about the hierarchical structure of MetaBase.xml, see the Metabase Configuration File.

Example 1

The following example illustrates the relationship between the IIsWebService, IIsWebServer, and IIsWebVirtualDir keys. Indentation is used in the example to help illustrate the hierarchical relationship of the keys.

<IIsWebService Location="/LM/W3SVC">

    <IIsWebServer Location="/LM/W3SVC/1">

        <IIsWebVirtualDir Location="/LM/W3SVC/1/ROOT">

    <IIsWebServer Location="/LM/W3SVC/2">

        <IIsWebVirtualDir Location="/LM/W3SVC/2/ROOT">

In Example 1, the IIsWebService key is the highest-level key. Likewise, the IIsWebServer keys are at a lower level than IIsWebService, and the IIsWebVirtualDir keys are at a lower level than the IIsWebServer keys. Keys that are at the same level cannot inherit properties from each other. Therefore, because the IIsWebServer keys are at the same hierarchical level in the metabase, they cannot inherit properties from each other. The IIsWebVirtualDir keys are also at the same level in relation to each other, and therefore they cannot inherit properties from each other.

note Note The hierarchical structure of the metabase is determined by the Location attribute of the keys themselves, not the class name of the keys.

Automatic Inheritance

Inheritable properties that are not explicitly set at a lower-level key are automatically inherited from the next-higher key in which the property is configured. The highest-level key in MetaBase.xml in which a property can be set is the IIS_Global key; however, none of the properties that can be set at the IIS_Global key are inheritable. Therefore, the IIS_ROOT key is the highest key in MetaBase.xml in which a property can be inherited.

Example 2

The following example illustrates properties that are configured differently in different keys in MetaBase.xml, as well as properties that are inherited. The names of properties that are set at a specific metabase key appear in bold text. Otherwise, the names of properties that are inherited from the next-highest key that has the inheritable property set, appear in plain text. Extensible Markup Language (XML) comments precede the property or properties to which they correspond.

<IIsWebService Location="/LM/W3SVC"

<!-- The DefaultDoc and ContentIndexed properties are specifically set at this key. -->
DefaultDoc="Default.htm,Default.asp"
ContentIndexed="FALSE"

               >

<IIsWebServer Location ="/LM/W3SVC/1"

              <!-- The DefaultDoc property is specifically set at this key. -->
DefaultDoc="Default.htm,Default.asp,index.htm"

              <!-- The ContentIndexed property is inherited from the IIsWebService key -->

              >

</IIsWebServer>
<IIsWebVirtualDir Location ="/LM/W3SVC/1/ROOT"

              <!-- The DefaultDoc and ContentIndexed properties are inherited from the /LM/W3SVC/1 location. -->

              >

</IIsWebVirtualDir>
<IIsWebServer Location ="/LM/W3SVC/2"

              <!-- The DefaultDoc and ContentIndexed properties are inherited from the IIsWebService key.  -->

              >

</IIsWebServer>
<IIsWebVirtualDir Location ="/LM/W3SVC/2/ROOT"

                  <!-- The DefaultDoc property is inherited from the /LM/W3SVC/2 location. -->

                  <!-- The ContentIndexed property is specifically set at this key. -->
ContentIndexed="TRUE"

>

</IIsWebVirtualDir>
</IIsWebService>
Related Topics
  • For information on metabase structure and terminology, see Metabase Configuration File.


Configuring the Metabase

The IIS metabase is a plain-text XML file containing most IIS configuration values. The metabase can be configured manually, using IIS Manager or a text editor, or programmatically, using the Windows Management Instrumentation (WMI) and Active Directory® Service Interfaces (ADSI) providers. Deciding the method you use to configure the metabase depends on the task you want to accomplish. For a one-time, one step configuration task, editing the metabase file directly in a text editor might be easiest, while for repetitive tasks requiring a number of steps, a programmatic approach is most efficient. Another important aspect of configuring the metabase is knowing how to back up and restore the metabase if changes result in an error.

This section includes the following information:

  • About Configuring the Metabase: Describes the methods used to configure the metabase.
  • Metabase History Feature: Provides an overview of the metabase history feature. This section includes discussions on versioning and naming history files, and configuring the metabase history.
  • Writing Changes to MetaBase.xml: Describes writing a property in-schema or out-of-schema.
  • Metabase Edit-While-Running Feature: Describes how the edit-while-running feature works, and how to enable this feature.
  • Adding Metabase Comments: Describes how to add comments in the MetaBase.xml file.
  • Extending the Metabase Schema: Describes how to extend the metabase schema to enable the storage of custom properties in the metabase.
  • Code Examples to Configure Metabase Properties: Describes how to programmatically access a metabase node to change a property.


About Configuring the Metabase

IIS includes several methods of changing values in the metabase. As shown in the Metabase Updating Process illustration, you can set or view metabase values programmatically by using any of the following resources:

  • IIS Manager: The user interface (UI) that you can use to update the in-memory metabase. This is the safest way to update the metabase.
  • Active Directory Service Interfaces (ADSI): A set of scripting interfaces that you can use at a command prompt or run from a script.
  • Windows Management Instrumentation (WMI): A set of scripting interfaces that you can use at a command prompt or run from a script.
  • COM DLL or executable program: A custom Component Object Model (COM) object dynamic-link library (DLL) or an executable program (.exe), such as MetaEdit, that you can use to configure the in-memory metabase.
    MetaEdit is a metabase editing tool available for download from Microsoft. You can obtain MetaEdit by following the instructions in Knowledge Base article number Q232068.

All configuration settings that are made using the resources in this list are written to the in-memory metabase through Admin Base Objects (ABOs). The in-memory metabase is a copy of the MetaBase.xml and MBSchema.xml files in the IIS file cache.

Metabase Updating Process

Shows the interfaces to the In-memory metabase.

IIS Admin Base Objects

As shown in the preceding illustration, the ABOs are central to updating the in-memory metabase. The ABOs are COM automation objects that are used to write IIS configuration values that are stored in the IIS metabase. Individual ABOs correspond to metabase key names in the metabase, and they are addressed by their paths within the metabase. Each object has properties, and each property is stored in the metabase. You can manipulate IIS configuration by using ABOs to add new virtual directories, new Web sites, and so forth.

IIS Manager and the other resources in the illustration that are used to update the in-memory metabase write directly to the ABOs. The ABOs then write the changes to the in-memory metabase. You can also access ABOs directly by using C or Microsoft® Visual C++® code to programmatically update the in-memory metabase.

Metabase Storage Layer

Because the in-memory metabase is located in memory, which is temporary storage, it is periodically written to disk through the metabase storage layer. The metabase storage layer is the part of IIS that reads the metabase files into the in-memory metabase and also writes the in-memory metabase to the metabase files. The metabase storage layer facilitates the Extensible Markup Language (XML)-to-binary conversion that takes place during these events. The metabase storage layer writes the metabase files into the in-memory metabase through the ABO when IIS is started. The storage layer writes the in-memory metabase directly to the metabase files when a write-to-disk event occurs or when IIS is shut down.

Metabase Files

IIS 6.0 replaces the IIS 5.0 metabase configuration file, which used a proprietary binary file named MetaBase.bin, with a plain-text file named MetaBase.xml. Additionally, the MBSchema.xml file contains the schema, defines default attributes for all metabase properties, and enforces rules — for example, to what nodes properties can be written in the metabase configuration. These files are stored on your computer in the systemroot\System32\Inetsrv folder. Only users who are members of the Administrators group can view and modify these files.

Because the MetaBase.xml file is a plain-text file, you can directly configure MetaBase.xml using common text-editing tools, such as Microsoft Notepad.

important Important The MBSchema.xml file cannot be edited directly using the edit-while-running feature. Changes to MBSchema.xml must be made programmatically.

Related Topics
  • For information about how the metabase files are read into memory when IIS is started, see Starting IIS.
  • For information about how IIS is written to disk, see Writing the Metabase to Disk and Stopping IIS.
  • For information about configuring the MetaBase.xml file directly, see Metabase Edit-While-Running Feature.
  • For information on metabase schema, see Metabase Schema.
  • For information on configuring the metabase securely, see Metabase Security.


Metabase History Feature

IIS automatically maintains a record of metabase changes that are saved to disk. You can also configure the number of metabase history files to save. Using the metabase history feature, you can revert the metabase through any number of changes to restore a particular configuration, or to see what has changed between revisions.

This section includes the following information:

  • About the Metabase History Feature: Provides an overview of the metabase history feature.
  • Naming the Metabase History Files: Describes how metabase history files are versioned and named.
  • Writing the Metabase to Disk: Describes how and when the in-memory metabase is written to disk.
  • Configuring the Metabase History Feature: Describes how to configure the metabase history feature.


About the Metabase History Feature

By marking each new metabase file with a unique version number and saving a copy of the file in the history folder, the metabase history feature automatically keeps track of metabase changes that are saved to disk. Each history file is then available for restoring the MetaBase.xml and MBSchema.xml files from the history folder, editing the MetaBase.xml file while IIS is running, and troubleshooting event log errors. The metabase history feature is enabled by default.

History Folder

The history folder stores versioned copies of the MetaBase.xml and MBSchema.xml files. These copies can only be viewed by members of the Administrators group. The location of the history folder is systemroot\System32\Inetsrv\History.

A history file pair consists of a MetaBase.xml and MBSchema.xml file of the same major and minor version numbers. The default setting allows for a maximum of 10 versioned history file pairs to be stored in the history folder, but you can configure the maximum number of file pairs that can be stored in the history folder. However, before increasing the number of versioned sets of files stored in the history folder, you should ensure that you have adequate hard disk space on the drive volume where the history folder is located. (You can estimate the amount of hard disk space that is required by multiplying the average combined file size of MetaBase.xml and MBSchema.xml files by the number of versions that you want to store in the history folder.) You should not decrease the value of the MaxHistoryFiles property to below 10 if the edit-while-running feature is enabled.

When the in-memory metabase is written to disk, IIS checks to determine whether the number of history file pairs that are contained in the history folder exceeds the value of the MaxHistoryFiles property. If the number of history file pairs exceeds the value of the MaxHistoryFiles property, the oldest history file pair, based on the time-stamp value, is deleted.

Related Topics

  • For information about backing up your entire operating system, including special steps that must be performed to include IIS in that backup, see Backing up and Restoring Data.
  • For information about configuring the metabase history, see Configuring the Metabase History Feature.
  • For information about restoring the MetaBase.xml or MBSchema.xml files from history files, see Backing Up and Restoring the Metabase.
  • For more information about editing the MetaBase.xml file while IIS is running, see Metabase Edit-While-Running Feature.
  • For information on the Windows Event log, see Event log in Windows Help
    • .


Naming the Metabase History Files

To keep track of metabase history, IIS uses the following versioning scheme to enumerate the copies of MetaBase.xml that are stored in the history folder.

Metabase Version Numbers

  • The value of the HistoryMajorVersionNumber metabase property, also referred to as the major version number, increases when the in-memory metabase is written to disk.
  • The minor version number increases when the edit-while-running feature is enabled and an administrator changes and saves the MetaBase.xml file directly with an application such as Notepad.

HistoryMajorVersionNumber Property

The HistoryMajorVersionNumber property is located under the IIS_Global node in the metabase, as shown in the following example:

<?xml version ="1.0"?>
<configuration xmlns="urn:microsoft-catalog:null-placeholder">
<MBProperty>
<IIS_Global   Location ="."
   ChangeNumber="3008"
   HistoryMajorVersionNumber = "218"</IIS_Global>

important Important The HistoryMajorVersionNumber property is used by IIS to track the versions of the metabase. It is inadvisable to manually change the value of the HistoryMajorVersionNumber property.

Minor Version Number

The minor version number is not a property that is stored in the metabase. Instead, IIS calculates the minor version number each time a file is written to the history folder, as follows:

  • If the history file is created because the in-memory metabase is written to disk, the minor version number is reset to zero.
  • If the history file is created because the MetaBase.xml file is edited and saved directly, and if edit-while-running is enabled, IIS looks in the history folder to determine the last minor version number that was used for a history file with the same HistoryMajorVersionNumber number as MetaBase.xml. IIS then uses the next sequential minor version number when naming the new history file.

Naming the History Files

When a copy of MetaBase.xml is written to the history folder, the value of the HistoryMajorVersionNumber property and the calculated minor version number are added to the names of the file pair that is created within the history folder.

Respectively, the file names of versioned MetaBase.xml files and MBSchema.xml files are created in the following format, where both the value of the HistoryMajorVersionNumber property and the minor version number are 10-digit numbers:

  • MetaBase_HistoryMajorVersionNumber_minor version number.xml
  • MBSchema_HistoryMajorVersionNumber_minor version number. xml

When either the HistoryMajorVersionNumber or the minor version number value is less than a 10-digit value, the number is padded with zeros in the file name to create a 10-digit number. This keeps the file names aligned and in numerical order when sorting by file name, making the contents of the history folder easier to read.

The following is an example of file names in the history folder:

MetaBase_0000000001_0000000000.xml
MetaBase_0000000001_0000000001.xml
MetaBase_0000000002_0000000000.xml
MetaBase_0000000002_0000000001.xml
MetaBase_0000000002_0000000002.xml
MetaBaseError_0000000000.xml
MetaBaseError_0000000001.xml
MBSchema_0000000001_0000000000.xml
MBSchema _0000000001_0000000001.xml
MBSchema _0000000002_0000000000.xml
MBSchema _0000000002_0000000001.xml
MBSchema _0000000002_0000000002.xml

For each instance of a MetaBase_majorversion_minorversion.xml file within the history folder, there is an MBSchema_majorversion_minorversion.xml file of the same version that is used with the metabase configuration.

Metabase Error Files

File names that contain the word error are created in the history folder under the following circumstances:

  • Edit-while-running is enabled.
  • MetaBase.xml is edited directly, using an application such as Microsoft Notepad.
  • An error such as the following occurs:
    • An Extensible Markup Language (XML) tag is omitted in MetaBase.xml.
    • A property name is misspelled in MetaBase.xml.
    • The corresponding history file with the same HistoryMajorVersionNumber value as MetaBase.xml is not found.

Error files are named in the following format, where TenDigitNumber is the version number of the error file, starting with version number 0000000000:

MetaBaseError_TenDigitNumber.xml

The version number increases by one for each additional error file that is created.

Related Topics

  • For more information about metabase history, see Metabase History Feature.
  • For more information about editing the metabase file while IIS is running, see Metabase Edit-While-Running Feature.
  • For information about restoring the metabase, see Backing Up and Restoring the Metabase.


Writing the Metabase to Disk

The metabase configuration is written to disk either when the MetaBase.xml file is edited directly using a text editor and manually saved to disk, or when the in-memory metabase is saved to disk.

important Important The MetaBase.xml file can be edited and saved to disk only when the edit-while-running feature is enabled or when the IIS service is stopped before the MetaBase.xml file is edited and saved.

The in-memory metabase is written to disk only under the following circumstances:

  • When the IIS service is stopped, and there are changes pending in the in-memory metabase.
  • The in-memory metabase is written to disk 60 seconds after a change is made to the metabase. However, if more than 30 changes occur during those 60 seconds, the write is postponed for another 60 seconds. The in-memory metabase write to disk is postponed a maximum of five times, after which it is written to disk.
  • When edited programmatically, as when using a resource such as Active Directory® Service Interfaces (ADSI).

The following illustration and discussion describe how the in-memory metabase configuration is written to disk. The verification checks can influence how IIS saves the in-memory metabase to disk, as illustrated by the possible scenarios. The in-memory schema is written to disk in a similar way, and it is discussed later in this topic.

Writing the In-Memory Metabase Configuration to Disk

Illustrates how the In-Memory metabase is written to disk.

Step 1: Are there changes pending in the in-memory metabase?

When a write-to-disk event occurs, IIS first checks for pending changes in the in-memory metabase. Changes that are written to the MetaBase.xml file when edit-while-running is enabled are counted as pending changes in the in-memory metabase. If there are no pending changes in the in-memory metabase, no further action is taken and the in-memory metabase is written to disk. Otherwise, IIS proceeds to step 2.

Step 2: IIS locks the in-memory metabase to prevent external writes.

The in-memory metabase is locked to prevent writes while the in-memory metabase is written to disk. This ensures that a valid copy of the in-memory metabase is used.

Step 3: IIS determines the major version number.

  1. IIS increases the value of the HistoryMajorVersionNumber property in the in-memory metabase by one.
  2. IIS then verifies whether a file in the history folder is named with the same major version number. If a file using the same major version number exists in the history folder, IIS increases the value of the HistoryMajorVersionNumber property in the in-memory metabase again by one, and checks the history folder to determine whether the major version number is available. This process is repeated until an available major version number is found.

This method of determining the major version number prevents the possibility of overwriting a file in the history folder. Although unlikely under normal circumstances, the possibility exists that a file in the history folder has a nonsequential version number for one of the following reasons:

  • An administrator changes the value of the HistoryMajorVersionNumber property, which causes the value of the HistoryMajorVersionNumber property to roll over to 1 or to the lowest available major version number.
  • An administrator copies an old history file into the history folder.

Step 4: IIS creates a temporary file containing the in-memory metabase configuration.

When the major version number is determined, a temporary file named MetaBase.bak is created in the same folder as MetaBase.xml. The major version number that was determined in Step 3 is written in the temporary file.

Step 5: IIS unlocks the in-memory metabase to allow writes.

After the temporary file is created, the in-memory metabase is unlocked to allow writes through Admin Base Objects (ABOs).

Step 6: IIS copies the temporary file to the history folder and renames the history file using the major and minor version numbers.

The temporary file is copied to the history folder and renamed in the following format, where HistoryMajorVersionNumber is the major version number that was determined in Step 3 and the minor version number is reset to 0.

MetaBase_HistoryMajorVersionNumber_minor version number.xml

For more information about how history files are versioned, see Naming the Metabase History Files.

Step 7: Is MetaBase.xml write-locked?

The MetaBase.xml file can become write-locked by an application if the administrator opens the MetaBase.xml file for editing and the editing application enforces a write-lock. An application that enforces a write-lock releases the lock when the file is closed. However, in most circumstances, the MetaBase.xml file is not write-locked.

If MetaBase.xml is write-locked by an application, IIS cannot write changes to the MetaBase.xml file. Instead, a history file is created and an error is sent to the event log.

Step 8: Is MetaBase.xml newer than the temporary file?

IIS checks to determine whether the MetaBase.xml file is newer than the temporary file. The MetaBase.xml file can be newer than the temporary file when the in-memory metabase is written to disk at about the same time that an administrator saves changes to the MetaBase.xml file when edit-while-running is enabled.

If the MetaBase.xml file is newer than the temporary file, the MetaBase.xml file is not overwritten with the temporary file. Instead, an error is sent to the event log.

Step 9: The temporary file copies over MetaBase.xml, and is then deleted.

If all verification tests pass, the MetaBase.xml file is overwritten with the temporary file and the temporary file is deleted.

Step 10: Delete oldest history file?

IIS checks to determine whether the number of history file pairs in the history folder exceeds the value of the MaxHistoryFiles property. (A history file pair is a MetaBase.xml and MBSchema.xml history file that are named using the same major and minor version numbers.) If the number of history file pairs exceed the value of the MaxHistoryFiles property, the oldest history file pair, based on the time-stamp value, is deleted.

Writing the In-Memory Schema to Disk

IIS can distinguish changes that are made to the in-memory metabase schema separately from changes that are made to the in-memory metabase configuration. The process of writing the in-memory metabase schema to disk is similar to writing the in-memory metabase configuration to disk, as follows:

  • If there are no pending changes within the in-memory metabase schema when a write-to-disk event occurs, the in-memory metabase schema node is not written to disk. Instead, the MBSchema.xml file is copied to the history folder and renamed with the same major and minor version numbers that are used to version and name the metabase configuration history file in Step 6 above.
  • Otherwise, if changes are made to the in-memory metabase schema, the following occurs:
    1. The MBSchema.xml file is renamed to a temporary schema file.
    2. The in-memory schema is written to MBSchema.xml.
    3. The temporary schema file is copied to the history folder and renamed with the same major and minor version numbers that are used in Step 6 above.

Related Topics

  • For information about the edit-while-running feature, see Metabase Edit-While-Running Feature.
  • For information about configuring metabase history, see Configuring the Metabase History Feature.
  • For information about restoring the metabase, see Backing Up and Restoring the Metabase.


Configuring the Metabase History Feature

By default, the metabase history feature is enabled and the number of history file pairs that are saved within the history folder is defined by the default value of the MaxHistoryFiles property. A history file pair is the combination of a copy of a MetaBase.xml file and a MBSchema.xml file of the same version in the history folder. By default, the EnableHistory property is not written in the MetaBase.xml file, and IIS interprets the absence of the property to mean that the history feature is enabled and the MaxHistoryFiles property is set to the default value.

For the default values of properties, see the Metabase Property Reference.

important Important You must be a member of the Administrators group on the local computer to run scripts and executables, or you must have been delegated the appropriate authority. As a security best practice, log on to your computer using an account that is not in the Administrators group, and then use the Run as command to run your script or executable as an administrator. From the command prompt, type runas /user:administrative_accountname "script or executable command".

To change the metabase history default settings

  • Add the EnableHistory and MaxHistoryFiles metabase properties to the /LM level of the metabase.

To disable metabase history

  • Set the value of the EnableHistory property to 0 (zero).

To enable metabase history

  • Set the value of the EnableHistory property to 1 or remove the EnableHistory property from MetaBase.xml.

To change the number of history files that are stored in the history folder

  • Change the value of the MaxHistoryFiles property.

caution Caution Disabling history files can have serious consequences in the event that the metabase becomes corrupted by improper editing or by attack. Without backup files, the IIS server might have to be reconfigured from an empty state. However, keeping backup files can also be a security risk if you do not ensure that the files are protected by access control lists (ACLs). By default, only members of the Administrators group can view the history files, but if you move the location of the history files, you must duplicate those settings. For information on configuring ACLs, see Access Control.

Related Topics
  • For more information about the metabase history feature and how it is used, see Metabase History Feature.


Writing Changes to MetaBase.xml

Editing the MetaBase.xml file directly, using common text editing tools such as Microsoft Notepad, is an efficient way to configure the metabase over low-bandwidth connections. Editing MetaBase.xml with Notepad is more efficient than using IIS Manager, because IIS Manager is relatively slow over low-bandwidth lines, such as a 56 KB modem. Additionally, editing the metabase file directly is faster than through user interfaces (UIs), such as IIS Manager, when hundreds or thousands of sites are running on the same computer. Editing the MetaBase.xml file directly is particularly useful for administrators who don't want to use programmatic methods to administer IIS but want an alternative to the UI methods.

You can make changes to the MetaBase.xml file while IIS is running only if the edit-while-running feature is enabled. Otherwise, you must stop IIS before editing the MetaBase.xml file.

caution Caution If you restart IIS while there are pending metabase changes—that is, metabase changes still in memory, but not yet written to disk—the pending changes are lost unless edit-while-running is enabled. If you plan on making changes to the metabase and then restarting IIS, make sure that edit-while-running is enabled.

Because MetaBase.xml can be edited, fatal formatting errors and recoverable metabase schema errors can be introduced by administrators who make changes directly to the MetaBase.xml file. Catastrophic formatting errors occur when text editing creates Extensible Markup Language (XML) that is not well formed, such as missing XML tags. IIS fails to start if MetaBase.xml contains fatal formatting errors. Recoverable metabase schema errors occur when text editing yields well-formed XML but one or more properties is invalid, according the metabase schema. IIS fixes most metabase formatting errors by reverting to a previous history file. Editing the metabase schema is not recommended.

important Important You must be a member of the Administrators group on the local computer to perform the following procedure (or procedures), or you must have been delegated the appropriate authority. As a security best practice, log on to your computer using an account that is not in the Administrators group, and then use the Run as command to perform this procedure as an Administrator.

Metabase Properties

To understand metabase properties, it is necessary to have a knowledge of XML and metabase terminology. For information about these terminologies, see Metabase Configuration File.

You can write metabase properties in MetaBase.xml as either in-schema or custom properties. Writing properties in-schema results in an efficient use of the IIS cache, where the in-memory metabase and schema are stored, because the attributes are inherited from the schema rather than rewritten for each instance of a property. You can use a custom property when you do not want to inherit a particular attribute, or any attributes, from the metabase schema for a particular property. You can also use a custom property when you want to define a property that is not specified in the metabase schema.

An in-schema property is contained in the start tag of a key, and only the property name and value are defined. Attributes for an in-schema property are inherited from the metabase schema. In the following example, the EnableEditWhileRunning property is defined as an in-schema property with a value of zero, and it is written in the IIs_Computer key:

<IIs_Computer Location="/LMquot;
  EnableEditWhileRunning="0"
>

A custom property defines some or all of the attributes of a property. Unlike an in-schema property, a custom property is written between the XML start tag and the end tag of a metabase key. Custom properties are easy to identify because the name of the element that contains the custom property is Custom. The name and attributes of a custom property are contained in an XML element named Custom.

At a minimum, the name and ID attributes must be defined in a custom property. Other than the name of the property and the ID attribute, all remaining attributes for a custom property are inherited from the schema, if they are undefined. You need to define the other attributes only when you want them to contain a different value than the attribute values that are defined in-schema. In the following example, the Win32Error property is defined as a custom property with a value of zero, and it is written within the IIsFtpVirtualDir key.

<IIsFtpVirtualDir Location="/LM/MSFTPSVC/1/ROOT"
  >
     <Custom
       Name="Win32Error"

       Value="0"
       Attributes="INHERIT"
  />
</IIsFtpVirtualDir>

important Important Each property that is defined in the schema (MBSchema.xml) has a unique ID attribute. When you define a known property as a custom property, you must specify the unique ID number for that property. To view the unique ID number for any property that is defined in MBSchema.xml, see the Metabase Property Reference.

General Notes

  • Properties with the secure attribute set are stored encrypted.
  • All entries in MetaBase.xml are case sensitive.
  • The KeyType property contained in a node is used to determine the element or node type that is applied to the metabase path.
  • Nodes that do not contain a KeyType property are stored as the generic object IISConfigObject, which can contain any property, and any node can be contained within any other node.
  • Custom properties are allowed for any node type.
  • The IIS_Global node should not be edited.
  • Properties that appear in-schema that violate the schema, for example, a misspelled property name, are logged, and the property is ignored.
  • Custom properties require a metabase ID attribute.
  • The Multi-SZ attribute is replaced with the multistring value.
  • Flags contain bitmask identifiers.
  • The internal metabase implementation is Unicode. To support international and non-ASCII characters, the MetaBase.xml file is encoded in UTF-8 text format.

Writing Changes In-Schema or Out-of-Schema

You can use custom properties for the following purposes:

  • To use properties that are not defined in-schema.
  • To use properties with different attribute values than are defined in-schema.

When you write a property using different attribute values than what is defined in-schema, you must write the property as a custom property. Only the attributes that are different from the schema must be defined in MetaBase.xml.

Examples

  • In-Schema property
    AccessFlags=AccessWrite
  • Custom Property
    <Custom Name="AccessFlags"

  Type="DWORD"
  Value="1"
  UserType="IIS_MD_UT_FILE"
  Attributes="INHERIT"
/>
Related Topics
  • For metabase and XML terminology, see Metabase Configuration File.


Metabase Edit-While-Running Feature

This section contains information about the metabase edit-while-running feature (also known as Direct Metabase Edit). The ability to edit the metabase while IIS is running makes administration simpler, and avoids site downtime as IIS does not have to be stopped when configuration changes are needed.

This section includes the following information:
  • About the Metabase Edit-While-Running Feature: Describes how the edit-while-running feature works and interacts with the metabase history feature.
  • Enabling Edit-While-Running: Describes enabling the edit-while-running feature using IIS Manager and by editing the metabase directly.


About the Metabase Edit-While-Running Feature

With the release of IIS 6.0, members of the Administrators group can edit the metabase file directly while IIS is running, and the changes are immediately applied to the in-memory metabase. This capability, known as "edit-while-running," is possible because MetaBase.xml is a text file. Direct editing can be accomplished using common text tools, like Microsoft Notepad, when the edit-while-running feature is enabled.

Edit-while-running depends on the metabase history feature to keep track of the changes that an administrator makes to the MetaBase.xml file. The metabase history feature is enabled by default.

Edit-while-running is not enabled by default. For information about enabling edit-while-running, see Enabling Edit-While-Running.

important Important You must be a member of the Administrators group on the local computer to perform the following procedure (or procedures), or you must have been delegated the appropriate authority. As a security best practice, log on to your computer using an account that is not in the Administrators group, and then use the Run as command to perform this procedure as an Administrator.

Edit-While-Running Process

IIS uses Windows file change notification to determine when the MetaBase.xml file has been saved. When IIS detects that the metabase file has been saved, a series of checks are made, as noted in the following illustration. Several possible scenarios are presented, based on the results of the steps shown in the illustration, to demonstrate the behavior of edit-while-running.

important Important The MBSchema.xml file cannot be edited directly by using the edit-while-running feature. Changes made to metabase schema must be made programmatically.

Describes how edit-while-running works.

Step 1: IIS receives a file change notification that MetaBase.xml has been saved.

IIS receives a file change notification from Windows when the metabase file is saved. If MetaBase.xml is write-locked, when an administrator attempts to save MetaBase.xml directly with an application such as Notepad, an error is generated and a file change notification does not occur.

Step 2: IIS looks in MetaBase.xml for the HistoryMajorVersionNumber value.

IIS reads the value of the HistoryMajorVersionNumber property in the MetaBase.xml file to determine the major version number.

Step 3: IIS looks in the history folder for the corresponding history file.

The corresponding history file is the file that is named with the highest minor version number with the same HistoryMajorVersionNumber value that was found in MetaBase.xml in Step 2. If the corresponding history file is found, IIS proceeds to step 4.

Step 4: Parse MetaBase.xml.

IIS parses the MetaBase.xml file to determine whether there are fatal Extensible Markup Language (XML) errors, such as missing XML end tags. If MetaBase.xml can be parsed successfully, IIS proceeds to Step 5.

Step 5: Compare MetaBase.xml to the corresponding history file.

IIS compares the MetaBase.xml file to the corresponding history file of the same major version within the history folder. IIS determines the differences between the two files:

  • If no changes were made to MetaBase.xml, a history file is not created and no further action is taken.
  • If changes were made to MetaBase.xml, IIS proceeds to Step 6.

Step 6: Check that the level exists in the in-memory metabase that changes were made to in MetaBase.xml.

IIS determines whether the level/node exists within the in-memory metabase that changes were made to in the MetaBase.xml file. If the level/key exists within the in-memory metabase, IIS proceeds to Step 7.

Step 7: Write the changes to the in-memory metabase through Admin Base Objects (ABOs).

The changes are written to the in-memory metabase through ABOs.

A change that was made in MetaBase.xml might not be sent to the in-memory metabase for any of the following reasons:

  • The change violates metabase schema; for example, a property name is misspelled.
  • The in-memory metabase is write-locked by someone making a simultaneous change using Active Directory Service Interfaces (ADSI), ABO, or Windows Management Instrumentation (WMI) to the same metabase node or property.
  • The key in the in-memory metabase that changes were made to in the MetaBase.xml file does not exist. This could occur if an administrator deletes the key in the in-memory metabase, using a programmatic interface or IIS Manager, before the MetaBase.xml file is changed and saved to disk.

If a change is not written to the in-memory metabase for any of the reasons listed above, an error or warning is sent to the event log. For more information about simultaneous updates, see Simultaneous Updates below.

Step 8: IIS creates a new history file that contains the contents of the corresponding history file and the changes that were written to the in-memory metabase.

A history file is created in the history folder. This new file includes the combination of contents of the corresponding history file plus the changes that were written to the in-memory metabase in step 7. The new history file is named with the major version number that was found within the MetaBase.xml file (the value of the HistoryMajorVersionNumber property that was determined in Step 2) and the next highest minor version number. IIS looks within the history folder to find the highest minor version number that was used for the same major version number, and it uses the next sequential minor version number to name the new history file. This naming convention permits succeeding edits to the same major version of the file to work correctly.

Simultaneous Updates

IIS supports simultaneous updates between programmatic interfaces such as ADSI and WMI. However, under some circumstances, errors can occur as described in step 8 above. The rule is that the last write always wins.

IIS also supports simultaneous updates between the programmatic interfaces and one administrator directly editing the MetaBase.xml file. However, simultaneous writes to the same metabase node or property can result in an error condition.

You can protect against this by changing the access control list (ACL) of the metabase files or by having only one administrator for the computer. By default, only members of the Administrators group and the LocalSystem account can access the metabase files. IIS uses the System account internally to change the metabase files, so the access control entry (ACE) must remain. For more information on ACLs, see Access Control.

Related Topics

  • For more information about enabling edit-while-running, see Enabling Edit-While-Running.
  • For more information about configuring metabase history, see Configuring the Metabase History Feature.
  • For more information about writing changes to metabase schema, see Extending the Metabase Schema.


Enabling Edit-While-Running

The metabase edit-while-running feature can be enabled by using either IIS Manager or a command prompt.

The ability to enable metabase edit-while-running depends on the metabase history feature being enabled and set to a value of at least 10. This is the default metabase history setting.

It is important to note that all text within MetaBase.xml is case sensitive.

important Important You must be a member of the Administrators group on the local computer to perform the following procedure (or procedures), or you must have been delegated the appropriate authority. As a security best practice, log on to your computer using an account that is not in the Administrators group, and then use the Run as command to run IIS Manager as an administrator. From the command prompt, type runas /user:administrative_accountname "mmc %systemroot%\system32\inetsrv\iis.msc".

To enable metabase edit-while-running using IIS Manager

  1. In IIS Manager, right-click the local computer, and then click Properties.
  2. Select the Enable Direct Metabase Edit check box.

The following procedure requires IIS to be restarted. Restarting IIS stops all sites for a short time. To enable direct metabase edit without interruption of service, use IIS Manager procedure described above.

important Important You must be a member of the Administrators group on the local computer to run scripts and executables, or you must have been delegated the appropriate authority. As a security best practice, log on to your computer using an account that is not in the Administrators group, and then use the Run as command to run your script or executable as an administrator. From the command prompt, type runas /user:administrative_accountname "script or executable command".

To enable metabase edit-while-running from the command line

  1. From the Start menu, click Run.
  2. In the Open box, type cmd, and click OK.
  3. At the command prompt, type iisreset /stop, and press ENTER. Leave the command window open.
  4. Open the MetaBase.xml file with a plain text editor. By default, the MetaBase.xml file is located in the systemroot\system32\inetsrv directory.
  5. In the IIsComputer node, change the value of the EnableEditWhileRunning property from 0 (FALSE) to 1 (TRUE). The change should look as follows:
    6. IIsComputer Location ="/LM"
     EnableEditWhileRunning="1"
     EnableHistory="1"
     MaxBandwidth="4294967295"
     MaxHistoryFiles="10"
IIsComputer
  6. Save changes to the MetaBase.xml file.
  7. At the command prompt, type iisreset /start, and press ENTER.

Related Topics

  • For information about enabling metabase history, see Configuring the Metabase History Feature.
  • For more information about the EnableEditWhileRunning property, see EnableEditWhileRunning.
  • For information about restarting IIS, see Restarting IIS.


Adding Metabase Comments

A metabase comment must be stored in the in-memory metabase in the correct XML format, and associated with a particular node within the metabase so that the context of the comment can be preserved during subsequent writes of the metabase to disk. Put node-specific comments right above the node. If you delete the node, the comments about the node will be deleted as well.

When loading the metabase, the configuration system loads comments as a generic property into the metabase, along with other metabase data. If comments are found at the bottom of the file (below all nodes), that set of comments will always be preserved at the bottom of the file.

Comments are added as follows:

<!-- your comment goes here -->

The following is a list of rules concerning metabase comments:

  • Comments that are added above the MBProperty level are not picked up by the edit-while-running feature.
  • Comments that are added between the MBProperty level and the IIS_Global level cause an error file to be created.
  • Comments that are added between IIS_Global and IIS_ROOT are picked up by edit-while-running.
  • Adding comments between starting and ending XML tags results in an error file and the in-memory metabase being flushed to disk.


Extending the Metabase Schema

If you find that no existing Active Directory Service Interfaces (ADSI) object class meets your management needs, you can extend the IIS metabase schema. Extending the schema is a complex operation. Consider your needs carefully, and assess whether an extension is really necessary.

To extend the IIS metabase schema, you can programmatically edit the in-memory metabase schema while IIS is running by using ADSI. By creating a new object with the ADSI Schema Management, you can extend the metabase schema with a new class or property. The changes will be written to the MBSchema.xml file during the next write-to-disk event.

note Note You cannot use Windows Management Instrumentation (WMI) to edit the in-memory metabase schema.

This section includes the following information:

  • IIS ADSI Schema: Describes the IIS ADSI Schema and how it can be accessed.
  • About IIS Classes: Provides conceptual information about class architecture, inheritance, and derivation.
  • When to Extend the IIS ADSI Schema: Explains how to decide if the schema needs to be extended to meet given needs.
  • Extending the IIS ADSI Schema: Discusses entry points for implementing schema extensions, and provides code samples in Microsoft Visual Basic, Scripting Edition.

phrase 1, phrase 2, phrase 3


IIS ADSI Schema

The IIS ADSI Schema defines the group of objects that can be stored in the metabase. The Schema Management Objects represent the IIS ADSI Schema. The IIS ADSI Schema does not represent the Active Directory Service Interfaces (ADSI) object hierarchy, but you can think of it as an information store.

The Schema container object is used to attach a set of object definitions to the IIS namespace tree. Typically, each instance of a namespace has its own schema. ADSI represents this by placing a Schema container as a child of the namespace root.

For example, the IIS ADSI Schema contains definitions for classes, such as IIsWebServer. At the IISWebServer object level, the IIS ADSI Schema defines which properties can be set for that object, for example, the ServerBindings property. The IIS ADSI Schema also contains definitions for each property that is defined for the object, such as the property's data type.

This section includes the following information:

  • Schema Management: Presents the Schema Management Objects.
  • Using Schema Interfaces: Discusses schema interfaces that are used for extending the IIS ADSI Schema.


Schema Management

The Schema Management Objects support interfaces that are used to browse and modify the schema of a namespace. By using the Schema Management Objects together, you can create a new property that can be set at a virtual directory. For example, if you have a custom Internet Server API (ISAPI) extension, and you want to be able to configure it at each virtual directory in your Web site, you can define new properties that can be set at the virtual directory level. Editing the IIS ADSI Schema requires write access to the Schema container and its contents. By default, this capability is limited to members of the Administrators group on the local computer.

The Schema Management Objects are as follows:

  • Schema: The container object that contains a given schema.
  • Class: An object that defines a schema object class.
  • Property: An object that describes a property.

The Schema container object contains the IIS ADSI Schema Class object.

The IIS ADSI Schema Class object defines a class of objects that can be created in the IIS namespace, such as IISWebServer and IISComputer. The Class object supports the IADs mandatory interface, as well as the IADsClass Component Object Model (COM) interface. A given IIS ADSI Schema Class object contains a list of the property names it contains in the OptionalProperties list.

note Note Although some ADSI providers require class objects to maintain a MandatoryProperties list, the IIS ADSI provider does not require mandatory properties. Therefore, all properties are optional, and you must provide any additional required properties by adding them to the OptionalProperties list.

You can update the IIS ADSI Schema by using a script or a program. The schema is stored in the Schema, Class, and Property objects in the IIS metabase. You can write simple scripts that call ADSI methods to extend the IIS ADSI Schema. To view sample code, see Extending the IIS ADSI Schema.

You can also use other programming languages that support COM and Automation, such as C, C++, or Java, to write scripts or programs to extend the IIS ADSI Schema.


Using Schema Interfaces

The IIS ADSI Schema is implemented as a group of objects that are stored in the metabase. This makes it possible to manipulate the schema by using the standard Active Directory Service Interfaces (ADSI) object and container interfaces, IADs and IADsContainer. When extending the IIS ADSI Schema, developers should use the IADs and IADsContainer interfaces.

The Schema container is located at IIS://LocalHost/Schema. To access the IIS ADSI Schema, you can implement a script or an Active Server Pages (ASP) page to point to the IIS ADSI Schema location. Make sure to take appropriate security cautions. To set the path, you can use the following code:

<%
dim root
dim schemaObj
set SchemaObj = GetObject ("IIS://" & MachineName & "/Schema")
...
%>
Related Topics
  • For information on the IADs and IADsExtension interfaces, see the "ADSI Reference" section, under the "Networking Services" topic in the Platform SDK.


About IIS Classes

The Class object is the unit of storage in the IIS metabase. Classes define Class objects. The type of the Class defines the type of the new object. For example, if you want to create a new property, the class type must be of the type Property.

The Class object lists the following information:

  • The name of the class.
  • The object identifier for the class.
  • The globally unique identifier (GUID) for the class.
  • The properties (configuration parameters) that an instance of the class must have.
  • The additional attributes that an instance of the class can (optionally) have.
  • Which existing classes can create instances of this class.

Programs and scripts that extend the IIS ADSI Schema should apply updates in the following order:

  1. Add new classes.
  2. Add new properties.
  3. Add properties to classes.


When to Extend the IIS ADSI Schema

Extend the IIS ADSI Schema only if no existing object class meets your needs. Extending the IIS ADSI Schema is a complex operation; schema changes are propagated throughout the namespace. Consider your needs carefully and assess whether an extension is really necessary.

There are three ways to extend the IIS ADSI Schema:

  • Add additional properties to an existing class.
  • Modify the containment list for a class, allowing that class to contain instances of additional existing classes.
  • Create an entirely new class with only the properties that you want.

Usually, the best results are obtained by using existing classes. If an existing class needs only additional properties to meet your needs, then simply add the properties. For example, to know when a particular Web site is backed up, you can add a property, named LastBackup, that holds a time stamp for that event.

Create a new class only when no existing class meets your needs. Another reason to create a separate class is for private use.

Related Topics
  • For the latest information on Active Directory Service Interfaces (ADSI), see the ADSI Web site.


Extending the IIS ADSI Schema

This section includes information on and examples of how to implement new objects and properties and add them to the IIS ADSI Schema. This provides a programmatic, and safe, methodology for extending the metabase schema.

To add new objects and properties to the IIS ADSI Schema, use the IADsContainer and IADs objects as follows:

  • To create a new class for a new object or property, use IADsContainer::Create.
  • To read the attributes of Class and Propertyobjects, use IADs::Get or IADs::GetEx.
  • To set the attributes of Class and Property objects, use IADs::Put or IADs::PutEx.

You must also provide the data type (or syntax) when the new object is created.

This section includes the following information:

  • Creating Classes: Describes how to add a class to the metabase and provides sample VBScript for creating a metabase class.
  • Creating a Properties: Describes how to add a property to the metabase and provides sample VBScript for creating a metabase property.
  • Adding Properties to Classes: Describes how to add a property to an existing class and provides sample VBScript for adding a property to a class.
Related Topics
  • For information on available data types, see Metabase Property Reference.
  • For more information on the IADs and IADsContainer objects, see the "Network Services" topic in the "Windows ADSI Reference" section of the Platform SDK.


Creating Classes

You can use the following Microsoft Visual Basic®, Scripting Edition (VBScript) code sample to add a new Class object to the IIS ADSI Schema.

To create a Class object

  1. Bind to the Schema container.
  2. Create a new Class object.
  3. Write the new Class object to the metabase.
Example
'   Get the parameters for the machine name.
Dim ArgObj
Set ArgObj=WScript.Arguments

MachineName = ArgObj.Item (0)
ClassName = ArgObj.Item (1)

'   Bind to the Schema container object.
Dim SchemaObj
Dim NewClassObj
Set SchemaObj = GetObject ("IIS://" & MachineName & "/Schema")

'   Create a new Class object for ClassName.
Set NewClassObj = SchemaObj.Create ("Class", ClassName)

'   Write the new Class object to the metabase.
NewClassObj.SetInfo
Related Topics
  • For more examples, see Creating a Properties and Adding Properties to Classes.


Creating a Properties

You can use the following Microsoft Visual Basic, Scripting Edition, (VBScript) code sample to add a new Property object to the IIS ADSI Schema.

To create a Property object

  1. Bind to the Schema container.
  2. Create a new Property object.
  3. Set the syntax value of the object. The default syntax is String. The following table lists the possible syntax values.
    4. Syntax Value | Description
Boolean | Boolean variable (TRUE or FALSE)
Integer | 32-bit signed integer
String | Null-terminated string
ExpandSz | Double null-terminated list of strings
List | Array of null-terminated strings
IPSec | IPSecurity data type
NTAcl | Windows access control list (ACL)
MimeMapList | Array of MimeMap objects

  4. Write the new Property object to the metabase

Example

'Get the parameters for the machine name.
Dim MachineName
Dim PropertyName
Dim ArgObj
Set ArgObj=WScript.Arguments
MachineName=ArgObj.Item (0)
PropertyName=ArgObj.Item (1)

'Bind to the Schema container object.
Dim SchemaObj
Dim NewPropertyObj
Set SchemaObj=GetObject ("IIS://" & MachineName & "/Schema")

'Create a new Property.
Set NewPropertyObj=SchemaObj.Create ("Property", PropertyName)

'Set the syntax of the object.
'The default syntax is String.
'The syntax must be set before calling SetInfo.
NewPropertyObj.Syntax="string"

'Set the NewPropertyObject's attributes by inheritance.
NewPropertyObj.Inherit=True

'Write NewPropertyObject to the metabase.
NewPropertyObj.SetInfo
Related Topics
  • For more examples, see Creating Classes and Adding Properties to Classes.


Adding Properties to Classes

You can use the following Microsoft Visual Basic, Scripting Edition, (VBScript) code sample to add a new Property object to an existing IIS ADSI Schema class.

To add properties to a class

  1. Bind to the class in the IIS ADSI Schema that you want to add a property to.
  2. Bind to the OptionalProperties list for the Class object.
  3. Add the new property to the list.
  4. Write the new OptionalProperties list to the metabase.

Example

'Get the parameters for the machine name.
Dim MachineName
Dim ClassName
Dim PropertyName
Dim Action
Dim ArgObj
Set ArgObj=WScript.Arguments
Action = ArgObj.Item (0)
MachineName = ArgObj.Item (1)
ClassName = ArgObj.Item (2)
PropertyName = ArgObj.Item (3)

'Bind to Class in Schema container.
Dim SchemaObj
Dim NewClassObj
Set NewClassObj = GetObject ("IIS://" & MachineName & "/Schema/" & ClassName)

'Set the OptionalProperties list and add PropertyName.
Dim OptPropList
Dim cntOptPropListOptPropList = NewClassObj.OptionalProperties
cntOptPropList = UBound(OptProplist)

If (Action = "add") Then
   ReDim Preserve OptPropList(cntOptPropList+1)
   OptPropList(cntOptPropList+1) = PropertyNameNewClassObj.OptionalProperties = OptPropList
End If

if (Action = "del") Then
   Dim temparray
   Dim x, y
   ReDim temparray (cntOptPropList)

   x = y = LBound(OptPropList)
   For x = LBound(OptPropList) to UBound(OptPropList)
           If UCase(OptPropList(x)) = UCase(PropertyName) Then
              ReDim Preserve temparray (cntOptPropList-1)
                Else
                  temparray(y) = OptPropList(x) 'Copy item to the temp array
                  y = y + 1
                End If
  Next

NewClassObj.OptionalProperties = temparray
End if

NewClassObj.SetInfo
Related Topics
  • For more examples, see Creating Classes and Creating a Properties.


Code Examples to Configure Metabase Properties

The following examples demonstrate the syntax for setting a metabase property using different technologies, such as Windows Management Instrumentation (WMI) and Active Directory Service Interfaces (ADSI). The code examples are written in Microsoft® Visual Basic® Scripting Edition (VBScript), JScript®, and Perl.

The examples are simplified to show the essential code that is needed to change a metabase property. If you use these examples, add error checking code and security checking code before using them to configure your server.

Implementation Guidelines

To implement one of the VBScript, JScript, or Perl examples in a command-line administration script

  • For VBScript: Save the script file with the file name extension of .vbs and call a script with "cscript //nologo filename.vbs".
  • For JScript: Save the script file with the file name extension of .js and call a script with "cscript //nologo filename.js".
  • For Perl: Save the script file with the file name extension of .pl and call a script with "perl filename.pl".

To implement one of the VBScript, JScript, or Perl examples in an ASP page

  1. Set security on the Web application to disable anonymous access. Anonymous access to metabase properties is not allowed. The user requesting the ASP page should be an Administrator. In addition, the process executing the ASP page must have permission to modify the metabase.
  2. Add the following lines of ASP code, where the first line is at the top of the file, and "language" is "Microsoft Visual Basic Scripting Edition (VBScript)", "JScript", or "PerlScript":
    <%@ Language="language" %>
<%
insert the example code here
%>
  3. Change instances of WScript.Echo to Response.Write, and print to $Response->Write.
  4. Change the file name extension of your file to .asp.
  5. Install ActivePerl with PerlScript to run the Perl examples. ActivePerl can be downloaded from the ActiveState Web site.

Code Examples

In the following examples, there are italicized words that must be replaced by a valid string for the example to execute properly. Replace property_name_1 and property_name_2 with metabase property names. Replace numeric_or_Boolean_value and String_value with a valid data types for that property.

These examples demonstrate how to set a metabase property to a string, number, or Boolean value. These examples do not cover WMI situations where you need to pass in an object.

WMI
Microsoft Visual Basic Scripting Edition (VBScript)
set providerObj=GetObject("winmgmts:/root/MicrosoftIISv2")
set vdirObj=providerObj.get("IIsWebVirtualDirSetting='W3SVC/1/ROOT'")
' Print out the current value of some properties:
WScript.Echo "Before: " & vdirObj.property_name_1 & ", " & vdirObj.property_name_2
' Set some properties:
vdirObj.property_name_1=numeric_or_Boolean_value
vdirObj.property_name_2="String_value"
' Save the property changes in the metabase:
vdirObj.Put_()
WScript.Echo "After: " & vdirObj.property_name_1 & ", " & vdirObj.property_name_2
JScript
var providerObj=GetObject("winmgmts:/root/MicrosoftIISv2");
var vdirObj=providerObj.get("IIsWebVirtualDirSetting='W3SVC/1/ROOT'");
// Print out the current value of some properties:
WScript.Echo("Before: " + vdirObj.property_name_1 + ", " + vdirObj.property_name_2);
// Set some properties:
vdirObj.property_name_1=numeric_or_Boolean_value;
vdirObj.property_name_2="String_value";
// Save the property changes in the metabase:
vdirObj.Put_();
WScript.Echo("After: " + vdirObj.property_name_1 + ", " + vdirObj.property_name_2);
Perl
use Win32;
use Win32::OLE;
my $providerObj=Win32::OLE -> GetObject("winmgmts:/root/MicrosoftIISv2");
my $vdirObj=$providerObj->Get("IIsWebVirtualDirSetting='W3SVC/1'");
# Print out the current value of some properties:
print "Before: ", $vdirObj->{"property_name_1"}, ", ", $vdirObj->{"property_name_2"}, "\n";
# Set some properties:
$vdirObj->{"property_name_1"}=numeric_or_Boolean_value;
$vdirObj->{"property_name_2"}="String_value";
# Save the property changes in the metabase:
vdirObj->Put_();
print "After: ", $vdirObj->{"property_name_1"}, ", ", $vdirObj->{"property_name_2"}, "\n";
ADSI
Microsoft Visual Basic Scripting Edition (VBScript)
set vdirObj=GetObject("IIS://localhost/W3svc/1/Root")
' Print out the current value of some properties:
WScript.Echo "Before: " & vdirObj.property_name_1 & ", " & vdirObj.property_name_2
' Set some properties:
vdirObj.Put "property_name_1", numeric_or_Boolean_value
vdirObj.Put "property_name_2", "String_value"
' Save the property changes in the metabase:
vdirObj.SetInfo
WScript.Echo "After: " & vdirObj.property_name_1 & ", " & vdirObj.property_name_2
JScript
var vdirObj=GetObject("IIS://localhost/W3svc/1/Root");
// Print out the current value of some properties:
WScript.Echo("Before: " + vdirObj.property_name_1 + ", " + vdirObj.property_name_2);
// Set some properties:
vdirObj.Put("property_name_1", numeric_or_Boolean_value);
vdirObj.Put("property_name_2", "String_value");
// Save the property changes in the metabase:
vdirObj.SetInfo();
WScript.Echo("After: " + vdirObj.property_name_1 + ", " + vdirObj.property_name_2);
Perl
use Win32;
use Win32::OLE;
my $vdirObj=Win32::OLE -> GetObject("IIS://localhost/W3SVC/1/Root");
# Print out the current value of some properties:
print "Before: ", $vdirObj->{"property_name_1"}, ", ", $vdirObj->{"property_name_2"}, "\n";
# Set some properties:
$vdirObj->{"property_name_1"}=numeric_or_Boolean_value;
$vdirObj->{"property_name_2"}="String_value";
# Save the property changes in the metabase:
$vdirObj->SetInfo();
print "After: ", $vdirObj->{"property_name_1"}, ", ", $vdirObj->{"property_name_2"}, "\n";

You may encounter errors when running example code that you have altered. The following table lists possible errors and their causes.

Error Code Possible Cause
0x80005006 The property does not exist, or it does not exist at the access location where you are attempting to set it.

For example, you cannot set the AdminServer property at the Web site level (W3SVC/1, W3SVC/1/ROOT) or the virtual directory level (W3SVC/1/ROOT/vdir); you can set it only at the World Wide Web Publishing Service (WWW service) level. You cannot set the AdminEmail property on any Web, File Transfer Protocol (FTP), or Simple Mail Transfer Protocol (SMTP) metabase key; you can set it only on a Network News Transfer Protocol (NNTP) metabase key.

See the Metabase Property Reference for the metabase property that you are trying to set. Use the Access Locations table to verify that you are accessing the property at a valid location. Or, you can open the MetaBase.xml file on your server and search for the property to see what locations it is set on.
0x8000500C The data type of the property is different than the data type to which you are attempting to set it.

For example, you cannot set the AspCodepage property to a string ("English"); you can set it only to a number representing a code page (1252).

Related Topics

  • For information about scripting in JScript or Microsoft Visual Basic Scripting Edition (VBScript), see the Microsoft Script Technologies SDK.
  • For an article about scripting in PerlScript, see Active Scripting with PerlScript.
  • For information about WMI and additional examples, see Module 3: Writing Administration Scripts that Use WMI of the IIS WMI Provider Tutorial and Using Command-Line Administration Scripts.
  • For information about ADSI and additional examples, see About IIS ADSI Objects.


Metabase Security

The metabase files must be protected at all costs. A default installation of Internet Information Services (IIS) ensures metabase security by setting strict access control entries (ACEs) on the metabase files and by encrypting sensitive data within the files (An Access Control List [ACL] contains ACEs). If you maintain this level of security, perform regular backups, use a strong administrator password, and limit the number of users who have administrative credentials, you are taking the proper precautions to protect your metabase files.

This section outlines metabase security issues, and includes the following topics:

  • File-Level Security: Describes securing the metabase files.
  • Encrypted Properties: Discusses the various encrypted fields within the metabase.
  • Checklist: Metabase Security: Provides the steps necessary to protect the metabase.
phrase 1, phrase 2, phrase 3


File-Level Security

IIS installs the metabase files with strict access control entries (ACEs) set to prevent anyone but administrators from viewing your configuration data. An Access Control List (ACL) is a container for ACEs.

The following table lists the metabase files, their purpose, and the permissions that are set on them.

File | Purpose | Access Control List (ACL)
systemroot\System32\Inetsrv\MetaBase.xml | Stores configuration data for the IIS services. For more information, see Metabase Configuration File. | NT AUTHORITY\SYSTEM : Full control BUILTIN\Administrators : Full control
systemroot\System32\Inetsrv\MBSchema.xml | Stores the schema for the configuration file. The schema defines what IIS properties can be set at certain metabase nodes. For more information, see Metabase Schema. | NT AUTHORITY\SYSTEM : Full control BUILTIN\Administrators : Full control
systemroot\System32\Inetsrv\History\History File | Stores the metabase history files that are created automatically by IIS. For more information, see Restoring the Metabase from History Files. | NT AUTHORITY\SYSTEM : Full control BUILTIN\Administrators : Full control
systemroot\System32\Inetsrv\MetaBack\Backup File | Stores the metabase backup files that are created on demand by using the Backup/Restore Configuration feature. For more information, see Restoring the Metabase from Backup Files. | NT AUTHORITY\SYSTEM : Full control BUILTIN\Administrators : Full control
Related Topics
  • For information on access control, see Access Control.


Encrypted Properties

IIS encrypts sensitive data in the metabase configuration file, MetaBase.xml, so that it cannot be viewed even if an unauthorized user gains access to the file.

important Important Do not manually change encrypted properties in MetaBase.xml. There is no way to encrypt your data before inserting it using Notepad or some other text editor. Only Windows Management Instrumentation (WMI), Active Directory Service Interfaces (ADSI), or Admin Base Objects (ABOs) can be used to change the data in encrypted properties.

Metabase properties are marked for encryption by an attribute that is set on the property in the metabase schema file. The following line of code from the metabase schema file shows how the AnonymousUserPass property is marked for encryption with a SECURE attribute:

<Property InternalName="AnonymousUserPass"  Type="STRING" UserType="IIS_MD_UT_FILE"
  Attributes="INHERIT|SECURE" MetaFlagsEx="CACHE_PROPERTY_MODIFIED" DefaultValue=""/>

caution Caution You cannot use WMI, ADSI, or ABO to add an attribute to an existing property in the metabase schema; for example, you cannot mark an existing propery as SECURE. If you attempt to use WMI, ADSI, or ABO to remove a property in the metabase schema and then create it again with the SECURE attribute, you lose your metabase configuration data for that property. You can, however, use ADSI to create new properties in the metabase schema with the SECURE attribute. Manual changes that are made to the metabase schema file using a text editor do not persist after the IIS Admin service is started.

The following table lists all the encrypted properties in the metabase.

Property
ADConnectionsPassword
AdminACL
AdminACLBin
AnonymousUserPass
ImapDsPassword
LogOdbcPassword
Pop3DsPassword
RoutePassword
SmtpDsPassword
UNCPassword
FeedPassword
WAMUserPass


Checklist: Metabase Security

The following is a list of recommended steps to ensure the security of the metabase.

Step | Reference
Check box | Make sure that the passwords for all accounts on your computer are strong and not written anywhere near the computer or within view. | Passwords
Check box | Maintain strict access control permissions on the metabase files that are listed in File-Level Security. Only the LocalSystem account and the Administrators group should be listed in the access control lists (ACLs) as having full control of the metabase files, including the history files and backups. IIS sets this access control by default. | File-Level Security; Access Control
Check box | Employ the concept of least permission on your computer. Allow only one person to know the Administrator password, and limit the number of people whose accounts are in the Administrators group. Set ACLs on all folders and files so that the fewest users have the lowest level permission needed to run required tasks. Set IIS security on all IIS applications and virtual directories so that the fewest permissions necessary exist to allow proper clients to view your content. | Access Control; Security
Check box | Do not run the cipher command or use Encrypting File System (EFS) on the metabase files. Sensitive data, such as passwords that are stored in MetaBase.xml, are already encrypted. Encrypting the entire MetaBase.xml file slows down your IIS server and may cause errors. | Cipher; Encrypting File System
Check box | When you edit the MetaBase.xml file manually, copy the MetaBase.xml file first, and then work on the copy. When you have checked your changes, replace MetaBase.xml with your copy. | Metabase Edit-While-Running Feature
Check box | Create backups of your metabase files using the backup/restore configuration tool whenever you make a significant change in the metabase. If you allow other people to configure the metabase, make it a policy that they create a backup with their name in the title whenever they make a change. IIS periodically makes its own backup files, called history files, but history files might not be created for every change to the metabase. | Restoring the Metabase from Backup Files; Restoring the Metabase from History Files
Check box | Do not use the metabase import and export feature to create regular backup files. This feature is meant to transport sections of the metabase to other computers; therefore, it does not include sensitive data, such as passwords and the keys that encrypt them. However, it is recommended that you create an export file for your entire metabase periodically in the event that your computer hardware fails and you must move your Web sites to another computer. | Metabase Import and Export
Check box | Remember that backing up or exporting the metabase does not back up your content (.htm files, .asp files, components, and so on). The metabase only holds configuration data, such as where your content is stored. To back up your content, use the Windows backup and restore feature. | Backing up and Restoring Data
Check box | Monitor your event log for IIS event messages. For example, if you attempt to make changes to the metabase when there is a write-lock on the in-memory database, a metabase history file is created and an error is written to the event log. If you successfully create an FTP virtual directory, but IIS cannot enumerate the physical directory, an error is written to the event log. | Events Reference; Event Viewer
Check box Set up file auditing on the various files that affect the metabase. This way, if the metabase becomes corrupted, you can identify the account of the last user who made a change. Select your auditing choices carefully for the files listed below, and monitor the audit logs for a period of time to determine if the settings are meeting your needs.
  • systemroot\System32\Inetsrv\MetaBase.xml
    If you choose to audit the MetaBase.xml file, only users who edit the metabase manually are identified in the audit logs by their own account name. Users who edit the metabase using IIS Manager or other tools are logged as accessing the metabase under the LocalSystem account. Because IIS itself is constantly accessing the metabase, audit logs can grow very quickly unless you limit auditing to specific users, such as the local Administrators group, and specific access attempts, such as writing to a file. Auditing MetaBase.xml is still valuable for determining when changes were made, but you may have to audit the other files listed here to find the exact identity of the user.
  • Custom tools and script files that use WMI, ADSI, or ABO to edit the metabase
    Auditing should be set on these tools to identify who executes them. If you audit MetaBase.xml and want to find out who made a change at 3:01 P.M. on a certain day, you can look in the audit logs for your scripts and tools to see if someone ran one of them at 3:01 P.M.
  • systemroot\System32\Inetsrv\Inetmgr.exe
    Audit this file for the same reason as auditing custom tools and script files, above.
 Auditing
To set, view, change, or remove auditing for a file or folder
Related Topics
  • For a global security checklist, see Security Best Practices.

    • © 1997-2003 Microsoft Corporation. All rights reserved.


Backing Up and Restoring the Metabase

Creating backups of the metabase is a vital part of maintaining metabase reliability. The ability to create backup files and to restore the metabase using backup files has been enhanced in IIS 6.0 in that you can now restore the backup on other machines if secure backup has been chosen. Backups of the metabase are created automatically by IIS, and they can be created on demand by an IIS administrator using IIS Manager. All backups, regardless of how they were created, are stored together and displayed together in IIS Manager.

Restoring a backup from a previous version of IIS is not supported. After you install or upgrade to IIS 6.0, it is recommended that you perform a metabase backup as soon as possible to preserve your configuration data.

Backing up the metabase should be supplemented with proper metabase security practices.

The following table compares the two methods of restoring the metabase:

Using Backup Files | Using History Files
The metabase can be restored to a different installation of Windows, even on a different computer. | The metabase can be restored only on the same installation of Windows from which the history files were created. This is because of encrypted data that is included in the backups.
Backup files can be created on demand, scheduled through IIS Manager, or created by using a programmatic administration script. | History files can be created automatically (when the IIS history feature is enabled) or by using a programmatic administration script.
Backup files can be restored from IIS Manager, by using application programming interfaces (APIs), or by using programmatic administration scripts. | History files can be restored manually or by using IIS Manager.

This section includes the following information:

  • Restoring the Metabase from Backup Files: Describes how to to create secure or nonsecure backup files of your IIS metabase, and how to use those backup files to restore your IIS configuration.
  • Restoring the Metabase from History Files: Describes how to use automatically generated history files to restore your IIS configuration.


Restoring the Metabase from Backup Files

IIS administrators can create backup files using either IIS Manager or a command-line administration script. The backup files are portable copies of the metabase configuration file (MetaBase.xml) and the matching metabase schema file (MBSchema.xml). By using the metabase configuration backup/restore feature, you can restore the metabase from the backup files.

Backing Up the IIS Metabase

Using the configuration backup/restore feature, you can create complete backup copies of the IIS metabase. Metabase backup files provide a way to restore your metabase configuration and schema data in the event that your metabase becomes corrupted. Backup files can be restored either to the computer on which the backup was made or to other installations of the Windows Server 2003 family.

Backup files contain only configuration data; they do not include your content. To back up your content as well, use the Windows Backup feature. For more information, see Backing up and Restoring Data.

note Note The metabase is locked while the backup is in progress.

Secure Backup

When creating a secure backup, the administrator provides a password that is used by IIS to encrypt the backup files. The password is encrypted and stored in the header of the backup file. Only the administrator password and secure properties within the backup files are encrypted; all other information within the backup files are plaintext. After the backup file is encrypted, the password within the backup file cannot be changed.

Nonsecure Backup

When creating a nonsecure backup, the administrator does not supply a password. Therefore, nonsecure backup files are encrypted with a blank password, which allows any member of the Administrators group to restore the metabase using nonsecure backup files. Only the blank password and secure properties are encrypted; all other information within the backup file is plaintext.

important Important You must be a member of the Administrators group on the local computer to perform the following procedure (or procedures), or you must have been delegated the appropriate authority. As a security best practice, log on to your computer using an account that is not in the Administrators group, and then use the Run as command to run IIS Manager as an administrator. From the command prompt, type runas /user:administrative_accountname "mmc %systemroot%\system32\inetsrv\iis.msc".

To back up the IIS metabase

  1. In IIS Manager, right-click the local computer, point to All Tasks, and click Backup/Restore Configuration.
  2. Click Create Backup and type a name for the backup file in the Configuration backup name box. Note that the backup name is not case-sentitive.
  3. Optional: If you want to create a secure backup, select the Encrypt backup using password check box, type a password in the Password box, and then type the same password in the Confirm password box.
  4. Click OK.

When a backup is created, a set of two files is created and named in the following format:
name.mdx
name.scx
where name is the name that the administrator uses to name the backup set, and x is the version number of the backup set, starting with 0 (zero). The version number is increased by one for each backup set that uses the same name. For example, if you use the name mybackup as the name of your backup set twice, mybackup.md0 and mybackup.sc0 are created on the first backup; on the second backup, the files are named mybackup.md1 and mybackup.sc1. By default, backup files are stored in the systemroot\System32\Inetsrv\MetaBack folder.

Restoring an IIS Metabase Backup

You can restore a metabase backup to the same computer on which the backup was made, or onto a different computer. Because a metabase backup does not include content files, if you restore a metabase backup to a different server, you must copy your content files as well. The content files must exist in the same location and on the same drive used on the original server. Restoring a backup from an earlier version of IIS is not supported.

important Important Before restoring a metabase from one computer to a different computer, you must first delete the machine-specific information from the metabase file. For important information on this issue, see Machine-Specific and System-Specific Information, and Copying IIS Configurations.

To restore an IIS metabase backup

  1. In IIS Manager, right-click the local computer, point to All Tasks, and click Backup/Restore Configuration.
  2. In the Backups list, click the backup you want to restore and click Restore.

    3. note Note If you want to restore IIS to its initial configuration, restore the backup named Initial Backup, created automatically by IIS setup.

  3. Read the message that appears and click Yes if you want to continue.
  4. If you are restoring a secure backup, you are prompted for the password you typed when the backup was created. Type the password and click OK. Note that passwords are case sensitive.
  5. Click OK.

SSL Certificates

If you use a Secure Sockets Layer (SSL) certificate on your Web server and you restore the metabase backup to a different installation of the operating system, an error occurs if the certificate is not available or installed. If a site's SSL certificate is missing, connections are dropped, and IIS displays a "page unavailable" message. The server logs the following warning in the event log: "The solution is to reinstall the certificate into the same certificate store and restart IIS. Failure to restart IIS after reinstalling the certificate results in continued error logs and dropped connections."

Related Topics
  • For information on backing up and restoring the IIS metabase using a command-line administration script, see Managing IIS Configurations.
  • For information about metabase key names and paths, property inheritance, security, and reliability, see Metabase Structure.
  • For information about installing SSL certificates, see Configuring SSL on Servers.
  • For information about restarting IIS, see Restarting IIS.
  • For more information on the initial metabase configuration backup, see IIS Initial Configuration Backup.


Restoring the Metabase from History Files

IIS periodically creates backup files called history files when the history feature is enabled. The history files are copies of the metabase configuration file (MetaBase.xml) and the matching metabase schema file (MBSchema.xml). Restoring the metabase from history files is similar to restoring the metabase from backup files.

important Important You must be a member of the Administrators group on the local computer to perform the following procedure (or procedures), or you must have been delegated the appropriate authority. As a security best practice, log on to your computer using an account that is not in the Administrators group, and then use the Run as command to run IIS Manager as an administrator. From the command prompt, type runas /user:administrative_accountname "mmc %systemroot%\system32\inetsrv\iis.msc".

To restore the metabase using IIS Manager

  1. In IIS Manager, right-click the local computer, point to All Tasks, and click Backup/Restore Configuration.
  2. In the Backups list, click the Automatic Backup you want to restore, and then click Restore.
  3. Read the message that appears and click Yes if you want to continue.
  4. Click OK.

You may find it necessary to restore the metabase without using IIS Manager. For example, if a configuration change is made improperly or if it is made with incorrect Extensible Markup Language (XML) syntax, and IIS Manager is unable to enumerate the metabase, use the following procedure to restore the metabase.

To manually restore the metabase

  1. Open a command prompt. From the Start menu, click Run.
  2. In the Open box, type cmd, and then click OK.
  3. Stop the IIS services. At the command prompt, type iisreset /stop, and then press ENTER. The command prompt displays the following:
    Attempting stop...
    Internet services successfully stopped
    If the IIS services do not stop, and it is possible to restart the computer, type iisreset /stop /rebootonerror, and then press ENTER.
  4. Make copies of your current metabase files. At the command prompt, type cd systemroot\System32\Inetsrv, and then press ENTER to navigate to the folder where the files are. Next, type copy MBSchema.xml MBSchema.old, and then press ENTER to copy the schema file. Finally, type copy MetaBase.xml Metabase.old, and then press ENTER to copy the metabase configuration file.
  5. Locate the metabase history files. At the command prompt, type cd systemroot\System32\Inetsrv\History, and then press ENTER.
  6. Select the version of history files that you want. At the command prompt, type dir, and then press ENTER. All of the files appear in the following format:
    <date>  <time>   <file size> MBSchema_<identifying number>_0000000000.xml
<date>  <time>   <file size> MetaBase_<identifying number>_0000000000.xml
    When you restore the IIS metabase to a previous version, you need matching metabase schema and configuration files. Select matching files by their identifying number.
  7. Copy the chosen history schema file over the existing metabase schema. At the command prompt, type copy /y MBSchema_<identifying number>_0000000000.xml systemroot\System32\Inetsrv\MBSchema.xml, and then press ENTER. With this command, you copy the file and rename it at the same time.
  8. Copy the matching history configuration file over the existing metabase configuration. At the command prompt, type copy /y Metabase_<identifying number>_0000000000.xml systemroot\System32\Inetsrv\MetaBase.xml, and then press ENTER. Again, this command copies the file and renames it at the same time.

    important Important If you mix up the names or copy a schema and configuration file that do not match, the metabase restoration will fail when you start the IIS services.

  9. Restart IIS. At the command prompt, type iisreset /start, and then press ENTER. The command prompt displays the following:
    Attempting start...
    Internet services successfully started
    If the IIS services do not restart, repeat these steps beginning at step 4, and copy a different set of history files over the current metabase files.
Related Topics
  • For information on metabase history files, see Metabase History Feature.
  • For information about backing up the metabase, see Restoring the Metabase from Backup Files.
  • For information about metabase key names and paths, property inheritance, security, and reliability, see Metabase Structure.
phrase 1, phrase 2, phrase 3


Metabase Import and Export

This discusses site cloning, application cloning, and creating a metabase template to import or merge from other IIS computers.

This section includes the following information:

  • About Metabase Import and Export: Provides an overview of the metabase import and export feature.
  • Importing and Exporting Metabase Elements with IIS Manager: Explains how to import and export metabase elements using IIS Manager.
  • Moving Sites and Applications to Another Computer: Discusses the procedure for creating a template of an import file and special considerations when importing and exporting sites and applications.
  • Machine-Specific and System-Specific Information: Lists the metabase elements that should not be included in import files.
  • Restoring Sections of the Metabase: Explains how to recover a section of the metabase without the need to restore the entire metabase.


About Metabase Import and Export

The metabase import and export feature enables administrators to create an export file, named MetaBase.xml by default, that contains specifically selected elements of a metabase configuration file. This export file can later be imported into the metabase configuration file of the same computer, or to another computer running a member of the Microsoft Windows Server 2003 family.

Additionally, you can use the metabase export feature to create a metabase template, which can be used to configure multiple computers with the same IIS configuration settings, excluding machine- and system-specific information. For more information about metabase templates, see Restoring Sections of the Metabase.

Metabase export does not replace the functionality of metabase backup because it does not include encrypted properties. Metabase backup is used to create backup files of the entire metabase configuration and schema, which can be restored only in its entirety, including encrypted properties. Metabase export cannot be used to export the metabase schema.

note Note Neither the metabase backup nor export feature can be used to save or copy content files, scripts, or binaries. To back up your your entire server, including content files, scripts, and binaries, use an application such as Windows Backup. To simply copy these files to a new location, use an application such as Windows Explorer or the Windows xcopy command. Remember to reregister any components that you copy to a new computer.

Specifying Metabase Elements for Import or Export

You can import and export the following metabase elements:

  • All Web site configurations or a single site configuration.
  • All FTP site configurations or a single FTP site configuration.
  • All SMTP site configurations or a single SMTP site configuration.
  • All NNTP site configurations or a single NNTP site configuration.
  • An IIS application configuration.
  • A directory, virtual directory, or file configuration properties.
  • All application pool configurations or a single application pool configuration.

For information on the elements that can be exported, and later imported, see Metabase Import and Export.

Importing and Exporting a Metabase Element

To import or export a metabase element, you can use any of the following:

  • IIS Manager.
  • The iiscnfg.vbs tool that is included with IIS.
  • A custom script using the Export method of the Windows Management Instrumentation (WMI) provider for IIS or the Export method of the Active Directory Services Interfaces (ADSI) provider for IIS.
  • A custom application using Admin Base Objects (ABO).

Regardless of whether you use a programmatic interface, a script, or IIS Manager to import and export metabase elements, there are specific choices you must make. The following list outlines both the required and optional steps needed to import and export a metabase element. The inheritance and merge options are discussed later in this topic.

important Important You must be a member of the Administrators group on the local computer to perform the following procedure (or procedures), or you must have been delegated the appropriate authority. As a security best practice, log on to your computer using an account that is not in the Administrators group, and then use the Run as command to run IIS Manager as an administrator. From the command prompt, type runas /user:administrative_accountname "mmc %systemroot%\system32\inetsrv\iis.msc".

Before Exporting a Metabase Element

  • Select a metabase element to export.
  • Specify the name and location of the .xml file to contain the exported element.
  • Optionally choose to export inherited properties.
  • Optionally choose to export lower-level (child) subkeys recursively.
  • Optionally encrypt the export file with a password that you provide.

When a metabase element is exported, IIS creates an .xml file containing the exported element or elements.

Before Importing a Metabase Element

  • Specify a metabase export file to import.
  • Specify an element within the export file to import.
  • Optionally choose to import inherited properties.
    The export file must contain inherited properties for this option to be available.
  • Optionally choose to import lower-level (child) subkeys recursively.
    The export file must contain lower-level (child) subkeys for this option to be available.
  • Specify the password, if any, that was used to encrypt the export file.
  • Optionally choose to merge the settings from the export file into the metabase configuration.
  • If you intend to import a metabase element to another computer, you must first change the system- and machine-specific information in the export file. For machine- and system-specific information, see Machine-Specific and System-Specific Information.

Inherit and Merge Flags

Inherit and merge flags can only be set when importing or exporting metabase nodes programmatically using the WMI or ADSI Export or Import methods, or by using the Iiscnfg.vbs command-line tool with the inherit or merge flags.

If you set the inherit flag during a metabase export, inheritable properties that are applicable to the metabase element are saved as part of the export file. If the inherit flag is set during an import operation, these inheritable properties are imported into the metabase.

The behavior of importing inheritable settings differs, depending on whether the merge flag is used along with the inherit flag.

For example:

  • If you import a metabase element using the inherit flag without the merge flag, inherited properties are imported into the metabase, overwriting all information that is in the destination node. (Any properties in the metabase that are not in the export file are removed.)
  • If you import a metabase element using the inherit flag with the merge flag, inherited properties are imported into the metabase, and the value of the properties in the export file that already exist at the same location in MetaBase.xml are overwritten. (Properties that exist in the metabase but not in the export file will remain unchanged.)

important Important Inherited properties affect the configuration of all sites. Use caution when importing a metabase element using the inherit flag.

Export Lower-Level Subkeys

When specifying a metabase element to export, you can optionally export lower-level (child) subkeys. If an element is exported using this option, you can optionally import an element and all recursive subkeys.

Related Topics
  • For more information about exporting an IIS configuration, see Exporting IIS Configurations.
  • For more information about importing an IIS configuration, see Importing IIS Configurations.
  • For more information about metabase backup and restore, see Backing Up and Restoring the Metabase.
  • For more information about metabase property inheritance, see Property Inheritance.
  • For more information about IIS applications, see About Configuring Applications.
  • For more information about Backup, see Ntbackup in Windows Help.
  • For more information about the Windows xcopy command, see Xcopy in Windows Help.
  • For information about metabase templates, see Restoring Sections of the Metabase.


Importing and Exporting Metabase Elements with IIS Manager

You can use the metabase import/export feature to to create an export file, containing specifically selected elements of a metabase configuration file. This export file can later be imported into the metabase configuration file on the same computer or another computer running a member of the Microsoft Windows Server 2003 family.

The simplest way to use the metabase import/export feature is through IIS Manager. However, if you need to use this feature on numerous machines quickly, you can use one of the following:

  • The iiscnfg.vbs tool that is included with IIS.
  • A custom script using the Export method of the Windows Management Instrumentation (WMI) provider for IIS or the Export method of the Active Directory Services Interfaces (ADSI) provider for IIS.
  • A custom application using Admin Base Objects (ABO).

important Important You must be a member of the Administrators group on the local computer to perform the following procedure (or procedures), or you must have been delegated the appropriate authority. As a security best practice, log on to your computer using an account that is not in the Administrators group, and then use the Run as command to run IIS Manager as an administrator. From the command prompt, type runas /user:administrative_accountname "mmc %systemroot%\system32\inetsrv\iis.msc".

To export metabase elements

  1. In IIS Manager, expand Local Computer, right-click the application pool, Web site, FTP site, or virtual directory that you want to export, point to All Tasks, and click Save Configuration to a File.
  2. In the File name box, type the name you want to give to your export file.
  3. In the Path box, type or browse to the path where you want the export file saved. For security purposes, select a folder on which you have already restricted access by setting strict Access Control permissions. Any files created in such a folder inherit the access control list (ACL).
  4. If you want to encrypt your export file for increased security, select the Encrypt configuration using password check box, and type a strong password in the Password and Confirm password boxes.
  5. Click OK and verify that your export file has been created.

To import metabase elements

  1. Before importing metabase elements from a file, make sure you have removed or changed all machine- and system-specific information.
  2. In IIS Manager, expand Local Computer; right-click the Web site, FTP site, virtual directory, or application pool node to which you want to import configuration data; point to New; and click Web Site (from file), FTP Site (from file), Virtual Directory (from file), or Application Pool (from file)— depending on the type of node to which you want to import configuration data.
  3. In the File box, type the path to your import file or click Browse to locate it.
  4. Click Read File. The importable nodes are displayed under Select a configuration to import.
  5. Click the object whose configuration you want to import and click OK.
  6. If the element already exists in the metabase, a message that states This <element> already exists appears. You can choose Create a new <element> or Replace the existing <element>, and then click OK. Note that if you choose to replace the existing element, you lose all previous configuration settings.
Related Topics
  • For more information about exporting an IIS configuration, see Exporting IIS Configurations.
  • For more information about importing an IIS configuration, see Importing IIS Configurations
    • .
  • For more information about metabase backup and restore, see Backing Up and Restoring the Metabase
    • .


Moving Sites and Applications to Another Computer

You can use the metabase export feature to configure multiple computers with the same basic IIS configuration settings. The procedure below illustrates how to create a metabase template for the World Wide Web Publishing Service (WWW service) — though any service, site, virtual directory, or application can be ported.

important Important You must be a member of the Administrators group on the local computer to perform the following procedure (or procedures), or you must have been delegated the appropriate authority. As a security best practice, log on to your computer using an account that is not in the Administrators group, and then use the Run as command to run IIS Manager as an administrator. From the command prompt, type runas /user:administrative_accountname "mmc %systemroot%\system32\inetsrv\iis.msc".

The following procedure creates a complete, system-independent copy of the metabase configuration and saves it to a file. The file can then be imported to other IIS 6.0 servers without overwriting or conflicting with settings on the target system.

To port an entire system-independent metabase configuration to another computer

  1. Open a command prompt, and switch to the systemroot\system32 directory.
  2. Type cscript iiscnfg.vbs /f filename.xml /d password /inherited /children, and press ENTER.
  3. Copy the .xml file you created to a temporary directory on the target system.
  4. On the target system, open a command prompt and switch to the systemroot\system32 directory.
  5. Type cscript iiscnfg.vbs /import /f path\filename.xml /dp password /children /inherited /merge, and press ENTER.

The iiscnfg.vbs script contains many options for exporting and importing metabase configurations. For more information on metabase import and import options, see Iiscnfg.vbs: IIS Configuration Script in Windows Help.

To port metabase elements to another computer

  1. Configure an IIS server to the state that you want ported to other computers.
  2. Export a metabase element to a file, either using IIS Manager; the iiscnfg.vbs tool that is included with IIS; a custom script using the IIsComputer.Export method of the Windows Management Instrumentation (WMI) provider for IIS or the Export method of the Active Directory Services Interfaces (ADSI) provider for IIS; or a custom application using Admin Base Objects (ABO). IIS Manager includes inherited settings by default. If you are not using IIS Manager, you can specify the inherit flag if you want to include all inherited settings.
  3. Clean up the export file by removing or changing all the machine- and system-specific information, and removing all other settings that you do not want applied to other computers. The cleaned-up export file becomes your import file.
  4. On the new computers, create any physical folders that are needed for site and virtual directory paths, copy any content files (.asp files, ISAPIs, and so on) that need to be ported, and register any components that were copied over.
  5. Import your file on each computer to which you want to apply the settings. Make sure to use the merge flag if you do not want settings in the import file to overwrite any existing settings on the computer. Choose the inherit flag if you used it to create the export file.

Always test your computers after importing metabase elements before relying upon your import file.

Metabase Import/Export Behavior

When using the metabase import/export feature, you need to be aware of the following behaviors with which the feature operates:

  • If you attempt to import a property to a computer whose metabase schema file does not include the property, the import process continues, but errors are logged in the event viewer. If you are using a script or application to perform the import, the script or application issues a warning.
  • If you attempt to import a password that is blank, encrypted properties are subsequently read as plaintext, but stored in the metabase as encrypted. Therefore IIS cannot read them properly.
  • If the key type of any imported metabase element does not match the destination element, an error occurs.
  • If you use a script or application using the inherited option, inherited settings are imported and applied to the parent element. If you do not use the inherited option, only the elements that are explicitly set are imported.
  • If you import configuration data using a script or application and you use the merge flag, existing elements are not overwritten, and new ones are added. If you do not use the merge flag, existing elements are deleted or overwritten.
Related Topics
  • For more information about exporting an IIS configuration, see Exporting IIS Configurations.
  • For more information about importing an IIS configuration, see Importing IIS Configurations
    • .
  • For more information about metabase backup and restore, see Backing Up and Restoring the Metabase
    • .


Machine-Specific and System-Specific Information

When importing a metabase element to another computer, you must change or remove machine-specific and system-specific information in the import file before you use it, otherwise IIS cannot use these values.

Machine-specific and system-specific information is defined as follows: (All properties listed below are defined in the Metabase Property Reference.)

  • Metabase properties that contain paths to resources in the file system might not match the paths on other computers. For example, the following properties might be written in the import file in the following way:
    LogFileDirectory="c:\windows\system32\logfiles"
Path="c:\inetpub\ftproot"
HttpErrors="400,*,FILE,c:\windows\help\iishelp\common\400.htmmore HTTP errors
InProcessIsapiApps="c:\windows\system32\inetsrv\httpext.dllmore ISAPI applications
ScriptMaps=".asp,c:\windows\system32\inetsrv\asp.dll,1,GET,HEAD,POST,TRACE
     more script maps
  • Change the paths in bold above to the path used by the machine to which you want to import the metabase element. Search for other paths in your import file before using it.
  • Metabase properties that specify the IWAM and IUSR accounts may not match the user accounts used by other computers. If your import file contains these properties, delete them so that their values do not overwrite the existing valid properties. These properties might be written in the import file in the following way:
    <IIsWebService  Location="/LM/MSFTPSVC"
     WAMUserName="account_name"
     AnonymousUserName="account_name"
     >
  • The ServerBindings property, which is used to configure the port number for a site, may not be set the same way on another computer. However, you may want to import these settings to the new computer so that the computers will be configured the same way. The ServerBindings property is set at the site level, and can be written in the import file in the following way:
    <IIsFtpServer  Location="/LM/MSFTPSVC/1"
     ServerBindings=":21:"
     >
<IIsWebServer  Location="/LM/W3SVC/1"
     ServerBindings=":80:"
     >
  • Metabase properties that contain access control lists (ACLs) cannot be moved to another computer. If your import file contains these properties, delete them so that their values do not overwrite the existing valid properties. These properties might be written in the import file in the following way:
    AdminACL="long_number"
  • Metabase properties that contain passwords cannot be moved to another computer. If your import file contains properties with passwords, delete them so that their values do not overwrite the existing valid properties. These properties might be written in the import file in the following way:
    <IIsWebService  Location="/LM/W3SVC"
     WAMUserPass="long_number"
     AnonymousUserPass="long_number"
     LogOdbcPassword="long_number"
     >

    • If you use an import file with a blank password property, the new computer subsequently stores encrypted properties as plaintext (human-readable). Never include password properties in import files.

Related Topics
  • For more information about exporting an IIS configuration, see Exporting IIS Configurations.
  • For more information about importing an IIS configuration, see Importing IIS Configurations.
  • For more information about metabase backup and restore, see Backing Up and Restoring the Metabase.


Restoring Sections of the Metabase

You can make fixes to specific sections of the metabase in two ways:

  • You can use the import feature without the merge option to import metabase elements over damaged data.
  • If the damaged section prevents IIS from loading the metabase, you can manually edit the MetaBase.xml file in any text editor by copying sections from an export or backup file and pasting them into the MetaBase.xml file.

You can be prepared to make fixes to the metabase by creating a template of your entire metabase, as well as by creating export files of new sections of your metabase file at various stages of its life, so that you have something to work from if a section becomes corrupted.

To create a template of your entire metabase, first create a backup file. Remove any machine-specific and system-specific information from your backup file, and then remove extraneous information and configuration information that is specific to applications, sites, and virtual directories.

What you are left with is a template of top-level configuration information that might not be recoverable using metabase import/export. Together with the export files of specific sections that you created, you are prepared for any loss of data or corruption.

Related Topics
  • For information on creating backup files, see Restoring the Metabase from Backup Files.
  • For information on removing machine-specific and system-specific information from a backup file, see Machine-Specific and System-Specific Information.


Metabase Changes for IIS 6.0

This section provides information about changes to the metabase properties for Internet Information Services (IIS) 6.0 and includes the following topics:

  • Metabase Properties Removed from IIS 6.0: Lists properties that were supported in previous versions but that are not valid for IIS 6.0.
  • Metabase Properties Added to IIS 6.0: Provides a list of properties that are new to IIS 6.0 and links to each property's reference.


Metabase Properties Removed from IIS 6.0

The following IIS 5.0 metabase properties have been removed from the IIS 6.0 metabase.

AspThreadGateEnabled | AspThreadGateLoadHigh
AspThreadGateLoadLow | AspThreadGateSleepDelay
AspThreadGateSleepMax | AspThreadGateTimeSlice
CPUAppEnabled | CPUCGIEnabled
CPUCGILimit | CPUEnableActiveProcs
CPUEnableAllProcLogging | CPUEnableAppLogging
CPUEnableCGILogging | CPUEnableEvent
CPUEnableKernelTime | CPUEnablePageFaults
CPUEnableProcType | CPUEnableTerminatedProcs
CPUEnableTotalProcs | CPUEnableUserTime
CPULimitLogEvent | CPULimitPause
CPULimitPriority | CPULimitProcStop
CPULimitsEnabled | CPULoggingInterval
CPULoggingMask | CPULoggingOptions
CPUResetInterval | HcCacheControlHeader
HcCompressionBufferSize | HcCompressionDirectory
HcCompressionDll | HcCreateFlags
HcDoDiskSpaceLimiting | HcDoDynamicCompression
HcDoOnDemandCompression | HcDoStaticCompression
HcDynamicCompressionLevel | HcExpiresHeader
HcFileExtensions | HcFilesDeletedPerDiskFree
HcIoBufferSize | HcMaxDiskSpaceUsage
HcMaxQueueLength | HcMimeType
HcMinFileSizeForComp | HcNoCompressionForHttp10
HcNoCompressionForProxies | HcNoCompressionForRange
HcOnDemandCompLevel | HcPriority
HcSendCacheHeaders | PutReadSize
UNCAuthenticationPassthrough |


Metabase Properties Added to IIS 6.0

The following are new metabase properties introduced in IIS 6.0, or pre-existing properties whose behavior has changed since IIS 5.0.

AspRunOnEndAnonymously | ADConnectionsPassword
ADConnectionsUserName | AddNoHeaders
AppPoolAutoStart | AppPoolAutoStart
AppPoolCommand | AppPoolId
AppPoolIdentityType | AppPoolQueueLength
AppPoolState | AspAppServiceFlags
AspBufferingLimit | AspBufferingLimit
AspCalcLineNumber | AspDiskTemplateCacheDirectory
AspExecuteInMTA | AspKeepSessionIDSecure
AspLCID | AspMaxDiskTemplateCacheFiles
AspMaxRequestEntityAllowed | AspPartitionID
AspSxsName | BannerMessage
ConnectResponse | CPUAction
CPULimit | CPUResetInterval
DemandStartThreshold | DisallowOverlappingRotation
DisallowRotationOnConfigChange | EtrnSubdomains
FeedAccountName | FeedFeedpairId
FilterEnableCache | FtpLogInUtf8
HcDoDynamicCompression | HcDoStaticCompression
HttpRedirect | IdleTimeout
LoadBalancerCapabilities | LogCustomPropertyNodeID
MaxDirChangeIOSize | MaxErrorFiles
MaxMailObjects | MaxProcesses
MaxSmtpErrors | MinFileBytesPerSec
NameResolutionType | NntpClearTextProvider
OrphanActionExe | OrphanActionParams
OrphanWorkerProcess | PeriodicRestartMemory
PeriodicRestartRequests | PeriodicRestartSchedule
PeriodicRestartTime | PingingEnabled
PingInterval | PingResponseTime
RapidFailProtection | RapidFailProtectionInterval
RapidFailProtectionMaxCrashes | ShouldPickupMail
ShouldPipelineIn | ShouldPipelineOut
ShutdownTimeLimit | SMPAffinitized
SMPProcessorAffinityMask | SmtpAqueueWait
SmtpDisableRelay | SmtpDomainValidationFlags
SmtpEventlogLevel | SmtpHeloNoDomain
SmtpMailNoHelo | SmtpMaxRemoteQThreads
SmtpSSLCertHostnameValidation | SmtpSSLRequireTrustedCA
SmtpUseTcpDns | StartupTimeLimit
UpdatedDefaultDomain | UpdatedFQDN
UserIsolationMode | VrDriverClsid


Web Site Administration

Whether your site is on an intranet or the Internet, the principles of providing content are the same. You place your Web files in directories on your server so that users can establish an HTTP connection and view your files with a Web browser. But beyond simply storing files on your server, you must manage how your site is deployed, and more importantly, how your site evolves. Today, an engaging Web site is seldomly a static collection of pages. Most successful Web administrators are kept busy accommodating ever-changing Web content.

In this section, you learn the basics of managing a Web site's infrastructure, from redirecting requests to hosting multiple sites.

This section includes the following information:

  • About Web Site Administration: Introduces the process of organizing and managing Web sites.
  • Naming Web Sites: Describes naming and assigning a host header name to a Web site.
  • Starting and Stopping Web Sites: Describes the processes of starting and stopping Web sites.
  • Working with MIME Types: Describes configuring IIS to serve new file types.
  • Changing Default Web Site Settings: Describes changing default Web site settings and how settings are hierachically inherited.
  • Using Content Expiration: Describes removing or replacing content based on expiration rules.
  • Using Content Ratings: Describes methods for making sure your content is rated for appropriateness to different audiences.
  • Using Server-Side Include Directives: Describes methods for instructing a Web server to insert various types of content into a Web page.
  • Redirecting Requests to Files, Directories, or Programs: Describes forwarding page requests to a different server.
  • Hosting Multiple Web Sites on a Single Server: Describes methods for hosting more than one Web site from a single server.
Related Topics
  • For the fundamentals of creating server-side scripts with ASP, see ASP.


About Web Site Administration

Suppose you just deployed an expensive, new Web site only to discover that a company logo was omitted from all of the site's pages. Or, imagine that you are suddenly asked to route thousands of users to alternate Web sites while technicians scramble to troubleshoot a malfunctioning computer. Such issues only begin to hint at the day-to-day challenges of successfully managing a Web site. And although effective Web site management ultimately depends on an administrator's skill, there are a number of basic tools and procedures that you can use to deal with the most common management tasks and emergencies.

Getting Started

To begin with, you should set up your Web sites by indicating which directories contain the documents that you want to publish. The Web server cannot publish documents that are not within these specified directories. So, the first step in deploying a Web site should be to first determine how you want your files organized. You then use IIS Manager to identify which directories are part of the site.

If you want to get started right away without having to create a special directory structure and your files are all located on the same hard disk of the computer running Internet Information Services (IIS), you can publish your documents immediately by copying your Web files into the default home directory, LocalDrive:\Inetpub\Wwwroot. (For an FTP site, copy your files into LocalDrive:\Inetpub\Ftproot.) Intranet users then can access these files with the following URL: http://servername/filename. To learn how to host multiple sites and organize disparate Web content, see the procedures in this section. They explain such things as how to change the default location of your files and how to add directories that are located on other hard disks or on computers across the network.

Home Directories

Each Web or FTP site must have one home directory. The home directory is the central location for your published pages. It contains a home page or index file that welcomes visitors and contains links to other pages in your site. The home directory is mapped to your site's domain name or to your server name. For example, if your site's Internet domain name is www.microsoft.com and your home directory is C:\Website\Microsoft, then browsers use the URL http://www.microsoft.com to access files in your home directory. On an intranet, if your server name is AcctServer, then browsers use the URL http://acctserver to access files in your home directory.

A default home directory is created when you install IIS, and when you create a new Web site. For instructions to change the home directory, see Setting Home Directories.

Virtual Directories

To publish from any directory not contained within your home directory, you must create a virtual directory. A virtual directory is a directory that is not contained in the home directory but appears to client browsers as though it were.

A virtual directory has an alias, or a name that Web browsers use to access that directory. Because an alias is usually shorter than the path name of the directory, it is more convenient for users to type. An alias is more secure because users do not know where your files are physically located on the server and cannot use that information to modify your files. Aliases make it easier for you to move directories in your site. Rather than changing the URL for the directory, you change the mapping between the alias and the physical location of the directory.

For example, suppose you are setting up a Web site for your marketing team on your company's intranet. The following table shows the mapping between the physical location of the files and the URL that accesses the files.

Physical Location | Alias | URL
C:\Inetpub\Wwwroot | home directory (none) | http://SampleWebSite
\\Server2\SalesData | Customers | http://SampleWebSite/Customers
D:\Inetpub\Wwwroot\Quotes | None | http://SampleWebSite/Quotes
D:\Inetpub\Wwwroot\OrderStatus | None | http://SampleWebSite/OrderStatus
D:\Marketing\PublicRel | PR | http://SampleWebSite/PR

Both virtual directories and physical directories (directories without an alias) appear in IIS Manager. A virtual directory is indicated by a wheel icon. The following illustration shows the Web site example described above, where /Customers and /PR are virtual directories.

Example Web site as it would appear in IIS Manager with virtual directories marked by a gear icon.

For a simple Web site, you might not need to add virtual directories. You can simply place all of your files in the site's home directory. If you have a complex site or want to specify different URLs for different parts of your site, you can add virtual directories as needed.

Reroute Requests with Redirects

When a browser requests a page on your Web site, the Web server locates the page identified by the URL and returns it to the browser. When you move a page on your Web site, you can't always correct all of the links that refer to the old URL of the page. To make sure that browsers can find the page at the new URL, you instruct the Web server to give the browser the new URL. The browser uses the new URL to request the page again. This process is called "redirecting a browser request" or "redirecting to another URL." Redirecting a request for a page is similar to using a forwarding address with a postal service. The forwarding address ensures that letters and packages addressed to your original residence are delivered to your new residence.

Redirecting a URL is useful when you are updating your Web site and want to make a portion of the site temporarily unavailable, or when you have changed the name of a virtual directory and want links to files in the original virtual directory to access the same files in the new virtual directory.

Server-Side Includes

Often, it can be useful to dynamically alter Web content after the content has been requested, but before it gets returned to the browser. IIS includes a feature called server-side includes that provides this functionality.

Using server-side includes (SSI), you can carry out a number of of Web site management activities from adding dynamic time stamps to running a special shell command each time a file is requested. SSI commands, called directives, are added to Web pages at design time. When a page is requested, the Web server parses out all the directives it finds in a Web page and then executes them. A commonly used SSI directive inserts, or includes, the contents of a file into a Web page. For example, if you are required to continually update a Web page advertisement, you could use SSI to include the advertisement's HTML source in the Web page. To update the advertisement, you need only modify the file containing the advertisement's HTML source. You do not have to know a scripting language to use SSI; simply follow the correct directive syntax.

ASP and ASP .NET

ASP is a server-side scripting environment that you can use to create dynamic and interactive Web pages, and build powerful Web applications. When the application server receives a request for an ASP file, it processes server-side script code contained in the file to build the HTML Web page that is sent to the browser. In addition to server-side script code, ASP files can contain HTML (including related client-side scripts) as well as calls to COM components that perform a variety of tasks, such as connecting to a database or processing business logic. ASP requires you to use a scripting language, such as VBScript or JScript.

ASP .NET is the next generation of the Microsoft server-side scripting environment. It provides a new programming model and infrastructure, enabling Web developers to build and deploy enterprise-class Web applications that are more secure, scalable, and stable than ever before.

Related Topics
  • For information on using virtual directories with Web sites, see Using Virtual Directories.
  • For information on using virtual directories with an FTP site, see Using Virtual Directories with FTP Sites.
  • For more information on redirecting URLs, see Redirecting Requests to Files, Directories, or Programs.
  • For more detailed procedural and reference information on server-side includes, see Using Server-Side Include Directives.
  • For information on using ASP to Manage Web Site Content, see ASP or search for "asp" on the Microsoft Developer Network (MSDN) Web site.
  • For information on ASP .NET to Manage Web Site Content, see ASP.NET or search "asp .net" on the Microsoft Developer Network (MSDN) Web site.


Naming Web Sites

A server running IIS can host multiple Web sites. Each Web site is said to be running on a virtual server. Each virtual Web site has a descriptive name and can support one or more host header names. Host header names make it possible to host multiple domain names on one computer.

important Important You must be a member of the Administrators group on the local computer to perform the following procedure (or procedures), or you must have been delegated the appropriate authority. As a security best practice, log on to your computer using an account that is not in the Administrators group, and then use the Run as command to run IIS Manager as an administrator. From the command prompt, type runas /user:administrative_accountname "mmc %systemroot%\system32\inetsrv\iis.msc".

To name a Web site

  1. In IIS Manager, expand the local computer, right-click the Web site, and click Properties.
  2. On the Web Site tab, in the Description box, type a descriptive name for the site.
  3. Click OK.

To assign a host header name to a Web Site

  1. Ask your system administrator to add the new site name mapping for your static IP address to your name resolution system (typically DNS).
  2. In IIS Manager, right-click the Web site to which you which you want to assign a host header name, and click Properties.
  3. On the Web Site tab, click Advanced.
  4. Click Add to assign a host header name, IP address, and port for the Web site.
  5. Click OK twice.

    6. note Note Host headers do not function when you use Secure Sockets Layer (SSL) because host headers are included in the encrypted client request. However, you can have multiple server certificates, multiple IP addresses, and multiple SSL ports per server.

Related Topics
  • For more information on the use of host header names, see Hosting Multiple Web Sites on a Single Server.
  • For instructions on how to add new sites, see Adding Web Sites to Your Server.


Starting and Stopping Web Sites

By default, sites start automatically when your computer starts. Stopping a site does not interfere with other Internet services that are running. Pausing a site prevents the site from accepting new connections but does not affect requests that are already being processed. Starting a site resumes Internet services for the site.

You can start, stop, or pause a Web site using either IIS Manager or a command-line administration script. Both methods are detailed below.

important Important You must be a member of the Administrators group on the local computer to perform the following procedure (or procedures), or you must have been delegated the appropriate authority. As a security best practice, log on to your computer using an account that is not in the Administrators group, and then use the Run as command to run IIS Manager as an administrator. From the command prompt, type runas /user:administrative_accountname "mmc %systemroot%\system32\inetsrv\iis.msc".

To start, stop, or pause a Web site using IIS Manager

  • In IIS Manager, right-click the site you want to start, stop, or pause; and click Start, Stop, or Pause.

note Note If a site stops unexpectedly, IIS Manager might not correctly indicate the state of the site. In IIS, right-click the Web Sites folder and click Refresh to see the current state of all Web sites.

To start, stop, or pause a Web site using a command-line administration script

  1. From the Start menu, click Run.
  2. In the Open box, type cmd, and click OK.
  3. At the command prompt, type cscript iisweb.vbs /action "WebSiteName" and press ENTER. Substitute start, stop, or pause for action. Substitute your actual Web site name (for example "Default Web Site") for WebSiteName.
Related Topics
  • For information on restarting all of your Internet services, see Restarting IIS.
  • To quickly establish a site that uses the default settings, see Site Setup.
  • To change properties on existing Web sites, see Changing Default Web Site Settings Web site.
  • To add multiple sites, see Hosting Multiple Web Sites on a Single Server.
  • To perform common tasks from command-line scripts, see Using Command-Line Administration Scripts.


Working with MIME Types

Multipurpose Internet Mail Exchange (MIME) types instruct a Web browser or mail application how to handle files received from a server. For example, when a Web browser requests an item on a server, it also requests the MIME type of the object. Some MIME types, like graphics, can be displayed inside the browser. Others, such as word processing documents, require an external helper application to be displayed.

When IIS delivers a mail message to a mail application, or a Web page to a client Web browser, it also sends the MIME type of the data it is sending. If there is an attached or embedded file in a specific format, IIS also tells the client application the MIME type of the embedded or attached file. The client application then knows how to process or display the data being received from IIS.

IIS serves only files with extensions registered in the MIME types list, and also allows you to configure additional MIME types and change or remove MIME types.

IIS is preconfigured to recognize a default set of global MIME types. These MIME types are recognized by all Web sites you create in IIS. MIME types can also be defined at the Web site and directory levels, independent of one another or the types defined globally. When you view MIME types at the Web site or directory level, only the types unique to that level are displayed, not all types inherited from the next level up. If you apply a MIME type at the global level after modifying the same MIME type at a lower level, the global-level MIME type overrides the modified MIME type at the lower level.

IIS returns a 404.3 error if a client request refers to a file name extension that is not defined in the MIME types. You can configure IIS to serve all files regardless of file name extension by adding a wildcard character (*) MIME type.

important Important You must be a member of the Administrators group on the local computer to perform the following procedure (or procedures), or you must have been delegated the appropriate authority. As a security best practice, log on to your computer using an account that is not in the Administrators group, and then use the Run as command to run IIS Manager as an administrator. From the command prompt, type runas /user:administrative_accountname "mmc %systemroot%\system32\inetsrv\iis.msc".

To add a global MIME type

  1. In IIS Manager, expand the local computer, right-click the computer on which you want to add a MIME type, and click Properties.
  2. Click the MIME Types tab.
  3. Click New.
  4. In the Extension box, type the file name extension.
  5. In the MIME type box, type a description that exactly matches the file type defined on the client computer.

    6. note Note You can also create a MIME type for files without an extension or undefined MIME types. To do this, type an asterisk (*) in the Extension box, and type application/octet-stream in the MIME type box.

  6. Click OK.

To add a MIME type to a Web site or directory

  1. In IIS Manager, right-click the Web site or Web site directory for which you want to add a MIME type, and click Properties.
  2. Click the HTTP Headers tab.
  3. Click Mime Types.
  4. Click New.
  5. In the Extension box, type the file name extension.
  6. In the MIME type box, type a description that exactly matches the file type defined on the client computer. If you define a MIME type that has already been defined at a higher level, you are prompted to select the level where the MIME type should reside.
  7. Click OK.

The following illustration shows the relationship between a MIME type defined in IIS and a file type defined on a client computer.

Relationship between a MIME type defined in IIS and a file type defined on a client system

To remove a MIME type from a Web site or directory

  1. In IIS Manager, right-click the Web site or Web site directory from which you want to remove a MIME type, and click Properties.
  2. Click theHTTP Headers tab.
  3. Click Mime Types.
  4. From the Registered MIME types list, click the MIME type you want to remove, and then click Remove.
  5. Click OK.


Changing Default Web Site Settings

During IIS installation, default values are set for the various properties assigned to Web sites. Properties can be set at the global level, affecting all Web sites on a server, on the individual site level, at the directory level, or at the file level. IIS uses an inheritance model, which means that settings on higher levels are automatically inherited by lower levels. Settings at lower levels can be edited individually to override inherited settings from the next level up.

If you change a setting at a lower level, then later change a setting at a higher level that conflicts with the lower level setting, you will be prompted to choose whether you want to change the lower-level setting to match the new higher-level setting.

important Important You must be a member of the Administrators group on the local computer to perform the following procedure (or procedures), or you must have been delegated the appropriate authority. As a security best practice, log on to your computer using an account that is not in the Administrators group, and then use the Run as command to run IIS Manager as an administrator. From the command prompt, type runas /user:administrative_accountname "mmc %systemroot%\system32\inetsrv\iis.msc".

To set master properties for all sites assigned to a computer

  1. In IIS Manager, expand the local computer, right-click the Web Sites folder, and click Properties.
  2. Click Help on any of the tabs for more information on those settings.

To set properties for a single Web site

  1. In IIS Manager, right-click the Web site whose settings you want to change, and click Properties.
  2. Click Help on any of the tabs for more information on those settings.


Using Content Expiration

If you have time-sensitive information on your Web site, you can configure settings that will ensure that obsolete information isn't cached by proxies or Web browsers. You can configure Web site content to automatically expire at any time. When content expiration is enabled, the Web browser compares the current date to the expiration date to determine whether to display a cached page or request an updated page from the server. Server-side technology, such as Microsoft ASP.NET can be used to dynamically change the content served. Typically, time-sensitive information is limited to individual files, directories, or Web sites; however, you can also set content expiration for all Web sites on a computer.

important Important You must be a member of the Administrators group on the local computer to perform the following procedure (or procedures), or you must have been delegated the appropriate authority. As a security best practice, log on to your computer using an account that is not in the Administrators group, and then use the Run as command to run IIS Manager as an administrator. From the command prompt, type runas /user:administrative_accountname "mmc %systemroot%\system32\inetsrv\iis.msc".

To set the expiration of Web site content

  1. In IIS Manager, expand the local computer; right-click the Web site, virtual directory, directory, or file on which you want to set content expiration; and click Properties.
  2. Click the HTTP Headers tab.
  3. Select the Enable content expiration check box.
  4. Click Expire immediately, Expire after, or Expire on, and type the appropriate expiration information in the corresponding boxes.
  5. Click OK.
Related Topics
  • For more information on Web site settings, see Changing Default Web Site Settings.


Using Content Ratings

You can configure your Web server's content rating features to embed descriptive labels in HTTP headers of your Web page. Some Web browsers, such as Microsoft Internet Explorer 3.0 or later, can detect these content labels and help users to identify potentially objectionable Web content. Your Web server's default Platform for Internet Content Selection (PICS)-based rating system uses a system developed by the Internet Content Rating Association (ICRA), which rates content according to levels of violence, nudity, sexual content, and offensive language. Before setting your Web content ratings, you should complete a ICRA questionnaire to obtain the recommended content ratings for your particular Web content.

If you are running a publicly viewable Web site, it is good practice to have the content rated. Doing so does not automatically make your site unavailable to users because the users must also enable content ratings and set content thresholds on their client computer for the rating information to have any effect on their browsing experience.

important Important You must be a member of the Administrators group on the local computer to perform the following procedure (or procedures), or you must have been delegated the appropriate authority. As a security best practice, log on to your computer using an account that is not in the Administrators group, and then use the Run as command to run IIS Manager as an administrator. From the command prompt, type runas /user:administrative_accountname "mmc %systemroot%\system32\inetsrv\iis.msc".

To set content ratings

  1. In IIS Manager, expand the local computer; right-click a Web site, directory, or file; and click Properties.
  2. Click the HTTP Headers tab.
  3. In the Content rating section, click Edit Ratings.
  4. Click the Ratings tab and select the Enable ratings for this content check box.
  5. In the Category list, click a ratings category. Drag or click the rating slider to set the level of potentially objectionable material for the category. Each setting displays a description of the rating level.
  6. Under E-mail address of person rating this content, type the e-mail address of the person who rated the content.
  7. Click the arrow next to the Expire on box and click a ratings expiration date from the calendar.
  8. Click OK.


Using Server-Side Include Directives

Server-side include (SSI) directives instruct the Web server to insert various types of content into a Web page. These types of content can include the value of a server variable (sometimes called a CGI variable), the output of a shell command, a modification date and/or size of a file, or the contents of another file (when the #include statement is used). Directives can also include a string of SSI errors.

You can use SSI directives to instruct the Web server to include text, graphics, or application output into a Web page just before sending that information to the browser. You can use SSI to include, for example, a time/date stamp, a copyright notice, or a form for a customer to fill out and return. Including a file is an easy way to incorporate text or links to graphics that are repeated in many files. SSI provides special preprocessing directives that help you access information about a file or display the value of a server variable. SSI also provides a directive that you can use to insert the output from an application or a shell command into a Web page. Rather than adding the content or output to every file, you can save the content into an include file. The include files are called through a simple statement that instructs the Web server to insert the content or output into the applicable Web pages.

IIS processes SSI directives while it processes the Web page. When the Web server reaches an SSI directive, it inserts the contents of the include file, or the output of the application directly into the Web page. If the include file contains an SSI directive, that file or output is also inserted. In addition to the basic directive used to include a file, you can use SSI directives to insert information about a file (such as its size) or to run an application or a shell command.

By default, IIS is set to process server-side include files with the file name extensions .stm, .shtm, or .shtml, although you can configure other file name extensions to be processed as well. IIS also looks for and processes the #include directive in files with the .asp file name extension. Ensure that all files containing SSI directives have a defined SSI file name extension. Furthermore, SSI directives, as well as other script maps, work in any file whose file name extension is mapped to the ssinc.dll. If, for some reason, the extensions were deleted from the applications mappings list, use the procedure below to add the SSI file name extensions to the list.

Also be sure to put SSI files into a directory with Scripts or Execute access permissions. You should limit user access to this directory to avoid attacks by malicious users. For more information, see Access Control and Setting NTFS Permissions for Directories or Files.

important Important You must be a member of the Administrators group on the local computer to perform the following procedure (or procedures), or you must have been delegated the appropriate authority. As a security best practice, log on to your computer using an account that is not in the Administrators group, and then use the Run as command to run IIS Manager as an administrator. From the command prompt, type runas /user:administrative_accountname "mmc %systemroot%\system32\inetsrv\iis.msc".

To enable server-side includes

  1. In IIS Manager, expand the local computer, right-click the Web Sites folder (to enable SSI on all Web sites) or right-click a specific Web site, and click Properties.
  2. Click the Home Directory tab.
  3. In the Application settings section, click Configuration.
  4. On the Mappings tab, click Add.
  5. In the Add/Edit Application Extension Mapping dialog box, enter all of the required information.
  6. Click OK.

To disable server-side includes on your IIS Web server, you must remove SSI extensions from the application mappings list. If your Web server receives a request for a page and the SSI extension has been removed, IIS will not process the SSI directive within the page. You can disable the processing of server-side include directives on all Web sites or on a specific Web site.

To disable server-side includes

  1. In IIS Manager, expand the local computer, right-click the Web Sites folder (to disable SSI on all Web sites) or right-click a specific Web site, and click Properties.
  2. Click the Home Directory tab.
  3. In the Application settings section, click Configuration.
  4. On the Mappings tab, scroll down in the Application Mappings list, click the SSI extension you wish to disable, and then click Remove.
  5. Click OK.
Related Topics
  • For information on enabling the execution of shell commands, see the SSIEnableCmdDirective section in WWW Service Registry Entries.
  • For specific programmatic information on implementing server-side include directives, search for "ssi" on the Microsoft Developer Network (MSDN) Web site.


Redirecting Requests to Files, Directories, or Programs

You can redirect requests for files in one directory to a different directory, to a different Web site, or to a file in a different directory. When the browser requests the file from the original URL, the Web server instructs the browser to request the page from the redirected URL.

An advanced capability of the redirect method allows you to redirect all requests for files in a particular directory to a program. Generally speaking, you should also pass any parameters from the original URL to the program, which you can do by using redirect variables.

important Important You must be a member of the Administrators group on the local computer to perform the following procedure (or procedures), or you must have been delegated the appropriate authority. As a security best practice, log on to your computer using an account that is not in the Administrators group, and then use the Run as command to run IIS Manager as an administrator. From the command prompt, type runas /user:administrative_accountname "mmc %systemroot%\system32\inetsrv\iis.msc".

To redirect requests to another directory or Web site

  1. In IIS Manager, expand the local computer, right-click the Web site, virtual directory, or directory within a Web site to which you want to add a redirect, and click Properties.
  2. Click the Home Directory, Virtual Directory, or Directory tab.
  3. Under The content for this resource should come from, click A redirection to a URL.
  4. In the Redirect to box, type the path to the destination directory or the URL of the Web site. For example, to redirect all requests for files in the /Catalog directory to the /NewCatalog directory on another Web site, type http://sitename/NewCatalog. The redirect must be to a fully qualified URL.
  5. Click OK.

To redirect all requests to a single file

  1. In IIS Manager, right-click the Web site or directory, and click Properties.
  2. Click the Home Directory, Virtual Directory, or Directory tab.
  3. Under The content for this resource should come from, click A redirection to a URL.
  4. In the Redirect to box, type the URL of the destination file. The redirect must be to a fully qualified URL.
  5. Under The client will be sent to, select The exact URL entered above check box to prevent the Web server from appending the original file name to the destination URL.
  6. Click OK.

You can use wildcards and redirect variables in the destination URL to precisely control how the original URL is translated into the destination URL.

To redirect requests to a program

  1. In IIS Manager, right-click the Web site or directory, and click Properties.
  2. Click the Home Directory, Virtual Directory, or Directory tab.
  3. Under The content for this resource should come from, click A redirection to a URL.
  4. In the Redirect to box, type the URL of the program, including any redirect variables needed to pass parameters to the program.
    For example, to redirect all requests for scripts in a Scripts directory to a logging program that records the requested URL and any parameters passed with the URL, type /Scripts/Logger.exe?URL=$V+PARAMS=$P. $V and $P are redirect variables.
  5. Under The client will be sent to, select The exact URL entered above check box to prevent the Web server from appending the original file name to the destination URL.
  6. Click OK.
Related Topics
  • For more information on redirect variables, see the Redirect Reference.


Hosting Multiple Web Sites on a Single Server

IIS supports multiple Web sites on a single server. For example, rather than using three different servers to host www.microsoft.com, mspress.microsoft.com, and support.microsoft.com, you can install all three Web sites on the same server. Consolidating Web sites saves hardware resources, conserves space, and reduces energy costs.

To ensure user requests reach the correct Web site, you must configure a unique identity for each site on the server. To do so, you must distinguish each Web site with at least one of three unique identifiers: a host header name, an IP address, or a unique TCP port number.

Web sites hosted on the same server can be distinguished using the following unique identifiers.

Web Site Identifier | Uses
Host header name | Recommended for most situations.
Unique IP Address | Used primarily for Internet services that host Secure Sockets Layer (SSL) on the local server.
Nonstandard TCP port number | Generally not recommended. Can be used for private Web site development and testing purposes but rarely used on production Web servers.

By changing one of these three identifiers, you can create unique identities for multiple Web sites without installing a dedicated server for each site. You can also create a unique home directory for each site and store the content on the local server or on remote network shares. Thus, each Web site acts as a separate entity, or virtual server.

note Note Standardize on one method of uniquely identifying Web sites per server, preferably using host header names. Using one method per server improves performance by optimizing cache and routing lookups. Conversely, using any combination of host headers, unique IP addresses, or non standard port numbers to identify multiple Web sites on the same server degrades the performance of all Web sites on the server.

This section includes the following information:

  • Adding Web Sites to Your Server: Provides instructions to prepare the server and create a unique identity for the site.
  • Creating Multiple Sites Using Multiple IP Addresses: Provides instructions to configure IIS to assign a unique IP address to each Web site.
  • Creating Multiple Sites Using Host Header Names: Describes the advantages and disadvantages of using host headers to distinguish multiple sites.
  • Creating Multiple Sites Using Ports: Describes how to use nonstandard TCP port numbers to create unique Web site identifiers for site development and testing purposes.
Related Topics
  • For information about configuring Web site properties, see Changing Default Web Site Settings Web site.


Adding Web Sites to Your Server

IIS enables you to create multiple Web sites on a single server. To add a site to a server, you must prepare the server and associated network services, and create a unique identity for the site.

Preparing to Add a Web Site

Adding a Web site to a server that is already hosting a Web site requires some preparation before you run the Web Site Creation Wizard. Consider the following recommendations in your preparation process:

  • Carefully review the methods of hosting multiple Web sites to determine which method of creating unique Web site identities is appropriate for your environment.
  • Multiple Web sites can use the same IP address. If you use a unique IP address to identify a new Web site, however, you must obtain a static IP address from your organization or ISP and configure the TCP/IP settings on the server.
  • If you use host header names to identify a new Web site, select a unique name. On a private network, the host header can be an intranet site name. On the Internet, the host header must be a publicly available Domain Name System (DNS) name, such as support.microsoft.com. Register the public DNS name with an authorized Internet name authority.
  • Update your name resolution system (typically DNS) with a new record that contains the new IP address and name of the site. For more information, see Domain Name Resolution.
  • Standard Internet services use TCP port 80 by default and it is generally not recommended to use any other port for HTTP services. However, if you use a non-standard TCP port number to identify a new Web site for special situations (typically used on private Web sites for development and testing purposes), select a TCP port number above 1023 so it does not conflict with well-known port numbers assigned by the Internet Assigned Numbers Authority.
  • Use Windows Explorer to create a home directory for the Web site content. Create subdirectories to store HTML pages, image files, and other content as needed. To organize home directories for multiple Web sites on the same server, you can create a top-level directory for storing all home directories, and then create subdirectories for each site. You can create a home directory on the local server, as a uniform naming convention (UNC) path on a network share, or as a URL that redirects clients to a different Web server. You can also create virtual directories that map to the physical directories. For more information, see Setting Home Directories and Using Virtual Directories
  • Determine whether to generate the Web site identification number incrementally, or from the Web site name. When you create a new site on IIS 6.0, a Web site identification number is randomly generated using the name of the Web site. With IIS 5.1 and previous versions, site identification numbers were generated incrementally. For example, because the default Web site is created first, its Web site identification number is 1; and the next site created is identified as 2. For more information, see DisableLazyContentPropagation in Global Registry Entries.
  • Create a home page that clearly identifies the new Web site.

Adding a Web Site

IIS provides the following two methods for adding a new Web site:
  • The Web Site Creation Wizard
  • The iisweb.vbs command-line script

important Important You must be a member of the Administrators group on the local computer to perform the following procedure (or procedures), or you must have been delegated the appropriate authority. As a security best practice, log on to your computer using an account that is not in the Administrators group, and then use the Run as command to run IIS Manager as an administrator. From the command prompt, type runas /user:administrative_accountname "mmc %systemroot%\system32\inetsrv\iis.msc".

To add a Web site with the Web Site Creation Wizard

  1. In IIS Manager, expand the local computer, right-click the Web Sites directory, point to New, and click Web Site.
  2. Click Next.
  3. In the Description box, type the name you have selected for the Web site, and click Next.
  4. In the Enter the IP address to use for this Web site box, click All Unassigned to allow HTTP to respond to all unassigned IP addresses on the server, or click a specific IP address for the site.

    note Note In the Web Site Creation Wizard, All Unassigned refers to IP addresses that are assigned to a computer but not assigned to a specific site. The default Web site uses all of the IP addresses that are not assigned to other sites. Only one site can be set to use unassigned IP addresses for a given port number. For more information on how sites are identified, see Creating Multiple FTP Sites.

  5. The TCP port is assigned to port 80 by default. To use a nonstandard port number to create a unique identity for a private Web site, in the TCP port this Web site should use box, type a new port number above 1023.
  6. In the Host Header for this Web site (Default:None) box, type the host header name to identify a Web site. If you are adding additional sites to a single IP address by using host headers, you must assign a host header name containing the full name of the site, for example, www.microsoft.com.
  7. If SSL encryption is not enabled on the server, the SSL port box does not appear. If SSL encryption is enabled on the server, type the SSL port number, and then click Next.
  8. In the Path box, type or browse to the path of your Web site home directory.
  9. Web sites are configured for anonymous access by default. To create a secure or private Web site, clear the Allow anonymous access to this Web site check box, and click Next.
  10. In the Web Site Access Permissions dialog box, select the permissions for the home directory. Click Next, and then click Finish.

To add a Web site with the iisweb.vbs command-line script

  1. If the new Web site will be in a new directory, create the new directory.
  2. From the Start menu, and click Run.
  3. In the Open box, type cmd, and click OK.
  4. From the command prompt, switch to the systemroot\system32 directory.
  5. Type cscript iisweb.vbs /create Home Directory
    Site Description" /i IP Address /b Port     and press ENTER.
    For example, the following command creates and starts a Web site called MyWebSite on port 80 at IP address 123.456.789 with c:\inetpub\wwwroot\newdirectory as its home directory.
    cscript iisweb.vbs /create c:\inetpub\wwwroot\newdirectory "MyWebSite" /i 123.456.789 /b 80.

    6. note Note The iisweb.vbs script supports many more options for creating a Web site. To see the options available, search for "iisweb.vbs" in Windows Help.

Related Topics
  • To change properties on existing Web or FTP sites, see Changing Default Web Site Settings.
  • To add virtual directories, see Using Virtual Directories.
  • To perform common tasks from command-line scripts, see Using Command-Line Administration Scripts.


Creating Multiple Sites Using Multiple IP Addresses

Some secure server configurations require the use of unique IP addresses to distinguish multiple Web sites on the same server.

IIS enables you to configure Web sites to listen on all available IP addresses, or on an individual IP address. If you use multiple IP addresses to distinguish between different sites on the same server, you must configure IIS to assign each site a unique IP address.

The following table summarizes the advantages and disadvantages of using IP addresses to distinguish multiple Web sites.

Advantages | Disadvantages
Can host secure HTTPS services on the same server. | Requires a unique, static IP address for each site. Because public IP addresses are in short supply, it can be difficult to obtain a large number of static IP addresses.
 | Can degrade performance compared to using host headers only. The World Wide Web Publishing Service (WWW service) must manage an endpoint for every site identified by a unique IP address, and thus consumes memory from the non-page pool.

Because assigning a large number of unique IP address to multiple Web sites on the same server can degrade performance, this method is used primarily to identify multiple sites on servers that host Secure Sockets Layer (SSL) or Transport Layer Security (TLS) services.

important Important Because Secure Hypertext Transfer Protocol (HTTPS) over TLS and SSL encrypts host header names, host header information is inaccessible to Web sites hosted on the same server with SSL or TLS services. To overcome this limitation, you can use host headers to uniquely identify standard HTTP services on one server, and use unique IP addresses to identify secure HTTPS services on a separate server. Using host headers on the standard HTTP server preserves IP addresses and optimizes Web site performance if encrypting information is not an issue. Redirecting requests for secure Internet services to an HTTPS site on a separate server is transparent to the user and avoids the performance degradation that would result from mixing host header identifiers with unique IP address identifiers on the same server.

Using a combination of host headers and unique IP addresses to identify multiple Web sites on the same server decreases the performance of cache lookups and routing lookups. To optimize performance, standardize on one method per server, preferably using host headers for standard HTTP Web sites.


Creating Multiple Sites Using Host Header Names

Every Web site has a descriptive name, and can support one or more host header names. Organizations that host multiple Web sites on a single server often use host headers because this method enables them to create multiple Web site identities without using a unique IP address for each site.

Because the World Wide Web Publishing Service (WWW service) must allocate non-page pool memory to manage an endpoint for every IP address, an advantage to using host headers is that you avoid the potential performance degradation associated with identifying multiple Web sites with unique IP addresses.

When a client request reaches the server, IIS uses the host name, which is passed in the HTTP header, to determine which site clients are requesting. If the site is used on a private network, the host header can be an intranet site name, such as SupIntranet. If the site is used on the Internet, the host header must be a publicly available Domain Name System (DNS) name, such as support.microsoft.com, and you must register the name with an authorized Internet name authority.

The following table summarizes the advantages and disadvantages of using host headers to distinguish multiple Web sites.

Advantages | Disadvantages
Can host multiple sites without assigning a unique IP address to each site. | To use host headers on multiple Web sites that offer secure Internet services, you must host the HTTPS services on a separate server, identify the HTTPS site with an IP address, and redirect requests for secure services to that server. This is required because HTTPS encrypts host header names through Secure Sockets Layer (SSL) so that host header information cannot be interpreted by a Web site that hosts SSL services on the same server.
Transparent to virtually all users. |
Can yield better performance than assigning a unique IP address to each site because the WWW service does not have to allocate non-page pool memory for each site identified by a unique IP address. |

Using host headers to distinguish multiple Web sites on the same server is recommended for most situations. When using this method, carefully consider what the default Web site displays. If a user attempts to contact your site with an old browser that does not support HTTP 1.1, and the default Web site is enabled on the server but does not include programming to overcome the limitations of old browsers, the user is directed to the default Web site assigned to the IP address. This might not be the site the user is expecting to see. The default Web site might include a script that supports the use of host header names in browsers that do not support HTTP 1.1.

note Note If a browser receives a request for a site that is currently stopped, the user is directed to the default Web site. For this reason, Internet service providers (ISPs) typically display their own home page as the default. If the user cannot reach a site identified by a host header, and the default Web site is not enabled, the user's browser displays a Host Not Found error.

Related Topics
  • For information about Web site names, see Domain Name Resolution.


Creating Multiple Sites Using Ports

Although not recommended for production servers, you can use nonstandard TCP port numbers to create unique Web site identifiers for site development and testing purposes. You can do this by creating a Web site identity that consists of a TCP/IP address, or name, appended with a nonstandard TCP port number. Standard Web sites use the default TCP port 80 for HTTP connections and the default TCP port 443 for secure HTTPS connections. Because TCP/IP endpoints are defined by a combination of IP address (or the corresponding name) and port number, configuring a Web site with a nonstandard port number creates a unique endpoint, or identity, for the site.

If you use a nonstandard TCP port number to identify a Web site, users are not able to reach the site through a standard name or URL. Instead, users must know the nonstandard TCP port number assigned to the Web site, and append the Web site's name or IP address in their Web browser address bar.

For example, to reach a private Web site named DevIntranet, with an IP address of 10.0.0.02, and the HTTP service assigned to the nonstandard TCP port 8080, users would have to type http://devintranet:8080 or http://10.0.0.02:8080 in their Web browser to reach the site. Consequently, using port numbers to identify Web sites is not a viable method for most Internet or intranet sites.

note Note If you use an appended port number as the unique identifier for a Web site, use a port number above 1023. The Internet Assigned Numbers Authority (IANA), assigns port numbers 0 through 1023 to standard TCP/IP applications and protocols and publishes these port numbers as well-known ports.

The following table summarizes the advantages and disadvantages of using port numbers to distinguish Web sites.

Advantages | Disadvantages
Can create multiple private Web sites, including sites that support HTTPS on the same server, without assigning a unique IP address. Used primarily for Web site development and testing purposes. | Generally not recommended for production servers because this method requires clients to type in the name or IP address followed by a nonstandard port number to reach the site. Host names, or friendly names, cannot be used.
 | Requires administrators to open non standard ports on the server or firewall, increasing the exposure to TCP/IP-based security attacks.
Related Topics
  • For information on port filtering, see TCP/IP Port Filtering.
  • For information about adding Web sites, see Adding Web Sites to Your Server.


FTP Site Administration

Whether your site is on an intranet or the Internet, the principles of providing a place to upload and download files using FTP are the same. You place your files in directories on your FTP server so that users can establish an FTP connection and transfer files with an FTP client or FTP-enabled Web browser. But beyond simply storing files on your server, you must manage how your site is deployed, and more importantly, how your site evolves. This section presents the basics of managing the infrastructure of an FTP site, from securing your site to hosting multiple sites.

This version of Internet Information Services (IIS) includes Isolating FTP Users to help administrators, and particularly Internet hosting providers, efficiently secure and commercialize the FTP services for their customers.

The FTP service is not installed by default on the operating systems in the Microsoft® Windows® Server 2003 family. To install the FTP service, see FTP Site Setup.

This section includes the following information:

  • Changing FTP Site Home Directories: Describes the concept of a home directory and methods for changing the home directory of an FTP site.
  • Naming FTP Sites: Describes assigning a descriptive name to an FTP site.
  • Setting FTP Messages and Directory Output Style: Describes the message and directory output options.
  • Using Virtual Directories with FTP Sites: Describes the concept of a virtual directory and methods for creating and removing a virtual directory.
  • Stopping and Starting FTP Sites: Describes why you would need to stop and restart your FTP sites and how to perform these actions.
  • Changing Default FTP Site Settings: Describes how to change default settings globally or on an individual site.
  • Creating Multiple FTP Sites: Describes how to use IP addresses or port numbers to differentiate multiple FTP sites.
  • Adding FTP Sites to Your Server: Describes the process of adding a new FTP site to a server running IIS.
  • Redirecting FTP Requests to Directories or Network Shares: Describes forwarding file requests to a different directory or network share.
  • Modes and Data Transmission: Describes the different FTP connection and data transfer modes supported by IIS.
  • Server-to-Server FTP Transfer: Describes how to configure IIS for server-to-server FTP transfer by changing the EnablePortAttack registry key. The topic also suggests using Web Distributed Authoring and Versioning (WebDAV) publishing as a file transfer alternative.
  • Restarting FTP Uploads and Downloads Describes the FTP rest command, which addresses the problem of losing a network connection while downloading a file.
  • Securing FTP Sites: Describes some of the misconceptions about FTP security and how to establish a secure FTP site.
  • Isolating FTP Users: Describes the concept of FTP user isolation and which type of isolation to use to restrict users to their own directories.


Changing FTP Site Home Directories

Each FTP site on a computer must have its own home directory. The default home directory for the default FTP site is LocalDrive:\Inetpub\Ftproot.

There are two ways to change the home directory of an FTP site:

  • Use IIS Manager
  • Edit the MetaBase.xml file directly.

important Important You must be a member of the Administrators group on the local computer to perform the following procedure (or procedures), or you must have been delegated the appropriate authority. As a security best practice, log on to your computer using an account that is not in the Administrators group, and then use the Run as command to run IIS Manager as an administrator. From the command prompt, type runas /user:administrative_accountname "mmc %systemroot%\system32\inetsrv\iis.msc".

To change the home directory of an FTP site using IIS Manager
  1. In IIS Manager, expand the local computer, expand the FTP Sites folder, right-click the FTP site whose home directory you want to change, and click Stop.
  2. Right-click the FTP site again, and click Properties.
  3. Click the Home Directory tab.
  4. Under The content for this resource should come from, click the location of your home directory.

    5. note Note If you select a directory on a network share, you might need to enter a user name and password to access the resource. IUSR_computername is the default account used if another account is not specified. If you use an account with administrative credentials on the server, clients can gain access to server operations. This seriously jeopardizes the security of your network. For more information on security see, Security Best Practices in Windows Help.

  5. Click Apply, and then click OK.
  6. Right-click the FTP site you've just changed, and click Start.
  7. Optional: Move or copy the content for the FTP site from the original home directory to the new home directory.

To change the home directory of an FTP site by editing the MetaBase.xml file

  1. In IIS Manager, right-click the local computer, point to All Tasks, and click Select Restart IIS....
  2. In the Stop/Start/Reset dialog box, click Stop Internet Services, and click OK.
  3. Expand the FTP Sites folder, right-click the FTP site you want to change, and click Stop.
  4. In Windows Explorer, from the systemroot\System32\Inetsrv folder, open the MetaBase.xml file in a text editor.
  5. To change the FTP home directory, search for "/msftpsvc/1/root" and change the Path= value to the new location of the FTP home directory. Substitute the value 1 with the value corrresponding to the FTP site you want to change.
  6. In IIS Manager, right-click the local computer, point to All Tasks, and click Select Restart IIS....
  7. In the Stop/Start/Reset dialog box, click Start Internet Services, and click OK.
  8. Optional: Move or copy the content for the FTP site from the original home directory to the new home directory.
Related Topics
  • For information on installing the FTP service, see FTP Site Setup.
  • For more information on the structure of the IIS Metabase, see IIS Metabase.


Naming FTP Sites

A server running IIS can host multiple FTP sites. Each site runs on a virtual server, and each FTP site has a descriptive name.

important Important You must be a member of the Administrators group on the local computer to perform the following procedure (or procedures), or you must have been delegated the appropriate authority. As a security best practice, log on to your computer using an account that is not in the Administrators group, and then use the Run as command to run IIS Manager as an administrator. From the command prompt, type runas /user:administrative_accountname "mmc %systemroot%\system32\inetsrv\iis.msc".

To name an FTP site

  1. In IIS Manager, expand the FTP Sites folder, right-click the FTP site you want to name, and click Properties.
  2. On the FTP Site tab, in the Description box, type a descriptive name for the site.
  3. Click OK.
Related Topics
  • For information on installing the FTP service, see FTP Site Setup.
  • For instructions on how to add new FTP sites, see Adding FTP Sites to Your Server.


Setting FTP Messages and Directory Output Style

When you set up an FTP site, you can send informational messages about your site to the user's FTP client. The message can be a greeting that welcomes users to the FTP site when they log on, an exit message that users see when they log off, a message that informs users when the maximum number of connections has been reached, or a banner message. The banner message appears before the user logs on to the site, which can be useful when your site contains material of a sensitive nature. These messages are blank by default.

important Important You must be a member of the Administrators group on the local computer to perform the following procedure (or procedures), or you must have been delegated the appropriate authority. As a security best practice, log on to your computer using an account that is not in the Administrators group, and then use the Run as command to run IIS Manager as an administrator. From the command prompt, type runas /user:administrative_accountname "mmc %systemroot%\system32\inetsrv\iis.msc".

To globally set messages on all FTP sites

  1. In IIS Manager, expand the local computer, right-click the FTP Sites folder, and click Properties.
  2. Click the Messages tab.
  3. Type messages in any of all of the Banner, Welcome, Exit, and Maximum connections boxes. These messages will appear on all FTP sites.
  4. Click Apply, and then OK.

To set messages on a specific FTP site

  1. In IIS Manager, right-click the FTP site for which you want to change messages, and click Properties.
  2. Click the Messages tab.
  3. Type messages in any of all of the Banner, Welcome, Exit, and Maximum connections boxes. Messages set at the individual FTP site level override messages set at the global level.
  4. Click Apply, and then OK.

Setting the Directory Output Style

You can set the directory output style of all FTP sites, or an individual FTP site to be in either MS-DOS®® or UNIX format. The directory output style defines the format that is used when an FTP client sends a /list command. The default directory output style is MS-DOS® format.

The UNIX directory listing style displays the year in a four-digit format when the year in the date of the file is different from the year in the date of the FTP server. No year is returned in cases where the year in the date of the file is the same as the year in the date of the FTP server.

To set the global FTP directory output style

  1. In IIS Manager, right-click the FTP Sites folder, and click Properties.
  2. Click the Home Directory tab.
  3. Under Directory listing style, click UNIX or MS-DOS®.
  4. Click Apply, and then OK.

To set the FTP directory output style for an individual FTP site

  1. In IIS Manager, expand the FTP Sites folder, right-click the FTP site for which you want to change the directory listing style, and click Properties.
  2. Click the Home Directory tab.
  3. Under Directory listing style, click UNIX or MS-DOS®. The output style set at the individual FTP site level overrides the output style set at the global level.
  4. Click Apply, and then OK.

note Note The MS-DOS® directory listing style displays the year in a two-digit format by default. You can change this setting to display the year in a four-digit format. For information on changing the MS-DOS® directory format to display the year in a four-digit format, see the FtpDirBrowseShowLongDate metabase property.

Related Topics
  • For information on installing the FTP service, see FTP Site Setup.


Using Virtual Directories with FTP Sites

A virtual directory is a friendly name, or alias, either for a physical directory on your server hard disk that does not usually reside under the home directory, or for the home directory on another computer. Because an alias is usually shorter than the path of the physical directory, it is more convenient for users to type. The use of aliases is also secure because users do not know where your files are physically located on the server and therefore cannot use that information to modify your files. Aliases also make it easier for you to move directories in your site. Rather than changing the URL for the directory, you need only change the mapping between the alias and the physical location of the directory.

Another advantage of aliases is that you can publish content in multiple directories, to be accessed by all users, and control read/write permissions for each virtual directory separately.

If your FTP site contains files that are located in a directory other than the home directory, or on other computers, you must create virtual directories to include those files in your FTP site. To use a directory on another computer, you must specify the directory's Universal Naming Convention (UNC) name, and provide a user name and password for user rights.

If you want to publish from any directory not contained within your home directory, you must create a virtual directory. For example, suppose you are setting up a Web site for your marketing team on your company's intranet. The following table shows the mapping between the physical location of the files and the URL that accesses the files.

Physical Location | Alias | URL
C:\Inetpub\Ftproot | home directory (none) | ftp://SampleFTPSite
\\Server2\SalesData | Customers | ftp://SampleWebSite/Customers
D:\Marketing\PublicRel | PR | ftp://SampleFTPSite/PR

Both virtual directories and physical directories (directories without an alias) appear in IIS Manager. A virtual directory is indicated by a modified folder icon. The following illustration shows the FTP site example described above, where /Customers and /PR are virtual directories.

Example FTP site as it would appear in IIS Manager with virtual directories marked by a modified folder.

For a basic FTP site, you most likely do not need to add virtual directories. You can simply place all of your files in the site's home directory. If you have a complex site, or want to specify different URLs for different parts of your site, you can add virtual directories as needed. To make a virtual directory accessible from multiple sites, you must add the virtual directory to each site.

important Important For anonymous users, you must set the virtual directory to be mapped to a folder under the working folder established for the anonymous users, for example, C:\inetpub\ftproot\localuser\public.
If you are setting a virtual directory for a site that uses User Isolation, you can set per-user virtual directories, because all the users are isolated in their own working directories. For example, if USER1 has as working folder C:\inetpub\ftpRoot\localuser\USER1, and you want USER1 to access a virtual directory that you create, this virtual directory should be mapped to a folder under the above path. In this case, no other user can access this virtual directory, unless he has the same working directory as USER1.
If you are setting a virtual directory for a site that utilizes User Isolation with Active Directory® directory service, and the working folder of USER1 is mapped to \\computer\User1Share, then you must create the virtual directory to map to a folder under this path and in this case, only the users that have the working folder mapped to the above path will be able to access this virtual directory.

There are two ways to create or delete a virtual directory:

  • Using IIS Manager.
  • Using the iisftpdr.vbs administration script.

important Important You must be a member of the Administrators group on the local computer to perform the following procedure (or procedures), or you must have been delegated the appropriate authority. As a security best practice, log on to your computer using an account that is not in the Administrators group, and then use the Run as command to run IIS Manager as an administrator. From the command prompt, type runas /user:administrative_accountname "mmc %systemroot%\system32\inetsrv\iis.msc".

To create a virtual directory using IIS Manager

  1. In IIS Manager, expand the local computer, expand the FTP Sites folder, expand the FTP site to which you want to add a virtual directory, right-click the site or folder within which you wish to create the virtual directory, point to New, and then click Virtual Directory.
  2. Click Next.
  3. In the Alias box, type a name for the virtual directory, and click Next. This is the name the user types, and should be short and easy to type.
  4. In the Directory box, type or browse to the physical directory in which the virtual directory resides, and click Next.
  5. Under Allow the following permissions, select the check boxes next to the access permissions appropriate to your needs, and click Next.
  6. Click Finish. The virtual directory is created below the currently selected folder level.

To create a virtual directory using the iisftpdr.vbs administration script

  1. From the Start menu, click Run.
  2. In the Open box, type cmd, and click OK.
  3. At the command prompt, type cscript iisftpdr.vbs /create "SampleFTPSite" VirtualDirectoryName x:\path, and press ENTER. Substitute your FTP site name, virtual directory name, and path to the physical directory as appropriate.

note Note Deleting a virtual directory does not delete the corresponding physical directory or files.

To delete a virtual directory using IIS Manager

  • In IIS Manager, expand the FTP site containing the virtual directory you want to delete, right-click the virtual directory, click Delete, and then click Yes.

The following method does not work for root virtual directories.

To delete a virtual directory using the iisftpdr.vbs administration script

  1. From the Start menu, click Run.
  2. In the Open box, type cmd, and click OK.
  3. At the command prompt, type cscript iisftpdr.vbs /delete "SampleFTPSite" VirtualDirectoryName, and press ENTER. Substitute Your FTP site name and virtual directory name as appropriate.
Related Topics
  • For information on installing the FTP service, see FTP Site Setup.
  • For detailed information on the iisftpdir command-line administration script, search for "iisftpdr.vbs" in Windows Help.
  • For information on Security for virtual directories, see Securing Virtual Directories and Access Control in Windows Help.


Stopping and Starting FTP Sites

The need to stop and restart an FTP site typically indicates a problem with the site. If your FTP site is slow, unresponsive, or is not running properly in some other way, stopping and then restarting the site can resolve a temporary problem with the software.

By default, FTP sites start automatically when your computer restarts. Starting a site restarts or resumes a specific site, or the FTP service if it was not previously running, which might immediately fix problems. Stopping a site disables the specific FTP site, disconnecting all client connections to the site. Stopping the FTP service stops all FTP sites and unloads the FTP service. Pausing a site prevents the FTP service from accepting new connections but does not affect requests that are already being processed.

important Important You must be a member of the Administrators group on the local computer to perform the following procedure (or procedures), or you must have been delegated the appropriate authority. As a security best practice, log on to your computer using an account that is not in the Administrators group, and then use the Run as command to run IIS Manager as an administrator. From the command prompt, type runas /user:administrative_accountname "mmc %systemroot%\system32\inetsrv\iis.msc".

To start, stop, or pause an FTP site

  • In IIS Manager, expand the local computer, expand the FTP Sites folder, right-click the site you want to start, stop, or pause, and click Start, Stop, or Pause.

If a site stops unexpectedly, IIS Manager might not correctly indicate the state of the site. In IIS Manager, right-click the FTP Sites folder and click Refresh to see the current state of all FTP sites.

Related Topics

  • For information on installing the FTP service, see FTP Site Setup.
  • For information on restarting all of your Internet services, see Restarting IIS.
  • To change properties on existing FTP sites, see Changing Default FTP Site Settings.


Changing Default FTP Site Settings

During installation of IIS, default values are set for the various properties assigned to FTP sites. Properties can be set at the global level, affecting all FTP sites on a server; on the individual site level; or at the directory or file level. IIS uses an inheritance model, which means that settings at higher levels are automatically inherited by lower levels. Settings at lower levels can be edited individually to override inherited settings from the next level up.

If you change a setting at a lower level, then later change a setting at a higher level that conflicts with the lower level setting, you are prompted to choose whether you want to change the lower-level setting to the new higher-level setting.

important Important You must be a member of the Administrators group on the local computer to perform the following procedure (or procedures), or you must have been delegated the appropriate authority. As a security best practice, log on to your computer using an account that is not in the Administrators group, and then use the Run as command to run IIS Manager as an administrator. From the command prompt, type runas /user:administrative_accountname "mmc %systemroot%\system32\inetsrv\iis.msc".

To globally set properties for all FTP sites

  1. In IIS Manager, expand the local computer, right-click the FTP Sites folder, and click Properties.
  2. Click Help on any of the tabs for more information on those settings.

To set properties for a single FTP site

  1. In IIS Manager, expand the FTP Sites folder, right-click the FTP site whose settings you want to change, and click Properties.
  2. Click Help on any of the tabs for more information on those settings.
Related Topics
  • For information on installing the FTP service, see FTP Site Setup.


Creating Multiple FTP Sites

You can create multiple FTP sites using multiple IP addresses and multiple ports. While creating multiple sites with multiple IP addresses is a common and recommended practice, it can be more complicated because, by default, clients call port 21 when using the FTP protocol. Therefore, if you create multiple FTP sites using multiple ports, you need to inform users of the new port number so their FTP clients can locate and connect to the port.

If you create a new site using the same port as an existing site with the same IP address, the new site will not start. The general rule is that you can have multiple sites using the same IP and port, but only one site from this group can run at a time. If you try to start another site from this group, you receive an error message.

important Important You must be a member of the Administrators group on the local computer to perform the following procedure (or procedures), or you must have been delegated the appropriate authority. As a security best practice, log on to your computer using an account that is not in the Administrators group, and then use the Run as command to run IIS Manager as an administrator. From the command prompt, type runas /user:administrative_accountname "mmc %systemroot%\system32\inetsrv\iis.msc".

To create multiple FTP sites using multiple IP addresses

  1. In IIS Manager, expand the local computer, right-click the FTP Sites folder, point to New, and click FTP Site.
  2. Click Next.
  3. In the Description box, type a description of your FTP site, and then click Next.
  4. Under Enter the IP address to use this FTP site, type a new IP address, and leave the TCP port setting at 21.
  5. Complete the rest of the FTP Site Creation Wizard.

To create multiple FTP sites using multiple ports

  1. In IIS Manager, expand the local computer, right-click the FTP Sites folder, point to New, and click FTP Site.
  2. Click Next.
  3. In the Description box, type a description of your FTP site, and then click Next.
  4. Under Enter the IP address to use for this FTP site, type your Web server's IP address.
  5. Under Type the TCP port for this FTP site, change the TCP port from the default setting of 21 to an unallocated port number. If you are uncertain which port numbers are already allocated, choose a high number, for example a number between 5000 and 5999.
  6. Complete the rest of the FTP Site Creation Wizard.
Related Topics
  • For information on installing the FTP service, see FTP Site Setup.


Adding FTP Sites to Your Server

IIS enables you to create multiple FTP sites on a single server. To add a site to a server, you must prepare the server and associated network services, and create a unique identity for the site.

Preparing to Add an FTP Site

Adding an FTP site to a server that is already hosting an FTP site requires some preparation.

  • Multiple FTP sites can use the same IP address. If you use a unique IP address to identify a new FTP site, however, you must obtain a static IP address from your organization or Internet service provider (ISP) and configure the TCP/IP settings on the server.
  • Standard FTP services use TCP port 21 by default, and it is generally not recommended to use any other port for FTP services. However, if you use a nonstandard TCP port number to identify a new FTP site for special situations (typically used on private Web sites for development and testing purposes), select a TCP port number above 1023 so it does not conflict with well-known port numbers assigned by the Internet Assigned Numbers Authority.
  • Use Windows Explorer to create a home directory for the FTP site content. Create subdirectories to store other content as needed. To organize home directories for multiple FTP sites on the same server, you can create a top-level directory for storing all home directories, and then create subdirectories for each site. You can create a home directory on the local server, or as a uniform naming convention (UNC) path on a network share. You can also create virtual directories that map to the physical directories.

Adding an FTP Site

IIS provides the following two methods for adding a new FTP site:

  • IIS Manager.
  • The iisftp.vbs command-line administration script.

important Important You must be a member of the Administrators group on the local computer to perform the following procedure (or procedures), or you must have been delegated the appropriate authority. As a security best practice, log on to your computer using an account that is not in the Administrators group, and then use the Run as command to run IIS Manager as an administrator. From the command prompt, type runas /user:administrative_accountname "mmc %systemroot%\system32\inetsrv\iis.msc".

To add an FTP site with IIS Manager

  1. In IIS Manager, right-click the FTP Sites folder, point to New, and click FTP Site.
  2. Click Next.
  3. In the Description box, type the name you have selected for the FTP site, and click Next.
  4. Under Enter the IP address to use for this FTP site, click All Unassigned to allow FTP to respond to all unassigned IP addresses on the server, or, click a specific IP address for the site.

    5. note Note In the FTP Site Creation Wizard, All Unassigned refers to IP addresses that are assigned to a computer but not assigned to a specific site. The default FTP site uses all of the IP addresses that are not assigned to other sites. Only one site can be set to use unassigned IP addresses for a given port number. For more information on how sites are identified, see Creating Multiple FTP Sites.

  5. The TCP port is assigned to port 21 by default. To use a nonstandard port number to create a unique identity for a private FTP site, under Type the TCP port for this FTP site, type a new port number above 1023, and click Next.
  6. Click the appropriate user isolation method for this site, and click Next. See Isolating FTP Users for information on which method is appropriate for your site.
  7. In the Path box, type or browse to the path of your FTP site home directory, and click Next.
  8. Select Read or select Read and Write permissions for the site, and click Next.
  9. Click Finish.

To add an FTP site with the iisftp.vbs command-line administration script

  1. If the new FTP site will be in a new directory, create the new directory.
  2. From the Start menu, click Run.
  3. In the Open box, type cmd, and click OK.
  4. At the command prompt, switch to the systemroot\System32 directory.
  5. Type cscript iisftp.vbs /create Home Directory "Site Description" IP Address /b Port and press ENTER. For example, the following command creates and starts an FTP site called MyFTPSite on port 21 at IP address 123.456.789 with C:\Inetpub\Ftproot\Newdirectory as its home directory.
    cscript iisftp.vbs /create c:\inetpub\ftproot\newdirectory "MyFTPSite" /i 123.456.789 /b 21.

    6. note Note The iisftp.vbs script supports many more options for creating an FTP site. To see the options available, search for "iisftp.vbs" in Windows Help

Related Topics
  • For information on installing the FTP service, see FTP Site Setup.
  • For more information on creating a home directory, see Changing FTP Site Home Directories.
  • To change properties on existing FTP sites, see Changing Default FTP Site Settings.
  • To add virtual directories, see Using Virtual Directories with FTP Sites.
  • To perform common tasks from command-line scripts, see Using Command-Line Administration Scripts.


Redirecting FTP Requests to Directories or Network Shares

You can redirect requests for files in one directory to a different directory or to a network share. When an FTP client requests the file from the original URL, the FTP server instructs the client to request the file from the redirected resource. Redirection is useful when users have grown accustomed to using a particular URL to access certain files.

important Important You must be a member of the Administrators group on the local computer to perform the following procedure (or procedures), or you must have been delegated the appropriate authority. As a security best practice, log on to your computer using an account that is not in the Administrators group, and then use the Run as command to run IIS Manager as an administrator. From the command prompt, type runas /user:administrative_accountname "mmc %systemroot%\system32\inetsrv\iis.msc".

To redirect requests to another directory or network share

  1. In IIS Manager, expand the FTP Sites folder, right-click the FTP site or directory within an FTP site to which you want to add a redirect, and click Properties.
  2. Click the Home Directory, Virtual Directory, or Directory tab.
  3. Under The content for this resource should come from, click the location from which the files should be served.
  4. In the Local path box, type or browse to the path from which you want the files served.
  5. Click OK.
Related Topics
  • For information on installing the FTP service, see FTP Site Setup.


Modes and Data Transmission

When using FTP, there are two things to consider. The first is the connection mode, which can be either passive or active; and the second is the data transfer mode, which can be stream, block, or compressed.

The IIS-based FTP service supports both active and passive mode connections, depending on the method that is specified by the client. IIS does not support disabling either active or passive connection modes.

The default data transfer mode for IIS-based FTP is stream. IIS does not currently support block or compressed data transfer mode.

Unlike HTTP and other protocols used on the Internet, the FTP protocol uses a minimum of two connections during a session: a half-duplex connection for control, and a full-duplex connection for data transfer. By default, TCP port 21 is used on the server for the control connection, but the data connection is determined by the method that the client uses to connect to the server, as detailed below.

  • Active-mode FTP connections are sometimes referred to as "client-managed" because the client sends a port command to the server, over the control connection. The command requests the server to establish a data connection from TCP port 20 on the server to the client, using the TCP port that is specified by the port command.
  • Passive-mode FTP connectionsare sometimes referred to as "server-managed", because after the client issues a pasv command, the server responds with one of its transient ports used as the server-side port of the data connection. After a data connection command is issued by the client, the server connects to the client using the port immediately above the client-side port of the control connection.

Data Transfer and Firewalls

The most common problem encountered with FTP over the Internet involves data transfers through a proxy server, a firewall, or a Network Address Translation (NAT) device. In most cases these network security devices allow the control connection to be established over TCP port 21 (that is, the user can successfully log on to the FTP server), but when the user attempts a data transfer such as DIR, LS, GET, or PUT, the FTP client appears to stop responding because the network security device is blocking the data connection port that is specified by the client. If the network security device supports logging, you can verify port blocking by reviewing the deny/reject logs on the network security device.

The following table includes FTP clients provided by Microsoft, and the connection mode supported by each client.

FTP Client | Transfer Mode
Command-line | Active
Internet Explorer 5.1 and earlier | Passive
Internet Explorer 5.5 and later | Active and Passive
FrontPage 1.1 to FrontPage 2002 | Active
Related Topics
  • For information on installing the FTP service, see FTP Site Setup.
  • For more information on FTP data transmission, refer to the FTP protocol specification at the World Wide Web Consortium Web site.
  • For information on setting the port range used for passive-mode FTP connections, see the PassivePortRange metabase property.


Server-to-Server FTP Transfer

You can configure IIS to allow server-to-server FTP transfers by changing the EnableDataConnTo3rdIP and EnablePasvConnFrom3rdIP keys in the system registry. By default, the EnablePasvConnFrom3rdIP registry key is disabled to prevent malicious attacks against the FTP service. Although details for configuring server-to-server transfers are listed below, Microsoft does not recommend enabling the EnablePasvConnFrom3rdIP registry key on IIS-based FTP servers connected to the Internet.

important Important Using Registry Editor incorrectly can cause serious problems that require reinstalling the operating system. Because Registry Editor bypasses the standard safeguards that prevent you from entering settings that are conflicting or likely to degrade performance or damage your system, exercise caution when making changes to the registry. Microsoft cannot guarantee that problems resulting from the incorrect use of Registry Editor can be solved. For information about how to edit the registry, see the Changing Keys and Values topic in Registry Editor Help.

The procedure below lists the steps required to transfer a binary file (called MyFile.xls) from Server1 (IP Address: 192.168.0.10) to Server2 (IP Address: 192.168.1.20) using the command-line FTP client on Workstation1. You must have Write permissions granted on Server2 for this example to work. You must also have two computers running the IIS-based FTP service.

The server that initiates the data channel (Server1 in this example) must have the following value set in the registry:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MSFTPSVC\Parameters\EnableDataConnTo3rdIP=1

Server2 must have the following value set in the registry:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MSFTPSVC\Parameters\EnablePasvConnFrom3rdIP=1

In normal client/server FTP transfers, the user is only responsible for entering "friendly" commands to the server; the client responds automatically. When a server-to-server FTP transfers is performed, another server is the client. Therefore, the user is responsible for sending all FTP commands to both servers (in RFC959 format, preceded by the "literal" keyword).

To transfer a binary file between FTP servers

  1. Connect to Server1 using a command-line FTP client. (This connection will be referred to as Client1).
  2. Connect to Server2 using a command-line FTP client. (This connection will be referred to as Client2).
  3. Issue the following command in Client2: literal pasv.
    The computer responds with: 227 Entering Passive Mode (192,168,1,20,15,61).
    Note that 15,61 represents the low and high order bytes of the port number (port 3901 in this case), which is randomly assigned with each FTP connection. As a result, the last two numbers of this string will be different.
  4. Issue the following command in Client1: literal port 192,168,1,20,15,61.
    The computer responds with: 200 Port Command Successful.
    Use the IP and port string returned in step 3.
  5. Issue the following command in both Client1 and Client2: literal type i.
    The computer responds with: 200.
  6. Type set to I.
  7. Issue the following command in Client1: literal retr myfile.bin.
    The computer responds with: 125 Data Connection already open; Transfer Starting.
  8. Issue the following command in Client2: literal stor myfile.bin.
    The computer responds with: Opening BINARY mode data connection for myfile.bin.
  9. Continue issuing the literal stat command on Client2 until it returns a 211 response indicating "No data connection is listed".
    This 211 response message is several lines long and indicates that the transfer is no longer in progress.
  10. To transfer files from Server2 to Server1, issue the literal retr command from Client1 and the literal stor command from Client2.

File Transfer Alternatives

If you are concerned about FTP security, or if a network security device like a firewall prevents server-to-server data transmission, consider using a file transfer alternative like Web Authoring with WebDAV. WebDAV is the recognized standard for HTTP file transfers.

Related Topics
  • For information on port, pasv, stor, retr, stat, and other literal FTP commands, see the World Wide Web Consortium Web site.


Restarting FTP Uploads and Downloads

If your connection closes unexpectedly while uploading or downloading a file using FTP, it might not be necessary to transfer the entire file again, because the IIS -based FTP service supports restarting failed FTP uploads and downloads. If your FTP client software supports FTP restart, you can reestablish the FTP connection and restart the file transfer; and the file transfer will automatically pick up where it left off.

The command-line FTP client included with Microsoft Windows does not support restarting downloads. You must use a third-party command-line FTP client for that functionality. If you are using a command-line FTP client, uploads can be resumed by using the append command to add data to an existing file. Downloads can be restarted by first issuing a rest command with the desired offset, and then issuing the retr command.

note Note The IIS implementation of FTP restart is limited to an offset of less than four gigabytes.

Related Topics
  • For information on installing the FTP service, see FTP Site Setup.
  • For information on the commands supported by the Microsoft Windows command-line FTP client, search for "ftp" on the Microsoft Developer Network (MSDN) Web site.
  • For the official FTP specification with the entire FTP command set, see the World Wide Web Consortium Web site.


Securing FTP Sites

FTP is commonly misunderstood as a secure means for transferring data, because the FTP server can be configured to require a valid user name and password combination prior to granting access. Be aware that neither the credentials specified at logon nor the data itself is encrypted or encoded in any way. All credentials are sent across the network in plaintext. In other words, all FTP data can be easily intercepted and analyzed by any station on any network between the FTP client and FTP server. The risk of plaintext credentials is that someone other than the intended users could log on to FTP and download the files you have placed there. If you intend to place sensitive data on your FTP site or if secure communication between clients and your FTP server are important, consider using FTP over an encrypted channel such as a Virtual Private Network secured with Point-to-Point Tunneling Protocol or Secure Internet Protocol (IPSec). You should also consider using Web Authoring with WebDAV (WebDAV), which utilizes Secure Sockets Layer (SSL).

caution Caution FTP Web sites or virtual directories that are configured to use Active Directory (AD) isolation or FTP load-balancing should not be mapped to physical directories that are used for FrontPage® Server Extensions (FPSE) Web sites. Doing so can allow users to view any files in that folder structure over the network.

Related Topics
  • For information on installing the FTP service, see FTP Site Setup.
  • To learn how to set up a private network over the Internet using Point-to-Point Tunneling Protocol (PPTP) or how to set up secure IP communications with a Virtual Private Network (VPN) and IPSec, see PPTP, VPN, and IPSec in Windows Help.
  • To learn about FTP authentication methods, see FTP Site Authentication.


Isolating FTP Users

FTP user isolation is a solution for Internet service providers (ISPs) and Application service providers who want to offer their customers individual FTP directories for uploading files and Web content. FTP user isolation prevents users from viewing or overwriting other users' Web content by restricting users to their own directories. Users cannot navigate higher up the directory tree because the top-level directory appears as the root of the FTP service. Within their specific site, users have the ability to create, modify, or delete files and folders.

FTP user isolation is a site property, not a server property. It can be turned on or off for each FTP site.

FTP User Isolation Modes

FTP user isolation supports three isolation modes. Each mode enables different levels of isolation and authentication.

Isolation Mode | Description
Do not isolate users | This mode does not enable FTP user isolation. This mode is designed to work similarly to earlier versions of IIS. Because isolation is not enforced among different users logging on to your FTP server, this mode is ideal for a site that offers only download capabilities for shared content or for sites that do not require protection of data access between users.
Isolate users This mode authenticates users against local or domain accounts before they can access the home directory that matches their user name. All user home directories are in a directory structure under a single FTP root directory where each user is placed and restricted to their home directory. Users are not permitted to navigate out of their home directory. If users need access to dedicated shared folders, you can also establish a virtual root. This mode does not authenticate against Active Directory directory service.

note Note Server performance can degrade when this mode is used to create hundreds of home directories.
Isolate users using Active Directory This mode authenticates user credentials against a corresponding Active Directory container, rather than searching the entire Active Directory, which requires large amounts of processing time. Specific FTP server instances can be dedicated to each customer to ensure data integrity and isolation. When a user's object is located within the Active Directory container, the FTPRoot and FTPDir properties are extracted to provide the full path to the user's home directory. If the FTP service can successfully access the path, the user is placed within the home directory, which represents the FTP root location. The user sees only their FTP root location and is, therefore, restricted from navigating higher up the directory tree. The user is denied access if either the FTPRoot or FTPDir property do not exist, or, if these two together do not form a valid and accessible path.

note Note This mode requires an Active Directory server running on an operating system in the Windows Server 2003 family. A Windows 2000 Active Directory can also be used but requires manual extension of the User Object schema. To learn more about setting up an Active Directory server, see Windows Help.

Configuring FTP User Isolation with IIS Manager

When your FTP server is set to isolate users, all user home directories are located in a two-level directory structure in the FTP site directory (as configured on the FTP home directory property page). The FTP site directory can either reside on the local machine or on a network share.

important Important You must be a member of the Administrators group on the local computer to perform the following procedure (or procedures), or you must have been delegated the appropriate authority. As a security best practice, log on to your computer using an account that is not in the Administrators group, and then use the Run as command to run IIS Manager as an administrator. From the command prompt, type runas /user:administrative_accountname "mmc %systemroot%\system32\inetsrv\iis.msc".

To create a new FTP site that does not isolate users

  1. In IIS Manager, expand the local computer, right-click the FTP Sites folder, point to New, and click FTP Site.
  2. Click Next.
  3. Provide the required information in the FTP Site Description and IP Address and Port Settings dialog boxes, and click Next.
  4. In the FTP User Isolation dialog box, click Do not isolate users, and click Next.
  5. Complete the remaining steps of the wizard.

To create a new FTP site that isolates users

  1. In IIS Manager, expand the local computer, right-click the FTP Sites folder, point to New, and click FTP Site.
  2. Provide the required information in the FTP Site Description and IP Address and Port Settings dialog boxes, and click Next.
  3. In the FTP User Isolation dialog box, click Isolate users, and click Next.
  4. Complete the remaining steps of the wizard.
  5. Right-click the new FTP site you created, and click Properties.
  6. Click the Security Accounts tab. If the Allow anonymous connections check box is selected, in the User name and Password boxes, type a user name and password to use to to authenticate anonymous users.
  7. If anonymous access is allowed, create the subdirectories LocalUser and LocalUser\Public under the FTP site home directory.
  8. If users of the local computer log in with their individual account user names (rather than as anonymous users), create the subdirectories LocalUser and LocalUser\username under the FTP site root directory for each user allowed to connect to this FTP site.
  9. If users of different domains log on with their explicit domain\username credentials, create a subdirectory for each domain (by using the name of the domain) under the FTP site root directory. Under each domain directory, create a directory for each user. For example, to support access by user Sales\user1, create the Sales and Sales\user1 directories.

Configuring FTP User Isolation with Active Directory

When you set your FTP server to isolate users with Active Directory, each user's home directory can reside on an arbitrary network path. In this mode, you have the flexibility to distribute user home directories across multiple servers, volumes, and directories as is appropriate to the network configuration. You can also set the FTPRoot and FTPDir properties for a user to form a local path to the FTP server machine. This mode integrates Active Directory authentication when retrieving a user's home directory information. This integration enables you to use Active Directory Services Interfaces (ADSI) and scripting to manage the physical location of user home directories.

This mode is most appropriate for ISP deployments, where an array of front-end FTP servers all access an Active Directory to retrieve home directory information for users, and access an array of back-end file servers.

The Active Directory User object has been extended to include two properties: FTPRoot and FTPDir. These properties store the file server share and relative home directory for each user. The FTPRoot determines the Universal Naming Convention (UNC) file server share, while the FTPDir indicates the relative path on the share. Concatenating these two properties results in the full UNC path to the users' home directory, or to the FTP server.

These two properties correspond to the msIIS-FTPRoot and msIIS-FTPDir properties that were added to the Active Directory schema in the Windows Server 2003 family. They can also be set and modified using the iisftp.vbs command-line administration script. For more information on setting these properties using the iisftp.vbs command-line administration script to set these properties, search for "iisftp.vbs" in Windows Help. You can also install the Admin Pack, available with Windows Server 2003 family Resource Kit, and modify these properties using the Active Directory snap-in.

Configuring user isolation by using Active Directory involves setting up the following corresponding services:

  • File servers: You can use file servers to create the shares and user directories for all users permitted to connect to the FTP service, including anonymous accounts. You should plan for expected disk space usage, storage management, network traffic, and other processes related to your server infrastructure.
  • Active Directory: This mode of user isolation requires the availability of an Active Directory server running on an operating system in the Windows Server 2003 family. The Windows Server 2003 family Active Directory schema is the first to contain the user object properties used by the FTP service. For more information about setting up an Active Directory server, see Windows Help. You should also configure the user object in Active Directory for each user (including anonymous accounts) by setting the FTPRoot and FTPDir properties to point to the home directories. Also note that frequently used information retrieved from Active Directory is cached on the FTP server. You can limit the maximum elapsed time before flushing the cache for the Active Directory properties corresponding to the anonymous user by using the registry parameter DsCacheRefreshSecs.

important Important To use FTP user isolation in Active Directory mode with Windows 2000 domain controllers, you need to extend the base user object in the Windows 2000 Active Directory schema to include the new FTP properties, msIIS-FTPRoot and msIIS-FTPDir. For more information on how to extend the base user object in the Windows 2000 Active Directory schema, see the Active Directory Programmer's Guide.

To create a new FTP site that isolates users with Active Directory

  1. In IIS Manager, right-click the FTP Sites folder, point to New, and click FTP Site.
  2. Provide the required information in the FTP Site Description and IP Address and Port Settings dialog boxes, and click Next.
  3. In the FTP User Isolation dialog box, click Isolate users using Active Directory, and click Next.
  4. Complete the remaining steps of the wizard.
  5. Right-click the new FTP site you created, and click Properties.
  6. Click the Security Accounts tab. If the Allow anonymous connections check box is selected, in the User name and Password boxes, type a user name and password to use to to authenticate anonymous users. This user should not be a local computer user, but rather a domain user with appropriate home directory configuration in the Active Directory object.
  7. Type a default logon domain name. This domain name is given to users who do not specify their user domain when they log on. In other words, a user connecting with the user name "domain1\user1" is authenticated against domain1, while a user connecting as user2 is authenticated against the default logon domain. If a default domain is not set, and a user does not specify a domain name, access is denied for all but anonymous users.
Related Topics
  • For information on installing the FTP service, see FTP Site Setup.


NNTP Administration

Newsgroups make it easy for users in your organization to engage in discussions on various topics with each other and with users outside of the organization. Whether enabling a departmental newsgroup or providing a full feed of Internet newsgroups, the principals of setting up a news server are the same.

This section includes the following information:

  • Creating NNTP Virtual Servers: Describes multiple-server strategies and how to create virtual Network News Transfer Protocol (NNTP) servers.
  • Creating Virtual Directories: Describes how to create and modify virtual directories.
  • Configuring NNTP Virtual Servers: Introduces the settings options for NNTP virtual servers.
  • Starting, Stopping, or Pausing NNTP Virtual Servers: Describes how to start, stop, and pause NNTP virtual servers and the difference between managing servers and services.
  • Starting, Stopping, or Pausing the NNTP Service: Describes how to start, stop, and pause NNTP services and how it differs from managing virtual servers.
  • NNTP Security: Introduces NNTP security concepts.
  • Managing Newsgroups: Introduces concepts in managing newsgroups including how to create, moderate, edit, delete, and configure them.
  • Configuring Expiration Policies: Describes how to set and modify newsgroup expiration policies.


Creating NNTP Virtual Servers

You can create as many NNTP virtual servers as you need. Each virtual server should have a unique IP address/TCP port combination. Although it is possible to have multiple NNTP virtual servers on a single IP address by using a different TCP port for each one, this configuration is not recommended because the client software must then be specially configured to use the nonstandard TCP port.

When you create an NNTP virtual server, you are prompted to enter two directory paths: a path for internal files and a path for newsgroup files. If possible, put these two paths on different disk partitions because the internal files can be corrupted if the disk partition runs out of disk space. Keeping them on a separate disk partition reduces the chance that the disk partition can run out of disk space.

important Important You must be a member of the Administrators group on the local computer to perform the following procedure (or procedures), or you must have been delegated the appropriate authority. As a security best practice, log on to your computer using an account that is not in the Administrators group, and then use the Run as command to run IIS Manager as an administrator. From the command prompt, type runas /user:administrative_accountname "mmc %systemroot%\system32\inetsrv\iis.msc".

To create a new NNTP virtual server
  1. In IIS Manager, expand the local computer, and then right-click an existing NNTP virtual server, point to New, and click Virtual Server.
  2. Follow the instructions of the New NNTP Virtual Server Wizard. Be sure to select an IP address that is not being used by another NNTP virtual server.
  3. The new NNTP virtual server will start automatically. However, if you have assigned it an IP address/TCP port combination that is already in use, it won't start. You must reconfigure the IP address/TCP port combination to one that is unique.
  4. Configure the new NNTP virtual server.
Related Topics
  • For information on creating virtual directories, see Creating Virtual Directories.


Creating Virtual Directories

You can create as many virtual directories as you want. Create virtual directories that match the structure of your newsgroup hierarchy.

important Important You must be a member of the Administrators group on the local computer to perform the following procedure (or procedures), or you must have been delegated the appropriate authority. As a security best practice, log on to your computer using an account that is not in the Administrators group, and then use the Run as command to run IIS Manager as an administrator. From the command prompt, type runas /user:administrative_accountname "mmc %systemroot%\system32\inetsrv\iis.msc".

To create a virtual directory
  1. In IIS Manager, expand the local computer, and then expand the NNTP virtual server that you want.
  2. Right-click Virtual Directories, point to New, and then click Virtual Directory.
  3. Follow the New NNTP Virtual Directory Wizard. Create a newsgroup subtree for this virtual directory.
  4. Select either File System (a local location) or Remote as a storage location for the news content. This location can be configured later if necessary by clicking Contents in the Virtual Directory box.
  5. If you selected File System, type a path to the local folder, or click Browse to select a folder. If you selected Remote, type a path to the remote location, or click Browse to select a remote folder. For a remote location, you must also provide a user name and password that Microsoft NNTP Service can use to log on to that remote computer. Type a name or click Browse to search for one. Click Check to ensure that the user name/password combination you plan to use is valid.

note Note If you store content in a remote location, the remote computer must be configured with at least read/write permissions for the user name you provide. Make sure that the remote location is secure and that it is maintained by trusted administrators.

To modify a virtual directory
  1. In IIS Manager, expand the local computer, and then expand the NNTP virtual server that you want.
  2. Right-click the virtual directory that you want to modify, and then click Properties.
  3. Change the options in the virtual directory's Properties box as needed.
Related Topics
  • For information on creating an NNTP virtual server, see Creating NNTP Virtual Servers.


Configuring NNTP Virtual Servers

For each Network News Transfer Protocol (NNTP) virtual server you can configure security, create newsgroups, set newsgroup limits, and so on. Most configuration options are assigned default values when a new NNTP virtual server is created.

Each NNTP virtual server is listed separately in IIS Manager. Each one has its own properties, expiration policies, and virtual directories. Be sure to select the correct NNTP virtual server before changing properties. To open the properties dialog box for an NNTP virtual server, right-click the NNTP virtual server, and then click Properties.

Besides creating newsgroups for the new NNTP virtual server, you must specify the following virtual server settings:

Tab | Settings
Access | Configure client access to the NNTP virtual server and to establish transmission security.
General | Specify IP address, connection limits, path header, and logging settings.
Security | Add Windows user accounts and groups to the list of NNTP virtual server operators.
Settings | Configure a maximum limit for the size of news articles and news feeds, and specify the SMTP server to which moderated messages are sent.

This section includes the following information:

  • NNTP Access Tab: Describes the options that are available on the Access tab.
  • NNTP General Tab: Describes the options that are available on the General tab.
  • NNTP Security Tab: Describes the options that are available on the Security tab.
  • NNTP Settings Tab: Describes the options that are available on the Settings tab.


NNTP Access Tab

Use the Access tab to restrict access to individual newsgroups or sets of newsgroups on the basis of the user name, or to restrict access to all newsgroups on the basis of the client computer IP address.

The Access tab contains the following options:

Option | Description
Access control | Authentication options. You can choose one or more options. To view the options, click Authentication.
Allow anonymous | Unrestricted user access to newsgroups that do not have permissions set on their directories. User names and passwords are not required.
Anonymous | Opens the Anonymous Account dialog box, which allows you to select a Windows account that will be used when someone logs on anonymously.
Username | The user name of the Windows user account used by all anonymous connections. This account defines the privileges of anonymous users. To select an account already defined on this computer, click Browse.
Password | The password for the anonymous user account.
Enable automatic password synchronization | The automatic update of the password in the NNTP service when the password in the computer running a member of the Windows Server 2003 family is changed.
Basic authentication | Authentication that requires the user to provide a valid Windows user name and password that are authorized for access to that directory. The user name and password are sent as unencrypted clear text across the network. Permissions are set on the directory.
Integrated Windows Authentication | Authentication that encrypts the user name and password and then sends them to the NNTP service. The user name and password must be authorized for access to the requested newsgroup directory. Microsoft Outlook® Express supports this protocol. Permissions are set on the directory.
Enable SSL client authentication | Enables secure client authentication using Secure Sockets Layer (SSL) encryption and certificates. A server SSL certificate is required.
Require SSL client authentication | Requires clients to provide an encrypted user name and password using SSL.
Enable client certificate mapping to Windows user accounts | Uses the Windows account mapped to the SSL client certificate to authenticate the user. Click Client Mappings to enter certificates and Windows account names.
Secure communication | Click Certificate to start the Web Server Certificate Wizard.
Connection control | The specific IP addresses that are allowed or not allowed access to this Network News Transfer Protocol (NNTP) virtual server. By default, all IP addresses are granted access. To view the options, click Connection.
All except the list below | Allows access to this NNTP virtual server to all IP addresses except for those listed.
Only the list below | Denies access to this NNTP virtual server to all IP addresses except for those listed.
Add | Click this button to open the Computer window where you can add computers or domains to the list.
IP address | The IP address for a single computer that is being added. Click DNS Lookup to find the IP address associated with the DNS name of the computer.
Subnet address | The base IP address for a group of computers that is being added. A subnet mask is required.
Subnet mask | The subnet mask that specifies the range of IP addresses for a group of computers that is being added.
Name | The domain name of a group of IP addresses that is being added.

Related Topics
  • For information on NNTP security, see NNTP Security.
  • For additional information on the Access tab, see Restricting Access to Newsgroups.


NNTP General Tab

Use the General tab to specify how clients connect to the NNTP service.

The Generaltab contains the following options:

Option | Description
IP address | The IP address of the Network News Transfer Protocol (NNTP) virtual server.
Advanced | Opens the Advanced dialog box where you can enable multiple IP addresses for the NNTP virtual server and configure TCP and Secure Sockets Layer (SSL) port numbers.
TCP port | The TCP port used by clients to connect to the NNTP service. You can enter any unique TCP port number. The default is port 119.
SSL port | The TCP port used by clients to connect to the NNTP service using SSL. You can enter any unique TCP port number. The default is port 563.
Limit number of connections to | When the check box is selected, this option limits the number of simultaneous client connections to the NNTP virtual server. The default is 5,000 connections.
Connection time-out (minutes) | The number of minutes before an inactive client is disconnected. The default is 10 minutes.
Path header | The string used for the Path line in each news posting. The Path header displays the path a news message takes to reach its destination. When a message is forwarded from a news server, a descriptive string is added to the message in the Path line. Any punctuation character except the period (.) can separate the Path header. For information about how NNTP Path statements are generated, see Request for Comments (RFC) 1036. The default value is the Domain Name System (DNS) name of the NNTP virtual server. You do not need to change the default value.
Enable logging | Enables logging to track users of the NNTP virtual server. The default log file directory is systemroot\System32\LogFiles\Nntpsvc1. To enable logging, you must also select the Log access check box in the Virtual Directory dialog box. note Note Auditing server activity with log files is a good way to detect if unauthorized external users are attempting to access your virtual server or if internal users are trying to access resources that they do not have permissions to access. For more information about auditing and using Event Viewer, see Windows Server 2003 family Help.
Active log format | The transaction log format. To specify log properties, click Properties.


NNTP Security Tab

Use the Security tab to specify the operators who are allowed access to the NNTP virtual server.

The Security tab contains the following options:

Option | Description
Operators | The operators or groups of operators that are authorized to access this NNTP virtual server. The default value is the Administrators group for the computer.
Add | Opens the Select Users or Groups dialog box where you can select new operators.
Remove | Removes the selected operator.
Object Types (in the Select Users or Groups dialog box) | Objects from which to select operators.
Locations (in the Select Users or Groups dialog box) | The available locations in the selected domain.
Enter the object names to select (in the Select Users or Groups dialog box) | Provides a space to type the object names that you want to find.

Related Topics
  • For information on NNTP security, see NNTP Security.
  • For information on restricting operator access, see Restricting Operator Access.


NNTP Settings Tab

Use the Settings tab to set limits on posting articles, to enable control messages, and to enable moderated newsgroups.

The Settings tab contains the following options:

Option | Description
Allow client posting | When selected, this option allows clients to post articles to newsgroups on this NNTP virtual server.
Limit post size (KB) | Specifies, in kilobytes, the largest single article that a user can post. To have no limit, clear the check box.
Limit connection size (MB) | Specifies, in megabytes, the maximum amount of data that a user can post to a newsgroup during a connection. To have no limit, clear the check box.
Allow feed posting | When selected, this option allows clients to post articles to newsfeeds on this NNTP virtual server.
Limit post size (KB) | Specifies, in kilobytes, the largest single article that a user can post to a newsfeed. To have no limit, clear the check box.
Limit connection size (MB) | Specifies, in megabytes, the maximum amount of data that a user can post to a newsfeed during a connection. To have no limit, clear the check box.
Allow servers to pull news articles from this server | Allows other NNTP servers to use pull feeds to get more than one article at a time from this server.
Allow control messages | Allows clients and servers to send control messages that create and remove newsgroups and delete individual articles.
SMTP server for moderated groups | The DNS name of the SMTP mail server that sends articles to the moderators of newsgroups or specifies the directory path where these articles are placed. The directory must be a local directory.
Default moderator domain | The default domain for moderated newsgroups. The domain must be a qualified domain name. Articles posted to moderated newsgroups that have no specified moderator are sent to news_group_name@default_moderator_domain, where news_group_name is the name of the newsgroup to which the article is sent and default_moderator_domain is the value that you specify for this option.
Administrator e-mail account | An e-mail address for receiving the non-delivery reports (NDRs) of moderated newsgroup articles that cannot be delivered to the specified moderator. To enable sending NDRs, create a new DWORD value named MailFromHeader with a value of 1 in the following registry key: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet \Services\NntpSvc\Parameters\


Starting, Stopping, or Pausing NNTP Virtual Servers

You can use IIS Manager in the Microsoft Management Console (MMC) to start, stop, and pause the default NNTP virtual server and any other virtual servers that you have created.

You can also start, stop, and pause the NNTP service. However, stopping the service stops all of the NNTP virtual servers that are running on your computer. When the NNTP service is stopped, you cannot use MMC to perform administrative functions on any NNTP virtual server.

It is important to make sure that only trusted and qualified administrators in your organization have the necessary permissions to start or stop an NNTP virtual server. For more information, see Restricting Operator Access.

When an NNTP virtual server is started, it accepts new connections from users. When you stop an NNTP virtual server, it disconnects current users and does not accept new connections. When you pause an NNTP virtual server, it does not accept new connections but continues to service existing connections. If you want to stop an NNTP virtual server but not disconnect users currently connected to the virtual server, you can also choose to shut down gracefully.

important Important You must be a member of the Administrators group on the local computer to perform the following procedure (or procedures), or you must have been delegated the appropriate authority. As a security best practice, log on to your computer using an account that is not in the Administrators group, and then use the Run as command to run IIS Manager as an administrator. From the command prompt, type runas /user:administrative_accountname "mmc %systemroot%\system32\inetsrv\iis.msc".

To start, stop, or pause an NNTP virtual server

  1. In IIS Manager, expand the local computer, and then click the NNTP virtual server that you want.
  2. On the Action menu, click Start, Stop, or Pause.

To shut down an NNTP virtual server gracefully

  1. Pause the virtual server to prevent new connections.
  2. To check for current users, use IIS Manager. Click Current Sessions. All current users are listed.
  3. If you want to block current users from posting new articles, click the NNTP Settings tab, and then clear the Allow client posting check box.
  4. Stop the NNTP virtual server after all of the current users have disconnected.
Related Topics
  • For information on starting, stopping, or pausing the NNTP service, see Starting, Stopping, or Pausing the NNTP Service.


Starting, Stopping, or Pausing the NNTP Service

The NNTP service runs as a service on computers running a member of the Windows Server 2003 family. There can be multiple NNTP virtual servers on a computer, but only one instance of the NNTP service.

It is important to make sure that only trusted and qualified administrators in your organization have the necessary permissions to start or stop the NNTP service. For more information, see Restricting Operator Access.

You can start, stop, or pause each virtual server independently of one another while the NNTP service is running. It is important to remember, however, that pausing or stopping the entire NNTP service will affect all of the NNTP virtual servers. When the service is stopped, you cannot use Microsoft Management Console (MMC)to perform administrative functions on any NNTP virtual server.

The one exception is that, in MMC only, you can start a virtual server while the NNTP service is stopped. Starting an NNTP virtual server will also restart the entire the NNTP service. This, in turn, will start all other NNTP virtual servers that had been running when the NNTP service was originally stopped.

When you start the NNTP service, it accepts new connections from users. When you stop the NNTP service, it disconnects current users and does not accept new connections. When you pause the NNTP service, every running NNTP virtual server stops accepting new connections but continues to service existing connections. If you want to stop the NNTP service but not disconnect users currently connected to each of the virtual servers, you can also choose to shut down gracefully.

important Important You must be a member of the Administrators group on the local computer to perform the following procedure (or procedures), or you must have been delegated the appropriate authority. As a security best practice, log on to your computer using an account that is not in the Administrators group, and then use the Run as command to run IIS Manager as an administrator. From the command prompt, type runas /user:administrative_accountname "mmc %systemroot%\system32\inetsrv\iis.msc".

To start, stop, or pause the NNTP service

  1. From the Start menu, point to Administrative Tools, and then click Component Services.
  2. In the Component Services box, click Services (Local).
  3. In the details pane, right-click Network News Transfer Protocol (NNTP), and then click Start, Stop, or Pause.

note Note When you restart the NNTP service, all NNTP virtual servers that were running when you shut down the service will automatically restart. However, an NNTP virtual server that was already stopped when the service was shut down will remain stopped, even after the NNTP service is restarted.

To shut down the NNTP service gracefully

  1. Follow the previous procedure to pause the NNTP service. This option prevents new connections.
  2. Check for current users on each of your NNTP virtual servers. In IIS Manager, expand each NNTP virtual server and click Current Sessions. All current users are listed.
  3. If you want to block current users from posting new articles, click the NNTP Settings tab, and then clear the Allow client posting check box.
  4. Stop each NNTP virtual server after all of the current users have disconnected.
  5. After all of the current users have disconnected from each virtual server, stop the NNTP service.
Related Topics
  • For information on starting, stopping, or pausing NNTP virtual servers, see Starting, Stopping, or Pausing NNTP Virtual Servers.


NNTP Security

By default, any user who can connect to the Network News Transfer Protocol (NNTP) service can view all newsgroups. These users connect anonymously, which means that they do not have to supply a user name or password. The Setup program creates a different Windows user account that is used by all anonymous users.

You can configure security to control who has access to specific newsgroups and who can operate the NNTP service. You can also restrict access on the basis of the client computer IP address. If users connect to the NNTP service over a public network, you can encrypt that connection by using the Secure Sockets Layer (SSL) protocol so that others cannot intercept the articles being sent and received.

Security is based on Windows user accounts and directory permissions. User access to newsgroups is restricted on the basis of user name and password.

This section includes the following information:

  • Restricting Access to Newsgroups: Describes how to restrict newsgroup access and set authentication methods.
  • Limiting Access by IP Address: Describes how to restrict access to the NNTP service by the IP address of the client computer.
  • Restricting Operator Access: Describes how to add and remove NNTP operator privileges.
  • Securing Connections with SSL: Describes Secure Sockets Layer (SSL) concepts and how to implement them.


Restricting Access to Newsgroups

You can control access to individual newsgroups or sets of newsgroups by setting permissions for the directories that contain those newsgroups. You can set permissions for an individual directory or for a set of directories. You can also limit access to all newsgroups according to the IP address of the client computer.

If you do not want to restrict access to a newsgroup, enable anonymous access and do not set any permissions for the directory that contains the newsgroup. To enable anonymous access, on the NNTP Access tab, click the Authentication button under Access control, and then select the Allow anonymous check box.

To restrict access to a newsgroup

  1. Create Windows user accounts for users. It is recommended that you organize users into groups and then grant permissions by group to simplify administration. If possible, use accounts and groups that are already established in your organization.
  2. Define permissions for the directory that contains the newsgroup. Be sure to give the LocalSystem account full access to all newsgroup directories so that the Network News Transfer Protocol (NNTP) service has access to newsgroup files.
  3. Set the authentication method used by the NNTP service.

The NNTP service supports two methods for authentication of users:

  • Basic authentication
  • Integrated Windows authentication

important Important You must be a member of the Administrators group on the local computer to perform the following procedure (or procedures), or you must have been delegated the appropriate authority. As a security best practice, log on to your computer using an account that is not in the Administrators group, and then use the Run as command to run IIS Manager as an administrator. From the command prompt, type runas /user:administrative_accountname "mmc %systemroot%\system32\inetsrv\iis.msc".

To set the authentication method

  1. In IIS Manager, expand the local computer, right-click the NNTP virtual server, and then click Properties.
  2. On the Access tab, under Access control, click Authentication.
  3. Select one or more of the following:
    • The Allow anonymous check box.
    • The Basic authentication check box.
    • The Integrated Windows Authentication check box.
    • The Enable SSL client authentication check box.

      • important Important If you are going to require only Basic authentication, it is highly recommended that you also enable SSL to prevent user names and passwords from being compromised during transmission.

  4. To require Secure Sockets Layer (SSL) authentication, select the Require SSL client authentication check box.
  5. To associate client certificates with Windows user accounts, select the Enable client certificate mapping to Windows user accounts check box, and then click Client Mappings.
Related Topics
  • For information on limiting access by IP address, see Limiting Access by IP Address.
  • For information on restricting operator access, see Restricting Operator Access.
  • For information on securing connections with SSL, see Securing Connections with SSL.


Limiting Access by IP Address

You can limit access to the NNTP service by the IP address of the client computer. By default, all IP addresses have access to the NNTP service.

You can either allow or deny access to a specific list of IP addresses. IP addresses can be specified individually or as a group by using a subnet mask. You can also specify IP addresses by using a domain name, but doing so adds the overhead of a DNS lookup for each connection.

important Important You must be a member of the Administrators group on the local computer to perform the following procedure (or procedures), or you must have been delegated the appropriate authority. As a security best practice, log on to your computer using an account that is not in the Administrators group, and then use the Run as command to run IIS Manager as an administrator. From the command prompt, type runas /user:administrative_accountname "mmc %systemroot%\system32\inetsrv\iis.msc".

To limit access by IP address
  1. In IIS Manager, expand the local computer, right-click the NNTP virtual server, and then click Properties.
  2. On the Access tab, under Connection control, click Connection.
  3. In the Connection box, click All except the list below to deny access to a list of IP addresses, or click Only the list below to allow access to a list of IP addresses.
  4. In the Connection box, click Add for each IP address you want to grant or deny access to the NNTP virtual server.
  5. In the Computer box, click one of the following options: Single Computer, Group of computers, or Domain. Then proceed as follows:
    • For the Single Computer option: In IP address, type the IP address of the computer. (If you don't know the IP address, click DNS Lookup.)
    • For the Group of computers option: In Subnet address, type the IP address. Then, in Subnet mask, type the subnet mask for the group of computers.
    • For the Domain option: In Name, type the domain name of the computer.
  6. Click OK.
Related Topics
  • For information on restricting operator access, see Restricting Operator Access.
  • For information on securing connections with SSL, see Securing Connections with SSL.


Restricting Operator Access

Operators of the NNTP service must be assigned operator user rights. By default, everyone in the Administrators group on computers running a member of the Windows Server 2003 family is assigned operator user rights.

important Important You must be a member of the Administrators group on the local computer to perform the following procedure (or procedures), or you must have been delegated the appropriate authority. As a security best practice, log on to your computer using an account that is not in the Administrators group, and then use the Run as command to run IIS Manager as an administrator. From the command prompt, type runas /user:administrative_accountname "mmc %systemroot%\system32\inetsrv\iis.msc".

To add an operator

  1. In IIS Manager, expand the local computer, right-click the NNTP virtual server, and then click Properties.
  2. On the Security tab, click Add.
  3. In the Select Users or Groups box, click Locations, and then click the domain of the operator you want to add.
  4. In the Select Users or Groups box, click Object Types, click the operator or group, and then click OK.
  5. In the Select Users or Groups box, type the object name to select, or click Advanced to search for a particular object.
  6. After you make all of your selections, click OK.

To remove an operator

  1. In IIS Manager, expand the local computer, right-click the NNTP virtual server, and then click Properties.
  2. On the Security tab, in the Operators list, click the operator that you want to remove.
  3. On the Security tab, click Remove, and then click OK.
Related Topics
  • For information on limiting access by IP address, see Limiting Access by IP Address.
  • For information on securing connections with SSL, see Securing Connections with SSL.


Securing Connections with SSL

Secure Sockets Layer (SSL) provides a secure, encrypted connection between the NNTP service and the client computer. SSL can protect your private information when users connect across a public network such as the Internet.

SSL support requires an SSL certificate, and this certificate has to be installed on a computer running a member of the Windows Server 2003 family. SSL must also be supported by the client software. Microsoft Outlook® Express supports SSL.

If a server certificate is installed, the NNTP service uses SSL whenever a client requests it. You can optionally require SSL for all newsgroups or for newsgroups located in a virtual directory. You can also use SSL authentication of clients.

To enable SSL

  • Obtain and install an SSL server certificate.

important Important You must be a member of the Administrators group on the local computer to perform the following procedure (or procedures), or you must have been delegated the appropriate authority. As a security best practice, log on to your computer using an account that is not in the Administrators group, and then use the Run as command to run IIS Manager as an administrator. From the command prompt, type runas /user:administrative_accountname "mmc %systemroot%\system32\inetsrv\iis.msc".

To require an SSL connection for access to newsgroups

  1. In IIS Manager, expand the local computer, expand the NNTP virtual server, and then click Virtual Directories.
  2. In the details pane, right-click the virtual directory that you want to modify, and then click Properties.
  3. On the General tab, click Secure.
  4. In the Security box, select the Require secure channel check box.

To enable SSL authentication for clients

  1. In IIS Manager, expand the local computer, right-click the NNTP virtual server, and then click Properties.
  2. On the Access tab, click Authentication.
  3. In the Authentication Methods box, select the Enable SSL client authentication check box.
Related Topics
  • For information on limiting access by IP address, see Limiting Access by IP Address.
  • For information on restricting operator access, see Restricting Operator Access.


Managing Newsgroups

As soon as you create your newsgroups, users can begin posting articles to them. If you want a moderator to review new articles before they are posted, define a moderated newsgroup.

You can change the properties of an existing newsgroup or delete the newsgroup if you no longer need it. You can also select options that enable the NNTP service to delete articles after a specified number of hours or when the amount of disk space used by newsgroups reaches specified limits. Finally, you can filter which newsgroups are visible to users and the number that will display whenever the Newsgroups node is selected under the Network News Transfer Protocol (NNTP) virtual server.

This section includes the following information:

  • Creating Newsgroups: Describes how to use the New Newsgroup Wizard to create a newsgroup.
  • Moderating Newsgroups: Introduces the concept of moderating newsgroups, how to enable moderating, and how to create a moderated newsgroup.
  • Editing and Deleting Newsgroups: Describes how to edit the properties of an existing NNTP service newsgroup or delete a newsgroup that you no longer need.
  • Defining Newsgroup Limits and Expirations: Describes how to limit the length of time articles are kept in an NNTP service newsgroup by defining expiration policies for newsgroups.
  • Limiting Newsgroup Enumeration: Describes how to limit the number of newsgroups that will be displayed in IIS Manager.


Creating Newsgroups

Use the New Newsgroup Wizard to create a newsgroup. When you create a new newsgroup, the NNTP service creates the directory for the newsgroup automatically. If you want a moderator to review new articles before they are posted, you can create a moderated newsgroup.

important Important You must be a member of the Administrators group on the local computer to perform the following procedure (or procedures), or you must have been delegated the appropriate authority. As a security best practice, log on to your computer using an account that is not in the Administrators group, and then use the Run as command to run IIS Manager as an administrator. From the command prompt, type runas /user:administrative_accountname "mmc %systemroot%\system32\inetsrv\iis.msc".

To create a newsgroup

  1. In IIS Manager, expand the local computer, and then expand the NNTP virtual server that you want.
  2. Right-click Newsgroups, point to New, and then click Newsgroup.
  3. Follow the steps in the New Newsgroup Wizard:
    • In Name, type the name of the newsgroup you want to create.
    • In Description, type a brief description of the newsgroup function.
    • If you want, in Pretty name type another name for the newsgroup, which will be returned by the List Prettynames NNTP command. The pretty name is another alias for the newsgroup that can be displayed by clients.
    • Click Finish.
Related Topics
  • For information on moderated newsgroups, see Moderating Newsgroups.
  • For information on editing and deleting newsgroups, see Editing and Deleting Newsgroups.
  • For information on defining newsgroup limits and expirations, see Defining Newsgroup Limits and Expirations.
  • For information on limiting newsgroup enumeration, see Limiting Newsgroup Enumeration.


Moderating Newsgroups

If you want to control what articles are posted to a newsgroup, you should create a moderated newsgroup. Articles submitted to a moderated newsgroup are not posted until they are approved by the moderator you have chosen for that newsgroup.

note Note Microsoft recommends having a moderator for every newsgroup, especially if users outside your organization are allowed to make postings on your server. A moderator can filter inappropriate material and he or she can detect if someone is trying to compromise information on the server or compromise the server itself.

When a user submits an article to a moderated newsgroup, the NNTP service sends the article to the newsgroup moderator. The moderator can either approve the article and send it back to the NNTP service to be posted or discard the article. For discarded articles, the moderator can send a message to the article's author to explain why the article was rejected.

Any NNTP client can be used to post messages to a moderated newsgroup. However, the moderator needs to use an NNTP client that supports moderating functions.

To use moderated newsgroups, you must specify either a Simple Mail Transfer Protocol (SMTP) mail server for sending articles directly to the moderators or a directory where the articles are stored for the moderators.

You can also specify a default moderator domain. If you choose to use the default moderator for a newsgroup, articles are sent to newsgroup_name@default_domain, where newsgroup_name is the name of the newsgroup (the periods have been replaced by underscores). For example, articles posted to the newsgroup rec.sports.tennis, with a default domain of contoso.com, are sent to rec_sports_tennis@contoso.com.

important Important You must be a member of the Administrators group on the local computer to perform the following procedure (or procedures), or you must have been delegated the appropriate authority. As a security best practice, log on to your computer using an account that is not in the Administrators group, and then use the Run as command to run IIS Manager as an administrator. From the command prompt, type runas /user:administrative_accountname "mmc %systemroot%\system32\inetsrv\iis.msc".

To enable moderated newsgroups

  1. In IIS Manager, expand the local computer, right-click the NNTP virtual server, and then click Properties.
  2. On the Settings tab, in SMTP server for moderated groups, type the DNS name or the IP address of the SMTP server, or type the path to the directory where articles are stored for the moderators. The directory path must be a local directory. You should normally set this value to the pickup directory of the SMTP server. By default, this directory is \Inetpub\Mailroot\Pickup.
  3. On the Settings tab, in Default moderator domain, type the e-mail domain for default moderators.
  4. Click OK.
  5. If you specified an SMTP server, be sure that the user ID under which the NNTP service is running (by default, the System Account) is defined as an account on the SMTP server.

To create a moderated newsgroup

  1. If necessary, create the newsgroup. After you finish the New Newsgroup Wizard, the procedure is the same for both new and existing newsgroups.
  2. In IIS Manager, expand the local computer, expand the NNTP virtual server, and then click Newsgroups.
  3. In the details pane, right-click the newsgroup that you want, and then click Properties.
  4. On the General tab, select the Moderated check box.
  5. In Moderator, type the e-mail address of the moderator, or click Set Default to use the default moderator.
  6. Click OK.
Related Topics
  • For information on creating newsgroups, see Creating Newsgroups.
  • For information on editing and deleting newsgroups, see Editing and Deleting Newsgroups.
  • For information on limiting newsgroup enumeration, see Limiting Newsgroup Enumeration.


Editing and Deleting Newsgroups

You can edit the properties of an existing NNTP service newsgroup or delete a newsgroup that you no longer need.

important Important You must be a member of the Administrators group on the local computer to perform the following procedure (or procedures), or you must have been delegated the appropriate authority. As a security best practice, log on to your computer using an account that is not in the Administrators group, and then use the Run as command to run IIS Manager as an administrator. From the command prompt, type runas /user:administrative_accountname "mmc %systemroot%\system32\inetsrv\iis.msc".

To edit or delete a newsgroup

  1. In IIS Manager, expand the local computer, expand the NNTP virtual server, and then click Newsgroups.
  2. In the details pane, right-click the newsgroup that you want, and then click one of the following:
    • Properties, to edit the newsgroup properties.
    • Rename, to rename the newsgroup.
    • Delete, to remove the newsgroup.
Related Topics
  • For information on creating newsgroups, see Creating Newsgroups.
  • For information on moderated newsgroups, see Moderating Newsgroups.
  • For information on defining newsgroup limits and expirations, see Defining Newsgroup Limits and Expirations.
  • For information on limiting newsgroup enumeration, see Limiting Newsgroup Enumeration.


Defining Newsgroup Limits and Expirations

You can limit how long articles are kept in an NNTP service newsgroup by defining expiration policies for newsgroups. An expiration policy can apply to a single newsgroup or to any number of newsgroups. You can define as many policies as you need. In each case, the oldest articles are deleted first.

If you do not specify an expiration policy for a newsgroup, you should delete articles manually when they are no longer needed.

important Important You must be a member of the Administrators group on the local computer to perform the following procedure (or procedures), or you must have been delegated the appropriate authority. As a security best practice, log on to your computer using an account that is not in the Administrators group, and then use the Run as command to run IIS Manager as an administrator. From the command prompt, type runas /user:administrative_accountname "mmc %systemroot%\system32\inetsrv\iis.msc".

To create an expiration policy

  1. In IIS Manager, expand the local computer, and then expand the NNTP virtual server that you want.
  2. Right-click Expiration Policies, point to New, and then click Expiration Policy.
  3. Follow the steps in the New NNTP Expiration Policy Wizard.

You can modify an existing expiration policy, including changing the newsgroups to which the policy applies, with the Expiration Policy dialog box.

To modify an expiration policy

  1. In IIS Manager, expand the local computer, expand the NNTP virtual server that you want, and then click Expiration Policies.
  2. In the details pane, right-click the expiration policy that you want to modify, and then click Properties.
  3. Change the options in the Expiration Policy box as needed.

note Note Use the Move Up and Move Down buttons to specify which newsgroups the expiration policy should apply to and in what order. For example, if you want to include all of the alt.tv newsgroups (alt.tv.*) in the policy, but exclude the alt.tv.cable newsgroup from the policy, meaning that you want to apply an expiration policy to all of the alt.tv newsgroups except the alt.tv.cable newsgroup, use the Move Up and Move Down buttons to include alt.tv.* first and exclude alt.tv.cable second.

Related Topics
  • For information on creating newsgroups, see Creating Newsgroups.
  • For information on moderated newsgroups, see Moderating Newsgroups.
  • For information on editing and deleting newsgroups, see Editing and Deleting Newsgroups.
  • For information on limiting newsgroup enumeration, see Limiting Newsgroup Enumeration.


Limiting Newsgroup Enumeration

Use the Find Newsgroups dialog box to limit the number of newsgroups that will be displayed when you select Newsgroups, which is beneath the NNTP virtual server node.

Potentially, a server can store thousands of newsgroups; in some cases, it might not be possible to enumerate all of them. Administrators may want to filter the newsgroups that will be enumerated. You can filter newsgroups by type, by number, or both.

important Important You must be a member of the Administrators group on the local computer to perform the following procedure (or procedures), or you must have been delegated the appropriate authority. As a security best practice, log on to your computer using an account that is not in the Administrators group, and then use the Run as command to run IIS Manager as an administrator. From the command prompt, type runas /user:administrative_accountname "mmc %systemroot%\system32\inetsrv\iis.msc".

To limit the number of enumerated newsgroups
  1. In IIS Manager, expand the local computer, and then expand the NNTP virtual server that you want.
  2. Right-click Newsgroups, and then click Limit groups enumeration.
  3. In the Newsgroups field, type the kind of the newsgroup you want to display when Newsgroup is selected. All other types will be filtered out. Use wildcards, such as alt.*. In this example, only newsgroups under the alt hierarchy would be visible to users. By default, every kind of newsgroup is enumerated.

    note Note You can also type the name of a specific newsgroup in this space, but then only that newsgroup will be visible. Only one wildcard or one newsgroup can be entered at a time.

  4. If you do not want to have a limit on the number of enumerated newsgroups, clear the Limit number of items on the result pane check box. This check box is selected by default.
  5. In Maximum number of items, type the maximum number of newsgroups that you want to enumerate on this virtual server. This limit will only apply when the Limit number of items on the result pane check box is selected. The default is 100 newsgroups.
Related Topics
  • For information on creating newsgroups, see Creating Newsgroups.
  • For information on editing and deleting newsgroups, see Editing and Deleting Newsgroups.
  • For information on moderated newsgroups, see Moderating Newsgroups.
  • For information on defining newsgroup limits and expirations, see Defining Newsgroup Limits and Expirations.


Configuring Expiration Policies

Expiration policies can be set separately for each virtual server. Expiration policies specify the article age limit for newsgroups; they also specify the newsgroups to which the policy applies. If a newsgroup is assigned to more than one expiration policy, the more restrictive policy applies.

important Important You must be a member of the Administrators group on the local computer to perform the following procedure (or procedures), or you must have been delegated the appropriate authority. As a security best practice, log on to your computer using an account that is not in the Administrators group, and then use the Run as command to run IIS Manager as an administrator. From the command prompt, type runas /user:administrative_accountname "mmc %systemroot%\system32\inetsrv\iis.msc".

To create a new expiration policy

  1. In IIS Manager, expand the local computer, and then expand the NNTP virtual server that you want.
  2. Right-click Expiration Policies, point to New, and then click Expiration Policy.
  3. Follow the steps in the New NNTP Expiration Policy Wizard. The wizard will prompt you for the name of an expiration policy, the newsgroups it will affect, and the expiration period. These properties are described in the table below.

To edit an existing expiration policy

  1. In IIS Manager, expand the local computer, expand the NNTP virtual server that you want, and then click Expiration Policies.
  2. In the details pane, right-click the expiration policy that you want to edit, and then click Properties.
  3. Change the options in the Expiration Policy box as needed.

    note Note Use the Move Up and Move Down buttons to specify which newsgroups the expiration policy should apply to and in what order. For example, if you want to include all of the alt.tv newsgroups (alt.tv.*) in the policy, but exclude the alt.tv.cable newsgroup from the policy, meaning that you want to apply an expiration policy to all of the alt.tv newsgroups except the alt.tv.cable newsgroup, use the Move Up and Move Down buttons to include alt.tv.* first and exclude alt.tv.cable second.

The following properties can be set for expiration policies:

Option | Description
Articles older than (Hours) | Removes articles that are older than a specified number of hours. The default is 168 hours (7 days). To have no age limit, clear the check box.
Affected newsgroups | A list of the newsgroups to which the policy applies. The asterisk (*) wildcard character specifies multiple newsgroups. For example, rec.* denotes and includes all newsgroups starting with "rec.".
Add | Click this button to open the Add Newsgroup dialog box where you can type in the names of newsgroups to add to this expiration policy. Use the asterisk (*) wildcard character to specify multiple newsgroups.
Remove | To remove a newsgroup from an expiration policy, select the newsgroup in the list of Affected newsgroups and click Remove.
Move Up | To move a newsgroup up in an expiration policy, select the newsgroup in the list of Affected newsgroups and click Move Up.
Move Down | To move a newsgroup down in an expiration policy, select the newsgroup in the list of Affected newsgroups and click Move Down.

Related Topics
  • For information on creating expiration policies, see Defining Newsgroup Limits and Expirations.


SMTP Administration

The Internet-standard Simple Mail Transfer Protocol (SMTP) can be used to transport and deliver messages based on specifications in Request for Comments (RFC) 821 and RFC 822. The SMTP server also includes enhancements that build upon the basic delivery functions of the protocol. There are options available that give you control over the routing and delivery of messages, and that provide secure communications.

This section includes the following information:

  • Configuring SMTP Virtual Servers: Describes how to set an SMTP virtual server display name and the IP address/TCP port combination.
  • Starting, Stopping, or Pausing SMTP Virtual Servers: Introduces the concepts of starting, stoping, and pausing an SMTP virtual server and how it differs from the same actions on a service.
  • Starting, Stopping, or Pausing the SMTP Service: Describes the concept of multiple virtual servers and how to start, stop, or pause them individually.
  • Configuring Startup Settings: Describes how to configure the default state of the SMTP service at startup.
  • Setting Connections: Describes how to set incoming and outgoing connection limits.
  • Creating Additional SMTP Virtual Servers: Describes how to create new SMTP virtual servers.
  • Setting up Virtual Servers for Clustering: Introduces the concept of clustered servers and how to configure virtual servers for that environment.
  • Enabling Protocol Logging: Describes how to enable logging in ASCII or ODBC formats.
  • SMTP Security: Introduces security and access concepts.
  • Delivering Messages: Describes the settings that determine how delivery occurs, including routing, transmission, and security options.
  • Managing Messages: Describes how to set connection limits to maximize performance, how to set limits for message size and number of recipients, and how to manage undeliverable messages.
  • LDAP Routing: Describes how to configure the SMTP service so that it will consult an LDAP server to resolve senders and recipients.
  • Monitoring Message Transactions: Describes four protocol log formats and how to implement them.
  • SMTP Domains: Introduces local and remote domain concepts.


Configuring SMTP Virtual Servers

There are two identifying features for a Simple Mail Transfer Protocol (SMTP) virtual server: the display name and the IP address/TCP port combination. Setup assigns a Microsoft Management Console display name for the default SMTP virtual server. You can keep the name (Default SMTP Virtual Server) or change it using the following steps. You can also select the IP address that will be associated with this SMTP virtual server.

important Important You must be a member of the Administrators group on the local computer to perform the following procedure (or procedures), or you must have been delegated the appropriate authority. As a security best practice, log on to your computer using an account that is not in the Administrators group, and then use the Run as command to run IIS Manager as an administrator. From the command prompt, type runas /user:administrative_accountname "mmc %systemroot%\system32\inetsrv\iis.msc".

To identify an SMTP virtual server
  1. In IIS Manager, right-click the SMTP virtual server, and then click Rename.
  2. Type a new name for the virtual server name if you want to change it from the default. Do not use extended characters when naming your SMTP virtual server.
  3. Right-click the SMTP virtual server, and click Properties.
  4. On the General tab, in the IP address list, click the IP address for this virtual server. The SMTP virtual server can respond to connection requests for all IP addresses configured on the computer. To identify the TCP port for each IP address configured for the virtual server, click Advanced. Port 25 is the SMTP standard TCP port and is recommended. More than one virtual server can use Port 25, provided they are associated with different IP addresses.

note Note When you change an SMTP virtual server's configuration, you may want to use the Pause command. Pausing prevents new client connections but enables Microsoft SMTP Service to continue to process existing client connections and deliver queued messages.


Starting, Stopping, or Pausing SMTP Virtual Servers

The Default SMTP Virtual Server starts upon installation of the SMTP service. You can pause, stop, and start it in IIS Manager.

You can also start, stop, and pause the entire SMTP service. However, if you have more than one virtual server, stopping the service affects all of the Simple Mail Transfer Protocol (SMTP) virtual servers running on your computer. When the SMTP service is stopped, you cannot use IIS in Microsoft Management Console (MMC) to perform administrative functions on any SMTP virtual server.

important Important Make sure only trusted administrators in your organization have the necessary permissions to start or stop an SMTP virtual server. For more information, see Setting Operator Permissions.

You can stop and start the SMTP service manually. However, while it is operating, you must be careful when stopping, pausing, or restarting the service to minimize the impact on users.

If the default startup setting is Manual, you can use IIS in Microsoft Management Console (MMC) to start a Simple Mail Transfer Protocol (SMTP) virtual server.

important Important You must be a member of the Administrators group on the local computer to perform the following procedure (or procedures), or you must have been delegated the appropriate authority. As a security best practice, log on to your computer using an account that is not in the Administrators group, and then use the Run as command to run IIS Manager as an administrator. From the command prompt, type runas /user:administrative_accountname "mmc %systemroot%\system32\inetsrv\iis.msc".

To start an SMTP virtual server

  • In IIS Manager, expand the local computer, right-click the SMTP virtual server, and click Start.

You can stop a Simple Mail Transfer Protocol (SMTP) virtual server for configuration changes and maintenance.

To stop an SMTP virtual server

  • In IIS Manager, expand the local computer, right-click the SMTP virtual server, and click Stop.
You can pause a Simple Mail Transfer Protocol (SMTP) virtual server for configuration changes and maintenance. Pausing prevents new client connections, but it enables the virtual server to continue processing existing client connections and delivering queued messages.

To pause an SMTP virtual server

  • In IIS Manager, expand the local computer, right-click the SMTP virtual server, and click Pause.
Related Topics
  • For information on managing the SMTP service, see Starting, Stopping, or Pausing the SMTP Service.


Starting, Stopping, or Pausing the SMTP Service

The SMTP service runs as a service on Windows Server 2003, Standard Edition and Windows Server 2003, Enterprise Edition, and it starts upon installation. Although there is only one SMTP service on a computer, it is possible to have more than one Simple Mail Transfer Protocol (SMTP) virtual server. You can start, stop, or pause each virtual server independently of one another while the SMTP service is running.

If you have more than one SMTP virtual server, it is important to remember that pausing or stopping the entire SMTP service will affect all of the SMTP virtual servers. When the service is stopped, you cannot use IIS in Microsoft Management Console (MMC) to perform administrative functions on any SMTP virtual server.

note Note The one exception is that you can start a virtual server while the SMTP service is stopped. Starting an SMTP virtual server will also restart the entire SMTP service. This, in turn, will start all other SMTP virtual servers that had been running when the SMTP service was originally stopped.

When you start the SMTP service, it accepts new connections from users. When you stop the SMTP service, it does not accept new connections. When you pause the SMTP service, every running SMTP virtual server will cease accepting new connections but will continue to service existing connections.

important Important You must be a member of the Administrators group on the local computer to perform the following procedure (or procedures), or you must have been delegated the appropriate authority. As a security best practice, log on to your computer using an account that is not in the Administrators group, and then use the Run as command to perform this procedure as an Administrator.

To start, stop, or pause the SMTP service

  1. From the Start menu, point to Administrative Tools, and then click Component Services.
  2. In the console tree, click Services (Local).
  3. In the details pane, right-click Simple Mail Transfer Protocol (SMTP), and then click Start, Stop, or Pause.

note Note When you restart the SMTP service, all SMTP virtual servers that had been running when you shut down the service will automatically restart. However, an SMTP virtual server that was already stopped when the service was shut down will remain stopped, even after the SMTP service restarts.

Related Topics
  • For information about starting, stopping, or pausing an SMTP virtual server, see Starting, Stopping, or Pausing SMTP Virtual Servers.


Configuring Startup Settings

You can use Administrative Tools to configure the default state of the SMTP service at startup.

important Important You must be a member of the Administrators group on the local computer to perform the following procedure (or procedures), or you must have been delegated the appropriate authority. As a security best practice, log on to your computer using an account that is not in the Administrators group, and then use the Run as command to perform this procedure as an Administrator.

To configure the default startup settings

  1. From the Start menu, point to Administrative Tools, and then click Component Services.
  2. In the console tree, click Services (Local).
  3. In the details pane, right-click Simple Mail Transfer Protocol (SMTP), and then click Properties.
  4. On the General tab, in the Startup type list, click Automatic, Manual, or Disabled.


Setting Connections

A connection is initiated whenever a message is sent to or received from a remote server.

note Note Designating the TCP port that the SMTP service uses to receive incoming messages is done when you configure the Simple Mail Transfer Protocol (SMTP) virtual server.

Setting connection limits and imposing connection time-outs can make it more difficult for someone to initiate a malicious attack (such as denial of service) against your virtual server.

important Important You must be a member of the Administrators group on the local computer to perform the following procedure (or procedures), or you must have been delegated the appropriate authority. As a security best practice, log on to your computer using an account that is not in the Administrators group, and then use the Run as command to run IIS Manager as an administrator. From the command prompt, type runas /user:administrative_accountname "mmc %systemroot%\system32\inetsrv\iis.msc".

To configure incoming connections
  1. In IIS Manager, right-click the SMTP virtual server, and then click Properties.
  2. On the General tab, select the Limit number of connections to check box (the default is no limit), and set the following options.
    Option | Description
    Limit number of connections to | When the check box is selected, this option specifies the number of concurrent connections for incoming message delivery. The minimum is 1 connection. When the check box is not selected, no limit is imposed.
    Connection time-out (minutes) | Specifies the time allowed before an inactive connection is closed. The default is 10 minutes.

To configure outbound connections

  1. In IIS Manager, right-click the SMTP virtual server, and then click Properties.
  2. Click the Delivery tab, and click Outbound connections.
  3. In the Outbound Connections dialog box, select a check box and set the following options.
    Option | Description
    Limit number of connections to When the check box is selected, this option specifies the total number of simultaneous outbound connections to all remote domains that can exist at one time. The default is 1,000 connections. The minimum is 1.

    This setting can be used to improve system performance in conjunction with the Limit number of messages per connection to check box on the Messages tab.
    Time-out (minutes) | Specifies the time allowed before an inactive connection is closed. The default is 10 minutes.
    Limit number of connections per domain to | When the check box is selected, this option limits connections to any single remote domain. The default is 100 connections. This number should be less than or equal to the value for the Limit number of connections to option.
    TCP port | Designates the TCP port used for outgoing transmissions. The default is port 25. The outgoing port setting can be the same as that for incoming transmissions or it can be different.
Related Topics
  • For information about configuring an SMTP virtual server, see Configuring SMTP Virtual Servers.
  • For information about limiting the number of messages per connection, see Limiting the Number of Messages per Connection.


Creating Additional SMTP Virtual Servers

In most cases, you should need only one Simple Mail Transfer Protocol (SMTP) virtual server. However, if you are hosting multiple domains and want to have more than one default domain, for example, you can create multiple SMTP virtual servers. To an end user, each SMTP virtual server appears as a separate server with a unique IP address/TCP port combination.

When you create an SMTP virtual server, you are prompted to enter a path to your home directory. This directory must be local to the computer on which the SMTP service runs.

important Important You must be a member of the Administrators group on the local computer to perform the following procedure (or procedures), or you must have been delegated the appropriate authority. As a security best practice, log on to your computer using an account that is not in the Administrators group, and then use the Run as command to run IIS Manager as an administrator. From the command prompt, type runas /user:administrative_accountname "mmc %systemroot%\system32\inetsrv\iis.msc".

To create a new SMTP virtual server
  1. If the SMTP virtual server will be using a new IP address, configure an IP address. From the Start menu, click Control Panel, and then double-click Network Connections. See Windows® Server 2003 family Help for more information on Network Connections.
  2. After you configure the IP address, in IIS Manager, right-click an existing SMTP virtual server, point to New, and then click Virtual Server.
  3. Follow the steps in the New SMTP Virtual Server Wizard. Be sure to select an IP address/TCP port combination that is not being used by another SMTP virtual server. The recommended TCP port is 25, which is the SMTP standard TCP port. More than one virtual server can use the same TCP port provided they are configured with different IP addresses.
  4. If the default startup setting for SMTP Service is set to Automatic, the new SMTP virtual server will start automatically. If it doesn't start, it is because you selected an IP address/TCP port combination that is already in use.
  5. Configure the new SMTP virtual server.
Related Topics
  • For information about configuring an SMTP virtual server, see Configuring SMTP Virtual Servers.


Setting up Virtual Servers for Clustering

A server cluster is a group of independent computer systems, known as nodes, working together as a single system to ensure that mission-critical applications and resources remain available to clients. Server clusters provide high availability. High availability in a Simple Mail Transfer Protocol (SMTP) server cluster means that, if one virtual server fails, its work is dispersed to the remaining virtual servers in the cluster, ensuring mail service is not interrupted. The other benefit of server clusters is the failover of server resources, which is when a virtual server goes down and another one comes online to assumes its role.

In clustering, a node is a system that has a working installation of Windows Server 2003, Enterprise Edition and the Cluster service. Microsoft recommends creating a new virtual server on your node for clustering, rather than reconfiguring your default SMTP virtual server.

For more information about Windows Clustering and server clusters, see Windows Server 2003, Enterprise Edition Help. That documentation contains detailed information about setting up and administrating server clusters.

important Important You must be a member of the Administrators group on the local computer to perform the following procedure (or procedures), or you must have been delegated the appropriate authority. As a security best practice, log on to your computer using an account that is not in the Administrators group, and then use the Run as command to run IIS Manager as an administrator. From the command prompt, type runas /user:administrative_accountname "mmc %systemroot%\system32\inetsrv\iis.msc".

To set up an SMTP virtual server for clustering
  1. If necessary, change the default startup setting of the SMTP Service to Manual.
  2. Before creating a new virtual server, in IIS Manager, right-click Default SMTP Virtual Server, and then click Properties.
  3. On the General tab, click Advanced.
  4. Under Address, double-click (All Unassigned).
  5. In the Identification dialog box, change the TCP port number from the default 25. Any unassigned port will work. It is important to change this port number to avoid conflicts with the new SMTP virtual server you will be creating for clustering. Type in the new port number (make sure it is unique), and then click OK.
  6. Create a new SMTP virtual server. After it is created, you will have to manually start it. Make sure to use the default TCP port on the new virtual server, port 25.

    important Important When you get to the Select Home Directory and Default Domain screen of the New SMTP Virtual Server Wizard, be sure to type paths to the shared resource that will be used in clustering. Do not type paths to a local hard drive.

  7. Run the IIS Synchronization command to synchronize all IIS information on your node with the other nodes in the server cluster. At a command prompt, go to the %systemroot%\System32\Inetsrv directory on your node and type iissync servername, where servername is another node in the server cluster. See IIS Help for more information on the IIS Synchronization command.
  8. With the server cluster nodes synchronized, you may still have to check the TCP port numbers on your newly created SMTP virtual server as well as on the default virtual server. Specifically, when you view your local node from other nodes in the server cluster, make sure the TCP port settings are identical to how you set them on the local node. On all nodes, the default SMTP virtual server should no longer point to the default TCP port (25), but the new SMTP virtual server should be assigned port 25. Settings must be identical on every node for clustering to work.
  9. Start Cluster Administrator. Follow the wizard and associate a resource type to the new SMTP virtual server.

    10. note Note In the Parameters dialog box, be sure to select your new SMTP virtual server from the list, and not the default SMTP virtual server. See Windows Server 2003 Enterprise Edition Help for more information about Cluster Administrator.

Related Topics
  • For information on configuring the default startup setting, see Configuring Startup Settings
  • For information on creating additional SMTP virtual servers, see Creating Additional SMTP Virtual Servers.
  • For information on starting, stopping, or pausing SMTP virtual servers, see Starting, Stopping, or Pausing SMTP Virtual Servers.


Enabling Protocol Logging

Use the General tab to enable transaction logging and to select the format. When setting up the log file, keep in mind that the log formats and default file names are the same as those used by other IIS services. If you choose the default names, all transactions for all services are recorded in the same file. You can set up a separate file for each service if you want to maintain separate records.

If you set up the file in a location other than the default, make sure it is stored on a local drive and not on a network.

Auditing server activity with log files is a good way to detect if unauthorized external users are attempting to access your virtual server, or if internal users are trying to access resources they do not have permission to access. For more information about auditing and using Event Viewer, see Windows Server 2003 family Help.

important Important You must be a member of the Administrators group on the local computer to perform the following procedure (or procedures), or you must have been delegated the appropriate authority. As a security best practice, log on to your computer using an account that is not in the Administrators group, and then use the Run as command to run IIS Manager as an administrator. From the command prompt, type runas /user:administrative_accountname "mmc %systemroot%\system32\inetsrv\iis.msc".

To enable logging that uses one of the ASCII text formats
  1. In IIS Manager, right-click the SMTP virtual server, and then click Properties.
  2. On the General tab, select the Enable logging check box.
  3. In the Active log format list, click a transaction log format. If you chose the W3C Extended Log File Format, click the Advanced tab, and then click the items you want to track.
  4. Click Properties, and then set the log file size and location.

To enable logging that uses the ODBC format

  1. Set up an ODBC-compliant database.
  2. In IIS Manager, right-click the SMTP virtual server, and then click Properties.
  3. On the General tab, select the Enable logging check box.
  4. In the Active log format list, click ODBC Logging.
  5. Click Properties, and then set the log file size and location.
Related Topics
  • For information about monitoring message transactions, see Monitoring Message Transactions.
  • For information about setting up an ODBC-compliant database, see Setting up an ODBC-Compliant Database.


SMTP Security

You can specify security settings for a Simple Mail Transfer Protocol (SMTP) virtual server on the two security tabs. These settings apply to all domains on the virtual server.

Tab | Settings
Security | Designates the user accounts that have operator permissions to run the SMTP service. Operators have the ability to configure SMTP virtual server properties.
Access | Contains settings to require authentication and the use of Transport Layer Security (TLS) for all incoming connections. You can also grant or deny access to specific computers or networks.

This section includes the following information:

  • Setting Operator Permissions: Describes how to assign and remove operator permission on SMTP virtual servers.
  • Requiring Authentication for Incoming Connections: Describes how to disable authentication for incoming messages, set clear text authentication for incoming messages, and use integrated Windows authentication to authenticate incoming messages.
  • Requiring Authentication for Outbound Messages: Describes how to disable authentication for outgoing messages, set Basic authentication for outgoing messages, and set Integrated Windows authentication for outgoing messages.
  • Setting IP Access Restrictions to Servers: Describes how to set IP address access restrictions.
  • Setting or Removing Relay Restrictions from Virtual Servers: Describes how to set and remove relay restrictions from a virtual server.
  • Requiring TLS Encryption: Describes how to create and manage key certificates and how to set TLS encryption levels for the server.


Setting Operator Permissions

You can designate which user accounts can have operator permissions for the Simple Mail Transfer Protocol (SMTP) virtual server. After Windows user accounts are set up, you can grant permissions by selecting the account from a list. These permissions can be rescinded by removing the account from the list of virtual server operators.

important Important You must be a member of the Administrators group on the local computer to perform the following procedure (or procedures), or you must have been delegated the appropriate authority. As a security best practice, log on to your computer using an account that is not in the Administrators group, and then use the Run as command to run IIS Manager as an administrator. From the command prompt, type runas /user:administrative_accountname "mmc %systemroot%\system32\inetsrv\iis.msc".

To assign operator permissions
  1. In IIS Manager, right-click the SMTP virtual server, and then click Properties.
  2. Click the Security tab, and click Add.
  3. Select a Windows user account, and then click OK. The selected account will now appear in Operators.

To remove operator permissions

  1. In IIS Manager, right-click the SMTP virtual server, and then click Properties.
  2. Click the Security tab, and in the Operators list, click the operator you want to remove.
  3. Click Remove.

note Note You can also remove operator permissions from the Windows user accounts that are listed in Operators.

Related Topics
  • For information on requiring authentication for incoming connections, see Requiring Authentication for Incoming Connections.
  • For information on requiring authentication for outbound messages, see Requiring Authentication for Outbound Messages.


Requiring Authentication for Incoming Connections

There are three authentication methods available. You can choose one, two, or all three methods. All three are set by default.

important Important The default mail relay settings on the SMTP virtual server allow only mail from authenticated users to be relayed. Therefore, to allow users in your organization to send mail through the virtual server, users must first be authenticated. By choosing one of the methods in the Authentication dialog box, your users will be able to send mail and, at the same time, unauthorized users will not be able to use your virtual server to relay mail.

Authentication option | Description
Anonymous access | An account name or password is not required. You can use this option to disable authentication for the Simple Mail Transfer Protocol (SMTP) virtual server.
Basic authentication | An account name and a password are sent using plaintext. Specify a Windows domain that is appended to the account name for authentication.
Integrated Windows authentication | A Windows account name and password are authenticated using this option.

important Important You must be a member of the Administrators group on the local computer to perform the following procedure (or procedures), or you must have been delegated the appropriate authority. As a security best practice, log on to your computer using an account that is not in the Administrators group, and then use the Run as command to run IIS Manager as an administrator. From the command prompt, type runas /user:administrative_accountname "mmc %systemroot%\system32\inetsrv\iis.msc".

To disable authentication for incoming messages
  1. In IIS Manager, right-click the SMTP virtual server, and then click Properties.
  2. Click the Access tab, and under Access control, click Authentication.
  3. Select the Anonymous access check box, and then clear the remaining check boxes for the other options.

To set clear text authentication for incoming messages

  1. In IIS Manager, right-click the SMTP virtual server, and then click Properties.
  2. Click the Access tab, and under Access control, click Authentication.
  3. Select the Basic authentication check box.
  4. In the Default domain box, type a Windows domain name. This default domain differs from the SMTP virtual server default domain.

To use Integrated Windows authentication to authenticate incoming messages

  1. In IIS Manager, right-click the SMTP virtual server, and then click Properties.
  2. Click the Access tab, and under Access control, click Authentication.
  3. Select the Integrated Windows Authentication check box.
Related Topics
  • For information on requiring authentication for outbound messages, see Requiring Authentication for Outbound Messages.


Requiring Authentication for Outbound Messages

You can configure the Simple Mail Transfer Protocol (SMTP) virtual server to provide the authentication credentials required by a receiving server. There are three types of authentication available: anonymous, Basic (plaintext), and Integrated Windows authentication. Anonymous requires no authentication. With the plaintext option, the account name and password of the server you're connecting to are transmitted in plaintext. The Integrated Windows authentication option requires a Windows account name and password.

The option set here can be overridden for a specific remote domain. Overriding the authentication settings for a remote domain enables you to set the virtual server authentication level to handle most of the transmissions, while allowing exceptions for individual addresses. The following table describes several configuration examples.

SMTP transmissions | Authentication option
Messages are commonly sent to multiple addresses. | Disable authentication for the SMTP virtual server. If attempts to deliver messages to an address fail because of authentication requirements, add a remote domain for the address. Then enable authentication for the domain at the same level required by the server.
Messages are commonly sent to one address, which requires authentication. | Determine what level of authentication is required to connect. Then enable authentication for the SMTP virtual server using the same level. If you want to then send messages to other addresses, set up remote domains and set different authentication options. If you use this option, it is likely that the account name used is the one that identifies the computer set up as the smart host.

important Important You must be a member of the Administrators group on the local computer to perform the following procedure (or procedures), or you must have been delegated the appropriate authority. As a security best practice, log on to your computer using an account that is not in the Administrators group, and then use the Run as command to run IIS Manager as an administrator. From the command prompt, type runas /user:administrative_accountname "mmc %systemroot%\system32\inetsrv\iis.msc".

To disable authentication for outgoing messages

  1. In IIS Manager, right-click the SMTP virtual server, and then click Properties.
  2. Click the Delivery tab, and click Outbound Security.
  3. Click Anonymous access.
  4. Clear all other options.

To set Basic authentication for outgoing messages

  1. In IIS Manager, select the SMTP virtual server, and then click Properties on the Action menu.
  2. On the Delivery tab, click Outbound Security to open the Outbound Security dialog box.
  3. Click Basic authentication.
  4. Under User name and Password, type the account name and password that will grant you access to the computer you are connecting to.

important Important If Basic authentication is your only authentication method, it is strongly recommended that you also require TLS encryption to avoid unauthorized detection of user names and passwords.

To set Integrated Windows authentication for outgoing messages

  1. In IIS Manager, select the SMTP virtual server, and then click Properties on the Action menu.
  2. On the Delivery tab, click Outbound Security to open the Outbound Security dialog box.
  3. Select the Integrated Windows Authentication check box.
  4. Under Account and Password, type a Windows account name and password that will grant you access to the computer you're connecting to.
Related Topics
  • For information on requiring authentication for incoming connections, see Requiring Authentication for Incoming Connections.
  • For information on encrypting outgoing messages, see Requiring TLS Encryption.


Setting IP Access Restrictions to Servers

You can grant or deny Simple Mail Transfer Protocol (SMTP) virtual server access to specific IP addresses. By default, the SMTP virtual server is accessible to all IP addresses. You can set restrictions by specifying a single IP address, a group of addresses using a subnet mask, or a domain name.

important Important You must be a member of the Administrators group on the local computer to perform the following procedure (or procedures), or you must have been delegated the appropriate authority. As a security best practice, log on to your computer using an account that is not in the Administrators group, and then use the Run as command to run IIS Manager as an administrator. From the command prompt, type runas /user:administrative_accountname "mmc %systemroot%\system32\inetsrv\iis.msc".

To set IP address access restrictions

  1. In IIS Manager, right-click the SMTP virtual server, and then click Properties.
  2. Click the Access tab, and under Connection control, click Connection.
  3. Click either Only the list below or All except the list below.
  4. To add to the list of computers, click Add.
  5. To delete from the list of computers, select a listing, and then click Remove.
Related Topics
  • For information on setting or removing relay restrictions from a virtual server, see Setting or Removing Relay Restrictions from Virtual Servers.
  • For information on requiring TLS encryption, see Requiring TLS Encryption.


Setting or Removing Relay Restrictions from Virtual Servers

By default, the SMTP service blocks computers from relaying unwanted mail through the virtual server. To enable relay access through the Simple Mail Transfer Protocol (SMTP) virtual server, click Relay on the Access tab. By default, all computers are blocked except those that meet the authentication requirements designated in the Authentication dialog box, which you can view by clicking Authentication on the Access the tab.

note Note If your virtual server is on the Internet, to avoid propagating unsolicited e-mail, you should not allow relaying.

You can also allow messages to be relayed to a specific remote domain; see Configuring Remote Domains for more information. The domain setting overrides the SMTP virtual server setting.

important Important You must be a member of the Administrators group on the local computer to perform the following procedure (or procedures), or you must have been delegated the appropriate authority. As a security best practice, log on to your computer using an account that is not in the Administrators group, and then use the Run as command to run IIS Manager as an administrator. From the command prompt, type runas /user:administrative_accountname "mmc %systemroot%\system32\inetsrv\iis.msc".

To remove relay restrictions from a virtual server

  1. In IIS Manager, right-click the SMTP virtual server, and then click Properties.
  2. Click the Access tab, under Relay restrictions, click Relay.
  3. Click either Only the list below or All except the list below.
  4. Click Add to add exceptions to the global access option you chose in step 3.

You can specify the following options in the Relay Restrictions dialog box.

Option | Description
Only the list below | Only the computers listed below can relay messages through the SMTP virtual server.
All except the list below | All computers can relay messages through the SMTP virtual server, except those listed below. This option is set by default, along with Allow all computers which successfully authenticate to relay, regardless of the list above.
Add and Remove | Adds and removes entries to the list of those computers either granted or denied relay access.
Allow all computers which successfully authenticate to relay, regardless of the list above | Allows computers that meet authentication requirements set in the Authentication dialog box to relay messages to the SMTP virtual server. This option is set by default.

Related Topics
  • For information on setting IP access restrictions to the server, see Setting IP Access Restrictions to Servers.
  • For information on requiring TLS encryption, see Requiring TLS Encryption.


Requiring TLS Encryption

You can require that all clients use Transport Layer Security (TLS) encryption, a generic security protocol similar to Secure Sockets Layer (SSL), to connect to the default Simple Mail Transfer Protocol (SMTP) virtual server. This option secures the connection, but it is not used for authentication.

When requiring Basic authentication on your virtual servers, it is strongly recommended that you also use TLS encryption. Without encryption, user names and passwords can be easily intercepted.

To use TLS encryption for the virtual server, you must create key pairs and configure key certificates. Clients can then use TLS to encrypt the session with the SMTP service, therefore, all messages sent. The SMTP service can also use TLS to encrypt sessions with remote servers.

important Important You must be a member of the Administrators group on the local computer to perform the following procedure (or procedures), or you must have been delegated the appropriate authority. As a security best practice, log on to your computer using an account that is not in the Administrators group, and then use the Run as command to run IIS Manager as an administrator. From the command prompt, type runas /user:administrative_accountname "mmc %systemroot%\system32\inetsrv\iis.msc".

To create and manage key certificates
  1. In IIS Manager, right-click the SMTP virtual server, and then click Properties.
  2. Click the Access tab, and under Secure communication, click Certificate to set up new key certificates and manage installed key certificates for the SMTP virtual server.

Key pairs consist of a number of bits that indicate the key's security level. You can strengthen security by increasing the encryption level from 40 bits (the default) to 128 bits. The greater the number of bits, the more difficult the item is to decrypt. Users attempting to secure access must use the same encryption level that you set or messages will be returned with a non-delivery report (NDR).

To set TLS encryption levels for the server

  1. In IIS Manager, right-click the SMTP virtual server, and then click Properties.
  2. Click the Access tab, and under Access control, click Authentication.
  3. Click Basic authentication.
  4. Select the Require TLS encryption check box.

note Note There are two additional TLS options available. To use TLS for all outgoing connections, click Outbound Security on the Delivery tab, and then click TLS encryption. Also, if a server you commonly connect to requires the use of TLS for all incoming connections, you can create a remote domain and click TLS encryption when creating the domain.

Related Topics
  • For information on setting IP access restrictions to the server, see Setting IP Access Restrictions to Servers.
  • For information on setting or removing relay restrictions from a virtual server, see Setting or Removing Relay Restrictions from Virtual Servers.


Delivering Messages

After a connection has been opened and the receiving server has acknowledged that it is ready to receive data, messages can be transmitted for delivery. This section describes the settings that determine how delivery occurs.

This section includes the following information:

  • Message Delivery Options: Provides an overview of routing, transmission, and security opetions.
  • Configuring Retry Attempts and Intervals: Describes how to configure the server for mail that can't be delivered on the first attempt.
  • Setting the Message Hop Count: Describes how to limit the number of servers a message is allowed to pass through before delivery.
  • Setting the Masquerade Domain: Describes how to replace a local domain name used in the Mail From lines.
  • Setting Fully Qualified Domain Names: Describes the concept of fully qualified domain names and how to change them.
  • Configuring Smart Hosts: Describes how to route all outgoing messages for remote domains through a smart host instead of sending them directly to the domain.
  • Enabling Reverse DNS Lookup: Describes how to enable reverse DNS lookup.


Message Delivery Options

Use the Delivery tab to set all delivery and routing options. Settings can be grouped into three categories, which are listed below.

Routing Options

  • Smart host: Designates a server through which to route all outgoing messages.
  • Message hop count: Determines the maximum number of servers a message is routed through before being considered undeliverable.
  • Fully qualified domain name (FQDN): Clarifies the address to use in message exchanger (MX) records.

Transmission Options

  • Retry attempts and retry interval: Determines how many times to resend a message, and at what intervals, before the message is considered undeliverable.
  • Delivery using Pickup directory: Allows you to transmit messages composed as a text file.

Security Options

  • Outbound security: Allows you to use authentication and Transport Layer Security (TLS) encryption for outgoing messages.
  • Reverse DNS lookup: Verifies that the message actually originated from the computer and the domain listed in the From field.
  • Masquerade domains: Replaces any local domain name used in any Mail From lines in the protocol with a different domain name. This is the name you want stamped on outgoing messages.


Configuring Retry Attempts and Intervals

If a message cannot be delivered on the first attempt, the SMTP service sends it again from the Queue directory after a specified time. You can set the interval between delivery attempts. You can also designate the number of times to attempt to deliver a message. After the limit is reached, the message is returned to the sender with a non-delivery report (NDR) and copies of the message and NDR are sent to the location you designate. The NDR is placed in the Queue directory and goes through the same delivery process as messages. When the NDR reaches the maximum number of retry attempts, the NDR and message are sent to the Badmail directory.

important Important You must be a member of the Administrators group on the local computer to perform the following procedure (or procedures), or you must have been delegated the appropriate authority. As a security best practice, log on to your computer using an account that is not in the Administrators group, and then use the Run as command to run IIS Manager as an administrator. From the command prompt, type runas /user:administrative_accountname "mmc %systemroot%\system32\inetsrv\iis.msc".

To configure retry attempt and interval settings
  1. In IIS Manager, right-click the SMTP virtual server, and then click Properties.
  2. Click the Delivery tab.
  3. In the First retry interval (minutes) box, type a value for the amount of time to wait before retrying message delivery. The default is 15 minutes.
  4. In the Second retry interval (minutes) box, type a value for the amount of time to wait before retrying message delivery. The default is 30 minutes, which is 30 minutes after the First retry interval.
  5. In the Third retry interval (minutes) box, type a value for the amount of time to wait before retrying message delivery. The default is 60 minutes, which is 60 minutes after the Second retry interval.
  6. In the Subsequent retry interval (minutes) box, type a value for the amount of time to attempt delivery before posting a notification. The default is 240 minutes.

Delay Notification

To allow for network delays, you can set a delay period to expire before sending the delivery notification. The minimum value is 1 minute, the default is 12 hours, and the maximum value is 9999 days. Use the drop-down menu beside the value field to use minutes, hours, or days.

Expiration Timeout

Type a value for messages that have not been delivered after all retries and delays have expired. The minimum value is 1 minute, the default is 2 days, and the maximum value is 9999 days. Use the drop-down menu beside the value field to use minutes, hours, or days.


Setting the Message Hop Count

When a message is delivered, it may be routed to a number of servers before reaching its final destination. You can designate how many servers the message is allowed to pass through. This is called the hop count.

After the hop count is set, the Simple Mail Transfer Protocol (SMTP) server counts the hops listed in the Received lines of the message header. When the number of Received fields exceeds the maximum hop count setting, the message is returned to the sender with a non-delivery report (NDR).

important Important You must be a member of the Administrators group on the local computer to perform the following procedure (or procedures), or you must have been delegated the appropriate authority. As a security best practice, log on to your computer using an account that is not in the Administrators group, and then use the Run as command to run IIS Manager as an administrator. From the command prompt, type runas /user:administrative_accountname "mmc %systemroot%\system32\inetsrv\iis.msc".

To set the message hop count
  1. In IIS Manager, right-click the SMTP virtual server, and then click Properties.
  2. Click the Delivery tab, and click Advanced.
  3. In the Maximum hop count box, type a value for the number of hops a message can take between the source and destination servers. The default is 15 hops.
Related Topics
  • For information on designating a server for all outgoing messages, see Configuring Smart Hosts.
  • For information on setting a fully qualified domain name, see Setting Fully Qualified Domain Names.


Setting the Masquerade Domain

The masquerade domain replaces any local domain name used in any Mail From lines in the protocol. The replacement occurs on the first hop only.

important Important You must be a member of the Administrators group on the local computer to perform the following procedure (or procedures), or you must have been delegated the appropriate authority. As a security best practice, log on to your computer using an account that is not in the Administrators group, and then use the Run as command to run IIS Manager as an administrator. From the command prompt, type runas /user:administrative_accountname "mmc %systemroot%\system32\inetsrv\iis.msc".

To set the masquerade domain

  1. In IIS Manager, right-click the SMTP virtual server, and then click Properties.
  2. Click the Delivery tab, and click Advanced.
  3. In the Masquerade domain box, type a domain name that you want to appear in message headers, instead of the actual name of the domain.

    note Note All replies to such messages will be routed through the SMTP virtual server that uses the masquerade domain.

Related Topics
  • For information on enabling reverse DNS lookup, see Enabling Reverse DNS Lookup.


Setting Fully Qualified Domain Names

An e-mail domain must be able to be resolved through Domain Name System (DNS). There are two DNS records that are used to resolve an e-mail domain. In most cases, a mail exchanger (MX) record is set up to associate an e-mail domain with the fully qualified domain name (FQDN) of one or more Simple Mail Transfer Protocol (SMTP) virtual servers that serve that domain. Each SMTP server referenced in the MX record must have an address (A) record. The A record maps a given FQDN to its IP address.

It is possible to just have an A record set up for an e-mail domain. In this scenario, the A record maps the domain to the IP address or addresses of the SMTP virtual server or servers that serve that domain. Adding an MX record, however, is recommended over using an A record by itself, because an MX record allows an SMTP administrator to specify an ordered list of servers to use for clients sending mail to that e-mail domain. Microsoft SMTP Service always checks first for an MX record before falling back to an A record, so setting up MX records on your virtual server can improve performance. And, in some cases, the A record is used for other purposes, such as HTTP, although the MX record is generally used only for SMTP. The MX record allows one server to handle http://example.com (HTTP clients use the A record) and another server to handle someone@example.com (SMTP clients use the MX record).

On the SMTP service, there are two options for specifying an FQDN. You can use the name specified on the Network Identification tab of System Properties in Control Panel, or you can specify a unique FQDN for the SMTP virtual server you are configuring.

At startup, the name designated on the Network Identification tab of System Properties is automatically used for the FQDN. If you change the name (either manually or by joining a domain), the new name is automatically used for the FQDN the next time the computer is restarted. No action is required to update the FQDN for the virtual server.

To override the automatic use of the computer and domain names on the Network Identification tab, change the FQDN in the Advanced Delivery dialog box, accessed through the Delivery tab. The SMTP service can then use the designated name instead of the one specified on the Network Identification tab.

important Important You must be a member of the Administrators group on the local computer to perform the following procedure (or procedures), or you must have been delegated the appropriate authority. As a security best practice, log on to your computer using an account that is not in the Administrators group, and then use the Run as command to run IIS Manager as an administrator. From the command prompt, type runas /user:administrative_accountname "mmc %systemroot%\system32\inetsrv\iis.msc".

To change the FQDN
  1. In IIS Manager, right-click the SMTP virtual server, and then click Properties.
  2. Click the Delivery tab, and click Advanced.
  3. In the Fully-qualified domain name box, type the FQDN.
Related Topics
  • For information on setting the message hop count, see Setting the Message Hop Count.
  • For information on designating a server for all outgoing messages, see Configuring Smart Hosts.


Configuring Smart Hosts

You can route all outgoing messages for remote domains through a smart host instead of sending them directly to the domain. This enables you to route messages over a connection that may be more direct or less costly than other routes. The smart host is similar to the route domain option for remote domains. The difference is that, after a smart host is designated, all outgoing messages are routed to that server. With a route domain, only messages for the remote domain are routed to a specific server.

important Important Make sure your designated smart host is secure and admimistered by a trusted authority, especially when forwarding sensitive information.

If you set up a smart host, you can still designate a different route for a remote domain. The route domain setting overrides the smart host setting.

You can identify the smart host by fully qualified domain name (FQDN) or an IP address (but if you change the IP address, you would have to change it on every virtual server as well). If you use an IP address, enclose it in brackets ([ ]) to increase system performance. The SMTP service checks first for a server name, and then an IP address. The brackets identify the value as an IP address, so the DNS lookup is bypassed.

important Important You must be a member of the Administrators group on the local computer to perform the following procedure (or procedures), or you must have been delegated the appropriate authority. As a security best practice, log on to your computer using an account that is not in the Administrators group, and then use the Run as command to run IIS Manager as an administrator. From the command prompt, type runas /user:administrative_accountname "mmc %systemroot%\system32\inetsrv\iis.msc".

To set up a smart host
  1. In IIS Manager, right-click the SMTP virtual server, and then click Properties.
  2. Click the Delivery tab, and click Advanced.
  3. In the Smart host box, type the name of the smart host server. You can type a string to represent a name or enter an IP address.
  4. If you want the SMTP service to attempt to deliver remote messages directly before forwarding them to the smart host server, select the Attempt direct delivery before sending to smart host check box. The default is to send all remote messages to the smart host, not to attempt direct delivery.
Related Topics
  • For information on setting the message hop count, see Setting the Message Hop Count.
  • For information on setting a fully qualified domain name, see Setting Fully Qualified Domain Names.


Enabling Reverse DNS Lookup

If you select this option, the SMTP service will attempt to verify that the client’s IP address matches the host/domain submitted by the client in the EHLO/HELO command. If the reverse DNS lookup is successful, the RECEIVED header will remain intact. If the verification is unsuccessful, "unverified" appears after the IP address in the RECEIVED header of the message. If the reverse DNS lookup fails, "RDNS failed" will appear in the RECEIVED header of the message.

Because this feature verifies addresses for all incoming messages, its use could affect SMTP service performance. Clear the check box to disable the feature.

important Important You must be a member of the Administrators group on the local computer to perform the following procedure (or procedures), or you must have been delegated the appropriate authority. As a security best practice, log on to your computer using an account that is not in the Administrators group, and then use the Run as command to run IIS Manager as an administrator. From the command prompt, type runas /user:administrative_accountname "mmc %systemroot%\system32\inetsrv\iis.msc".

To enable reverse DNS lookup
  1. In IIS Manager, right-click the SMTP virtual server, and then click Properties.
  2. Click the Delivery tab, and click Advanced.
  3. Select the Perform reverse DNS lookup on incoming messages check box.
Related Topics
  • For information on setting the masquerade domain, see Setting the Masquerade Domain.


Managing Messages

This section describes how to set connection limits to maximize performance, how to set limits for message size and number of recipients, and how to manage undeliverable messages.

This section includes the following information:

  • Setting Message Size Limits: Describes how to set message and session limits.
  • Setting Recipient Limits: Describes how to set the maximum number of recipients for a single message sent in one connection.
  • Limiting the Number of Messages per Connection: Describes how to limit the number of messages sent in a single connection.
  • Storing Non-Delivery Reports: Describes how to set a storage location for non-delivery reports (NDRs).


Setting Message Size Limits

There are two message size limit settings. The first, Limit message size to, is a preferred message limit for the virtual server. This is what the SMTP service will advertise as the maximum message size this Simple Mail Transfer Protocol (SMTP) virtual server will accept. If a mail client sends a message that exceeds the limit, they will get an error. If a remote server supports EHLO, it will detect the advertised maximum message size value when it connects to the SMTP virtual server and won't attempt to deliver a message that exceeds the limit. Instead it will simply send a non-delivery report (NDR) to the sender of the message. A remote server that does not support EHLO will try to send a message that exceeds the size limit, but will still end up sending an NDR to the sender when the message doesn't go through.

Limit session size to is the maximum amount of data accepted during the total connection. This is the sum of all messages sent during the connection (applying to the message body only).

important Important You must be a member of the Administrators group on the local computer to perform the following procedure (or procedures), or you must have been delegated the appropriate authority. As a security best practice, log on to your computer using an account that is not in the Administrators group, and then use the Run as command to run IIS Manager as an administrator. From the command prompt, type runas /user:administrative_accountname "mmc %systemroot%\system32\inetsrv\iis.msc".

To set message size limits
  1. In IIS Manager, right-click the SMTP virtual server, and then click Properties.
  2. Click the Messages tab, select the Limit message size to (KB) check box, and then type a value (in kilobytes) for the maximum size of a message. The default is 2048 KB. The minimum value is 1 KB.
  3. Select the Limit session size to (KB) check box, and then type a value to indicate the maximum total size (in kilobytes) of all messages in a given connection. This number will always be larger than the maximum message size and should be set carefully because the connecting message transfer agent (MTA) is likely to resubmit the message repeatedly. The default size is 10240 KB. This value should be greater than or equal to the value entered for Limit message size to (KB).
Related Topics
  • For information on setting recipient limits, see Setting Recipient Limits.
  • For information on limiting the number of messages per connection, see Limiting the Number of Messages per Connection.
  • For information on storing non-delivery reports, see Storing Non-Delivery Reports.


Setting Recipient Limits

You can determine the maximum number of recipients for a single message sent in one connection. The default is 100, which is the minimum number specified in Request for Comment (RFC) 821. Many clients return messages with a non-delivery report (NDR) after an error message is received, indicating that the maximum number of recipients has been exceeded. The SMTP service does not return messages in this instance. It opens a new connection immediately and processes the remaining recipients. For example, if the recipient limit is set to 100 and a message with 105 recipients is received, the first 100 are delivered in one connection. Then, a new connection is opened, and the message is processed for the remaining five recipients.

important Important You must be a member of the Administrators group on the local computer to perform the following procedure (or procedures), or you must have been delegated the appropriate authority. As a security best practice, log on to your computer using an account that is not in the Administrators group, and then use the Run as command to run IIS Manager as an administrator. From the command prompt, type runas /user:administrative_accountname "mmc %systemroot%\system32\inetsrv\iis.msc".

To set recipient limits
  1. In IIS Manager, right-click the SMTP virtual server, and then click Properties.
  2. Click the Messages tab, select the Limit number of recipients per message to check box, and then type a number to represent the recipient limit. To impose no limit, clear the check box.
Related Topics
  • For information on setting message size limits, see Setting Message Size Limits.
  • For information on limiting the number of messages per connection, see Limiting the Number of Messages per Connection.
  • For information on storing non-delivery reports, see Storing Non-Delivery Reports.


Limiting the Number of Messages per Connection

This option enables you to limit the number of messages sent in a single connection. It also provides a method to improve system performance by allowing the use of multiple connections to deliver messages to a remote domain. When the set limit is reached, a new connection is automatically opened and the transmission continues until all messages are delivered.

For example, if you commonly send a large number of messages to certain remote domains, you could set the Limit number of messages per connection to value to a relatively small number, such as 20. As a result, when sending 100 messages in one session, the SMTP service immediately opens a new connection after the first 20 are sent, another after the next 20 are sent, and so on. In this case, there could be up to five simultaneous connections delivering queued messages to one destination. Message delivery would be faster because fewer messages are delivered simultaneously, instead of in one long stream over one connection.

To determine a value for the limit, review the Messages Sent/sec performance counter for the SMTP Server object in System Monitor. The Limit number of messages per connection to value should be less than the value indicated by the performance counter. If the counter indicates a value of 30, and you set your maximum connections to 50, no simultaneous connection would be opened because the server would not exceed 30 messages per second. It would work as though the messages were sent in one long stream over one connection. This setting affects outgoing messages only. You can use it to increase your server output speed, but it has no effect on the rate that other servers process incoming messages.

important Important You must be a member of the Administrators group on the local computer to perform the following procedure (or procedures), or you must have been delegated the appropriate authority. As a security best practice, log on to your computer using an account that is not in the Administrators group, and then use the Run as command to run IIS Manager as an administrator. From the command prompt, type runas /user:administrative_accountname "mmc %systemroot%\system32\inetsrv\iis.msc".

To limit the number of messages sent in one connection
  1. In IIS Manager, right-click the SMTP virtual server, and then click Properties.
  2. Click the Messages tab, select the Limit number of messages per connection to check box, and then type a value in the box. The default is 20.
Related Topics
  • For information on setting message size limits, see Setting Message Size Limits.
  • For information on setting recipient limits, see Setting Recipient Limits.
  • For information on storing non-delivery reports, see Storing Non-Delivery Reports.


Storing Non-Delivery Reports

When a message is undeliverable, the SMTP service returns it to the sender with a non-delivery report (NDR). You can also designate that copies of the NDR be sent to a location of your choice. If the NDR cannot be delivered to the sender, a copy of the message is put in the Badmail directory.

All NDRs go through the same delivery process as other messages, including attempts to resend the message. If the NDR has reached the retry limit and cannot be delivered to the sender, a copy of the message is placed in the Badmail directory. Messages placed in the Badmail directory cannot be delivered or returned.

important Important You must be a member of the Administrators group on the local computer to perform the following procedure (or procedures), or you must have been delegated the appropriate authority. As a security best practice, log on to your computer using an account that is not in the Administrators group, and then use the Run as command to run IIS Manager as an administrator. From the command prompt, type runas /user:administrative_accountname "mmc %systemroot%\system32\inetsrv\iis.msc".

To set a storage location for NDRs
  1. In IIS Manager, right-click the SMTP virtual server, and then click Properties.
  2. Click the Messages tab, in the Send copy of Non-Delivery Report to box, type the e-mail address of the mailbox you want to use to store copies of the NDRs. This address can be any valid SMTP e-mail address and is optional. To disable the feature, clear the text box.
  3. In the Badmail directory box, type the directory you want to use to store undeliverable messages. The default location is X:\Inetpub\Mailroot\Badmail, where X is the drive on which IIS is installed. Click Browse to select another folder. You can designate a different directory, provided it is on the same computer as the SMTP service.
Related Topics
  • For information on setting message size limits, see Setting Message Size Limits.
  • For information on setting recipient limits, see Setting Recipient Limits.
  • For information on limiting the number of messages per connection, see Limiting the Number of Messages per Connection.


LDAP Routing

Lightweight Directory Access Protocol (LDAP) is an Internet protocol that enables you to access directory information from an LDAP server. With permission to use LDAP, you can browse, read, and search directory listings on the LDAP server.

With the LDAP Routing tab, you can configure the SMTP service so that it will consult an LDAP server to resolve senders and recipients. For example, you can use Active Directory® directory service as an LDAP server, and use Active Directory Users and Computers to create a group mailing list that is automatically expanded on the Simple Mail Transfer Protocol (SMTP) virtual server.

This section describes how to configure the SMTP service as an LDAP client so you can gain access to directory information on an LDAP server.

This section includes the following information:

  • Determining Authentication Levels: Describes the four binding types that determine the level of authentication used for connections.
  • Preliminary Steps to Configuring LDAP Connections: Describes how to plan before configuring Lightweight Directory Access Protocol (LDAP).
  • Setting LDAP Routing Information: Describes how to enable Lightweight Directory Access Protocol (LDAP) routing, and set options for LDAP routing.
  • Selecting Schema Types: Describes the schema types available from the Schema drop-down menu on the LDAP Routing tab.


Determining Authentication Levels

There are four binding types that determine the level of authentication used for connections. The option selected affects other options.

Binding type | Description
Anonymous | No authentication is required. Select this option when the server does not require account and password information.
Plaintext | This option allows the transmission of account information and passwords in plaintext. When this option is selected, account and password information is required.
Windows SSPI | The client and server negotiate to determine which level of authentication is acceptable by both, and use the strongest method available. When this option is selected, account and password information is required.
Service accounts | Uses the account information of the user under which the SMTP service is running. This is controlled by Component Services, under Administrative Tools.


Preliminary Steps to Configuring LDAP Connections

Because some settings on the LDAP Routing tab affect others, it is recommended that you plan before configuring Lightweight Directory Access Protocol (LDAP).

  1. Determine the schema type to use.
  2. Determine the level of authentication that will be needed to bind to the LDAP directory. If the LDAP server you connect to does not require authentication, no account information is necessary.
  3. Determine if you need to specify a naming context. A naming context may be necessary if the user accounts reside in a subcontainer within the LDAP directory. Specifying a naming context may allow the LDAP directory to return results more quickly and, in some cases, is necessary if there are multiple naming contexts on the LDAP server.
Related Topics
  • For information on determining the schema type to use, see Selecting Schema Types.
  • For information on determining the level of authentication, see Determining Authentication Levels.


Setting LDAP Routing Information

This topic describes how to enable Lightweight Directory Access Protocol (LDAP) routing, and set options for LDAP routing.

important Important You must be a member of the Administrators group on the local computer to perform the following procedure (or procedures), or you must have been delegated the appropriate authority. As a security best practice, log on to your computer using an account that is not in the Administrators group, and then use the Run as command to run IIS Manager as an administrator. From the command prompt, type runas /user:administrative_accountname "mmc %systemroot%\system32\inetsrv\iis.msc".

To set LDAP routing information
  1. In IIS Manager, right-click the SMTP virtual server, and then click Properties.
  2. Click the LDAP Routing tab.
  3. Select the Enable LDAP routing check box.
  4. Set options as described in the following table.
Option | Description
Server | Type the name of the computer running the LDAP directory. The field is not applicable when you use the Exchange LDAP Service schema type, because the service will find a nearby server and use it automatically.
Schema | Select a schema type.
Binding | Select the authentication method to use when binding to the LDAP server. Plain text transmits passwords in plaintext. To use the strongest authentication method available for the SMTP virtual server, select Windows SSPI. For no authentication, use Anonymous, which is the default. Service accounts will use the account information of whomever is trying to bind to the LDAP server.
Domain | Type the domain of the account you want to use to bind to the LDAP directory. This option applies if you select the Plain text or Windows SSPI binding types.
User name | Type the distinguished name (DN) of the account you want to use to bind to the LDAP directory. For example, cn=user1,ou=users,o=company. This option applies if you select the Plain text or Windows SSPI binding types.
Password | Type the password used for logging on to the directory service. This option applies if you select the Plain text or Windows SSPI binding types.
Base | Type the distinguished name of a container in the directory service you're accessing. This setting specifies where you want the SMTP service to start searching in the LDAP directory. The search will begin in the container and will continue to subcontainers if necessary.
Related Topics
  • For information on selecting a schema type, see Selecting Schema Types.
  • For information on selecting the authentication method, see Determining Authentication Levels.


Selecting Schema Types

The following schema types are available from the Schema list box on the LDAP Routing tab.

Schema type | Description
Active Directory | Select this option to use Active Directory directory service as the Lightweight Directory Access Protocol (LDAP) server. To manage mailboxes, use Active Directory Users and Computers.
Site Server Membership Directory | Use this option when you have installed Microsoft LDAP Service as part of Microsoft Commercial Internet System 2.0 Mail and you are using it to manage mailboxes.
Exchange LDAP Service | Select this option to use a Microsoft Site Server 3.0 or later LDAP server to manage mailboxes.
Related Topics
  • For information, see Preliminary Steps to Configuring LDAP Connections.
  • For information on setting LDAP routing information, see Setting LDAP Routing Information.


Monitoring Message Transactions

Protocol logs track the commands a Simple Mail Transfer Protocol (SMTP) virtual server receives from SMTP clients.

Four formats are available for tracking. For the most part, they track the same information. The differences among them are depth of detail, type of display, and analytical uses. When choosing a format, decide what you want to track, how you want to review the data, and how you want to track transactions from other Internet Information Services (IIS) services.

The default format is World Wide Web Consortium (W3C) Extended Log File Format, but you can choose a different one. For three of the formats, transactions are written to a text file. You can determine the logging period and maximum size of the file. When the size limit is reached, a new file is created. Back up and remove older files so the system doesn't run out of disk space when writing to the current transaction log file. There is also a format that enables you to collect data in an ODBC-compliant database.

note Note The log formats and default file names are the same as those used by other IIS services. Plan what you want to track for all the services, how many files to use, and how to set file size before choosing a format for the SMTP service.

This section includes the following information:

  • Log Formats: Describes the four formats available for transaction logs.
  • Setting up an ODBC-Compliant Database: Describes how to set up an open database connectivity (ODBC)-compliant dabase for protocol logging.
Related Topics
  • For information on enabling protocol logging, see Enabling Protocol Logging.


Log Formats

Four formats are available for transaction logs. The log formats and default file names are the same as those used by other IIS services. Plan what you want to track for all the services, how many files to use, and how to set file size before choosing a format for the SMTP service.

Microsoft IIS Log File Format

  • Information is written to a comma-delimited ASCII text file.
  • Data is fixed; you cannot customize the log.
  • There are multiple records for a single transmission.

NCSA Common Log File Format

  • Information is written to an ASCII text file that uses the National Center for Supercomputing Applications (NCSA) format.
  • Data is fixed; you cannot customize the log.
  • There are multiple records for a single transmission.

W3C Extended Log File Format

  • The World Wide Web Consortium (W3C) Extended Log File Format is the default logging format for the SMTP service, as well as other IIS services.
  • Data is variable; you can choose what you want to track.
  • This format is a good option for limiting log size.
  • Information is written to an ASCII text file.
  • This format includes some field options that apply to the Web and file transfer protocol (FTP) services only.
  • There are multiple entries for a single transmission.

ODBC Logging

  • You must set up an open database connectivity (ODBC)-compliant database before using this format.
  • Information is written to a database.
  • There are multiple records for a single transmission.

The following table describes the fields and data types for an ODBC transaction log file.

Field name | Data type | Description
ClientHost | varchar(255) | Client IP address
Username | varchar(255) | Client domain name
LogTime | datetime | Connection date and time
Service | varchar(255) | Internet Information Services (IIS) service
Machine | varchar(255) | Computer name
ServerIP | varchar(50) | Server IP address
ProcessingTime | integer | Processing time in milliseconds
BytesRecvd | integer | Bytes received by server
BytesSent | integer | Bytes sent by server
ServiceStatus | integer | Simple Mail Transfer Protocol (SMTP) protocol reply code
Win32Status | integer | Windows Server 2003 status or error code (a 0 value indicates success)
Operation | varchar(255) | SMTP protocol command
Target | varchar(255) | Recipient
Parameters | varchar(255) |

Related Topics
  • For information on monitoring message transactions, see Monitoring Message Transactions.
  • For information on enabling protocol logging, see Enabling Protocol Logging.


Setting up an ODBC-Compliant Database

This topic describes how to set up an open database connectivity (ODBC)-compliant dabase for protocol logging.

  1. Create an ODBC-compliant database by using a database program such as Microsoft Access or Microsoft SQL Server™.
  2. Create a table in the database that contains the fields listed in the following table.
    Field name | Data type
    ClientHost | varchar(255)
    Username | varchar(255)
    LogTime | datetime
    Service | varchar(255)
    Machine | varchar(255)
    ServerIP | varchar(50)
    ProcessingTime | integer
    BytesRecvd | integer
    BytesSent | integer
    ServiceStatus | integer
    Win32Status | integer
    Operation | varchar(255)
    Target | varchar(255)
    Parameters | varchar(255)


SMTP Domains

Domains in the SMTP service are different from DNS domains and Windows domains. The SMTP service domains are used for organizing messages for delivery.

The Simple Mail Transfer Protocol (SMTP) virtual server has at least one domain—the default local domain. You can add more domains and configure them to be local or remote. You can delete any domain except the default domain.

Local Domains

A local domain is a DNS domain that is serviced by the local SMTP server. Any message with a local domain name that arrives at an SMTP server must be delivered locally to a Drop directory or returned to the sender with a non-delivery report (NDR). Local domains are sometimes referred to as service domains or supported domains. E-mail addresses with local domain names are often referred to as local addresses.

If the domain is local, you can designate it as default or alias. There is one default domain. It is used to stamp message headers that lack a domain specification. An alias domain is an alias of the default domain. If you add a domain and assign it as the new default, the previous default changes to an alias domain.

Remote Domains

Domains that are not local are known as remote or nonlocal domains, and e-mail addresses with remote domain names are referred to as nonlocal addresses. The SMTP service looks up remote domains in DNS.

If you want to set unique delivery requirements for a specific remote domain, you can add a remote domain and configure it accordingly. For example, you can add a remote domain and require that the SMTP service always use Transport Layer Security (TLS) encryption in sessions with that domain. Or, you can change the routing so that messages sent to one remote domain are routed to another remote domain. Use the Domain Properties dialog box to configure domains.

This section includes the following information:

  • Creating SMTP Domains: Describes how to create alias and remote domains.
  • Deleting SMTP Domains: Describes how to delete an SMTP domain.
  • Configuring Local SMTP Domains: Introduces the concept of configuring local domains.
  • Configuring Remote Domains: Introduces the concept of configuring remote domains.


Creating SMTP Domains

You can create two types of domains in the SMTP service: alias and remote. Alias domains allow you to create secondary domains that point to the default domain and use its settings, including the Drop directory. Any message sent to an alias domain is stamped with the default domain name.

Remote domains can be set for domains to which you commonly send messages. For each remote domain, you can set a predetermined delivery route and require that Transport Layer Protocol (TLS) encryption be used in all sessions with that domain. You can also use a wildcard character in the name so that all inclusive domains for the domain you are creating use the same settings. Use an asterisk (*) as the first character, followed by a period (.). For example, you can use the asterisk as a wildcard in the following format:

*.example.com

important Important You must be a member of the Administrators group on the local computer to perform the following procedure (or procedures), or you must have been delegated the appropriate authority. As a security best practice, log on to your computer using an account that is not in the Administrators group, and then use the Run as command to run IIS Manager as an administrator. From the command prompt, type runas /user:administrative_accountname "mmc %systemroot%\system32\inetsrv\iis.msc".

To create an alias domain
  1. In IIS Manager, expand the SMTP virtual server, right-click Domains, point to New, and then click Domain.
  2. Use the New SMTP Domain Wizard to set up a local (alias) domain.
To create a remote domain
  1. In IIS Manager, expand the SMTP virtual server, right-click Domains, point to New, and then click Domain.
  2. Use the New SMTP Domain Wizard to set up a remote domain.
  3. To designate a route domain, set authentication for outgoing messages, or use TLS encryption, right-click the domain in the details pane, click Properties, and then specify the options.
Related Topics
  • For information on deleting SMTP domains, see Deleting SMTP Domains.


Deleting SMTP Domains

You can delete domains that you have added. You cannot delete the default domain, unless you first add an alias domain and then make that domain the default domain.

important Important You must be a member of the Administrators group on the local computer to perform the following procedure (or procedures), or you must have been delegated the appropriate authority. As a security best practice, log on to your computer using an account that is not in the Administrators group, and then use the Run as command to run IIS Manager as an administrator. From the command prompt, type runas /user:administrative_accountname "mmc %systemroot%\system32\inetsrv\iis.msc".

To delete a domain
  1. In IIS Manager, expand the SMTP virtual server, and click Domains.
  2. In the details pane, right-click the domain you want to delete, and click Delete.
Related Topics
  • For information on creating SMTP domains, see Creating SMTP Domains.


Configuring Local SMTP Domains

This section describes how to set options for existing local domains.

This section includes the following information:

  • Designating Default Domains: Describes how to rename the default domain.
  • Configuring Alias Domains: Describes how to set up alias domains that use the same settings as the default domain.
  • Configuring Drop Directories: Describes how to identify a directory in which to drop all incoming messages.


Designating Default Domains

The default domain is used to stamp messages from addresses that do not have a domain. A Simple Mail Transfer Protocol (SMTP) virtual server can have one default domain that cannot be deleted.

To name a default domain, you can use the name specified on the DNS tab for the TCP/IP protocol in the Network application in Control Panel. This domain name is also used for all other services. Alternatively, you can specify a unique domain to serve as the default for the SMTP service only.

At startup, the name designated on the DNS tab for the TCP/IP protocol in the Network application in Control Panel is automatically used for the default domain. If you change the name on the DNS tab, the new name is used automatically for the default domain the next time the service is started. No action is required to update the default domain for the SMTP service.

To override the automatic use of the network domain, specify the default domain on the General tab. The SMTP service can then use the designated name instead of the network domain.

important Important You must be a member of the Administrators group on the local computer to perform the following procedure (or procedures), or you must have been delegated the appropriate authority. As a security best practice, log on to your computer using an account that is not in the Administrators group, and then use the Run as command to run IIS Manager as an administrator. From the command prompt, type runas /user:administrative_accountname "mmc %systemroot%\system32\inetsrv\iis.msc".

To rename the default domain
  1. In IIS Manager, expand the SMTP virtual server, and then click Domains.
  2. In the details pane, right-click a domain name, and then click Rename.
  3. Type a new name for the default domain.
Related Topics
  • For information on configuring an alias domain, see Configuring Alias Domains.
  • For information on configuring a drop directory, see Configuring Drop Directories.


Configuring Alias Domains

You can set up alias domains that use the same settings as the default domain. Messages received by the SMTP service for the alias domain are placed in the Drop directory designated for the default domain.

important Important You must be a member of the Administrators group on the local computer to perform the following procedure (or procedures), or you must have been delegated the appropriate authority. As a security best practice, log on to your computer using an account that is not in the Administrators group, and then use the Run as command to run IIS Manager as an administrator. From the command prompt, type runas /user:administrative_accountname "mmc %systemroot%\system32\inetsrv\iis.msc".

To configure an alias domain
  1. In IIS Manager, expand the SMTP virtual server, right-click Domains, point to New, and then click Domain. The New SMTP Domain Wizard starts.
  2. Click Alias, and then click Next.
  3. In the Name box, type a name for the alias domain, and then click Finish.
Related Topics
  • For information on designating a default domain, see Designating Default Domains.
  • For information on configuring a drop directory, see Configuring Drop Directories.


Configuring Drop Directories

For the default domain, you must identify a directory in which to drop all incoming messages. The SMTP service places messages for alias domains in the Drop directory used for the default domain. You can designate any directory as the Drop directory, provided it is local to the computer for the SMTP service and is not already assigned as the Pickup directory. By default, this is a subdirectory of the SMTP Mailroot directory.

Be sure your Drop directory is in a secure location and can be accessed only by trusted administrators. Otherwise, unauthorized users may be able to access messages in the directory.

important Important You must be a member of the Administrators group on the local computer to perform the following procedure (or procedures), or you must have been delegated the appropriate authority. As a security best practice, log on to your computer using an account that is not in the Administrators group, and then use the Run as command to run IIS Manager as an administrator. From the command prompt, type runas /user:administrative_accountname "mmc %systemroot%\system32\inetsrv\iis.msc".

To designate a Drop directory
  1. In IIS Manager, expand the SMTP virtual server, and then click Domains.
  2. In the details pane, right-click the default domain, and then click Properties.
  3. In the Drop directory box, type the directory used to drop all incoming messages. The default location is LocalDrive:\Inetpub\mailroot\Drop. Or click Browse and select the directory. Make sure that you select the Drop directory and not the Pickup directory.


Configuring Remote Domains

You can set unique delivery requirements for a specific remote domain by adding a domain and configuring it accordingly. For example, you can set a predetermined delivery route, set authentication, and require that Transport Layer Security (TLS) encryption be used on all connections to the domain. If the remote domain is not specifically configured, the SMTP service will not perform any of these operations when delivering to this domain. It will, however, complete a normal DNS lookup.

This section includes the following information:

  • Configuring ATRN for Remote Domains: Describes how to create a remote domain for an address that periodically reviews messages and enable ATRN for the domain.
  • Configuring Authentication for Remote Domains: Describes how to configure the Simple Mail Transfer Protocol (SMTP) virtual server to provide the authentication credentials required by the remote domain.
  • Setting Route Domains: Describes how to specify a delivery path that may be faster and less expensive than a direct link.
  • Enabling TLS Encryption for Remote Domains: Describes how to enable Transport Layer Security (TLS) encryption for a remote domain.


Configuring ATRN for Remote Domains

The SMTP service can hold mail for clients that connect periodically to download messages. In this case, the client issues an ATRN command. The remote Simple Mail Transfer Protocol (SMTP) service then starts sending messages to the ATRN domain. You can create a remote domain for an address that periodically reviews messages and enable ATRN for the domain.

important Important You must be a member of the Administrators group on the local computer to perform the following procedure (or procedures), or you must have been delegated the appropriate authority. As a security best practice, log on to your computer using an account that is not in the Administrators group, and then use the Run as command to run IIS Manager as an administrator. From the command prompt, type runas /user:administrative_accountname "mmc %systemroot%\system32\inetsrv\iis.msc".

To enable ATRN transmissions for a remote domain
  1. In IIS Manager, expand the SMTP virtual server, and then click Domains.
  2. In the details pane, right-click the remote domain you want to change, and click Properties.
  3. Click the Advanced tab, and then select the Queue messages for remote triggered delivery check box.
  4. Click Add or Remove as necessary to select Windows user accounts that will be allowed to use the ATRN command in this domain.


Configuring Authentication for Remote Domains

You can configure the Simple Mail Transfer Protocol (SMTP) virtual server to provide the authentication credentials required by the remote domain. There are two types of authentication available: basic (plaintext) and Integrated Windows authentication. With the basic option, the account name and password of the server you're connecting to is transmitted in clear text. The Integrated Windows Authentication option requires a Windows account name and password. You can also disable authentication, which is the default option.

The selected option overrides the SMTP virtual server authentication setting on the Access tab. The following table describes several configuration examples.

SMTP virtual server transmissions | Authentication option
Messages are commonly sent to multiple addresses. | Disable authentication for the SMTP virtual server. If attempts to deliver messages to an address fail because of authentication requirements, add a remote domain for the address. Then enable authentication for the domain at the same level required by the server.
Messages are commonly sent to one address, which requires authentication. | Determine what level of authentication is required to connect. Then enable authentication for the SMTP virtual server using the same level. If you want to then send messages to other addresses, set up remote domains and set different authentication options. If you use this option, it is likely that the account name used is the one that identifies the computer set up as the smart host.

important Important You must be a member of the Administrators group on the local computer to perform the following procedure (or procedures), or you must have been delegated the appropriate authority. As a security best practice, log on to your computer using an account that is not in the Administrators group, and then use the Run as command to run IIS Manager as an administrator. From the command prompt, type runas /user:administrative_accountname "mmc %systemroot%\system32\inetsrv\iis.msc".

To disable authentication for outgoing messages
  1. In IIS Manager, expand the SMTP virtual server, and then click Domains.
  2. In the details pane, right-click the remote domain you want to change, and click Properties.
  3. On the General tab, click Outbound Security.
  4. Click Anonymous access, and then click OK.
To set Basic authentication for outgoing messages
  1. In IIS Manager, expand the SMTP virtual server, and then click Domains.
  2. In the details pane, right-click the remote domain you want to change, and click Properties.
  3. On the General tab, click Outbound Security.
  4. Click Basic authentication.
  5. In the User name box, type the user name; and in the Password box, type thepassword of the computer to which you are connecting.
  6. Click OK.

important Important If Basic authentication is your only authentication method, it is strongly recommended that you also require TLS encryption to avoid unauthorized detection of user names and passwords.

To set Integrated Windows authentication for outgoing messages
  1. In IIS Manager, expand the SMTP virtual server, and then click Domains.
  2. In the details pane, right-click the remote domain you want to change, and click Properties.
  3. On the General tab, click Outbound Security.
  4. Click Integrated Windows Authentication.
  5. In the Account box, type the Windows account name; and in the Password box, type the password.
  6. Click OK.


Setting Route Domains

You can specify a delivery path that may be faster and less expensive than a direct link. Type the name or IP address of the server through which you would like to route messages for this remote domain. If you enter an IP address, enclose the address in brackets ([ ]) to improve system performance. This setting overrides the smart host setting on the Delivery tab.

important Important You must be a member of the Administrators group on the local computer to perform the following procedure (or procedures), or you must have been delegated the appropriate authority. As a security best practice, log on to your computer using an account that is not in the Administrators group, and then use the Run as command to run IIS Manager as an administrator. From the command prompt, type runas /user:administrative_accountname "mmc %systemroot%\system32\inetsrv\iis.msc".

To designate a route domain
  1. In IIS Manager, right-click the SMTP virtual server, point to New, and then click Domain. The New SMTP Domain Wizard starts.
  2. Click Remote, and then click Next.
  3. In the Name box, type a name for the remote domain, and then click Finish.
  4. In the details pane, right-click the new remote domain, and then click Properties.
  5. On the General tab, under Route domain box, click Forward all mail to smart host, and then type the name or IP address of the server through which you would like to route messages for this remote domain.

    note Note You can identify the smart host by fully qualified domain name (FQDN) or an IP address (but if you change the IP address you would have to change it on every virtual server as well). If you use an IP address, enclose it in brackets to increase system performance. The SMTP service checks first for a server name, then an IP address. The brackets identify the value as an IP address, so the DNS lookup is bypassed.


Enabling TLS Encryption for Remote Domains

If you choose not to use Transport Layer Security (TLS) encryption for the Simple Mail Transfer Protocol (SMTP) virtual server, but you select the TLS encryption check box for this remote domain, SMTP will use it when connecting to the remote domain. Domain configurations always override the virtual server configurations.

important Important You must be a member of the Administrators group on the local computer to perform the following procedure (or procedures), or you must have been delegated the appropriate authority. As a security best practice, log on to your computer using an account that is not in the Administrators group, and then use the Run as command to run IIS Manager as an administrator. From the command prompt, type runas /user:administrative_accountname "mmc %systemroot%\system32\inetsrv\iis.msc".

To enable TLS encryption for a remote domain
  1. In IIS Manager, expand the SMTP virtual server, and then click Domains.
  2. In the details pane, right-click the remote domain you want to change, and click Properties.
  3. On the General tab, click Outbound Security.
  4. Click Integrated Windows Authentication.
  5. In the Account box, type the Windows account; and in the Password box, type the password.
  6. Select the TLS encryption check box, and then click OK.

note Note If the remote domain does not support TLS encryption, all messages will be returned with a non-delivery report (NDR).


Configuring Applications

This section identifies some of the configuration options that are available to Web-based applications through IIS Manager, including performance, caching, and debugging options.

This section includes the following information:

  • About Configuring Applications: Defines Web-based applications and explains how your Web site's directory structure is related to them.
  • Creating Applications: Explains how to set up a directory so that it is the starting point, or root, of an application.
  • Setting Application Mappings: Describes how to associate a file name extension with the program that processes those files.
  • Configuring ASP.NET Applications in Worker Process Isolation Mode: Describes how to configure Microsoft® ASP.NET applications when running in worker process isolation mode. In worker process isolation mode, attributes defined in the Machine.config file can now only be defined through Internet Information Services (IIS).
  • Configuring ASP Applications: Outlines how to set properties for Microsoft Active Server Pages (ASP) applications.
  • Enabling ASP Debugging: Explains how to check and correct ASP pages that are run in worker process isolation mode.
  • Configuring CGI Applications: Provides information on installing and configuring Common Gateway Interface (CGI) applications on the Web server.
  • Configuring ISAPI Extensions: Explains how to fine-tune server performance by caching Internet Server API (ISAPI) extensions.
  • Installing ISAPI Filters: Describes ISAPI filters and explains how to associate them with a Web server event.
  • Installing Wildcard Application Mappings: Describes how to configure a Web site to run an ISAPI application regardless of the extension of the requested file.
  • Configuring Applications to Use COM+ Services: Describes how to configure ASP applications to use component services.
Related Topics
  • For information on setting application-related server configurations that are dependent on an isolation mode, see Configuring Servers for Applications.
(The following words are used by Search; they are not intended to be displayed on the page.) configure, configuration, configuring, web app, web apps, web applications, program, programs, programmer, develop, developer, code, coder, coders, development, application root, directory, starting-point directory, create, write, map, mapping, mappings, associate, associating, association, file name, filename, extension, dll, .dll, .exe, exe, isolate, isolated, isolation, out of process, out-of-process, oop, out-of-proc, crash, reliable, stable, reliability, stability, availability, available, uptime, downtime, protection, separate, memory space, cgi, script, time out, time-out, times out, time-outs, timeouts, cache, caching, isapi, extensions, scriptless asp, flow control, enhanced, objects, self-tuning, fine-tune, tune-up, tune up, automatic, threads, error-handling, line, number, .asp, file, server scriptlets, business logic, reusable, com, components, j++, vb, vba, visual basic, jscript, javascript, filters, install, set up, setup, asp, active server pages, automate, administration tasks, properties, property sheet, start, stop, starting, stopping, pause, pausing, debug, debugging, step through, errors, links, more information


About Configuring Applications

When you create an application, you use IIS Manager to designate the application's starting-point directory, which is also called the application root, in your Web site. You can have more than one application per Web site. The default Web site that is created when you install IIS is an application starting point. Every file and directory that is beneath the starting-point directory in your Web site is considered part of the application until another starting-point directory is found. Thus, you use directory boundaries to define the scope of an application.

important Important In order to take a more proactive stance against malicious users and attackers, IIS is not installed on members of the Microsoft® Windows® Server 2003 family by default. Furthermore, when you initially install IIS, the service is installed in a highly secure and "locked" mode. By default, IIS serves only static content — meaning features like ASP, ASP.NET, Server-Side Includes, WebDAV publishing, and FrontPage® Server Extensions do not work unless enabled. If you do not enable this functionality after installing IIS, IIS returns a 404 error. You can serve dynamic content and enable these features through the Web Service Extensions node in IIS Manager. Also, if an application extension is not mapped in IIS, IIS returns a 404 error. To map an extension, see Setting Application Mappings. For more information on how to troubleshoot 404 errors, including 404.2 and 404.3; issues related to a new installation of IIS 6.0; or an upgrade from a previous version of IIS, see Troubleshooting.

IIS 6.0 supports many types of applications and their configuration options. You can create and then configure your applications for optimal performance and debugging; define a default script language; enable caching, buffering, and parent paths; and associate a file name extension with a type of program. These options can be configured using IIS Manager or the metabase.

An important change in IIS 6.0 that may affect your current Active Server Pages (ASP) applications is that parent paths are not enabled for ASP applications by default. For information on how to enable parent paths, see Configuring ASP Applications.

Application Modes

IIS 6.0 runs in one of two distinct modes of operation: worker process isolation mode and IIS 5.0 isolation mode. Application code runs in an isolated environment, but without the performance penalty of previous versions of IIS. Application isolation is the separation of applications by process boundaries that prevent the applications from affecting one another. Application isolation is configured differently for each of the two IIS isolation modes.

By default, after a clean install of IIS 6.0, IIS runs in worker process isolation mode. In worker process isolation mode, you have the option of pooling application processes. Also, for ASP.NET applications, application configuration is defined through the Web.config or Machine.config files. If you are running in worker process isolation mode, then you must configure the attributes defined in the Machine.config file through IIS.

Related Topics
  • For more information on the configuration options that are available to Web-based applications through IIS Manager, see Configuring Applications.
  • For more information on the isolation modes available in IIS 6.0, see IIS Isolation Modes.
  • For information on configuring application isolation modes, see Configuring Isolation Modes.
  • For information on the advantages of pooling application processes, and on how to create and configure application pools, see Configuring Application Pools.
(The following words are used by Search; they are not intended to be displayed on the page.) icons


Creating Applications

To create an application, you must first designate a directory as the starting point, which is also called the application root, for the application. You can then set properties for the application. Each application can have a friendly name. This name appears in IIS Manager and gives you a way to distinguish between applications. The application name is not used anywhere else.

note Note Web sites are root-level applications by default. When you create a Web site, a default application is created at the same time. You can use this root-level application, remove it, or replace it with a new application.

You can remove a directory from the application boundaries so that requests to files in that directory and its subdirectories cannot start the application. Removing a directory from an application boundary does not delete the directory from either your Web site or from your computer's hard disk.

important Important You must be a member of the Administrators group on the local computer to perform the following procedure (or procedures), or you must have been delegated the appropriate authority. As a security best practice, log on to your computer using an account that is not in the Administrators group, and then use the Run as command to run IIS Manager as an administrator. From the command prompt, type runas /user:administrative_accountname "mmc %systemroot%\system32\inetsrv\iis.msc".

To create an application

  1. In IIS Manager, expand the local computer, right-click the starting-point directory of the application you are creating, and then click Properties.
  2. Click the appropriate tab: Home Directory, Virtual Directory, or Directory.
  3. In the Application settings area, click Create.
  4. In the Application name box, type a name for your application.
  5. In the Execute Permissions list box, set permissions by doing one of the following:
    • Click None to prevent any programs or scripts from running.
    • Click Scripts only to enable applications mapped to a script engine to run in this directory without having permissions set for executables. Setting permissions to Scripts only is more secure than setting them to Scripts and Executables because you can limit the applications that can be run in the directory.
    • Click Scripts and Executables to allow any application to run in this directory, including applications mapped to script engines and Windows binaries (.dll and .exe files).
  6. Click OK.

note Note If you see the Remove button instead of the Create button, an application has already been created.

To remove a directory from the application

  1. In IIS Manager, expand the local computer, right-click the directory that you want to remove, and then click Properties.
  2. Click the appropriate tab: Home Directory, Virtual Directory, or Directory.
  3. In the Application settings area, click Remove.

note Note To stop an application and unload it from memory, click Unload. If the Unload button is dimmed, you are not in the application's starting-point directory.

Related Topics
  • For information on configuring application isolation modes, see Configuring Isolation Modes.
  • For information on Web application isolation, see Web Application Isolation.
  • For information on isolation modes, IIS Isolation Modes.
  • For more information about pooling application processes, see Configuring Application Pools.


Setting Application Mappings

There are many programming and scripting languages that you can use to develop Web applications. Thus, IIS uses the file name extension of a requested resource on your Web site to determine which Internet Server API (ISAPI) or Common Gateway Interface (CGI) program to run to process a request. For example, a request for a file ending with a .aspx extension causes the Web server to call the ASP.NET program (aspnet_isapi.dll) to process the request. The association of a file name extension with an ISAPI or CGI program is called application mapping.

IIS 6.0 is preconfigured to support common application mappings. You can add or remove mappings for all of the applications on a Web site or for an individual application.

important Important You must be a member of the Administrators group on the local computer to perform the following procedure (or procedures), or you must have been delegated the appropriate authority. As a security best practice, log on to your computer using an account that is not in the Administrators group, and then use the Run as command to run IIS Manager as an administrator. From the command prompt, type runas /user:administrative_accountname "mmc %systemroot%\system32\inetsrv\iis.msc".

To map an extension to an application

  1. In IIS Manager, expand the local computer, and then click the starting-point directory of the application you want.
  2. Right-click the directory, and then click Properties.
  3. Click the appropriate tab: Home Directory, Virtual Directory, or Directory.
  4. In the Application settings area, click Configuration, and then click the Mappings tab.
  5. On the Mappings tab, click Add.
  6. In the Executable box, type the path to the ISAPI or CGI program that will process the file. You must specify a program in a local directory on the Web server.
  7. In the Extension box, type the file name extension that you want to be associated with the ISAPI or CGI program. When the Web server receives a URL identifying a file with this extension, it calls the associated program to process the request.
  8. To allow processing for files of this type in a directory with Script permission, select the Script engine check box. When a directory has Script permission set (instead of Execute permission), only files associated with applications that are designated script engines can be processed in the directory.
  9. Select the Verify that file exists check box to allow the server to check that the requested script exists before mapping an extension to an application.

note Note On the Mappings tab there is a Verbs column, which was formerly called Exclusions in IIS 4.0. Changing to the word verbs addresses the issue of future compatibility, as more new HTTP verbs will be added to the Hypertext Transfer Protocol.

To remove an application mapping

  1. In IIS Manager, expand the local computer, and then click the starting-point directory of the application you want.
  2. Right-click the directory, and then click Properties.
  3. Click the appropriate tab: Home Directory, Virtual Directory, or Directory.
  4. In the Application settings area, click Configuration, and then click the Mappings tab.
  5. On the Mappings tab, click Remove.

    6. Requests for files with this file name extension are no longer processed in this Web site or directory.

Related Topics
  • For information on how to configure a Web site to run an ISAPI application regardless of the extension of the requested file, see Installing Wildcard Application Mappings.


Configuring ASP.NET Applications in Worker Process Isolation Mode

When you install ASP.NET on a computer running Windows Server 2003, there are two process model modes that you can choose. By default, ASP.NET uses the IIS 6.0 worker process isolation mode. This mode allows you to configure application pools, recycle worker processes, enable Web gardening, set idle time-outs and processor affinity, and use a variety of application health maintenance features. On computers running a member of the Windows Server 2003 family, your ASP.NET applications should use the worker process isolation mode unless you encounter specific compatibility issues.

Be aware, however, that when your application is running in worker process isolation mode, any <processModel> element configuration settings that you have created in the computer-wide Machine.config file are ignored, except the following three settings:

  • maxWorkerThreads
  • maxIoThreads
  • ResponseDeadlockInterval

The <processModel> element configures the ASP.NET process model settings on an IIS Web server. The <processModel> section can be set only within the Machine.config file, and it affects all ASP.NET applications running on the server.

Configuring the <processModel> Element Using IIS Manager

important Important These features of IIS 6.0 are available only when running in worker process isolation mode.

timeout Equivalent Setting in IIS 6.0 Worker Process Isolation Mode

The timeout attribute specifies the number of minutes until ASP.NET launches a new worker process to take the place of the current one. The default setting is Infinite. The Recycle worker processes entry is set to 120 minutes, as shown below, and is on by default.

important Important You must be a member of the Administrators group on the local computer to perform the following procedure (or procedures), or you must have been delegated the appropriate authority. As a security best practice, log on to your computer using an account that is not in the Administrators group, and then use the Run as command to run IIS Manager as an administrator. From the command prompt, type runas /user:administrative_accountname "mmc %systemroot%\system32\inetsrv\iis.msc".

To configure the ASP.NET attribute timeout using IIS Manager

  1. In IIS Manager, expand the local computer, expand Application Pools, right-click the application pool, and click Properties.
  2. On the Recycling tab, select the Recycle worker processes (in minutes) check box.
  3. Click the up or down arrow to set the number of minutes you want to elapse before the worker process is recycled.
  4. Click OK.

idleTimeout Equivalent Setting in IIS 6.0 Worker Process Isolation Mode

The worker processes or application pools in IIS 6.0 can be shut down after remaining idle for a specific amount of time. The Shutdown worker process entry is set to 20 minutes and is on by default.

To configure the ASP.NET attribute idleTimeout using IIS Manager

  1. In IIS Manager, expand the local computer, expand Application Pools, right-click the application pool, and then click Properties.
  2. Click the Performance tab, and under Idle timeout, select the Shutdown worker processes after being idle for check box.
  3. In the minutes box, type the number of idle (no processing requests) minutes that you want to elapse before shutting down the idle worker process.
  4. Click OK.

shutdownTimeout Equivalent Setting in IIS 6.0 Worker Process Isolation Mode

The shutdownTimeout attribute specifies the amount of time the worker process is given to shut itself down gracefully. The time is expressed in hr:min:sec string format. The worker process Shutdown time limit is set to 90 seconds, as shown below.

To configure the ASP.NET attribute shutdownTimeout using IIS Manager

  1. In IIS Manager, expand the local computer, expand Application Pools, right-click the application pool, and click Properties.
  2. Click the Health tab, and under Shutdown time limit, in the seconds box next to Worker process must shutdown within, type the desired number of seconds.
  3. Click OK.

requestLimit Equivalent Setting in IIS 6.0 Worker Process Isolation Mode

The worker processes or application pools in IIS 6.0 can be set to recycle after a specific number of requests. This feature is not on by default.

To configure the ASP.NET attribute requestLimit using IIS Manager

  1. In IIS Manager, expand the local computer, expand Application Pools, right-click the application pool, and then click Properties.
  2. Select Recycle worker process (in requests) and type the maximum amount of virtual memory allowed before the worker process is recycled.
  3. Click OK.

requestQueueLimit Equivalent Setting in IIS 6.0 Worker Process Isolation Mode

The requestQueueLimit attribute specifies the maximum allowed number of requests that will be queued in the Internet Server API (ISAPI) while waiting for the worker process to start after an abnormal termination. Note that this setting does not apply in the case of a clean shut down or normal cycle. The queue limit in IIS 6.0 is set in the kernel and is set to 1000 by default.

To configure the ASP.NET attribute requestQueueLimit using IIS Manager

  1. In IIS Manager, expand the local computer, expand the Application Pools folder, right-click the application, and then click Properties.
  2. Click the Performance tab.
  3. In the Request queue limit section, select the Limit the kernel request queue to check box, and click the up and down arrows in the requests box to set the maximum number of queued requests.
  4. Click Apply, and then click OK.

memoryLimit Equivalent Setting in IIS 6.0 Worker Process Isolation Mode

In IIS 6.0 worker process isolation mode, worker processes can be recycled based on both virtual memory and physical memory. Unlike the Machine.config files, the memory limit is not a percentage value, it is a finite value measured in megabytes.

Recycling based on physical or virtual memory is not on by default, but if selected, the default value is 500 megabytes (MB) for the virtual memory and 192 MB for the physical memory.

To configure the ASP.NET attribute memoryLimit using IIS Manager

  1. In IIS Manager, expand the local computer, expand Application Pools, right-click the application pool, and click Properties.
  2. On the Recycling tab, under Memory recycling, select the Maximum virtual memory (in megabytes) or Maximum used memory (in megabytes) check box.
  3. Click the up or down arrow to set memory limits.
  4. Click OK.

webGarden and cpuMask Equivalent Settings in IIS 6.0 Worker Process Isolation Mode

The webGarden attribute controls Web garden mode, or using multiple affinitized woker processes. The cpuMask controls the number of processes and the way the Web garden works.

Since webGarden enables the use of multiple processes, it means that all processes will have their own copy of things like application state, in-process session state, caches, and static data.

When using Web gardens, keep in mind the following:

  • If your application uses session state, it must choose an out-of-process provider (NT Service or SQL).
  • Application state and application statics are per process, not per computer.
  • Caching is per process, not per computer.

Web gardens can be also set up in IIS 6.0 worker process isolation mode by increasing the maximum number of worker processes per application pool from 1 to n (as required).

To configure the ASP.NET attribute webGarden and cpuMask

  1. In IIS Manager, expand the local computer, expand Application Pools, right-click the application pool, and then click Properties.
  2. Click the Performance tab, and under Web garden, in the Maximum number of worker processes box, type the number of worker processes that you want to assign to the application pool.
  3. Click OK.

userName and password Equivalent Settings in IIS 6.0 Worker Process Isolation Mode

The userName attribute allows the worker process to run with a different Windows identity than the default process identity. By default, this attribute is empty and the process runs as the IIS identity. If valid credentials are presented in the userName and password attributes, the process runs as the given account. When present, these attributes cause the worker process to run as the configured Windows identity. The default is blank attributes. In worker process isolation mode, the default is to run as Network Service. However, they can be set to a configurable account as follows.

To configure the ASP.NET attributes userName and password

  1. In IIS Manager, expand the local computer, expand the Application Pools folder, right-click the application pool you would like to configure, and click Properties.
  2. Click the Identity tab.
  3. Click Configurable.
  4. Click Browse, and under Enter the object name to select, type the account name in which you want your worker process to run, and click OK.
  5. In the Password box, type the password associated with this account. If there is no password associated with the account, leave the Password box blank.
  6. Click OK.

important Important When you configure a worker process identity for an application pool using a configurable account, you must add the account you created to the IIS_WPG group in order for the worker process to run.

pingFrequency and pingTimeout Equivalent Settings in IIS 6.0 Worker Process Isolation Mode

The pingFrequency attribute is the time interval in standard process model format (hr:min:sec). The default is 30 seconds. The pingTimeout attribute is the time interval in standard process model format (hr:min:sc). The default is 5 seconds.

In IIS 6.0 worker process isolation mode, pinging is enabled by default. The default value of pingFrequency is 30 seconds after the response comes back from the worker process. The equivalent setting for pingTimeout is PingResponseTime, which is 90 seconds and can be changed directly in the metabase.

To configure the ASP.NET attribute pingFrequency and pingTimeout

  1. In IIS Manager, expand the local computer, expand Application Pools, right-click the application pool, and then click Properties.
  2. Click the Health tab, and select the Enable pinging check box.
  3. In the seconds box next to Ping worker process, type the number of seconds that you want to elapse between pings.
  4. Click OK.
Related Topics
  • For information on configuring the ASP.NET worker process for a hosted environment so that users cannot obtain privileged access to information on the server, see Configuring ASP.NET Process Identity.
  • For more information on the ASP.NET configuration system, see ASP.NET Configuration.


Configuring ASP Applications

You can set properties that control performance and other factors of the Active Server Pages (ASP) applications that you have installed on your Web server. For example, you can turn on the use of session state in the application or set the default scripting language. Application properties apply to all ASP pages in the application unless you directly override the property on an individual page. You can also set these properties in the metabase. If the property in the metabase conflicts with the property you set in the property sheet then the last property setting overrides.

important Important In order to take a more proactive stance against malicious users and attackers, IIS is not installed on members of the Microsoft® Windows® Server 2003 family by default. Furthermore, when you initially install IIS, the service is installed in a highly secure and "locked" mode. By default, IIS serves only static content — meaning features like ASP, ASP.NET, Server-Side Includes, WebDAV publishing, and FrontPage® Server Extensions do not work unless enabled. If you do not enable this functionality after installing IIS, IIS returns a 404 error. You can serve dynamic content and enable these features through the Web Service Extensions node in IIS Manager. Also, if an application extension is not mapped in IIS, IIS returns a 404 error. To map an extension, see Setting Application Mappings. For more information on how to troubleshoot 404 errors, including 404.2 and 404.3; issues related to a new installation of IIS 6.0; or an upgrade from a previous version of IIS, see Troubleshooting.

Enabling Session State

You can enable session state persistence for the ASP application. If you enable session state, the server will create a new Session object for each connection and session state will be accessible, session storage will be allowed, Session_OnStart and Session_OnEnd will occur, and the ASPSessionID cookie will be sent to the client. If you do not enable session state, state access and storage are not allowed, events are not processed, and no cookie is sent. By default, session state is enabled with the session timeout at 20 minutes. The corresponding metabase property is AspAllowSessionState.

important Important You must be a member of the Administrators group on the local computer to perform the following procedure (or procedures), or you must have been delegated the appropriate authority. As a security best practice, log on to your computer using an account that is not in the Administrators group, and then use the Run as command to run IIS Manager as an administrator. From the command prompt, type runas /user:administrative_accountname "mmc %systemroot%\system32\inetsrv\iis.msc".

To enable session state for an ASP application

  1. In IIS Manager, expand the local computer, right-click the starting-point directory of the application you want to configure, and then click Properties.
  2. Click the appropriate tab: Home Directory, Virtual Directory, or Directory.
  3. In the Application settings area, click Configuration, and then click the Options tab.
  4. On the Options tab, in the Application configuration section, select the Enable session state check box.
  5. In the Session timeout box, click the up or down arrow to set the number of minutes until the session expires.
  6. Click OK.

Enabling Buffering

Enabling buffering on an ASP application specifies whether output from an ASP application will be buffered. All output from the application is collected in the buffer before the buffer is flushed to the client browser. If you do not enable buffering, output from an ASP script is written to the client browser as it becomes available. By default, buffering is enabled. The corresponding metabase property is AspBufferingOn.

To enable buffering for an ASP application

  1. In IIS Manager, expand the local computer, right-click the starting-point directory of the application you want to configure, and then click Properties.
  2. Click the appropriate tab: Home Directory, Virtual Directory, or Directory.
  3. In the Application settings area, click Configuration, and then click the Options tab.
  4. On the Options tab, in the Application configuration section, select the Enable buffering check box.
  5. Click OK.

Enabling Parent Paths

Enabling parent paths specifies whether an ASP page allows paths relative to the current directory (using the ..\ notation). If set to true, this property constitutes a potential security risk, because an include path could access critical or confidential files outside the root directory of the application.

Parent paths are no longer enabled by default. This affects your application if it has a Web page that contains the #include server-side include directive and uses ".." notation to refer to a parent directory. Enabling parent paths corresponds to the metabase setting, AspEnableParentPaths.

note Note In IIS 6.0, parent paths are not enabled by default.

To enable parent paths

  1. In IIS Manager, expand the local computer, right-click the starting-point directory of the application you want to configure, and then click Properties.
  2. Click the Directory tab, and then click Configuration.
  3. Click the Options tab.
  4. In the Application configuration section, select the Enable parent paths check box.
  5. Click OK.

Changing the Default ASP Language

The default ASP language affects ASP files that do not use the <%@Language%> directive. The default language is Microsoft Visual Basic® Scripting Edition (VBscript). Changing the default ASP language corresponds to the metabase setting, AspScriptLanguage.

To change the default ASP language

  1. In IIS Manager, expand the local computer, right-click the starting-point directory of the application you want to configure, and then click Properties.
  2. Click the Directory tab, and then click Configuration.
  3. Click the Options tab.
  4. In the Application configuration section, in the Default ASP language box, type the language you want to use.
  5. Click OK.

ASP Script Timeout

When you set the ASP script timeout, you specify, in seconds, the default length of time that ASP pages allow a script to run before terminating the script and writing an event to the Microsoft Windows® Event Log. The minimum value for this property is one second and the default value is 90 seconds. The corresponding metabase property is AspScriptTimeout

To change ASP script timeout

  1. In IIS Manager, expand the local computer, right-click the starting-point directory of the application you want to configure, and then click Properties.
  2. Click the Directory tab, and then click Configuration.
  3. Click the Options tab.
  4. In the Application configuration section, in the ASP script timeout box, click the up or down arrow to set the number of seconds before an error message is returned.
  5. Click OK.

ASP Caching

ASP processes the files that contain ASP scripts, stores these processed files in a cache, and then serves the cached files to clients. Caching ASP script files enhances performance because cached ASP scripts are not compiled each time they are called. The corresponding Metabase property is AspScriptFileCacheSize. AspScriptFileCacheSize specifies the number of precompiled script files to cache.

To change the settings for caching ASP script files

  1. In IIS Manager, expand the local computer, expand the Web Sites folder, right-click the Web site you want to configure, and then click Properties.
  2. Click the appropriate tab: Home Directory, Virtual Directory, or Directory.
  3. In the Application Settings area, click Configuration, and then click the Cache Options tab.

    note Note If the Configuration button is not active, the directory or starting point does not contain an isolated application. You can create a new application by clicking Create.

  4. In the ASP File Cache section, configure the ASP cache setting by doing one of the following:
    • To cache all requested .asp files, select the Cache all ASP files in memory check box. The maximum amount of files that can be cached is 2,000,000,000.
    • To set the maximum number of files cached in memory, select the Cache limited ASP files in memory check box, and then click the up or down arrow to set the maximum number of files. Files in excess of this number are persisted to the disk cache if you select the Cache remaining ASP files on disk check box. Or you can limit the total number of ASP files cached by selecting the Cache limited ASP files on disk check box, and then clicking the up or down arrow to set the maximum number of files.
    • To turn off the cache, select the Do not cache ASP files check box.
    • Click OK.

The ASP disk cache begins caching files into a directory when the ASP memory cache is full. Furthermore, a file has to be requested at least twice before it becomes a candidate for the ASP disk cache. The corresponding metabase property, AspMaxDiskTemplateCacheFiles, specifies the maximum number of compiled ASP templates that can be stored. AspDiskTemplateCacheDirectory contains the name of the directory that ASP uses to store compiled ASP templates to disk after overflow of the in-memory cache.

important Important In order for disk caching to work, ASP needs a properly configured disk cache directory in which to store the compiled ASP files. This means that the Administrators and IIS_WPG groups have full control on the disk cache directory and that the disk cache directory is a local directory on the Web server.

The default location of the disk cache is %systemroot%\System32\inetsrv\ASP Compiled Templates. In worker process isolation mode, subdirectories under the disk cache directory are created for each application pool. In IIS 5.0 isolation mode the default disk cache directory is %windir%\system32\inetsrv\ASP Compiled Templates.

To create a disk cache directory

  1. In IIS Manager, expand the local computer, expand the Web Sites folder, right-click the Web site that you want, and then click Properties.
  2. Click the appropriate tab: Home Directory, Virtual Directory, or Directory.
  3. In the Application Settings area, click Configuration.
  4. Click the Cache Options tab, and in the Disk cache directory box browse to the directory used for disk caching.
  5. Click OK.
Related Topics
  • For information on Side-by-side Assemblies, see What's New in ASP.
  • For information on NTFS and Web site permissions, see Securing Files with NTFS and Securing Sites with Web Site Permissions.
  • For information on changing ASP configuration options programmatically, see Metabase Property Reference.
  • For more information on pooling applications, see Configuring Application Pools.


Enabling ASP Debugging

important Important For security and performance reasons, do not enable debugging in a production environment.

You can set debugging options for ASP pages and control which types of error messages are sent. In order to enable debugging for ASP pages in worker process isolation mode, you must also configure the Access permissions and the Launch permissions for the debugger.

important Important You must be a member of the Administrators group on the local computer to perform the following procedure (or procedures), or you must have been delegated the appropriate authority. As a security best practice, log on to your computer using an account that is not in the Administrators group, and then use the Run as command to run IIS Manager as an administrator. From the command prompt, type runas /user:administrative_accountname "mmc %systemroot%\system32\inetsrv\iis.msc".

To enable ASP debugging

  1. In IIS Manager, expand the local computer, right-click Default Web Site, and then click Properties.
  2. Click the Home Directory tab, and then click Configuration.
  3. Click the Debugging tab, and then select the Enable ASP server-side script debugging check box.
  4. Click Send detailed ASP error messages to client if you want to send the client very detailed debugging information, or click Send the following text error message to client and type the text you want to send to the client.
  5. Click OK.

Because the worker process identity runs as the Network Service account in worker process isolation mode, you must follow these directions to debug ASP applications.

note Note It is recommended that you do not change the worker process identity to run as LocalSystem.

To configure Launch and Access permissions to enable ASP debugging in worker process isolation mode for Script Debugger and Visual InterDev

  1. If you haven't done so already, install Microsoft Script Debugger or Microsoft Visual InterDev® debugger.
  2. From the Start menu, click Run, and then type the following: dcomcnfg
  3. In the Console Root file, expand Component Services, expand Computers, expand My Computer, and expand DCOM Config.
  4. Right-click Machine Debug Manager and click Properties.
  5. Click the Security tab.
  6. Under Launch Permissions, click Edit, click Add, type Network Service, and then click OK. If you are joined to a domain, you may need to click Locations and change the location to the local computer.
  7. Under Access Permissions, click Edit, click Add, type Network Service, and then click OK. If you are joined to a domain, you may need to click Locations and change the location to the local computer.
  8. Click OK.

note Note To enable ASP debugging for Microsoft Visual Studio® .NET, you must add the Network Service account to the Debugger Users group.

Related Topics
  • For more information on the Microsoft Script Debugger tool, see Microsoft Script Debugger on MSDN® Online.
  • For more information on debugging in Visual Studio, see Adding Debugger Users and Configuring DCOM.


Configuring CGI Applications

IIS 6.0 supports Common Gateway Interface (CGI) applications. This topic provides administrative information on installing and configuring CGI applications on the Web server, and setting the timeout value for a CGI script.

CGI programs are executed when the Web server receives a URL that contains the CGI program name and any parameters that it requires. If your CGI program is compiled into an executable (.exe) file, you must give the directory that contains the program Execute permissions so that users can run the program. If your CGI program is written as a script, for example a Perl script, then you can give the directory either Execute permissions or Script permissions. To use Script permissions, the script interpreter must be marked as a script engine.

note Note The IIS_WPG group doesn't have the right to start CGI processes by default. If you create a new account and add it to the IIS_WPG group to run a worker process identity, you still must grant this new account two user rights to start CGI processes. These user rights are Adjust memory quotas for a process and Replace a process level token. To modify user rights, see Edit local security settings or Edit a security setting on a Group Policy object.

important Important In order to take a more proactive stance against malicious users and attackers, IIS is not installed on members of the Microsoft® Windows® Server 2003 family by default. Furthermore, when you initially install IIS, the service is installed in a highly secure and "locked" mode. By default, IIS serves only static content — meaning features like ASP, ASP.NET, Server-Side Includes, WebDAV publishing, and FrontPage® Server Extensions do not work unless enabled. If you do not enable this functionality after installing IIS, IIS returns a 404 error. You can serve dynamic content and enable these features through the Web Service Extensions node in IIS Manager. Also, if an application extension is not mapped in IIS, IIS returns a 404 error. To map an extension, see Setting Application Mappings. For more information on how to troubleshoot 404 errors, including 404.2 and 404.3; issues related to a new installation of IIS 6.0; or an upgrade from a previous version of IIS, see Troubleshooting.

If you want to develop new CGI applications, Microsoft provides several alternatives. For faster execution, consider developing an Internet Server API (ISAPI) extension instead. For ease of development, consider developing an ASP.NET application. For more information, see ASP.NET.

important Important You must be a member of the Administrators group on the local computer to perform the following procedure (or procedures), or you must have been delegated the appropriate authority. As a security best practice, log on to your computer using an account that is not in the Administrators group, and then use the Run as command to run IIS Manager as an administrator. From the command prompt, type runas /user:administrative_accountname "mmc %systemroot%\system32\inetsrv\iis.msc".

Installing CGI Applications

To install and configure CGI applications

  1. Set up a directory for your CGI programs. For extra security, separate your CGI programs from your content files. You do not need to name the directory Cgi-bin, although you can do so if you want. For more information, see Using Virtual Directories.
  2. If your CGI programs are scripts, obtain and install the appropriate script interpreter. For example, to run Perl scripts, obtain a Perl interpreter. Windows operating systems do not provide versions of Perl, SED, or AWK. Instead, you must obtain these interpreters from third-party developers.
  3. If your CGI programs are .exe files, give the directory Execute permissions. If your CGI programs are scripts, you can give the directory either Execute permissions or Script permissions. For more information, see Access Control.

    If you choose to give the directory Script permissions, you must mark the script interpreter as a script engine in the directory properties. Only interpreters that are marked as script engines are allowed to execute in the directory. Executable files (.dll and .exe files) cannot be directly executed; that is, a browser request cannot launch an executable file on the Web server by including the program name in the URL. By enabling Scripts only permissions and selecting the Script engine check box, you can safely put content files (such as .htm or .gif files) in the same directory as your CGI scripts. Content files are displayed in the browser and scripts are executed, but no one can run an unauthorized program and script commands are not displayed in the browser.
  4. For CGI scripts, create an application mapping between the file name extension of your script and the script interpreter.

    IIS maps file name extensions to an interpreter. For example, if you are using Perl scripts stored in files with a .pl extension, map the .pl extension to the program that runs Perl scripts. Map .bat and .cmd files to the command interpreter (Cmd.exe). For more information, see Setting Application Mappings.
  5. Set NTFS permissions. If you are using NTFS access permissions, verify that all users who need to run the program have Execute permissions for the directory. If your Web site accepts anonymous users, make sure that the anonymous user (the IUSR_computername account) has Execute permissions.

IIS supports most of the standard server environment variables.

For greater security, the Web server does not pass the command interpreter's special characters to a mapped CGI application. By default, the following characters cannot be included in the URL that calls the CGI application:

| ( , ; % < >

Related Topics
  • For general information on programming CGI applications, refer to the MSDN Online Library.
(The following words are used by Search; they are not intended to be displayed on the page.) W3SVC


Configuring ISAPI Extensions

By adjusting several settings that are associated with the ISAPI extensions (ISAPI DLLs) that run on your server, you can fine-tune server performance. Logging usage data, such as the number of requests and the time they were made, can help you determine how to make the adjustments.

important Important In order to take a more proactive stance against malicious users and attackers, IIS is not installed on members of the Microsoft® Windows® Server 2003 family by default. Furthermore, when you initially install IIS, the service is installed in a highly secure and "locked" mode. By default, IIS serves only static content — meaning features like ASP, ASP.NET, Server-Side Includes, WebDAV publishing, and FrontPage® Server Extensions do not work unless enabled. If you do not enable this functionality after installing IIS, IIS returns a 404 error. You can serve dynamic content and enable these features through the Web Service Extensions node in IIS Manager. Also, if an application extension is not mapped in IIS, IIS returns a 404 error. To map an extension, see Setting Application Mappings. For more information on how to troubleshoot 404 errors, including 404.2 and 404.3; issues related to a new installation of IIS 6.0; or an upgrade from a previous version of IIS, see Troubleshooting.

Caching ISAPI extensions

ISAPI DLLs can be loaded and cached so that additional requests can be processed without calling them again. Otherwise, the DLLs are unloaded after they are run. Caching reduces the time a user waits for a DLL to load, and most ISAPI extensions benefit from caching. You should clear this option only for special circumstances, such as debugging ISAPI extensions.

important Important You must be a member of the Administrators group on the local computer to perform the following procedure (or procedures), or you must have been delegated the appropriate authority. As a security best practice, log on to your computer using an account that is not in the Administrators group, and then use the Run as command to run IIS Manager as an administrator. From the command prompt, type runas /user:administrative_accountname "mmc %systemroot%\system32\inetsrv\iis.msc".

To enable caching

  1. In IIS Manager, expand the local computer, and then click the starting-point directory of the application you want.
  2. Right-click the directory, and then click Properties.
  3. Click the appropriate tab: Home Directory, Virtual Directory, or Directory.
  4. In the Application settings area, click Configuration, and then click the Mappings tab.
  5. On the Mappings tab, select the Cache ISAPI extensions check box.
Related Topics
  • For more information on logging server activity, see Logging Site Activity.
  • For more information on performance issues, see About Performance Tuning.


Installing ISAPI Filters

Like Internet Server API (ISAPI) extensions, ISAPI filters are programs that respond when the application server receives an HTTP request. However, unlike ISAPI extensions, ISAPI filters are always run in the server process. ISAPI filters are different from applications because they are driven by Web server events instead of a client request. You can associate an ISAPI filter with a particular Web server event; the filter is then notified every time its associated event occurs. For example, a filter could be notified when a Read or Write event occurs and then encrypt the raw data to be returned to the client.

You can install filters for all of the sites on an application server (global filters), and you can install filters for individual Web sites (site filters). If you install both global filters and site filters, the two filter lists are merged for the site.

When several filters have registered for the same event, they are called sequentially. Filters with a higher priority are run before filters with a lower priority. If several filters have the same priority, global filters that are set in the master properties are run before the filters that are set at the site level. Filters with the same priority at the same inheritance level are run in the order in which they were loaded. You can change the filter load order by adjusting the properties for the Web server or the Web site.

important Important You must be a member of the Administrators group on the local computer to perform the following procedure (or procedures), or you must have been delegated the appropriate authority. As a security best practice, log on to your computer using an account that is not in the Administrators group, and then use the Run as command to run IIS Manager as an administrator. From the command prompt, type runas /user:administrative_accountname "mmc %systemroot%\system32\inetsrv\iis.msc".

To add a filter to a Web server or Web site

  1. In IIS Manager, expand the local computer, right-click the Web server or Web site to which you want to add a filter, and then click Properties.
  2. Click the ISAPI Filters tab, and then click Add.

    note Note If you are adding filters to a Web site, you will not see any global filters inherited from the Web server's master properties. You will see only the filters installed for the Web site, even though both sets of filters are run.

  3. In the Filter name text box, type the name of the filter.
  4. In the Executable text box, type the name of the DLL file or click Browse to navigate to it, and then click OK.
  5. Click the up or down arrow to change the load order of a filter.

    note Note You can only change the load order of filters that have the same priority.

  6. If you have added or changed a global filter, you must stop and restart the Web server to load the new filters into memory. A filter added at the Web site level is automatically loaded when you add it.

note Note If an HTTP request triggers an event for which the filter is registered, the filter will receive the data contained in the request regardless of whether the request is for a file, a CGI application, or an ISAPI extension.

Related Topics
  • For information on how to fine-tune server performance by caching ISAPI extensions, see Configuring ISAPI Extensions.
  • For more information on ISAPI filters, see ISAPI Reference in the IIS Software Development Kit (SDK).


Installing Wildcard Application Mappings

In IIS 6.0, administrators can configure a Web site or virtual directory to run an Internet Server API (ISAPI) application at the beginning of every request to that Web site or virtual directory, regardless of the extension of the requested file.

When an IIS Web server receives a request from a client, the Web server looks at the extension of the file that is named in the request to determine which ISAPI or Common Gateway Interface (CGI) application handles that file. For example, if a request comes in for a Web page called Default.asp, IIS knows from the application mapping list that Default.asp is handled by the Asp.dll ISAPI application.

If you want certain tasks to be executed for every client request before the requested page is sent to its mapped application, you can write an ISAPI filter which intercepts requests as they arrive. However, ISAPI filters have the following limitations:

  • They cannot access the body of a request, only the headers.
  • They can only be configured per site, not per virtual directory.
  • They should not contain long-running operations because ISAPI filters are synchronous.
  • They are less flexible because the ISAPI filter API has less functionality than the ISAPI extension API, which is used to write ISAPI applications.
  • They are difficult to manage over time.
  • They are event-driven.

By using wildcard application maps, you can intercept every request before the requested page is sent to its mapped application. The effect is like having an application mapping that handles every file name extension. This is why the term wildcard is used to name this feature. Applications using wildcard application mappping can only be ISAPI applications.

A client request takes the following route:

  1. An incoming request is handled by any existing ISAPI filters that are installed on the root Web site. The ISAPI filters are executed in order.
  2. The request is sent to any existing wildcard application map applications, which are also executed in order. If the incoming request is for a Web file that is in a virtual directory, and there are wildcard application maps installed on the virtual directory and the root Web site, then only the wildcard application maps that are installed on the virtual directory are executed. If there are no wildcard application maps installed on the virtual directory, then the wildcard application maps that are installed on the Web site are executed. In other words, wildcard application maps are only inherited if none exist in the application where the requested Web file resides.
  3. The IIS server looks at the application mappings table to determine which ISAPI application or CGI script specifically processes the requested file.
  4. The response can be appended to at each stage and then sent back to the client.

Using Wildcard Application Mappings

Wildcard application maps can be used in the following scenarios:

  • Highly secure Web applications, such as banking applications, that require that every user who makes a request is authenticated against a database of user names, passwords, and account numbers. For example, once the user is authenticated, certain rules are created that specify what information the user can access. If the wildcard application map determines that the user has no rights, it can prevent the request from going any further, or it can send the request to a Web page other than the one that was requested. This custom authentication and authorization scheme can be implemented in an ISAPI application and installed as a wildcard application map. This way, all users must go through authentication, regardless of the file name extension they request.
  • E-commerce Web sites that display advertisements targeted to the interests of individual users. For example, when returning users make a request for a page, a wildcard application map application can examine their identity and then look up items that they previously viewed or purchased. Once the wildcard script map transfers control to the page that was requested, an advertisement that is appropriate to the user can be displayed.

important Important You must be a member of the Administrators group on the local computer to perform the following procedure (or procedures), or you must have been delegated the appropriate authority. As a security best practice, log on to your computer using an account that is not in the Administrators group, and then use the Run as command to run IIS Manager as an administrator. From the command prompt, type runas /user:administrative_accountname "mmc %systemroot%\system32\inetsrv\iis.msc".

To add a wildcard application mapping to a Web server or Web site

  1. In IIS Manager, expand the local computer, expand the Web Sites folder, right-click the Web site or virtual directory that you want, and then click Properties.
  2. Click the appropriate tab: Home Directory, Virtual Directory, or Directory.
  3. In the Application settings area, click Configuration, and then click the Mappings tab.
  4. To install a wildcard application map, do the following:
    • On the Mappings tab, click Insert.
    • Type the path to the DLL in the Executable text box or click Browse to navigate to it, select the Application Engine check box if the DLL is a script engine, and then click OK.
  5. To edit or delete a wildcard application map, do the following:
    • In the Application extensions list, click the script map that you want to change.
    • Click Edit to alter the script map, or click Remove to remove the script map.
  6. To change the order in which the wildcard application maps execute, rearrange the wildcard application maps in the Wildcard application maps (order of implementation) box by clicking the Move Up or Move Down button until they match the execution order you want.

    7. note Note Do not list the same application more than once in your list of wildcard application maps.

Related Topics
  • For information on developing wildcard application mappings, see Developing ISAPI Extensions and Filters and ISAPI Reference in the IIS Software Development Kit (SDK).
  • For information on regular application mappings, see Setting Application Mappings.


Configuring Applications to Use COM+ Services

COM+ provides a number of services that can be used by Active Server Pages (ASP) applications, and it provides one service, transaction processing, that can be used by ASP pages. The following is a short description of how each service can be configured for an ASP application. For information on how to configure these services in COM+, either programmatically or by using Component Services Manager, see the related information in the COM+ Software Development Kit (SDK) or online at COM+ (Component Services).

Since only side-by-side assemblies can be enabled using IIS Manager, example code for enabling each service on an ASP application is provided below.

This topic includes the following information:

  • Apartment Model Selection
  • Side-by-Side Assemblies
  • COM+ Partitions
  • Tracker

Apartment Model Selection

ASP is now capable of running all of its threads in a multi-threaded apartment (MTA). If your COM components are primarily free-threaded or both-threaded, running the ASP threads as MTA can improve performance significantly.

To enable an ASP application to run in an MTA, you can use the metabase setting, AspExecuteInMTA, at the application level. This means that you can have one application running on ASP MTA threads and a second application running on ASP STA (single-threaded apartment) threads. The default for ASP threads continues to be STA.

important Important When you switch an ASP application from running in STA to MTA (or from MTA to STA), the impersonation token becomes obsolete. This can cause the application to run with no impersonation, effectively letting it run with the identity of the process which might allow access to other resources. If you must switch threading models, disable the application and unload it before you make the change.

The following example sets the Default Web Site application (W3SVC/1/ROOT) to execute in MTA:

On Error Resume Next
set providerObj = GetObject("winmgmts://MyMachine/root/MicrosoftIISv2")
' Get a reference to the ASP application called Default Web Site
set IIsWebVirtualDirSettingObj = providerObj.get("IIsWebVirtualDirSetting='W3SVC/1/ROOT'")
WScript.Echo "Before: AspExecuteInMTA = " & IIsWebVirtualDirSettingObj.AspExecuteInMTA
' Set the ASP application to execute in MTA
IIsWebVirtualDirSettingObj.AspExecuteInMTA = 1
IIsWebVirtualDirSettingObj.Put_()
WScript.Echo "After: AspExecuteInMTA = " & IIsWebVirtualDirSettingObj.AspExecuteInMTA

Side-by-Side Assemblies

Side-by-side (SxS) assemblies allow ASP applications to specify which version of a system DLL or classic COM component to use, such as MDAC, MFS, MSVCRT, MSXML, and so on. For example, if your ASP application relies on MSXML version 2.0, you can ensure that your application still uses MSXML version 2.0 even after service packs are applied to the server. Any new version of MSXML is still installed on the computer, but version 2.0 remains and is used by your application. Configuring SxS assemblies requires that you know the path to the DLL, and that the COM+ manifest file exists in every virtual directory that needs to use the DLL. The COM+ manifest is an XML file that has information about where a DLL is installed. IIS does not verify that the manifest exists. A manifest looks like the following file excerpt:

<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
<assemblyIdentity publicKeyToken="75e377300ab7b886" type="win32" name="Test4Dir" version="1.0.0.0" processorArchitecture="x86"/>
<file name="DirComp.dll" hash="35ca6f27b11ed948ac6e50b75566355f0991d5d9" hashalg="SHA1">
<comClass clsid="{6C6CC20E-0F85-49C0-A14D-D09102BD7CDC}" progid="DirComp.PathInfo" threadingModel="apartment"/>
<typelib tlbid="{AA56D6B8-9ADB-415D-9E10-16DD68447319}" version="1.0" helpdir=""/>
</file>
</assembly>

You can enable side-by-side assemblies on the IIS side programmatically or by using IIS Manager.

To enable side-by-side assemblies on the IIS side using IIS Manager

  1. In IIS Manager, right-click a Web site or virtual directory and click Properties.
  2. Click the Virtual Directory tab, and click Configuration.
  3. If the configuration button is not available, it is because you have not created an application for this virtual directory. Click Create to create an application.
  4. In the Application Configuration dialog box, click the Options tab.
  5. Select the Enable Side by Side assemblies check box.
  6. In the Manifest file name box, type the name of the COM+ manifest file.
  7. Click OK twice.

To enable side-by-side assemblies programmatically, set the AspEnableSxs flag of the AspAppServiceFlags metabase property. Also set the AspSxsName metabase property to the name of the COM+ manifest name. Set both metabase properties at the application level.

important Important Only one version of a system DLL can be used in any application pool, even though this feature is configurable at the application level. For example, if application App1 uses MDAC, version 2.5 and application App2 uses MDAC, version 2.4, then App1 and App2 should not be in the same application pool. If they are, the application that is loaded first has its version of MDAC loaded, and the other application is forced to use it until the applications are unloaded.

The following example enables side-by-side assemblies on the Default Web Site application (W3SVC/1/ROOT). Notice that after setting only the AspEnableTracker property, the AspAppServiceFlags property changes as well:

On Error Resume Next
set providerObj = GetObject("winmgmts://MyMachine/root/MicrosoftIISv2")
' Get a reference to the ASP application called Default Web Site
set IIsWebVirtualDirSettingObj = providerObj.get("IIsWebVirtualDirSetting='W3SVC/1/ROOT'")
WScript.Echo "Before: AspEnableSxs = " & IIsWebVirtualDirSettingObj.AspEnableSxs
WScript.Echo "        AspSxsName = " & IIsWebVirtualDirSettingObj.AspSxsName
WScript.Echo "        AspAppServiceFlags = " & IIsWebVirtualDirSettingObj.AspAppServiceFlags
' Set the ASP application to enable COM+ side-by-side assemblies
IIsWebVirtualDirSettingObj.AspEnableSxs = 1
' Set the AspSxsName property
IIsWebVirtualDirSettingObj.AspSxsName = "VersionInfo"
' Save the values to the IIS metabase
IIsWebVirtualDirSettingObj.Put_()
' Get the reference again in order to refresh the AspAppServiceFlags property.
set IIsWebVirtualDirSettingObj = Nothing
set IIsWebVirtualDirSettingObj = providerObj.get("IIsWebVirtualDirSetting='W3SVC/1/ROOT'")
WScript.Echo "After: AspEnableSxs = " & IIsWebVirtualDirSettingObj.AspEnableSxs
WScript.Echo "       AspSxsName = " & IIsWebVirtualDirSettingObj.AspSxsName
WScript.Echo "       AspAppServiceFlags = " & IIsWebVirtualDirSettingObj.AspAppServiceFlags

COM+ Partitions

COM+ Partitions can be used to isolate Web applications into their own COM+ partitions. This is useful to prevent one Web application from accessing the private COM+ applications, configuration information, and data of another Web application. COM+ partitions can hold different versions of your own custom COM components. For example, if you host Web sites for two competing companies that both use COM+ in their Web applications, you can use COM+ partitions to ensure that one company's Web application cannot access the COM+ components in the other company's Web applications. If one of those companies asks you to change certain features in a COM+ application that they both use, you can isolate the new version of that COM+ application in the partition that is linked to their Web application.

To enable COM+ partitions on the IIS side, set the AspUsePartition flag of the AspAppServiceFlags metabase property at the application level. The partition is identified by a GUID (created using the Component Services Manager snap-in), which can be set at the AspPartitionID metabase property. If no partition is specified, the default system partition is used. For more information, please see "Creating and Configuring COM+ Partitions" in the COM+ SDK or online at COM+ (Component Services).

important Important Only one version of a COM+ component can be used in any application pool, even though this feature is configurable at the application level. For example, if application App1 uses version 1.0 of a custom COM+ application called Shop.dll, and application App2 uses version 2.0 of Shop.dll, then App1 and App2 should not be in the same application pool. If they are, the application that is loaded first has its version of Shop.dll loaded, and the other application is forced to use it until the applications are unloaded.

The following example enables partitions on the Default Web Site application (W3SVC/1/ROOT). Notice that after setting only the AspEnableTracker property, the AspAppServiceFlags property changes as well.

On Error Resume Next
set providerObj = GetObject("winmgmts://MyMachine/root/MicrosoftIISv2")
' Get a reference to the ASP application called Default Web Site
set IIsWebVirtualDirSettingObj = providerObj.get("IIsWebVirtualDirSetting='W3SVC/1/ROOT'")
WScript.Echo "Before: AspUsePartition = " & IIsWebVirtualDirSettingObj.AspUsePartition
WScript.Echo "        AspPartitionID = " & IIsWebVirtualDirSettingObj.AspPartitionID
WScript.Echo "        AspAppServiceFlags = " & IIsWebVirtualDirSettingObj.AspAppServiceFlags
' Set the ASP application to enable COM+ partitioning
IIsWebVirtualDirSettingObj.AspUsePartition = 1
' Set the AspPartitionID property to the GUID configured in Component Services Manager
' when you created the COM+ partition
IIsWebVirtualDirSettingObj.AspPartitionID = "{00000000-0000-0000-0000-000000000000}"
' Save the values to the IIS metabase
IIsWebVirtualDirSettingObj.Put_()
' Get the reference again in order to refresh the AspAppServiceFlags property.
set IIsWebVirtualDirSettingObj = Nothing
set IIsWebVirtualDirSettingObj = providerObj.get("IIsWebVirtualDirSetting='W3SVC/1/ROOT'")
WScript.Echo "After: AspUsePartition = " & IIsWebVirtualDirSettingObj.AspUsePartition
WScript.Echo "       AspPartitionID = " & IIsWebVirtualDirSettingObj.AspPartitionID
WScript.Echo "       AspAppServiceFlags = " & IIsWebVirtualDirSettingObj.AspAppServiceFlags

Tracker

COM+ tracker allows administrators or developers to debug ASP applications. For example, if a Web application is causing problems on your server, you can enable COM+ tracker to determine when ASP pages are being loaded, when COM components are loaded, and when threads leave a page. After you have debugged your application, you can disable COM+ tracker to return your application to normal performance speed.

To enable COM+ tracker on the IIS side, set the AspEnableTracker flag of the AspAppServiceFlags metabase property at the application level.

The following example enables tracking on the Default Web Site application (W3SVC/1/ROOT). Notice that after setting only the AspEnableTracker property, the AspAppServiceFlags property changes as well:

On Error Resume Next
set providerObj = GetObject("winmgmts://MyMachine/root/MicrosoftIISv2")
' Get a reference to the ASP application called Default Web Site
set IIsWebVirtualDirSettingObj = providerObj.get("IIsWebVirtualDirSetting='W3SVC/1/ROOT'")
WScript.Echo "Before: AspEnableTracker = " & IIsWebVirtualDirSettingObj.AspEnableTracker
WScript.Echo "        AspAppServiceFlags = " & IIsWebVirtualDirSettingObj.AspAppServiceFlags
' Set the ASP application to enable COM+ tracking
IIsWebVirtualDirSettingObj.AspEnableTracker = 1
IIsWebVirtualDirSettingObj.Put_()
' Get the reference again in order to refresh the AspAppServiceFlags property.
set IIsWebVirtualDirSettingObj = Nothing
set IIsWebVirtualDirSettingObj = providerObj.get("IIsWebVirtualDirSetting='W3SVC/1/ROOT'")
WScript.Echo "After: AspEnableTracker = " & IIsWebVirtualDirSettingObj.AspEnableTracker
WScript.Echo "       AspAppServiceFlags = " & IIsWebVirtualDirSettingObj.AspAppServiceFlags


Configuring Servers for Applications

In Web development, Web site and application code is complex and ever changing. Web sites and applications change as frequently as every week or month. Consequently, you require hosting services that actively manage your run-time environment, while safeguarding applications and managing performance.

This section explains how to use IIS Manager to configure your server to manage and execute Web-based applications.

This section includes the following information:

  • About Configuring Servers for Applications: Discusses things to consider when you configure your server to run Web-based applications.
  • Enabling and Disabling Dynamic Content: Describes the necessary tasks to enable and disable the Web service extensions that process dynamic information.
  • Configuring Isolation Modes: Describes configuring a server's modes of operation, and explains the ramifications of each mode.
  • Worker Process Isolation Mode: Describes the WWW Service Administration and Monitoring features of Internet Information Services (IIS) 6.0 running in worker process isolation mode, and provides procedures for using them.
  • IIS 5.0 Isolation Mode: Explains how to use the features of IIS 6.0 running in IIS 5.0 isolation mode.
Related Topics
  • For information on creating and configuring applications, see Configuring Applications.
(The following words are used by Search; they are not intended to be displayed on the page.) configure, configuration, configuring, web app, web apps, web applications, program, programs, programmer, develop, developer, code, coder, coders, development, application root, directory, starting-point directory, create, write, map, mapping, mappings, associate, associating, association, file name, filename, extension, dll, .dll, .exe, exe, isolate, isolated, isolation, out of process, out-of-process, oop, out-of-proc, crash, reliable, stable, reliability, stability, availability, available, uptime, downtime, protection, separate, memory space, cgi, script, time out, time-out, times out, time-outs, timeouts, cache, caching, isapi, extensions, scriptless asp, flow control, enhanced, objects, self-tuning, fine-tune, tune-up, tune up, automatic, threads, error-handling, line, number, .asp, file, server scriptlets, business logic, reusable, com, components, j++, vb, vba, visual basic, jscript, javascript, filters, install, set up, setup, asp, active server pages, automate, administration tasks, properties, property sheet, start, stop, starting, stopping, pause, pausing, debug, debugging, step through, errors, links, more information


About Configuring Servers for Applications

Internet Information Services (IIS) 6.0 delivers Web hosting services through an adjustable architecture that you can use to manage server resources with improved stability, efficiency, and performance. IIS separates applications into isolated pools and automatically detects memory leaks, defective processes, and over-utilized resources. When problems occur, IIS manages them by shutting down and redeploying faulty resources and connecting faulty processes to analytical tools.

IIS can run in either of two mutually exclusive modes of operation:

  • Worker process isolation mode This is the default mode of IIS 6.0, isolates key components of the World Wide Web Publishing Service (WWW service) from the effects of errant applications, and it protects applications from each other by using the worker process component. Use worker process isolation mode unless you have a specific compatibility issue that makes the use of IIS 5.0 isolation mode necessary. Web sites that serve static content or simple ASP applications should be able to move to IIS 6.0 running in worker process isolation mode with little or no modification.
  • IIS 5.0 isolation mode With this mode, you can run applications that are are incompatible with worker process isolation mode because they were developed for earlier versions of IIS. Applications that run correctly on IIS 5.0 should run correctly on IIS 6.0 in IIS 5.0 isolation mode.

Worker process isolation mode provides better default security for running Web applications than IIS 5.0 isolation mode. By default, worker processes run with the Network Service identity. The Network Service account has lower access rights than the default account for IIS 5.0 isolation mode. Web applications that run in-process in IIS 5.0 application mode run as LocalSystem. The LocalSystem account can read, execute, and change most of the resources on the computer.

The default isolation mode upon installing IIS 6.0 depends on whether you perform a clean installation or an upgrade.

  • After a clean install of IIS 6.0, IIS runs in worker process isolation mode.
  • After an upgrade from an earlier version of IIS 6.0, the isolation mode is the same as configured on the previously-installed version of IIS 6.0.
  • After an upgrade from IIS 5.0 or IIS 4.0, IIS 6.0 runs in IIS 5.0 isolation mode by default to maintain compatibility with your existing applications.

For information on switching from one isolation mode to the other, see Configuring Isolation Modes.

Worker Process Isolation Mode

IIS 6.0 introduces worker process isolation mode, which runs all Web applications in an isolated environment. When you run IIS in worker process isolation mode, applications can be configured to run in separate application pools. Each application pool is a logical representation of a configurable worker process and links to the applications in the pool. Worker processes operate independently of each other; they can fail without affecting other worker processes. The pooling of applications protects applications from the effects of worker processes that support other application pools. In this way, applications are protected from each other.

In worker process isolation mode, Hypertext Transfer Protocol (HTTP) requests are routed directly to an in-kernel application pool queue serving the configured application. Worker processes that serve an application pool pull the requests directly from the queue, avoiding process-switching overhead.

To further protect your WWW service, IIS 6.0 isolates critical World Wide Web Publishing Service (WWW service) components, such as the HTTP protocol stack (HTTP.sys) and WWW Service Administration and Monitoring, from the effects of third-party code running in worker processes. HTTP.sys receives and queues requests for WWW services. When a worker process enters an unhealthy state, and thus stops processing requests, HTTP.sys continues to process requests. Meanwhile, the WWW service detects that the worker process is unhealthy and shuts it down. If there is demand for a new worker process to serve requests (HTTP.sys has requests queued), the WWW service starts a new worker process to pick up the queued requests from HTTP.sys. Even though a worker process has failed, the WWW service continues to process requests and shields the user from experiencing a loss of service.

IIS 6.0 worker process isolation mode delivers the following specific improvements over earlier versions of IIS:

  • Robust performance Isolation prevents Web applications and Web sites from affecting each other or the WWW service. Reboots of the operating system and restarting of the WWW service are avoided.
  • Self-healing Automated management provides auto-restart of failed worker processes and periodic restart of deteriorating worker processes.
  • Scalability Web gardens allow more than one worker process to serve the same application pool.
  • Process affinity enables the connection of worker processes to specific processors on multi-CPU servers.
  • Automated debugging The debugging feature enables the automatic assignment of failing worker processes to debugging tools.
  • CPU limiting This monitoring feature enables controlling the amount of CPU resources that an application pool consumes in a configured amount of time.

IIS 5.0 Isolation Mode

If your server must run applications that are incompatible with worker process isolation mode, you can configure IIS to run in IIS 5.0 isolation mode, which supports the process model and features of IIS 5.0. If you run IIS in IIS 5.0 isolation mode, some features of worker process isolation mode are not available.

Related Topics
  • For information about creating application pools, see Configuring Application Pools.

  • For more information about when to use IIS 5.0 isolation mode and how to configure IIS for IIS 5.0 isolation mode, see Configuring Isolation Modes.


Enabling and Disabling Dynamic Content

In order to take a more proactive stance against malicious users and attackers, IIS is not installed on members of the Microsoft® Windows® Server 2003 family by default. Furthermore, when you initially install IIS, the service is installed in a highly secure and "locked" mode. By default, IIS serves only static content — meaning features like ASP, ASP.NET, Server-Side Includes, WebDAV publishing, and FrontPage® Server Extensions do not work unless enabled. If you do not enable this functionality after installing IIS, IIS returns a 404 error. For more information on how to troubleshoot 404 errors, including 404.2 and 404.3; issues related to a new installation of IIS 6.0; or an upgrade from a previous version of IIS, see Troubleshooting.

You can configure these request handlers, called Web service extensions, by manipulating the Web Service Extensions node in IIS Manager to accomplish the following:

  • Allow and prohibit Web service extensions.
  • Add new Web service extensions.
  • Allow the Web service extensions that a specified application can call.
  • Prohibit all Web service extensions from running on the local computer.

You can enable or disable Web service extensions individually if they are registered in the Web Service Extensions node in IIS Manager.

important Important You must be a member of the Administrators group on the local computer to perform the following procedure (or procedures), or you must have been delegated the appropriate authority. As a security best practice, log on to your computer using an account that is not in the Administrators group, and then use the Run as command to run IIS Manager as an administrator. From the command prompt, type runas /user:administrative_accountname "mmc %systemroot%\system32\inetsrv\iis.msc".

To enable and disable a Web service extension

  1. In IIS Manager, expand the local computer, and then click Web Service Extensions.
  2. In the details pane, click the Web Service Extension that you want to enable or disable.
  3. To enable a disabled Web service extension, click Allow.
  4. To disable an enabled Web service extension, click Prohibit.
  5. Click OK.
To use, or to deny the use of, an HTTP request handler that is not in the list of Web service extensions, you must first register it by adding the HTTP request handler to the list of Web service extensions.

To add new Web service extensions

  1. In IIS Manager, expand the computer name, and then click Web Service Extensions.
  2. In the details pane, click Add a new Web service extension.
  3. In the Extension name box, type the name of the new Web service extension.
  4. Click Add.
  5. In the Path to file box, type the path or click Browse to navigate to any files that the new Web service extension requires, and click OK.
  6. Optionally, select the Set extension status to Allowed check box to automatically set the status of the new Web service extension to Allowed.
  7. Click OK.

You can allow a specified application to call Web service extensions.

To allow an application to call a Web service extension

  1. In IIS Manager, expand the local computer, and then click Web Service Extensions.
  2. Click Add and allow extensions for a specific application.
  3. From the Application list box, click the name of the application. The Web service extension that the application is allowed to call appears in the Extensions to be allowed box.
  4. Click OK.

You can disable all Web service extensions that are registered on the local computer with one setting in the Web Service Extension node of IIS Manager.

To disable all Web service extensions

  1. In IIS Manager, expand the local computer, and then click Web Service Extensions.
  2. Click Prohibit all extensions. A warning message appears.
  3. To disable all extensions, click Yes. To cancel the action, click No. To see more information, click Help.
  4. If you click Yes, the status of each Web service extension is disabled.


Configuring Isolation Modes

You can run IIS 6.0 in one of two modes: worker process isolation mode or IIS 5.0 isolation mode. Worker process isolation mode is the default mode, that is, the mode that the server runs in on a clean installation. You can use IIS 5.0 isolation mode to run applications developed for older versions of IIS that are determined to be incompatible with worker process isolation mode.

This topic includes the following information:

  • Configuring IIS for worker process isolation mode.
  • Configuring IIS for IIS 5.0 isolation mode.

Configuring IIS for Worker Process Isolation Mode

Worker process isolation mode is the default service mode in IIS. Worker process isolation mode delivers all the benefits of IIS 6.0 new architecture: robust application pooling; automated restarts, scalability, debugging; and finely-tuned performance tuning. Web applications run with the Network Service identity, which provides a security advantage: the Network Service account has lower access privileges than LocalSystem. Use worker process isolation mode unless you must run applications that might conflict with it, as stated below in "Configuring IIS for IIS 5.0 Isolation Mode."

To complete the following procedure, you must restart IIS, which will temporarily interrupt the World Wide Web Publishing Service (WWW service).

important Important You must be a member of the Administrators group on the local computer to perform the following procedure (or procedures), or you must have been delegated the appropriate authority. As a security best practice, log on to your computer using an account that is not in the Administrators group, and then use the Run as command to run IIS Manager as an administrator. From the command prompt, type runas /user:administrative_accountname "mmc %systemroot%\system32\inetsrv\iis.msc".

To configure IIS for worker process isolation mode

  1. In IIS Manager, expand the local computer, right-click Web Sites, and then click Properties.
  2. Click the Service tab, clear the Run WWW service in IIS 5.0 isolation mode check box, and then click OK.
  3. To start the WWW service, click Yes.

If the switch to worker process isolation mode is successful, a folder named Application Pools appears in the IIS Manager listing for your local computer. You can always determine which isolation mode IIS is running by the presence (worker process isolation mode) or absence (IIS 5.0 isolation mode) of the Application Pools folder.

Configuring IIS for IIS 5.0 Isolation Mode

You must use IIS 5.0 isolation mode for applications that conflict with worker process isolation mode until the applications are modified.

The following application characteristics conflict with worker process isolation mode:

  • Dependency on Inetinfo.exe: If the application must run in the Inetinfo.exe process, it must be run in IIS 5.0 isolation mode because applications do not run in Inetinfo.exe in worker process isolation mode.
  • Requires Read Raw Data Filters: Read Raw Data Filters are available in IIS 5.0 isolation mode only.
  • Requires Dllhost.exe: Applications that must be run in a Dllhost.exe environment can be run only in IIS 5.0 isolation mode because Dllhost.exe is not available in worker process isolation mode.

If the IIS 6.0 service is running in worker process isolation mode (the IIS 6.0 default mode), and you must run applications that do not meet the requirements for worker process isolation mode, switch to IIS 5.0 isolation mode. This means you will not be able to take advantage of worker process isolation and the other features of worker process isolation mode.

After you complete the following procedure, you must restart the WWW service, which will temporarily interrupt the service.

To configure IIS for IIS 5.0 isolation mode

  1. In IIS Manager, expand the local computer, right-click Web Sites, and then click Properties.
  2. Click the Service tab, select the Run WWW service in IIS 5.0 isolation mode check box, and then click OK.
  3. To start the WWW service, click Yes.


Worker Process Isolation Mode

This section explains how use IIS Manager to configure Internet Information Services (IIS) to execute Web-based applications with IIS in worker process isolation mode.

This section includes the following information:

  • Configuring Application Pools: Explains the advantages of pooling application processes, and describes how to create and configure application pools.
  • Recycling Worker Processes: Describes how to configure IIS to periodically restart worker processes in an application pool.
  • Configuring Worker Processes for Idle Timeout: Describes how to configure idle process timeout, which is a resource management feature.
  • Processor Affinity: Explains the concept of process/processor affinity.
  • Configuring Web Gardens: Describes how to configure multiple application pools running under one worker process.
  • Application Pool Health: Explains the concepts of application pool health and health monitoring.
  • Configuring Worker Process Health Monitoring: Describes how to enable IIS to monitor the health of each worker process.
  • Configuring Rapid-Fail Protection: Describes how to protect resources when the requests to a worker process fail rapidly.
  • Configuring Startup and Shutdown Time Limits: Explains how to configure a worker process to startup on demand when the first request for a Uniform Resource Locator (URL) is received.
  • Configuring Application Pool Identity: Describes the security considerations that are related to configuring the identity of an application pool.
Related Topics
  • For an overview of IIS worker process isolation mode, see About Configuring Servers for Applications.
  • For information on configuring applications, see Configuring Applications.
(The following words are used by Search; they are not intended to be displayed on the page.) configure, configuration, configuring, web app, web apps, web applications, program, programs, programmer, develop, developer, code, coder, coders, development, application root, directory, starting-point directory, create, write, map, mapping, mappings, associate, associating, association, file name, filename, extension, dll, .dll, .exe, exe, isolate, isolated, isolation, out of process, out-of-process, oop, out-of-proc, crash, reliable, stable, reliability, stability, availability, available, uptime, downtime, protection, separate, memory space, cgi, script, time out, time-out, times out, time-outs, timeouts, cache, caching, isapi, extensions, scriptless asp, flow control, enhanced, objects, self-tuning, fine-tune, tune-up, tune up, automatic, threads, error-handling, line, number, .asp, file, server scriptlets, business logic, reusable, com, components, j++, vb, vba, visual basic, jscript, javascript, filters, install, set up, setup, asp, active server pages, automate, administration tasks, properties, property sheet, start, stop, starting, stopping, pause, pausing, debug, debugging, step through, errors, links, more information


Configuring Application Pools

important Important This feature of IIS 6.0 is available only when running in worker process isolation mode.

An application pool is a configuration that links one or more applications to a set of one or more worker processes. Because applications in an application pool are separated from other applications by worker process boundaries, an application in one application pool is not affected by problems caused by applications in other application pools.

By creating new application pools and assigning Web sites and applications to them, you can make your server more efficient and reliable, as well as making your other applications always available, even when the worker process serving the new application pool has problems.

Guidelines for Creating Application Pools

Consider the following guidelines when configuring application pools:

  • To isolate Web applications on a Web site from Web applications on other sites running on the same computer, create an individual application pool for each Web site.
  • For enhanced security, configure a unique user account (process identity) for each application pool. Use an account with the least user rights possible, such as Network Service in the IIS_WPG group.
  • If there is a test version of an application on the same server with the production version of the application, separate the two versions into different application pools. This isolates the test version of the application.
  • As a design consideration, if you want to configure an application to run with its own unique set of properties, create a unique application pool for that application.

important Important You must be a member of the Administrators group on the local computer to perform the following procedure (or procedures), or you must have been delegated the appropriate authority. As a security best practice, log on to your computer using an account that is not in the Administrators group, and then use the Run as command to run IIS Manager as an administrator. From the command prompt, type runas /user:administrative_accountname "mmc %systemroot%\system32\inetsrv\iis.msc".

To create a new application pool

  1. In IIS Manager, expand the local computer, right-click Application Pools, point to New, and then click Application Pool.
  2. In the Application pool name box, type the name of the new application pool.
  3. If the ID that appears in Application pool ID box is not the ID that you want, type a new ID.
  4. Under Application pool settings, click the appropriate setting. If you click Use existing application pool as template, in Application pool name box, right-click the application pool that you want to use as a template.
  5. Click OK.

To assign an application to an application pool

  1. In IIS Manager, right-click the application that you want to assign to an application pool, and then click Properties.
  2. Click the Virtual Directory, Directory, or Home Directory tab.
  3. If you are assigning a directory or virtual directory, verify that Application name is filled in. If the Application name box is not filled in, click Create, and then type a name.
  4. In the Application pool list box, click the name of the application pool to which you want to assign the Web site.
  5. Click OK.


Recycling Worker Processes

important Important This feature of IIS 6.0 is available only when IIS is running in worker process isolation mode.

In worker process isolation mode, IIS can be configured to periodically restart worker processes, so that you can recycle faulty Web applications. This ensures that applications in those pools remain healthy and that system resources are recovered.

You can configure worker processes to restart based on elapsed time, number of requests served, scheduled times, and two types of memory usage.

This topic includes the following sections:

  • How Worker Process Recycling Works
  • When to Use Worker Process Recycling
  • Configuring Worker Processes for Recycling
  • Logging Worker Process Recycling Events

How Worker Process Recycling Works

Depending on how an application pool is configured for recycling, the World Wide Web Publishing Service (WWW service) can recycle the assigned worker process in two ways:

  1. By default, the WWW service establishes an overlapped recycle, in which the worker process that is to be terminated is kept running until after a new worker process is started up.
  2. Alternatively, the WWW service can terminate a worker process and then start a new worker process if the workload justifies this action.

note Note When the WWW service recycles a worker process, it does not disconnect the existing TCP/IP connection. The HTTP protocol stack (HTTP.sys) establishes and maintains TCP/IP connections.

In an overlapped recycle scenario, the process that is targeted for a recycle continues to process requests while the WWW service simultaneously creates a replacement worker process. The new worker process is started before the old worker process stops, and requests are then directed to the new process. This design prevents service interruptions, because the old process remains in communication with HTTP.sys to handle requests until it shuts down. Because the shutdown timeout value of an overlapped shutdown or startup is configurable, the worker process can be terminated while it is still serving requests, if it does not finish draining requests within the time limit.

When you configure an application pool to recycle worker processes based on elapsed time, all the worker processes are recycled during the elapsed time set, but they are not recycled all at once. Application recycling is spread over the time set to reduce interruptions of service to client requests.

Similarly, when you configure an application pool to recycle applications based on the number of requests processed, recycling takes place at intervals to spread the overhead that is associated with the worker-process recycling.

When to Use Worker Process Recycling

Consider the following general guidelines when you decide whether to enable worker process recycling. The optimal solution is to fix the application that is causing the problem. However, recoding is not always an option, especially in cases when other application code is running that cannot be modified.

Consider using recycling when:

  • You are hosting problematic applications on your Web server that you cannot fix.
  • You are experiencing undetermined or intermittent problems.
  • You suspect an application is leaking memory as a result of performance monitoring.
  • You have previously implemented a temporary reset solution, such as scheduled execution of the IISReset command-line utility.

You may not need to use recycling at all if:

  • You are hosting a Web site that contains static content only and no custom Internet Server API (ISAPI) applications.
  • You are hosting an application that has already been thoroughly tested and does not suffer from memory or resource allocation problems.

To effectively use recycling, review the criteria on which recycling can be based, as listed in the following table.

Recycle based on | Description | Use when
ISAPI request | Recycles the worker process based on a request from an ISAPI in the application pool. | ISAPI extensions can declare themselves unhealthy.
Elapsed time | Recycles the worker process based on a time frame that is specified by the user in minutes. | Applications have problems running for extended time periods.
Number of requests | Recycles the worker process when the number of Hypertext Transfer Protocol (HTTP) requests exceeds a certain threshold. | Applications are failing based on the number of requests they receive.
Scheduled times | Recycling can occur at specified times within a 24-hour period. | Conditions are similar to the conditions for elapsed time.
Virtual memory (reserved plus used) | Recycles the worker process when the worker process virtual memory reaches a certain threshold. | The memory heap becomes highly fragmented, which is caused by applications reserving memory multiple times. The symptom is a steady increase in virtual memory.
Used memory | Recycles the worker process when the memory that is used by the W3wp.exe process reaches a certain threshold. | Some applications have memory leaks.
Demand | Recycling happens when an IIS administrator can control the recycling of an entire application pool by using Microsoft® Management Console (MMC) or a script. | There is an application pool that is causing problems while the other sites are up and running. Consider recycling the application, as opposed to resetting the entire WWW service.

Configuring Worker Processes for Recycling

important Important You must be a member of the Administrators group on the local computer to perform the following procedure (or procedures), or you must have been delegated the appropriate authority. As a security best practice, log on to your computer using an account that is not in the Administrators group, and then use the Run as command to run IIS Manager as an administrator. From the command prompt, type runas /user:administrative_accountname "mmc %systemroot%\system32\inetsrv\iis.msc".

To recycle a worker process immediatly on demand

  1. In IIS Manager, expand the local computer, expand Application Pools, right-click the application pool.
  2. Click Recycle.

To configure a worker process to be recycled after a set elapsed time

  1. In IIS Manager, expand the local computer, expand Application Pools, right-click the application pool, and then click Properties.
  2. On the Recycling tab, select the Recycle worker processes (in minutes) check box.
  3. In the box to the right of the Recycle worker processes (in minutes), type the number of minutes that you want to elapse before the worker process is recycled.
  4. Click OK.

To configure a worker process to be recycled after a set number of processing requests

  1. In IIS Manager, expand the local computer, expand Application Pools, right-click the application pool, and then click Properties.
  2. On the Recycling tab, select the Recycle worker process (in requests) check box.
  3. In the box to the right of the Recycle worker process (in requests), type the number of requests to be processed before the worker process is recycled.
  4. Click OK.

To configure a worker process to be recycled at scheduled times

  1. In IIS Manager, expand the local computer, expand Application Pools, right-click the application pool, and then click Properties.
  2. On the Recycling tab, select the Recycle worker processes at the following times check box.
  3. Click Add, Remove, or Edit to add a time to the list, delete a time, or change an existing time at which the worker process will be recycled.
  4. Click OK.

note Note When recycling is set to occur at scheduled times, it may occur off-schedule if the system time is altered. To avoid unintended changes in the time that recycling occurs, recycle the scheduled worker processes soon after the system time is changed.

To configure a worker process to be recycled after consuming a set amount of memory

  1. In IIS Manager, expand the local computer, expand Application Pools, right-click the application pool, and then click Properties.
  2. On the Recycling tab, under the Memory recycling, select the Maximum virtual memory (in megabytes) check box.
  3. In the box to the right of the Recycle worker process (in requests), type the maximum amount of virtual memory allowed before the worker process is recycled.
  4. Select the Maximum used memory (in megabytes) check box.
  5. In the box to the right of Maximum used memory (in megabytes), type the maximum amount of memory allowed before the worker process is recycled.
  6. Click OK.

Logging Worker Process Recycling Events

By setting the metabase property LogEventOnRecycle, you can direct the WWW Service to log worker process recycling events in the event log. You can use LogEventOnRecycle parameters to monitor and log recycle events based on:
  • Time consumed.
  • Requests processed.
  • Scheduled recycles.
  • Memory consumed.
  • Recycle on demand from an administrator.
  • Change in application pool recycle properties.
  • ISAPI requests it.
Related Topics
  • For information on setting LogEventOnRecycle, see LogEventOnRecycle in Metabase Property Reference.


Configuring Worker Processes for Idle Timeout

important Important This feature of IIS 6.0 is available only when IIS is running in worker process isolation mode.

When it is necessary to conserve system resources by terminating unused worker processes, you can configure a worker process to gracefully close after a specified period of time. You can use this feature to better manage the resources when the processing load is heavy, when identified applications consistently fall into an idle state, or when new processing space is not available. You can also start additional worker processes to replace a worker process that is finished.

important Important You must be a member of the Administrators group on the local computer to perform the following procedure (or procedures), or you must have been delegated the appropriate authority. As a security best practice, log on to your computer using an account that is not in the Administrators group, and then use the Run as command to run IIS Manager as an administrator. From the command prompt, type runas /user:administrative_accountname "mmc %systemroot%\system32\inetsrv\iis.msc".

To configure application pool idle timeout

  1. In IIS Manager, expand the local computer, expand Application Pools, right-click the application pool, and then click Properties.
  2. Click the Performance tab, and under the Idle timeout, select the Shutdown worker processes after being idle for check box.
  3. In the minutes box, type the number of idle (no processing requests) minutes that you want to elapse before shutting down the idle worker process.
  4. Click OK.
Related Topics
  • For information on application pool settings affecting starting and stopping of a worker process, see Configuring Startup and Shutdown Time Limits.


Processor Affinity

important Important This feature of IIS 6.0 is available only when IIS is running in worker process isolation mode.

On multi-CPU servers, application pools can be configured to establish affinity between worker processes and multiple CPUs to more efficiently use CPU caches. Processor affinity is used in conjunction with the processor affinity mask setting to specify CPUs.

Related Topics
  • For information on processor affinity mask settings, see SMPProcessorAffinityMask and SMPAffinitized.


Configuring Web Gardens

important Important This feature of IIS 6.0 is available only when IIS is running in worker process isolation mode.

With IIS 6.0 worker process isolation mode, you can configure an application pool to be supported by multiple worker processes. An application pool that uses more than one worker process is called a Web garden. Web gardens are different from Web farms in that Web gardens use multiple worker processes for an application pool, while Web farms use multiple servers for a Web site.

Creating a Web garden for an application pool enhances performance in the following ways:

  • Robust processing of requests: When a worker process in an application pool is tied up (for example, when a script engine stops responding), other worker processes can accept and process requests for the application pool.
  • Reduced contention for resources: When a Web garden reaches a steady state, each new TCP/IP connection is assigned, according to a round-robin scheme, to a worker process in the Web garden. This has the effect of smoothing out workloads and reducing contention for resources that are bound to a worker process.

important Important You must be a member of the Administrators group on the local computer to perform the following procedure (or procedures), or you must have been delegated the appropriate authority. As a security best practice, log on to your computer using an account that is not in the Administrators group, and then use the Run as command to run IIS Manager as an administrator. From the command prompt, type runas /user:administrative_accountname "mmc %systemroot%\system32\inetsrv\iis.msc".

To configure a Web garden

  1. In IIS Manager, expand the local computer, expand Application Pools, right-click the application pool, and then click Properties.
  2. Click the Performance tab, and under Web garden, in the Maximum number of worker processes box, type the number of worker processes that you want to assign to the application pool.
  3. Click OK.
Related Topics
  • For information on resource allocation, see Processor Affinity.


Application Pool Health

important Important This feature of IIS 6.0 is available only when running in worker process isolation mode.

In worker process isolation mode, application pools can be configured to monitor the health of their worker processes as well as the health of the entire pool. Monitoring the health of a worker process includes detecting that the worker process is not able to serve requests and taking appropriate action. For example, if a worker process fails to respond to a ping request by the World Wide Web Publishing Service (WWW service,) the worker process probably does not have threads available for processing incoming requests. When this happens, the WWW service will either terminate the worker process, or release the worker process and leave it running, and start a new worker process to replace it. An administrator can pre-configure an action to take when an unhealthy worker process is released, such as attaching the worker process to a debugger.

In addition to monitoring the health of worker processes, the WWW service can also detect ongoing problems with the entire application pool. For example, if worker processes are terminating abnormally every few seconds, the WWW service can determine that the worker process is unhealthy and stop it, preventing the unhealthy applications from affecting applications in other pools.

The following conditions cause an application pool to start or stop:

  • Initiation of rapid-fail protection causes an application pool to stop.
  • A job object hitting it's time limit causes an application pool to stop, followed by a start when the time window expires.
  • A configuration error caused by trying to use a nonexistent identity causes an application pool to stop.
  • A Windows administrator performs a demand stop or start on an application pool.

Monitoring Application Pool Health

Worker process pinging enables the WWW service to detect that a worker process is unable to respond to requests (In other words, the worker process is unhealthy). The ping is a message sent between the WWW service and the worker process. If the ping succeeds, then the WWW service assumes the application pool is healthy. If the ping fails (no response from the worker is received), then the WWW service assumes that a problem exists with the worker process. If a problem exists, the WWW service will either terminate the worker process or release it, and then will start a new worker process when it is needed to serve new requests. If the worker process is released but still running, then the WWW service will run the action configured by the administrator.

The setting of the WWW service pinging feature and the frequency of the ping are controlled by the metabase properties PingingEnabled and PingInterval.

ISAPI Extensions Can Declare Themselves Unhealthy

An ISAPI extension application can be built to programmatically signal IIS that it needs to be recycled. This can be accomplished through the new Server Support function: HSE_REQ_REPORT_UNHEALTHY. See ServerSupportFunction in the ISAPI Extension Reference at MSDN Online.

To use this function effectively, the IIS server that is running your application must have worker process pinging enabled (see Configuring Worker Process Health Monitoring), because it is during the ping operation that the WWW service detects that the ISAPI is unhealthy and the worker process should be recycled. The ISAPI will need an internal mechanism for determining its unhealthy state, such as monitoring the status of its internal thread pool. You should consider that this type of programming shuts down the worker process the ISAPI extension is running in. Therefore, all applications running in that worker process will be restarted.

The ASP ISAPI extension implements logic that takes advantage of this feature as it monitors the status of its internal thread pool. If too many of its threads enter a blocking state, it will signal a recycle.

Limitations of Health Detection

Health detection cannot be used to determine application failures that do not cause the worker process to crash nor block the available threads in the worker process. As an example, an application that is returning invalid response codes such as HTTP 500 errors, but otherwise functioning normally, will still respond to a ping from the WWW service, unless the application was a custom ISAPI extension that implemented specific code to indicate its unhealthy state.

Enabling Debugging Action

When a worker process is determined to be unhealthy, instead of terminating it, you might want the WWW service to keep it running for the purpose of debugging it, while bringing up a new worker process to serve requests. By enabling debugging on an application pool, you signal the WWW service not to terminate the worker process, but to release it from serving an application pool, and leave it running.

In addition to running an unhealthy worker process in a released state, you can configure the WWW service to launch an executable application or script (for example, an application that sends e-mail to administrators notifying them that the failure could be configured as an enable-debugging feature). The process id of the process deemed unhealthy is the first argument sent to the executable application or script.

note Note A worker process that has been released and left running may still terminate. The WWW service will have left it running. If the worker process recovers from its unhealthy state, it will detect that it has no relationship to the WWW service, and self-terminate. It would then be possible to find a log entry stating that a worker process was released, but find no evidence of the worker process running.

If you enable running unhealthy worker processes to be released, consider that you will need to deal with blocked worker processes, as they will not be removed from memory by IIS. There could be large numbers of failed worker processes running on your computer if administrators are not properly handling worker processes that are kept alive for debugging purposes. Also, consider that these worker processes may be tying up resources needed by other processes. You may need to terminate them quickly in order to free up those resources.

Rapid-Fail Protection

Rapid-fail protection stops application pools when too many worker processes assigned to it are found to be unhealthy in a specified period of time.

When an application pool is stopped, HTTP.sys will either return an out-of-service message (503: Service Unavailable) or connection resets based on the configuration of the LoadBalancerCapabilities property of the application pool. Also, when an application pool is stopped automatically, you can configure an action (a debugging action, for example) to notify the administrator that the application pool has stopped.

note Note If you host multiple applications on a single computer, you should be careful to configure load balancers or switching hardware to reroute only the traffic intended for a failed application pool. Do not route requests away from healthy application pools; they are still able to receive and process requests.

Rapid-fail protection reduces processing overhead for problematic applications as the requests do not enter user-mode processing. Thus, other application pools are protected from the unhealthy application pool.

You can set rapid-fail protection two ways:

  1. Configure IIS to place the application in a rapid-fail state based on the number of the worker process failures in a given time period, measured in minutes.
  2. Place an application in a rapid-fail state manually.

Scenario for Monitoring Application Pool Health

Monitoring application pool health and taking corrective actions requires, at a minimum, that you take the following steps:

  1. Allow the WWW service to detect unhealthy applications by enabling the WWW service to ping worker processes . See Configuring Worker Process Health Monitoring.
  2. Configure rapid-fail protection to allow the disabling of application pools when the worker processes assigned to them crash a set number of times in a specified period. See Configuring Rapid-Fail Protection.
Related Topics
  • For more information on configuring IIS for application pool health monitoring, see Configuring Worker Process Health Monitoring.
  • For information on setting rapid-fail protection, see Configuring Rapid-Fail Protection.


Configuring Worker Process Health Monitoring

important Important This feature of IIS 6.0 is available only when IIS is running in worker process isolation mode.

The World Wide Web Publishing Service (WWW service) monitors the health of worker processes by periodically pinging them to determine their responsiveness. If a worker process fails to respond to a ping, the WWW service terminates the worker process and creates another worker process as a replacement. Additionally, the WWW service maintains a communication channel to each worker process, and it can detect a drop in the communication channel, which indicates a worker process failure. When a worker process fails on its own accord, the WWW service starts another worker process in its place.

important Important You must be a member of the Administrators group on the local computer to perform the following procedure (or procedures), or you must have been delegated the appropriate authority. As a security best practice, log on to your computer using an account that is not in the Administrators group, and then use the Run as command to run IIS Manager as an administrator. From the command prompt, type runas /user:administrative_accountname "mmc %systemroot%\system32\inetsrv\iis.msc".

To enable application pool health monitoring

  1. In IIS Manager, expand the local computer, expand Application Pools, right-click the application pool, and then click Properties.
  2. Click the Health tab, and select the Enable pinging check box.
  3. In the seconds box next to Ping worker process every, type the number of seconds that you want to elapse between pings.
  4. Click OK.


Configuring Rapid-Fail Protection

important Important This feature of IIS 6.0 is available only when IIS is running in worker process isolation mode.

When an application pool detects that too many worker processes assigned to it have become unhealthy in a given period of time, rapid-fail protection is initiated. The communication channel with the World Wide Web Publishing Service (WWW service) is dropped. The WWW service detects the loss of communication and initiates the appropriate actions, typically sending an error or warning to the event log and then restarting the worker process. Worker process isolation mode can be configured so that if a particular application pool experiences consecutive multiple failures, the application pool can be automatically disabled, allowing for rapid-fail protection to start. The application pool is taken out of service and placed in a state such that the kernel-mode driver immediately returns an out-of-service message (503: Service Unavailable) to any requests to that application pool.

important Important You must be a member of the Administrators group on the local computer to perform the following procedure (or procedures), or you must have been delegated the appropriate authority. As a security best practice, log on to your computer using an account that is not in the Administrators group, and then use the Run as command to run IIS Manager as an administrator. From the command prompt, type runas /user:administrative_accountname "mmc %systemroot%\system32\inetsrv\iis.msc".

To configure rapid-fail protection

  1. In IIS Manager, expand the local computer, expand Application Pools, right-click the application pool, and then click Properties.
  2. Click the Health tab, and select the Enable rapid-fail protection check box.
  3. In the Failures box, type the number of worker process failures to be detected before disabling the worker process.
  4. In the Time period box, type the number of minutes during which failure totals are accumulated.
  5. Click OK.
Related Topics
  • For information on Web gardens, see Configuring Web Gardens.


Configuring Startup and Shutdown Time Limits

When the World Wide Web Publishing Service (WWW service) detects that a worker process is unhealthy, it marks the worker process for termination, and then, within configured time limits, it terminates the worker process and starts a new worker process to replace it. Worker processes shut down gracefully (finish request processing) when the shutdown time period is long enough to allow for this. It is important to tune the shutdown time period to fit the load characteristics of the applications that are being processed.

important Important You must be a member of the Administrators group on the local computer to perform the following procedure (or procedures), or you must have been delegated the appropriate authority. As a security best practice, log on to your computer using an account that is not in the Administrators group, and then use the Run as command to run IIS Manager as an administrator. From the command prompt, type runas /user:administrative_accountname "mmc %systemroot%\system32\inetsrv\iis.msc".

To configure a new worker process to start up within a specified time

  1. In IIS Manager, expand the local computer, expand Application Pools, right-click the application pool, and click Properties.
  2. Click the Health tab, and under Startup time limit, in the seconds box next to Worker process must startup within, type the desired number of seconds.
  3. Click OK.

To configure a worker process to shut down within a specified time

  1. In IIS Manager, expand the local computer, expand Application Pools, right-click the application pool, and click Properties.
  2. Click the Health tab, and under Shutdown time limit, in the seconds box next to Worker process must shutdown within, type the desired number of seconds.
  3. Click OK.


Configuring Application Pool Identity

important Important This feature of IIS 6.0 is available only when IIS is running in worker process isolation mode.

The identity of an application pool is the name of the account under which the application pool's worker process runs. By default, application pools operate under the Network Service account, which has low-level user access rights. That is, this account provides better security against attackers or malicious users who might attempt to take over the computer on which the World Wide Web Publishing Service (WWW service) is running. The LocalService account has low access rights as well, and is useful for situations that do not require access to resources on remote computers. You can configure application pools to run as LocalSystem, which is an account with more user rights than the Network Service or LocalService account. However, be mindful that running an application pool under an account with increased user rights presents a high security risk.

For example, suppose that an Internet Service Provider (ISP) wants to allow customers to upload Common Gateway Interface (CGI) applications and then add them to an application pool. Running CGI-enabled applications in a separate application pool under the Network Service account, with its lower user rights, reduces the risk that these applications will be used to attack the server.

important Important You must be a member of the Administrators group on the local computer to perform the following procedure (or procedures), or you must have been delegated the appropriate authority. As a security best practice, log on to your computer using an account that is not in the Administrators group, and then use the Run as command to run IIS Manager as an administrator. From the command prompt, type runas /user:administrative_accountname "mmc %systemroot%\system32\inetsrv\iis.msc".

To change the account under which an application pool runs

  1. In IIS Manager, expand the local computer, expand Application Pools, right-click the application pool, and then click Properties.
  2. Click the Identity tab, and click either Predefined or Configurable.
    Predefined refers to standard service names, such as Network Service (the default), LocalSystem, or Local Service. Configurable refers to registered user names.
  3. If you click Predefined, click a predefined account in the list box.
  4. If you click Configurable, in the User name and Password boxes, type the user name and password of the account under which you want the worker process to operate. Then, add the account to the IIS_WPG group.
  5. Click OK.

Worker Process Identity Restrictions with Kerberos

You can isolate Web sites in different worker processes running under different identities; however, there is a limitation if you also want to use Kerberos authentication. Kerberos employs the concept of a service. To use Kerberos authentication, a service must register its name, called a Service Principal Name (SPN), as well as the account that the service runs under. By default, Active Directory® directory service registers the NetBIOS, or machine name, and allows the machine account to use Kerberos. If you want to run a service under a different account or use a different name (for example, if your computer uses an additional WINS or DNS name), you can use the Setspn.exe command-line tool to set an SPN. You must be a domain administrator to set an SPN. The Setspn.exe command-line utility is available in the support tools pack located on your Windows Server 2003 CD-ROM.

If you are using Integrated Windows authentication and you want to use a local user account or LocalService as a worker process identity, you cannot use Kerberos authentication because Active Directory will not "trust" the accounts. In these cases, you must force IIS to use NTLM authentication (also referred to as Windows NT Challenge/Response authentication).

Using Setspn.exe

The following is the basic syntax for using the Setspn.exe command-line utility, where "accountname" can be the name alone, or the domain\name.

setspn [parameter] accountname

The following parameters can be used with Setspn.exe:

Parameter | Function | Example
-R | Reset HOST ServicePrincipalName. | setspn -R computername
-A | Add arbitrary SPN. | setspn -A SPN computername
-D | Delete arbitrary SPN. | setspn -D SPN computername
-L | List registered SPNs. | setspn -L SPN computername

The following example uses the Setspn.exe command-line utility to register an application pool running as Domain\UserAccount:

SETSPN.EXE -A HOST/<your computer name> Domain\UserAccount

The following example registers SPNs "HOST/daserver1" and "HOST/{DNS of daserver1}":

setspn -R daserver1

The following example registers SPN "http/daserver" for computer "daserver1":

setspn -A http/daserver daserver1

The following example deletes SPN "http/daserver" from computer "daserver1":

setspn -D http/daserver daserver1


IIS 5.0 Isolation Mode

This section explains how to use IIS Manager to configure Internet Information Services (IIS) to execute Web-based applications in IIS 5.0 isolation mode.

This section includes the following information:

  • Isolating Applications: Describes how to run an application in a memory space that is separate from the Web server memory space.
  • Stopping Isolated Applications: Describes how to stop execution of an isolated application.
Related Topics
  • For information on creating or configuring applications, see Configuring Applications.
  • For an overview of IIS 5.0 isolation mode, see About Configuring Servers for Applications.
(The following words are used by Search; they are not intended to be displayed on the page.) configure, configuration, configuring, web app, web apps, web applications, program, programs, programmer, develop, developer, code, coder, coders, development, application root, directory, starting-point directory, create, write, map, mapping, mappings, associate, associating, association, file name, filename, extension, dll, .dll, .exe, exe, isolate, isolated, isolation, out of process, out-of-process, oop, out-of-proc, crash, reliable, stable, reliability, stability, availability, available, uptime, downtime, protection, separate, memory space, cgi, script, time out, time-out, times out, time-outs, timeouts, cache, caching, isapi, extensions, scriptless asp, flow control, enhanced, objects, self-tuning, fine-tune, tune-up, tune up, automatic, threads, error-handling, line, number, .asp, file, server scriptlets, business logic, reusable, com, components, j++, vb, vba, visual basic, jscript, javascript, filters, install, set up, setup, asp, active server pages, automate, administration tasks, properties, property sheet, start, stop, starting, stopping, pause, pausing, debug, debugging, step through, errors, links, more information


Isolating Applications

important Important This feature of IIS 6.0 is available only when IIS is running in IIS 5.0 isolation mode.

Isolating applications means configuring them to run in a process (memory space) that is separate from the Web server and other applications. You can configure applications into one of three levels of application protection:

  • Low (in process) application protection.
  • Medium (pooled) application protection.
  • High (isolated) application protection.

Note that server-side include (SSI) and Internet Database Connector (IDC) applications cannot be run in a memory space that is separate from the Web server.

important Important You must be a member of the Administrators group on the local computer to perform the following procedure (or procedures), or you must have been delegated the appropriate authority. As a security best practice, log on to your computer using an account that is not in the Administrators group, and then use the Run as command to run IIS Manager as an administrator. From the command prompt, type runas /user:administrative_accountname "mmc %systemroot%\system32\inetsrv\iis.msc".

To set or change the level of application protection

  1. In IIS Manager, expand the local computer, right-click the Web site or the starting-point directory for an application, and then click Properties.
  2. Click the Home Directory, Virtual Directory, or Directory tab. If you are in the directory that is listed as the Starting Point directory, the Application name box is filled in.
  3. In the Application protection box, click the appropriate level of protection.
  4. Click OK.

The Web server finishes processing any current requests for the application before it creates a separate process. At the next request for the application, the application will run in the appropriate memory space.

Related Topics
  • For information on performance issues, see About Performance Tuning.


Stopping Isolated Applications

important Important This feature of IIS 6.0 is available only when IIS is running in IIS 5.0 isolation mode.

You can stop and unload isolated applications from memory without stopping the Web server, which makes it easier to test and debug applications.

important Important You must be a member of the Administrators group on the local computer to perform the following procedure (or procedures), or you must have been delegated the appropriate authority. As a security best practice, log on to your computer using an account that is not in the Administrators group, and then use the Run as command to run IIS Manager as an administrator. From the command prompt, type runas /user:administrative_accountname "mmc %systemroot%\system32\inetsrv\iis.msc".

To stop and unload an isolated application

  1. In IIS Manager, expand the local computer, right-click the Web site or the starting-point directory (the directory on which the application is set) for an application, and then click Properties.
  2. Click the Home Directory, Virtual Directory, or Directory tab. If you are in the directory that is listed as the Starting Point directory, the Application name box is filled in.
  3. Click Remove. If the Remove button is unavailable, you are not in the application's starting-point directory.


Security

This section describes how to configure both your Web server and Microsoft® Windows® operating system to properly secure your Web site and to carry out other essential security functions.

This section includes the following information:

  • About Security: Provides a conceptual overview of security for Internet Information Services 6.0.
  • Security Best Practices: Provides a list of best practices for securing your Web site and server.
  • Authentication: Provides information on how to confirm the identity of users that are attempting to establish connections to restricted content.
  • Access Control: Provides information on how users access and manipulate your resources.
  • TCP/IP Port Filtering: Provides information on how to control the types of traffic that reach your servers.
  • Encryption: Provides information on how to protect the privacy of your information with Secure Sockets Layer (SSL) encryption features.
  • Certificates: Provides information on how to establish secure connections by using certificates and SSL features.
  • Auditing: Provides information on how to monitor security activities to prevent tampering and unauthorized access.
  • Secure Sockets Layer: Provides information on how to create and manage secure communications connections between your servers and clients.
Related Topics
  • For information on isolating server applications so that they will be run in a process that is separate from the Web server process, see Isolating Applications.
  • For information on verifying the network name and address of your computer, see Domain Name Resolution.
(The following words are used by Search; they are not intended to be displayed on the page.) security, secure, lock down, lock-down, lockdown, insecure, risk, hack, hacker, hackers, crack, cracker, crackers, exploit, firewall, unauthorized, illegal, steal, sniff, sniffs, sniffer, checklist, weakness, weaknesses, vulnerable, vulnerability, gap, hole, open, spoof, fraud, defraud, fraudulent, false, bogus, virus, deface, attack, denial of service, denial-of-service, exe, .exe, executable, script, overload, spam, harrass, flood, syn flood, syn-flood, synflood, buffer overrun, buffer overload, long url, attack, attacks, breach, defeat, circumvent, overwrite, password, links, more information passwords, identity, identify, identification, logon, log on, credentials, control, user, users, authenticate, Digest authentication, challenge/response, basic, ntlm, digest, control, restrict, deny, keep out, safe, confidential, sensitive, secret, protect, shield, hide, hidden, defend, defense, defending, against, defeat, stop, prevent, prevention, file, files, directory, ntfs, user account, nt account, permission, permissions, privilege, privileges, admin, administrator, operator, invalid, valid, directories, share, shared, public, private, privacy, access, limit, limited, encrypt, encryption, encrypted, hash, hashed, scramble, scrambled, intercept, code, coder, md5, kerberos, base64, digital, cleartext, clear, text, certificate, server certificate, personal certificate, certification provider, authority, certify, certified, base-64, base64, base 64, key, key, 40 bit, 40-bit, 128 bit, 128-bit, cipher, cypher, ssl, secure sockets layer, track, audit, monitor, monitoring, detect, detection, alert, notify, false, repeated, unsuccessful attempts, intrude, intruder, intrusion, sneak, log, logs, logging, attempt, attempts, gain entry, enter, upload, trojan horse, back orifice, backorifice, html.internal, wizard, wizards, trust, trusted, account, accounts


About Security

Proper security safeguards on your Web server can reduce, or eliminate, various security threats from malicious individuals, as well as from well-intentioned users who might accidentally gain access to restricted information or inadvertently alter important files.

This topic includes the following information:

  • IIS Installed Locked Down
  • Elements of IIS Security
  • Standards Implemented
  • Setting Up Security

IIS Installed Locked Down

To ensure that Windows administrators do not face unnecessary security threats upon installation of IIS, IIS 6.0 installs with request-handling for static Web pages enabled, and with all other request-handling features disabled. From the moment IIS is installed, the locked-down security profile of IIS 6.0 minimizes the attack surface available to intruders. IIS 6.0 installation and service-enabling features simplify the administrative tasks associated with managing IIS services for security purposes. For example:

  • Further administrator intervention is required only to enable additional services as they are needed.
  • When additional services are needed, the Windows administrator can enable them through the Web Service Extensions node in IIS Manager.
  • When enabled features are no longer required, the Windows administrator can disable them through the Web Service Extensions node in IIS Manager.

For information on managing Web service extensions, see Enabling and Disabling Dynamic Content.

Elements of IIS Security

Authentication

Internet Information Services provides security features that are fully integrated with Windows. For example, IIS supports the following six methods of authentication. You can use these methods to confirm the identity of anyone requesting access to your Web site, and to grant access to public areas of the site, while preventing unauthorized access to private files and directories.

  • Anonymous authentication allows anyone access without asking for a user name or password.
  • Basic authentication prompts users for a user name and password, which are then sent unencrypted over the network.
  • Digest authentication operates much like Basic authentication, except that passwords are sent as a hash value. Digest authentication is available only on domains with a Windows domain controller.
  • Advanced Digest authentication is identical to Digest authentication, except that, for improved security, Advanced Digest stores the client credentials as an MD5 hash in the Active Directory® directory service on the domain controller of your computer running Windows Server 2003
  • Integrated Windows authentication uses hashing technology to identify users without actually sending passwords over the network.
  • Certificates are digital credentials that can be used to establish a Secure Sockets Layer (SSL) connection. They can also be used for authentication.

For information on different ways to use authentication on your Web server, see Authentication.

Access Control

With NTFS access permissions as the foundation of your Web server's security, you can define the level of file and directory access granted to Windows users and groups. For example, if a business decides to publish its catalog on your Web server, you need to create a Windows user account for that business and then configure permissions for the specific Web site, directory, or file. The permissions should permit only the server administrator and the owner of the business to update the Web site's contents. Public users should be allowed to view the Web site, but cannot alter its contents. To control access to directories and files in this manner, you must be using drives formatted in NTFS, not FAT32. If you use FAT32, your users will have access to every file on your hard drive. For details on setting NTFS permissions, see Setting NTFS Permissions for Directories or Files.

WebDAV is an extension of the HTTP 1.1 protocol that facilitates file and directory manipulation over an HTTP connection. Through the use of WebDAV "verbs", or commands, properties can be added to and read from files and directories. Files and directories can also be remotely created, deleted, moved, or copied. Additional access control can be configured through both Web server permissions and NTFS. For more information, see Web Authoring with WebDAV.

Certificates

Certificates are digital identification documents that allow both servers and clients to authenticate each other. They are required for the server and client's browser to set up an SSL connection over which encrypted information can be sent. The certificate-based SSL features in IIS consist of a server certificate, a client certificate, and various digital keys. You can create these certificates with Microsoft Certificate Services or obtain them from a mutually trusted, third-party organization called a certification authority (CA). For more information on setting up certificates and keys, see Configuring SSL on Servers.

Server certificates provide a way for users to confirm your Web site's identity. A server certificate contains detailed identification information, such as the name of the organization affiliated with the server content, the name of the organization that issued the certificate, and a public key used in establishing an encrypted connection. This information helps to assure users of the authenticity of Web server content and the integrity of the secure HTTP connection.

With SSL, your Web server also has the option of authenticating users by checking the contents of their client certificates. A typical client certificate contains detailed identification information about a user and the organization that issued the certificate and a public key. You can use client Certificate authentication, along with SSL encryption, to implement a highly secure method for verifying the identity of your users. For more information, see About Certificates.

Encryption

You can enable users to exchange private information with your server, such as credit card numbers or phone numbers, in a secure way by using encryption. Encryption "scrambles" the information before it is sent, and decryption "unscrambles" it after it is received. The foundation for this encryption in IIS is the SSL 3.0 protocol, which provides a secure way of establishing an encrypted communication link with users. SSL confirms the authenticity of your Web site and, optionally, the identity of users accessing restricted Web sites.

Certificates include keys used in establishing an SSL secure connection. A key is a unique value used to authenticate the server and the client in establishing an SSL connection. A public key and a private key form an SSL key pair. Your Web server utilizes this key pair to negotiate a secure connection with the user's Web browser to determine the level of encryption required for securing communications.

For this type of connection, both your Web server and the user's browser must be equipped with compatible encryption and decryption capabilities. During the exchange, an encryption key, or session key, is created. Both your server and the Web browser use the session key to encrypt and decrypt transmitted information. The session key's degree of encryption, or strength, is measured in bits. The greater the number of bits comprising the session key, the greater the level of encryption and security. Although these greater encryption key strengths offer greater security, they also require more server resources to implement. Your Web server's session key is typically 40 bits long, but can be 128 bits long depending upon the level of security you require. For more information, see Encryption.

Server-Gated Cryptography

Server-Gated Cryptography (SGC) offers financial institutions the solution for worldwide secure financial transactions using 128-bit encryption. SGC is an extension of Secure Sockets Layer (SSL) that allows financial institutions with export versions of IIS to use strong encryption.

SGC does not require an application to run on the client's browser and can be utilized by standard export versions of IIS 4.0 or later. A server configured for SGC can facilitate both 128-bit and 40-bit encryption sessions so multiple versions of IIS are not required. Although SGC capabilities are built into IIS 4.0 and later versions, a special SGC certificate is required to use SGC. Contact your certification authority for availability information. For more information about SGC, see the article titled Secured online banking goes global! at the Server-Gated Cryptography (SGC) Web site.

note Note If you open your SGC certificate, you might receive the following notice on the General tab: "The certificate has failed to verify for all of its intended purposes." This notice is issued because of the way SGC certificates interact with Windows 2000, and does not necessarily indicate that the certificate does not work properly.

Selectable Cryptographic Service Provider

Selectable Cryptographic Service Provider (CSP) allows you to select a Microsoft or third-party cryptographic provider to handle cryptography and certificate management. Each cryptographic provider can create a public and private key to encrypt data sent to and from the Web server. The private key is stored at the server end on hardware, a PCI card, a SmartCard, or in the registry as it is for the two default providers that Microsoft installs: Microsoft DH SChannel Cryptographic Provider and Microsoft RSA SChannel Cryptographic Provider. The Microsoft Cryptographic API (CryptoAPI) for every provider contains identical methods and properties. This allows you to switch between providers without having to rewrite code. For more information on CSP and managing installed third-party cryptographic providers, see the Microsoft CryptoAPI Overview on the MSDN Web Workshop. For the latest list of cryptographic service providers supporting IIS, select Endorsements on that page.

Auditing

You can use security auditing techniques to monitor a broad range of user and Web server security activity. It is recommended that you routinely audit your server configuration to detect areas where resources may be susceptible to unauthorized access and tampering. You can use the integrated Windows utilities, or the logging features built into IIS, or use Active Server Pages (ASP) applications to create your own auditing logs. For more information, see Auditing.

Standards Implemented

Many of the security features in IIS implement Internet community standards. These standards help to facilitate uniformity and cross-platform utilization of applications and information. Microsoft is committed to working with the Internet and computer communities both in assisting to structure good standards, but also in its implementation of those standards. For more information on the standards implemented by the IIS security features, follow the appropriate link in the following list:

Secure Sockets Layer (SSL 3.0) is a public key-based security protocol implemented by the Secure Channel (Schannel) security provider. SSL security protocols are used widely by Internet browsers and servers for authentication, message integrity, and confidentiality.

Basic authentication as described on the World Wide Web Consortium Web site, is a part of the HTTP 1.0 specification that sends password over networks in Base64 encoded format. Most browsers support this specification.

Digest authentication, as described on the World Wide Web Consortium Web site, sends authentication information over networks as a hash and is compatible with proxy servers.

PKCS #7 describes the format of encrypted data such as digital signatures or digital envelopes that securely contain information. Both of these are involved in the certificate features of IIS.

PKCS #10 describes the format of requests for certificates that are submitted to certification authorities.

For additional information about Windows and network security issues, visit the Microsoft Security Web site, and the Windows NT Security Web site. The National Security Agency - Information Security Systems Organization Web site is also a good source of information.

Setting Up Security

Before configuring your Web server security, determine the level of security that you will require to protect your Web and FTP sites. For example, if you intend create a Web site that allows special users to access private information, such as financial or medical records, then you will require a robust security configuration. This configuration should be able to reliably authenticate designated users and restrict access to only those users.

Much of your Web server's security relies on your Windows security configuration. If you do not properly configure your Windows security features, you cannot secure your Web server.

If you have not done so already, carry out the following tasks:

  • Configure the Windows Administrator account.
  • Create and manage user accounts.
  • Create and manage groups.
  • Define Windows security policies.

For more information, see Security in Windows online Help, or see the Microsoft Windows Server 2003 Resource Kit.

As part of your security configuration, you should also convert your hard disk partition to an NTFS partition. NTFS hard disk partitions offer precise file and directory access control, and save information more efficiently than FAT partitions. You can use the Windows Convert utility to convert a hard disk partition to NTFS. For more information, see Reformatting or converting a partition to use NTFS in Windows online Help.

Next, determine which files and directories will be publicly available to users visiting your Web and FTP sites. Keep public and restricted content in separate directories.

To get started configuring your Web server's security, see About Access Control for information about properly configuring anonymous Web server access.


Security Best Practices

General Best Practices

  • Log on with the least credentials. Log on to your computer using an account that is not in the Administrators group, and then use the Run as command to run IIS Manager as an administrator.
  • Reduce the attack surface. Disable all services you do not need, including IIS services such as FTP, NNTP or SMTP. If a feature or service is not enabled, then there is no need to secure it.
  • Do not download or run programs from untrusted sources. Programs can contain instructions to violate security in a number of ways including data theft, denial of service, and data destruction.
  • Keep virus scanners up to date. Virus scanners frequently identify infected files by scanning for a signature that is a known component of a previously identified virus. The scanners keep these virus signatures in a signature file, which is usually stored on the local hard disk. Because new viruses are discovered frequently, this file should also be updated frequently for the virus scanner to easily identify all current viruses.
  • Keep all software patches up to date. Software patches provide solutions to known security issues. Check software provider Web sites periodically to see if there are new patches available for software used in your organization.
    • The new process model in IIS 6.0 includes process recycling, which means an administrator can easily install most IIS patches and most new worker process DLLs without any interruption of service.
    • Auto Update version 1.0 provides three options to customers: notify patch availability the moment it is available, download patch and notify that it has been downloaded, and scheduled install. For more information, see Windows Automatic Updates in Windows Help.

  • Use NTFS. The NTFS file system is more secure than the FAT or FAT32 file system.
  • Assign strong NTFS permissions for your resources.
  • Exercise caution with domain controllers. If you use a domain controller as an application server, be aware that if security is compromised on the domain controller, then security is compromised on the entire domain.

IIS Best Practices

  • Restrict write access permissions for the IUSR_computername account. This will help limit the access anonymous users have to your computer.
  • Store executable files in a separate directory. This makes it easier to assign access permissions and audit for administrators.
  • Create a group for all anonymous user accounts. You can deny access permissions to resources based on this group membership.
  • Deny execute permissions for anonymous users to all executables in Windows directories and subdirectories.
  • Use IP address restriction if administering IIS remotely. For more information, see Securing Sites with IP Address Restrictions.
  • Assign the most restrictive permissions possible. For example, if your Web site is used only for viewing information, assign only Read permissions. If a directory or site contains applications, assign Scripts Only permissions instead of Scripts and Executables permissions. For more information, see Securing Sites with Web Site Permissions.
  • Do not assign Write and Script source access permissions or Scripts and Executables permissions. Use this combination with extreme caution. It can allow a user to upload potentially harmful executable files to your server and run them. For more information, see Securing Sites with Web Site Permissions.
Related Topics
  • For information on security best practices for the Windows Server 2003 family, see Security Best Practices in Windows Help.


Authentication

You can require users to provide a valid Microsoft® Windows® user-account name and password before they access any information on your server. This identification process is called authentication. Authentication can be set at the Web or FTP site, directory, or file level. Internet Informatin Services (IIS provides) authentication methods to control access to your Web sites and FTP sites.

This section includes the following information:

  • Web Site Authentication: Describes the authentication methods that match your requirements to validate user access to your Web sites.
  • FTP Site Authentication Describes the authentication methods that matche your requirements to validate user access to your FTP sites.


Web Site Authentication

Based on your security requirements, you can select an Internet Information Services (IIS) authentication method to validate users requesting access to your Web sites. You can set the authentication method for your Web resources using property sheets at the Web site, directory, or file level using IIS Manager.

The following table is a summary of the Web site authentication methods.

Method | Security Level | Sends Passwords How? | Usable Across Proxy Servers and Firewalls? | Client Requirements
Anonymous Authentication | None | N/A | Yes | Any browser
Basic Authentication | Low | Base64 encoded clear text | Yes; however, sending passwords across a proxy server or firewall in clear text is a security risk because Base64 encoded clear text is not encrypted | Most browsers
Digest Authentication | Medium | Hashed | Yes | Internet Explorer 5, or later
Advanced Digest Authentication | Medium | Hashed | Yes | Internet Explorer 5, or later
Integrated Windows Authentication | High | Hashed when NTLM is used. Kerberos ticket when Kerberos is used | No, unless used over a PPTP connection | Internet Explorer 2.0 and later for NTLM, and Windows 2000 or later with Internet Explorer 5 or later for Kerberos
Certificate Authentication | High | N/A | Yes, using an SSL connection | Internet Explorer and Netscape
.NET Passport Authentication | High | Encrypted | Yes, using an SSL connection | Internet Explorer and Netscape

This section includes the following information:

  • Anonymous Authentication: Describes the authentication method that does not require authenticated user credentials and is best used to grant public access to information that requires no security.
  • Basic Authentication: Describes the authentication method that requires a user name and password, provides a low level of security, and is best used for granting access to information with little or no need for privacy. Security is considered to be low because passwords are sent across the network in plaintext (unencrypted text), making them vulnerable to interception.
  • Digest Authentication: Describes the authentication method that requires a user name and password, provides a medium level of security, and may be used for granting access to secure information from public networks. Security is enhanced over Basic authentication by sending user credentials in a hashed message digest.
  • Advanced Digest Authentication: Describes the authentication method that provides a medium level of security and is identical to Digest authentication with one exception: user credentials are better protected from discovery by storing them in the domain controller (DC) as an MD5 hash.
  • Integrated Windows Authentication: Describes the authentication method that sends user authentication information over the network as a Kerberos ticket, provides a high level of security, and is best used for the organization's intranet. You cannot readily send user credentials past an HTTP proxy.
  • Certificates: Describes the authentication method that is used to establish secure communications connection between a client and a server using Secure Sockets Layer (SSL). Certificate authentication provides a high level of security suitable for conducting business over the Internet.
  • UNC Authentication: Describes the authentication method that is used to verify user credentials for access to shares on a remote computer.
  • .NET Passport Authentication Describes the authentication method that provides single sign-in security, giving users with access to diverse services on the Internet.
  • Setting the Default Logon Domain: Describes how you can configure a default logon domain for users logging on using Basic authentication who do not specify a domain.


Anonymous Authentication

Anonymous authentication gives users access to the public areas of your Web or FTP site without prompting them for a user name or password. When a user attempts to connect to your public Web or FTP site, your Web server assigns the connection to the Windows user account IUSR_computername, where computername is the name of the computer on which IIS is running. By default, the IUSR_computername account is included in the Windows user group, Guests. This group has security restrictions, imposed by NTFS permissions, that designate the level of access and the type of content available to public users.

IUSR_computername Account

The following explains how Internet Information Services (IIS) uses the IUSR_computername account:

  1. The IUSR_computername account is added to the Guests group on the computer running IIS during setup.
  2. When a request is received, IIS impersonates the IUSR_computername account before executing any code. IIS is able to impersonate the IUSR_computername account because the user name and password for this account are recognized by IIS.
  3. Before returning a page to the client, IIS checks NTFS file and directory permissions to see whether the IUSR_computername account is allowed access to the file.
  4. If access is allowed, the access process (also called authorization) completes and the resources are available to the user.
  5. If access is not allowed, IIS attempts to use another authentication method. If none is selected, IIS returns an "HTTP 403 Access Denied" error message to the browser.

note Note If you enable Anonymous authentication, IIS always attempts to authenticate the user with Anonymous authentication first, even if you enable additional authentication methods. You can change the account that is used for Anonymous authentication in IIS Manager, either at the Web server service level or for individual virtual directories and files.

In IIS 6.0, NETWORK_CLEARTEXT is the default logon type for Anonymous authentication (and for Basic authentication). One result is that Anonymous authentication no longer requires the Allow log on locally user right.

You can also change the security settings for the IUSR_computername account in Windows by using the Group Policy Manager snap-in of the Microsoft Management Console (MMC). However, if the anonymous user account does not have permission to access a specific file or resource, your Web server will refuse to establish an anonymous connection for that resource. For more information, see Securing Sites with Web Site Permissions.

important Important When you change the IUSR_computername account, the changes affect every anonymous HTTP request that a Web server services. Use caution if you modify this account.

Sub-Authentication

In earlier versions of IIS, by default you could use the sub-authentication component, Iissuba.dll, which enables IIS to manage passwords on anonymous accounts. Because using the component involves a security risk, IIS 6.0 does not enable sub-authentication by default. However, you can use sub-authentication to manage passwords for anonymous accounts by meeting the following requirements:

  • For applications you grant anonymous access, the worker process runs as LocalSystem.
  • The sub-authentication component, Iissuba.dll, is registered.
  • The AnonymousPasswordSynch metabase property is enabled (set to TRUE).

The actions taken to meet the above requirements are different for clean installs of IIS 6.0 and upgrades to IIS 6.0 from installations of IIS with sub-authentication configured.

Configuring Sub-Authentication on a Clean Installation of IIS 6.0

By default, on a clean install, IIS 6.0 runs in worker process isolation mode, and sub-authentication is disabled (AnonymousPasswordSynch is set to FALSE).

To configure sub-authentication on a clean install of IIS 6.0

  1. Register Iissuba.dll by opening the command prompt and typing
    rundll32 %windir%\system32\iissuba.dll,RegisterIISSUBA.
  2. Run all worker processes using Anonymous authentication as LocalSystem.
  3. Set the metabase property AnonymousPasswordSynch to TRUE.

If after a clean install of IIS 6.0, you switch to IIS 5.0 isolation mode, then by default, the worker process assigned to in-process applications will run as LocalSystem.

To configure sub-authentication after a clean install and after switching to IIS 5.0 isolation mode

  1. Register Iissuba.dll by opening the command prompt and typing
    rundll32 %windir%\system32\iissuba.dll,RegisterIISSUBA.
  2. Set the metabase property AnonymousPasswordSynch to TRUE.

Configuring Sub-Authentication on an Upgrade to IIS 6.0

Upon upgrading to IIS 6.0 from a previous version of IIS that uses sub-authentication to manage passwords on anonymous accounts, sub-authentication is enabled by default (AnonymousPasswordSynch is set to TRUE), but sub-authentication does not work because two configuration tasks have not been accomplished. Iissuba.dll is not registered and the worker processes using Anonymous authentication are running as LocalSystem. Your event log should have entries on this.

To configure sub-authentication on an upgrade to IIS 6.0 from an installation of IIS configured to use sub-authentication

  1. Register Iissuba.dll by opening the command prompt and typing
    rundll32 %windir%\system32\iissuba.dll,RegisterIISSUBA.
  2. Run all worker processes using Anonymous authentication as LocalSystem.

Configuring Anonymous Authentication

important Important You must be a member of the Administrators group on the local computer to perform the following procedure (or procedures), or you must have been delegated the appropriate authority. As a security best practice, log on to your computer using an account that is not in the Administrators group, and then use the Run as command to run IIS Manager as an administrator. From the command prompt, type runas /user:administrative_accountname "mmc %systemroot%\system32\inetsrv\iis.msc".

To enable anonymous authentication

  1. In IIS Manager, expand the local computer, right-click a site, directory, or file, and click Properties.
  2. Click the Directory Security or File Security tab, depending upon what level you are changing the security settings.
  3. In the Authentication and access control section, click Edit.
  4. Select the Enable anonymous access check box.
  5. Click OK twice.

To change the account used for anonymous authentication

  1. In IIS Manager, expand the local computer, double-click a site, directory, or file, and click Properties.
  2. Click the Directory Security or File Security tab, depending upon what level you are changing the security settings.
  3. In the Authentication and access control section, click Edit.
  4. Select the Enable anonymous access check box.
  5. Click Browse and type or browse to the valid Windows user account you want to use for anonymous access.
  6. Click OK three times.
Related Topics
  • For more information on the default logon type, see Default Logon Type.


Basic Authentication

The Basic authentication method is a widely used, industry-standard method for collecting user name and password information.

Client Authentication Process

The following steps outline how a client is authenticated using Basic authentication:

  1. The Internet Explorer Web browser displays a dialog box for a user to enter a previously assigned Windows account user name and password, also known as credentials.
  2. The Web browser then attempts to establish a connection to a server using the user's credentials. The clear text password is Base64-encoded before it is sent over the network.

    important Important Base64 encoding is not encryption. If a Base64-encoded password is intercepted over the network by a network sniffer, unauthorized users can easily decode and reuse the password.

  3. If a user's credentials are rejected, Internet Explorer displays an authentication dialog box to re-enter the user's credentials. Internet Explorer allows the user three connection attempts before failing the connection and reporting an error to the user.
  4. When the Web server verifies that the user name and password correspond to a valid Microsoft Windows user account, a connection is established.

The advantage of Basic authentication is that it is part of the HTTP specification and is supported by most browsers. The disadvantage is that Web browsers using Basic authentication transmit passwords in an unencrypted form. By monitoring communications on your network, an attacker or malicious user can easily intercept and decode these passwords using publicly available tools. Therefore, Basic authentication is not recommended unless you are confident that the connection between the user and your Web server is secure, such as with a dedicated line or a Secure Sockets Layer (SSL) connection. For more information, see Encryption.

note Note The browser chooses Integrated Windows authentication and attempts to use the current Windows logon information before prompting the user for a user name and password. Currently, only Internet Explorer versions 2.0 and later support Integrated Windows authentication.

Default Logon Type

In IIS 6.0, the default logon type (the metabase property is LogonMethod) for Basic authentication is NETWORK_CLEARTEXT (this applies to Anonymous authentication as well). This is a change from previous versions of IIS, for which the default logon type is INTERACTIVE. As a result of this change, when using the default logon type for Basic authentication, users no longer have interactive logon rights. Basic authentication works with domain controllers, and the NETWORK and NETWORK_CLEARTEXT settings no longer require logon rights. See the table below for a summary of the logon types used by Basic authentication.

Logon type | LogonMethod setting | Logon right required | Security Identifier (SID) added to access token | Outbound credentials?
NETWORK_CLEARTEXT (default) | 3 - MD_LOGON _NETWORK_CLEARTEXT | Network | NT AUTHORITY \NETWORK_CLEARTEXT | Yes
NETWORK | 2 - MD_LOGON _NETWORK | Network | NT AUTHORITY \NETWORK | No
BATCH | 1 - MD_LOGON _BATCH | Batch | NT AUTHORITY \BATCH | Yes

Token Cache Security Considerations

When using Basic authentication, user tokens are cached in the token cache. By default, tokens remain in the cache for 15 minutes (expressed as seconds). If you log on using Basic authentication with an account that has a high level of user logon rights, a successful attacker could use the account to gain access to the resources on your computer. There are several ways to minimize this threat:

  • Do not log on, or allow anyone to log on, using Basic authentication with an account that has a high level of user logon rights.
  • Set the token cache to either not cache user tokens by setting the Global Registry entry, UserTokenTTL, to zero; or, set a short time span for cached user tokens by setting UserTokenTTL to less than the default of 15 minutes. See UserTokenTTL in Global Registry Entries.

Configuring Basic Authentication

Enabling Basic authentication does not automatically configure your Web server to authenticate users. Windows user accounts must be created and the NTFS permissions properly set.

The Basic authentication method transmits user names and passwords across the network in an unencrypted form. You can use your Web server's encryption features, in combination with Basic authentication, to secure user account information transmitted across the network.

important Important You must be a member of the Administrators group on the local computer to perform the following procedure (or procedures), or you must have been delegated the appropriate authority. As a security best practice, log on to your computer using an account that is not in the Administrators group, and then use the Run as command to run IIS Manager as an administrator. From the command prompt, type runas /user:administrative_accountname "mmc %systemroot%\system32\inetsrv\iis.msc".

To enable Basic authentication

  1. In IIS Manager, right-click the Web Sites folder, Web site, directory, virtual directory, or file, and click Properties.

    note Note Configuration settings made at the Web Sites folder level can be inherited by all Web sites.

  2. Click the Directory Security or File Security tab, depending upon what level you are configuring security settings.
  3. In the Anonymous access and authentication control section, click Edit.
  4. In the Authenticated access section, select the Basic authentication check box.
  5. Because Basic authentication sends passwords over the network unencrypted, a dialog box appears asking if you want to proceed. Click Yes to proceed.
  6. In the Default domain box, either type the domain name you want to use, or click Select to browse to a new default logon domain. If the Default domain box is filled in, the name is used as the default domain. If the Default domain box is left empty, IIS uses the domain of the computer that is running IIS as the default domain. IIS configures the value of the DefaultLogonDomain property, which determines the default domain used to authenticate clients accessing your IIS server using Basic authentication. However, the domain specified by the DefaultLogonDomain property is used only when a client does not specify a domain in the logon dialog box that appears on the client computer.
  7. Optionally, you can enter a value in the Realm box, which configures the value of the Realm property. If the Realm property is set, its value appears on the client's logon dialog box, when Basic authentication is used. The value of the Realm property is sent to the client for informational purposes only, and is not used to authenticate clients using Basic authentication.
  8. Click OK twice.
Related Topics
  • For more information on encryption features, see About Encryption.
  • For more information on the default logon type, see Default Logon Type.


Digest Authentication

Digest authentication offers the same functionality as Basic authentication; however, Digest authentication provides a security improvement in the way that a user's credentials are sent across the network. Digest authentication transmits credentials across the network as an MD5 hash, or message digest, where the original user name and password cannot be deciphered from the hash. Digest authentication is available to Web Distributed Authoring and Versioning (WebDAV) directories.

Installation of additional client software is not required, but Digest authentication does rely on the HTTP 1.1 protocol as defined in the RFC 2617 specification at the World Wide Web Consortium Web site. Because Digest authentication requires HTTP 1.1 compliance, not all browsers support it. If a non-HTTP 1.1 compliant browser requests a file from a server using Digest authentication, the server will request the client to provide Digest authentication credentials. The non-HTTP 1.1. compliant client rejects the request because Digest authentication is not supported by the client.

Requirements for Digest Authentication

Before enabling Digest authentication on your IIS server, the following minimum requirements must be met. Only domain administrators can verify that the domain controller requirements are met. Check with your domain administrator if you are unsure about whether your domain controller meets the following requirements.
  • All clients that access a resource secured with Digest authentication are using Internet Explorer 5 or later.
  • The user and the server running IIS must be members of, or be trusted by, the same domain.
  • Users must have a valid Windows user account stored in Active Directory® on the domain controller.
  • The domain must have a domain controller running Windows 2000 or later.

    • important Important If the domain controller is on a computer running Windows 2000, IIS 6.0 requires sub-authentication for Digest authentication to work.

  • The computer running IIS must be operating on Windows 2000 or later.

important Important If your server operates in worker process isolation mode, you must use the LocalSystem account as the identity.

Sub-Authentication

To use Digest authentication in IIS 6.0 when the domain controller is running Windows 2000, you must enable sub-authentication, which is not installed by default on IIS 6.0. There are three requirements to enabling sub-authentication:
  • Install the sub-authentication component, iissuba.dll.
  • Set the UseDigestSSP metabase property to FALSE. See Setting the UseDigestSSP Metabase Property.
  • Set the identity of the application pool to LocalSystem. See Configuring Application Pool Identity.

To install the sub-authentication component

  1. From the Start menu, click Run.
  2. In the Open box, type cmd, and click OK.
  3. At the command prompt, type rundll32 systemroot\system32\iissuba.dll,RegisterIISSUBA.
  4. Press ENTER.
  5. For any application pools that use Digest authentication, set the identity as LocalSystem.

When you no longer want to use sub-authentication, unregister the sub-authentication component.

To unregister the sub-authentication component

  1. From the Start menu, click Run.
  2. In the Open box, type cmd, and click OK.
  3. At the command prompt, type rundll32 systemroot\system32\iissuba.dll,UnregisterIISSUBA.
  4. Press ENTER.

Client Authentication Process

The following steps outline how a client is authenticated using Digest authentication: Digest authentication client authentication.
  1. The client requests a file from the server running IIS.
  2. The server running IIS denies the request and sends the client the following information:
    • Digest authentication is being used.
    • The realm name.
  3. Internet Explorer prompts the user for credentials (user name and password). Internet Explorer then combines these credentials with the name of the realm to create an MD5 hash and resubmits the request for the file from the server running IIS, this time sending the MD5 hash.
  4. The server running IIS receives the hash and sends the client's hash to the domain controller for verification.
  5. The domain controller informs the server running IIS of the authentication results.
  6. If the client is authenticated, IIS sends the requested document or data to the client.

important Important Digest authentication completes only if the domain controller has a reversibly encrypted (clear text) copy of the requesting user's password stored in Active Directory. To allow passwords to be stored the in clear text, you need to activate the Store password using reversible encryption setting on the Account tab of the user in Active Directory. Alternatively, you can set a Group Policy to enable this capability. After making this setting you need to set a new password to activate this feature because the old password can't be determined. For more information on setting user properties in Active Directory, see Windows Help.

Configuring Digest Authentication

Enabling Digest authentication on the server running IIS requires the following two tasks:

  • Enable Digest authentication for Windows domain servers.
  • Configure the realm name.

important Important You must be a member of the Administrators group on the local computer to perform the following procedure (or procedures), or you must have been delegated the appropriate authority. As a security best practice, log on to your computer using an account that is not in the Administrators group, and then use the Run as command to run IIS Manager as an administrator. From the command prompt, type runas /user:administrative_accountname "mmc %systemroot%\system32\inetsrv\iis.msc".

To enable Digest authentication for Windows domain servers

  1. In IIS Manager, right-click the Web Sites folder, Web site, directory, virtual directory, or file, and click Properties.

    note Note Configuration settings made at the Web Sites folder level can be inherited by all Web sites.

  2. Click the Directory Security or File Security tab, depending upon what level you are configuring security settings.
  3. In the Anonymous access and authentication control section, click Edit.
  4. In the Authenticated access section, select the Digest authentication for Windows domain servers check box.
  5. In the Realm box, type the realm name, or click Select to browse for a domain.
  6. Click OK twice.

note Note If Basic authentication is enabled for the site, virtual directory, or folder you are configuring, the Default domain box will also be available. However, only Realm is meaningful to Digest authentication.

Configuring the Realm Name

In addition to using IIS Manager to configure the realm name, you can use scripting to configure the realm name at any level of the metabase, shown in the following table. If a child key is not specifically configured, it inherits its configuration from the next configured level up.

Metabase Level | Description
W3SVC | The W3SVC level, also known as the IISWebService level, is the highest level in the metabase where Digest authentication can be configured. Configurations set at this level are inherited by lower levels that do not have specific configuration settings.
W3SVC/n | The W3SVC/n level, also known as the IISWebService level, is a specific Web site, where n is the number of the site. Sites are numbered starting at 1. The default Web site is 1.
W3SVC/n/root | The W3SVC/n/Root level, known as the IISWebVirtualDir level, is the starting point for a Web Site, where n is the number of the site.
W3SVC/n/root/vdir | The W3SVC/n/ROOT/WebVirtualDir level, known as the IISWebVirtualDir level, is a virtual directory within a Web Site, where n is the number of the site.
W3SVC/n/root/vdir/webdir | The W3SVC/n/Root/WebVirtualDir/WebDir level, also known as the IISWebDirectory level, is a physical directory within a virtual directory within a Web site, where n is the number of the site.
W3SVC/n/root/vdir/file | The W3SVC/n/root/vdir/file level is an individual file within the W3SVC/n/ROOT/WebVirtualDir level, where n is the number of the site.
W3SVC/n/root/vdir/webdir/file | The W3SVC/n/root/vdir/file level is an individual file within the W3SVC/n/Root/WebVirtualDir/WebDir level, where n is the number of the site.

You can configure either one or multiple realm names on a server running IIS . You may want to configure multiple realm names, for instance, to allow access to the sales virtual directory to members of domain1 and access to the engineering virtual directory to members of domain2. This is particularly useful if domain1 and domain2 do not have a trusted relationship. If you configure multiple realm names, they must be configured at different levels of the metabase. See Windows Server 2003 family Help for more information about domains.

If a child key in the metabase is not configured with a realm name, that child key inherits the realm name from the next parent key that has the realm name configured. If the realm name is not configured, IIS sends its own computer name as the realm name. If IIS sends its own name as the realm name and IIS is not running on a Windows Server 2003 family domain controller with Active Directory, Digest authentication will fail. Although possible, it is not recommended to run IIS on a domain controller due to security risks and performance issues.


Advanced Digest Authentication

Under Advanced Digest authentication, user credentials are stored on the domain controller as an MD5 hash. Because credentials are stored in Active Directory as an MD5 hash, user passwords cannot be feasibly discovered by anyone with access to the domain controller, not even by the domain administrator. Advanced Digest authentication is available to Web Distributed Authoring and Versioning (WebDAV) directories. In IIS 6.0, Advanced Digest authentication is preferred over Digest authentication, but Digest authentication is still available.

Installation of additional client software is not required; however, Advanced Digest authentication does rely on the HTTP 1.1 protocol as defined in the RFC 2617 specification at the World Wide Web Consortium Web site. Because Advanced Digest authentication relies on the HTTP 1.1 protocol, not all browsers support it. If a non-HTTP 1.1 compliant browser requests a file from a server using Advanced Digest authentication, the server will request the client to provide Advanced Digest authentication credentials. The non-HTTP 1.1. compliant client rejects the request because Advanced Digest authentication is not supported by the client.

Requirements for Advanced Digest

Before enabling Advanced Digest authentication on your server running IIS, the following minimum requirements must be met. Only domain administrators can verify that the domain controller requirements are met. Check with your domain administrator if you are unsure about whether your domain controller meets the following requirements.
  • All clients that will access a resource secured with Advanced Digest authentication are using Internet Explorer 5 or later.
  • The user and the server running IIS must be members of the same domain, or the user must be a member of a trusted domain.
  • Users must have a valid Windows user account stored in Active Directory on the domain controller.
  • The domain must have a domain controller running a member of the Windows Server 2003 family.
  • The domain controller and the server running IIS must both be running a member of the Windows Server 2003 family or later. If either your domain controller or IIS server is running Windows 2000 or earlier, IIS defaults to Digest Authentication and does not warn you of this action.

Client Authentication Process

The following steps outline how a client is authenticated using Advanced Digest authentication:

Digest authentication Client Authentication.

  1. The client requests a file from the server running IIS.
  2. The server running IIS denies the initial request and sends the client the following information:
    • Digest authentication is being used.
    • The realm name.
  3. The server running IIS reports to the client (Internet Explorer) that Digest authentication, rather than Advanced Digest authentication, is used because the same Digest authentication algorithm is used between the server running IIS and the client for both Digest and Advanced Digest authentication.
  4. Internet Explorer prompts the user for credentials (user name and password). Internet Explorer then combines these credentials with the name of the realm to create an MD5 hash and resubmits the request for the file to the server running IIS, this time also sending the MD5 hash in the header of the HTTP request.
  5. The server running IIS receives the client's hash and sends it to the domain controller for verification.
  6. The domain controller compares the client's hash to the copy stored in Active Directory. If the hash values match, the domain controller informs the server running IIS that the client is authenticated.
  7. The server running IIS sends the requested file to the client.

Configuring Advanced Digest Authentication

Enabling Advanced Digest authentication on the server running IIS requires the following three tasks:

  • Enable Digest authentication for Windows domain servers.
  • Configure the realm name.
  • Set the UseDigestSSP metabase property to TRUE.

If you follow the first two procedures but do not configure the UseDigestSSP metabase key, you will be using Digest authentication, not Advanced Digest authentication.

Enabling Advanced Digest Authentication for Windows Domain Server

Verify that Advanced Digest authentication is enabled, or enable it.

important Important You must be a member of the Administrators group on the local computer to perform the following procedure (or procedures), or you must have been delegated the appropriate authority. As a security best practice, log on to your computer using an account that is not in the Administrators group, and then use the Run as command to run IIS Manager as an administrator. From the command prompt, type runas /user:administrative_accountname "mmc %systemroot%\system32\inetsrv\iis.msc".

To enable Advanced Digest authentication for Windows domain servers

  1. In IIS Manager, right-click the Web Sites folder, Web site, directory, virtual directory, or file, and click Properties.

    note Note Configuration settings made at the Web Sites folder level can be inherited by all Web sites.

  2. Click the Directory Security or File Security tab, depending upon what level you are configuring security settings.
  3. In the Anonymous access and authentication control section, click Edit.
  4. In the Authenticated access section, select the Digest authentication for Windows domain servers check box.
  5. In the Realm box, type the realm name, or click Select to browse for a domain. If Basic authentication is enabled for the site, virtual directory, or folder you are configuring, the Default domain box will also be available. However, only Realm is meaningful to Advanced Digest authentication.
  6. Click OK twice.

Configuring the Realm Name

In addition to using IIS Manager to configure the realm name, you can use scripting to configure the realm name at any level of the metabase, shown in the following table. If a child key is not specifically configured, it inherits its configuration from the next configured level up.

Metabase Level | Description
W3SVC | The W3SVC level, also known as the IISWebService level, is the highest level in the metabase where Digest authentication can be configured. Configurations set at this level are inherited by lower levels that do not have specific configuration settings.
W3SVC/n | The W3SVC/n level, also known as the IISWebService level, is a specific Web site, where n is the number of the site. Sites are numbered starting at 1. The default Web site is 1.
W3SVC/n/root | The W3SVC/n/Root level, known as the IISWebVirtualDir level, is the starting point for a Web Site, where n is the number of the site.
W3SVC/n/root/vdir | The W3SVC/n/ROOT/WebVirtualDir level, known as the IISWebVirtualDir level, is a virtual directory within a Web Site, where n is the number of the site.
W3SVC/n/root/vdir/webdir | The W3SVC/n/Root/WebVirtualDir/WebDir level, also known as the IISWebDirectory level, is a physical directory within a virtual directory within a Web site, where n is the number of the site.
W3SVC/n/root/vdir/file | The W3SVC/n/root/vdir/file level is an individual file within the W3SVC/n/ROOT/WebVirtualDir level, where n is the number of the site.
W3SVC/n/root/vdir/webdir/file | The W3SVC/n/root/vdir/file level is an individual file within the W3SVC/n/Root/WebVirtualDir/WebDir level, where n is the number of the site.

You can configure either one or multiple realm names on a server running IIS . You may want to configure multiple realm names, for instance, to allow access to the sales virtual directory to members of domain1 and access to the engineering virtual directory to members of domain2. This is particularly useful if domain1 and domain2 do not have a trusted relationship. If you configure multiple realm names, they must be configured at different levels of the metabase. See Windows Server 2003 family Help for more information about domains.

If a child key in the metabase is not configured with a realm name, that child key inherits the realm name from the next parent key that has the realm name configured. If the realm name is not configured, IIS sends its own computer name as the realm name. If IIS sends its own name as the realm name and IIS is not running on a Windows Server 2003 family domain controller with Active Directory, Digest authentication will fail. Although possible, it is not recommended to run IIS on a domain controller due to security risks and performance issues.

Setting the UseDigestSSP Metabase Property

Advanced Digest authentication uses a metabase key called UseDigestSSP. This metabase key is a switch between Digest and Advanced Digest Security Support Provider Interface (SSPI) code. After the key has been set, the only valid property values are 1 (TRUE), 0 (FALSE), or empty. If the property is set to TRUE, the new SSPI code for Advanced Digest authentication is used. In all other cases (FALSE, empty, or not set), IIS uses the Digest authentication code.

You can configure the UseDigestSSP metabase property at the W3SVC level of the metabase. A child key inherits its configuration from the level above it.

Related Topics
  • For more information on Digest authentication, see Digest Authentication, and the RFC 2617 specification as defined at the World Wide Web Consortium Web site.
  • For more information on the Active Directory or the domain controller, see Domains in Windows Help.
  • For more information about the UseDigestSSP metabase key, see UseDigestSSP in the Metabase Property Reference.


Integrated Windows Authentication

Integrated Windows authentication (formerly called NTLM, and also referred to as Windows NT Challenge/Response authentication) is a secure form of authentication because the user name and password are hashed before being sent across the network. When you enable Integrated Windows authentication, the user's browser proves its knowledge of the password through a cryptographic exchange with your Web server, involving hashing. Integrated Windows authentication is the default authentication method used in members of the Windows Server 2003 family.

Integrated Windows authentication uses Kerberos v5 authentication and NTLM authentication. If Active Directory Services is installed on a Windows 2000 or later domain controller and the user's browser supports the Kerberos v5 authentication protocol, Kerberos v5 authentication is used; otherwise, NTLM authentication is used.

Integrated Windows authentication includes the Negotiate, Kerberos, and NTLM authentication methods. Negotiate, a wrapper for Kerberos and NTLM, is a good choice for connecting to clients on the Internet because each lacks a capability, as follows:

  • NTLM can get past a firewall, but is generally stopped by proxies.
  • Kerberos can get past a proxy, but is generally stopped by firewalls.

For Kerberos v5 authentication to be successful, both the client and the server must have a trusted connection to a Key Distribution Center (KDC) and be Active Directory Services compatible.

Client Authentication Process

The following steps outline how a client is authenticated using Integrated Windows authentication:

  1. Unlike Basic authentication, Integrated Windows authentication does not initially prompt for a user name and password. The current Windows user information on the client computer is used for Integrated Windows authentication.

    2. note Note Microsoft Internet Explorer versions 4.0 and later can be configured to initially prompt for user information if needed. For more information, see Internet Explorer Help.

  2. If the authentication exchange initially fails to identify the user, the browser prompts the user for a Windows account user name and password, which it processes using Integrated Windows authentication.
  3. Internet Explorer continues to prompt the user until the user either enters a valid user name and password or closes the prompt dialog box.

Although Integrated Windows authentication is secure, it does have two limitations:

  1. Only Microsoft Internet Explorer versions 2.0 and later support this authentication method.
  2. It does not work over HTTP proxy connections.

Therefore, Integrated Windows authentication is best suited for an intranet environment, where both user and Web server computers are in the same domain and where administrators can ensure that every user has Internet Explorer version 2.0 or later.If Integrated Windows authentication fails due to improper user credentials or some other problem, the browser prompts the user to enter a user name and password.

Integrated Windows authentication uses Kerberos. Before the Kerberos authentication service can authenticate a service, the service must be registered on only one account object. If the logon account of a service instance changes, the service must be reregistered under the new account. Therefore, only one application pool that has the service registered can authenticate with Kerberos. As a result of this, you cannot isolate sites from each other on the virtual directory level in an application pool. There is a work around, however. The customer can isolate these sites based on domain name. For example, CompanynameHR.com and CompanynameSales.com.

Configuring Integrated Windows Authentication

important Important You must be a member of the Administrators group on the local computer to perform the following procedure (or procedures), or you must have been delegated the appropriate authority. As a security best practice, log on to your computer using an account that is not in the Administrators group, and then use the Run as command to run IIS Manager as an administrator. From the command prompt, type runas /user:administrative_accountname "mmc %systemroot%\system32\inetsrv\iis.msc".

To enable Integrated Windows authentication

  1. In IIS Manager, right-click the Web Sites folder, Web site, directory, virtual directory, or file, and click Properties.

    note Note Configuration settings made at the Web Sites folder level can be inherited by all Web sites.

  2. Click the Directory Security or File Security tab, depending upon what level you are configuring security settings.
  3. In the Anonymous access and authentication control section, click Edit.
  4. In the Authenticated access section, select the Windows Integrated Authentication check box.
  5. Click OK twice.
Related Topics
  • For more information about Kerberos, see Kerberos in Windows Help.
  • For more information on NTLM authentication, see Authentication in Windows Help.


Certificate Authentication

You can use your Web server's Secure Sockets Layer (SSL) security feature for two types of authentication. You can use a server certificate to allow users to authenticate your Web site before they transmit personal information, such as a credit card number. Also, you can use client certificates to authenticate users requesting information on your Web site. SSL authenticates by checking the content of an encrypted digital identification submitted by the user's Web browser during the logon process. (Users obtain client certificates from a mutually trusted third-party organization.) Server certificates usually contain information about your company and the organization that issued the certificate. Client certificates usually contain identifying information about the user and the organization that issued the certificate.

Client Certificate Mapping

Because a Windows user account is required to access resources like files, you can map client certificates to Windows user accounts on your Web server. After you create and enable a certificate map, each time a user logs on with a client certificate, your Web server automatically associates that user with the appropriate Windows user account. This way, you can automatically authenticate users who log on with client certificates, without requiring the use of other supported authentication methods such as Basic, Digest, or Integrated Windows authentication. You can map either one client certificate to one Windows user account or many client certificates to one account. For example, if you had several different departments or businesses on your server, each with its own Web site, you could use many-to-one mapping to map all of the client certificates of each department or company to its own Web site. This way, each site provides access only to its own clients.

phrase 1, phrase 2, phrase 3
Related Topics
  • For more information on client certificates, see Certificates.
  • For more information on client certificate mapping, see Client Certificate Mapping.


UNC Authentication

The Universal Naming Convention (UNC) authentication method, also called UNC Passthrough authentication, determines the credentials to be used for gaining access to a UNC share on a remote computer. Beginning with IIS 6.0, the UNC authentication looks at the request user and the credentials stored in the UNCUserName and UNCPassword properties of the metabase to determine the credentials to pass through to the computer with the UNC share, in the following way:

  1. If UNCUserName is specified (not empty) and UNCPassword is valid, the metabase user credentials are sent as the user identity for access to the remote share. If UNCUserName is specified (not empty) and UNCPassword is not valid, a 500 Internal Server Error: Invalid Username or Password message is sent to the client.
  2. If UNCUserName is empty, then the credentials of the request user (either an authenticated set of credentials for authenticated requests or IUSR_computername credentials for anonymous requests) are sent as the user identity for access to the remote share.

note Note The UNCAuthenticationPassthrough metabase key is no longer used for UNC authentication.

Related Topics
  • To secure access to remote UNC shares, see Securing Virtual Directories Mapped to UNC Shares.


.NET Passport Authentication

Microsoft® .NET Passport is a user-authentication service and a component of the Microsoft .NET framework. The .NET Passport single sign-in service and express purchase service enable your business to deliver a fast, convenient way for consumers to sign in and make transactions on your site. With the .NET Passport single sign-in service, you can map sign-in names to information in your databases, which enables you to offer .NET Passport members a personal Web experience through targeted ads, promotions, and content. Using .NET Passport in this way potentially helps you increase customer loyalty, sales, and advertising revenues.

.NET Passport uses standard Web technologies and techniques, such as Secure Sockets Layer (SSL), HTTP redirects, cookies, Microsoft JScript®, and strong symmetric key encryption to deliver the single sign-in service. .NET Passport is compatible with both Microsoft Internet Explorer version 4.0 or later, and Netscape Navigator version 4.0 or later. In addition, .NET Passport is compatible with some versions of UNIX.

The Microsoft .NET Passport Business Services home page includes information about the benefits for users and businesses, and instructions for implementing .NET Passport on your Web sites. This section describes how to enable and configure .NET Passport authentication on your IIS server.

This section includes the following information:

  • About .NET Passport Authentication: Describes the benefits, for administrators and .NET Passport members, of implementing .NET Passport Authentication on your Web sites.
  • Setting Up .NET Passport in IIS: Describes how to configure and test your .NET Passport configuration on IIS and against .NET Passport production servers.
  • Enabling .NET Passport Authentication: Describes how to implement .NET Passport authentication on your Web sites through IIS Manager.
  • Configuring Active Directory for .NET Passport Authentication: Describes how .NET Passport authenticates against Active Directory®directory service.


About .NET Passport Authentication

Microsoft .NET Passport is a user-authentication service that lets users of your site create a single sign-in name and password for easy access to all .NET Passport-enabled Web sites and services. .NET Passport-enabled sites rely on the .NET Passport central server to authenticate users rather than hosting and maintaining their own proprietary authentication systems. However, the .NET Passport central server does not authorize or deny a specific user's access to individual .NET Passport-enabled sites. It is the responsibility of the Web site to control users' permissions.

.NET Passport can also store user information in encrypted profiles (also known as registering) on .NET Passport servers. When .NET Passport users register at a participating site, their personal information can be shared with the site to speed registration. When the .NET Passport users sign into that site again, their .NET Passport profiles can enable access to personalized accounts or services on that site.

.NET Passport single sign-in service is similar to the forms-based authentication model that is commonly used on the Web today. The .NET Passport network extends this model to work across a distributed set of participating sites, while helping to preserve members' privacy and security and your ability to appropriately customize and brand the sign-in experience. Specifically, .NET Passport extends the forms-based authentication model in the following ways:

  • The sign-in, sign-out, and registration pages are centrally hosted rather than being specific to each individual site.
  • .NET Passport can be extensively co-branded to match the look and feel of your site. Co-branding material is served directly from your site and is included in the centrally hosted pages when those pages are displayed on a client browser.
  • Centrally hosted pages that require additional security to exchange credentials or other information are always served using Secure Sockets Layer (SSL).
  • All .NET Passport sign-in and core profile cookies are strongly encrypted. Each participating Web site receives a unique encryption key that helps to ensure information privacy.
  • The central .NET Passport servers return encrypted sign-in and profile information to your site, which can then be used to write local cookies and thus avoid redirects back to the central .NET Passport servers on subsequent page views.
  • Members do not need to retype their sign-in name and password when moving from site to site. .NET Passport enabled-sites issue a set of encrypted cookies in the .NET Passport central servers' domain to facilitate silent and seamless sign-in across sites. However, sites may still choose to always force members to be redirected to .NET Passport sign-in and to authenticate upon first viewing of their site.
  • Participating Web sites never receive a member's password. The authentication cookie is actually a pair of encrypted time stamps asserting when the member signed in. When members choose to sign out by clicking the .NET Passport sign-out link, they are redirected to a central page that enables deletion of all .NET Passport cookies from all of the sites that the member visited during the session.
  • There is no real-time, server-to-server communication between participating Web sites and the central .NET Passport servers. All information exchange occurs through the client's browser using HTTP redirects, encrypted information on the query string, and cookies. Server-to-server communication occurs only when a centrally hosted XML configuration file is periodically downloaded and cached locally by .NET Passport's server-side object (supplied in the .NET Passport SDK); this XML file contains current URLs for all the .NET Passport servers and the current profile schema.

Related Topics

  • For more information about implementing .NET Passport with IIS, see Enabling .NET Passport Authentication.
  • For more information about .NET Passport Services, including how to sign into .NET Passport, benefits for users and businesses, and instructions for implementing .NET Passport on your Web sites, see the Microsoft .NET Passport Business Services Web site.


Setting Up .NET Passport in IIS

Before setting up Microsoft .NET Passport authentication on your Web sites in a production environment, you are required to test IIS against .NET Passport preproduction servers. By working through these process, you confirm that your IIS server and the .NET Passport server are communicating properly, your site(s) is registered with .NET Passport (which may potentially involve signing forms and agreements), and your Web sites have proper site IDs. You must complete each process for every Web site you wish to enable with .NET Passport authentication.

This topic includes the following information:

  • .NET Passport Environments
  • Testing and Preproduction (PREP)
  • Mapping to Active Directory
  • Configuring for Preproduction (PREP)
  • Configuring for Production
  • Passport Manager Administration Utility

important Important Using Registry Editor incorrectly can cause serious problems that require reinstalling the operating system. Because Registry Editor bypasses the standard safeguards that prevent you from entering settings that are conflicting or likely to degrade performance or damage your system, exercise caution when making changes to the registry. Microsoft cannot guarantee that problems resulting from the incorrect use of Registry Editor can be solved. For information about how to edit the registry, see the Changing Keys and Values topic in Registry Editor Help.

With .NET Passport authentication on members of the Windows Server 2003 family, the default .NET Passport SecureLevel setting is 10. This means new sites using .NET Passport authentication (and default settings) require an Secure Sockets Layer (SSL) server certificate. You can change the SecureLevel setting for a site by changing a registry value.

To change the SecureLevel setting for the default Web site

  • Enter a new value in the registry for the following key:
    HKEY_LOCAL_MACHINE\Software\Microsoft\Passport\SecureLevel

To change the SecureLevel setting for any Web site other than the default Web site

  • Enter a new value in the registry for the following key:
    HKEY_LOCAL_MACHINE\Software\Microsoft\Passport\Sites\<Site Name>\SecureLevel

note Note This documentation is designed to be used in conjunction with the .NET Passport Software Development Kit (SDK) documentation (version 2.1 or later). If you have not already done so, review the SDK documentation, specifically the section titled "How to Implement .NET Passport". You may find it helpful to browse the Sample .NET PassportWeb site to better understand what a site running .NET Passport looks like. You can also review the code samples or simply use the code in the sample site as a template for your own site. You can access .NET Passport SDK Help from the MSDN Online Web site or the Sample .NET Passport Web site.

.NET Passport Environments

Setting up .NET Passport on your Web sites involves testing and configuring IIS against the following three .NET Passport environments:

  • Default installation environment: By default, the Microsoft .NET Passport SDK and Internet Information Services (IIS) (with the Passport Manager object) are configured for testing. The test or default installation environment uses a site ID of 1 (one), and has a default encryption key instead of a private, site-specific key.
  • Preproduction: The Preproduction (PREP) environment enables sites to verify their development efforts against .NET Passport servers without access to real-world .NET Passport user identifications and profiles. While in PREP mode, prospective .NET Passport participating sites can manipulate data, create new users, and run other tests against the user base without affecting existing deployed .NET Passport sites.
  • Production: The .NET Passport Production environment is shared by all working and approved .NET Passport participating sites after they are deployed to the public.

Testing and Preproduction (PREP)

You can check to see if your site is in the default installation environment by checking the Site ID field in the Passport Manager Administration utility. If the value in the Site ID field is 1, your site is in the default installation environment. While your site is in this environment, you can perform an initial evaluation of the single sign-in service (SSI) and test any dynamic content on your site against the Passport Manager object. You can develop your Web site and any applications on your site before registering your site and requesting a site ID, or while you are waiting for the site ID and key after registration. After you have a site ID, there should be no reason to use default installation environment again. The restrictions imposed by this mode are intended only to prevent developers from accessing certain .NET Passport features before having signed the necessary agreements or contracts.

note Note The preproduction enviroment requires a .NET Passport preproduction logon account. To set up a preproduction logon account, see Microsoft .NET Passport Member Services Registration.

Limitations in the Default Installation Environment

The following are operational limitations in the default installation environment:

  • Cannot read full core profile data or profile cookies: A Web site running in the default installation environment indicates that the administrator has not yet signed the necessary agreements that specify a site's requirements for privacy. For this reason, a site running in the default installation environment cannot access all .NET Passport user information. .NET Passport user information displayed on a test site contains several fields of default placeholder values, as generated by the logon server.
  • Cannot use co-branding: Co-branding support is dependent on several URLs that you must provide when registering as a .NET Passport participating site. Until you register and provide these URLs, the co-branding logo and text exist as placeholders. For details about how to implement co-branding after your site has registered as a .NET Passport participating site, see ".NET Passport Cobranding Overview" in .NET Passport SDK Help.
  • Cannot sign users out from sign-out page: On a registered .NET Passport site, when members choose to sign out by clicking the .NET Passport sign-out link, they are redirected to a central page that enables deletion of all .NET Passport cookies from all of the sites the member visited during the session. This is not the case in the default installation environment, so .NET Passport cookies remain on the user's browser until the user closes the browser entirely. If the .NET Passport user chose to save their password (thus making all session cookies persistent cookies), then .NET Passport cookies written in the test site's domain are still not deleted. For this reason, when testing browser behavior in the default installation environment, you may occasionally need to quit the browser to reproduce a clean .NET Passport sign-in.

Testing Passport with Active Server Pages

If your Web site uses Active Server Pages (ASP) to query information from the passport authentication ticket, you must create a Passport Manager object. The Passport Manager object is a server-side object for .NET Passport single sign-in and profile services. The Passport Manager object uses cookies and query string data as intermediaries for querying a central user store.

To create a Passport Manager object in an ASP page, use the ASP Server.CreateObject method to create a local object reference as follows:

 set oMgr = Server.CreateObject("Passport.Manager")

The Passport Manager object should only be created once on each ASP page. Multiple object instantiations on a single page can lead to unexpected results when the page loads or unloads. Also, multiple instantiations will slow performance with extra memory overhead and multiple encryption and decryption of the same cookies. One way to assure a single instantiation is to create the object only once in a header file that is included on each page.

Do not create the Passport Manager object in an ASP application in Session or Application scope, unless you are specifically using that instance for utility methods such as GetDomainAttribute or DomainFromMemberName (with input parameter).

The following code sample instantiates the Passport Manager object in an ASP page to obtain user information from a .NET Passport cookie. Web sites running in the default installation environment return generic values. Web sites running in PREP or Production environments return valid user information.

%
'
' instantiate the Passport Manager
'
Set oMgr = Server.CreateObject("Passport.Manager.1")

'
' use https if SecureLevel > 1
'
thisURL = Server.URLEncode("https://" & Request.ServerVariables("SERVER_NAME") & Request.ServerVariables("SCRIPT_NAME") ) signoutURL = Server.URLEncode("https://" & Request.ServerVariables("SERVER_NAME") & "/signout.asp")

If oMgr.IsAuthenticated(3600,FALSE) Then

'
' Convert the binary PUID to a hex format for displaying
'
strMemberIDHigh = oMgr.Profile("MemberIDHigh")
strMemberIDLow = oMgr.Profile("MemberIDLow")
strHex = Hex(strMemberIDHigh)

strPUID = String(8 - Len(strHex), "0") & strHex
strHex = Hex(strMemberIDLow)
strPUID = strPUID & String(8 - Len(strHex), "0") & strHex

For more information, see "Passport Manager Methods" or "Passport Manager Properties" in .NET Passport SDK (version 2.1 or later) Help.

Testing ASP Against the .NET Passport Default Installation Environment

To test ASP against the .NET Passport default installation environment

  1. Enable .NET Passport authentication on a virtual directory. If you want, you can use the code sample above in the Default.asp page and include the Default.asp page in the virtual directory. To learn more about enabling .NET Passport authentication on a Web site or a virtual directory, see Enabling .NET Passport Authentication.

    note Note Microsoft Windows XP client computers used to test .NET Passport must be configured for .NET Passport default installation and PREP environments. To configure your Windows XP client computers to connect to these environments, see ".NET Passport SDK: System Requirements" in .NET Passport SDK (version 2.1 or later) Help . More specifically, read the section titled "Client Computer Requirements".

  2. On a remote client computer, open a Web browser, type the virtual directory URL in the address bar, and press ENTER. The client connects to the Web site and then gets redirected to the .NET Passport server. Passport reads the site ID as 1, which tells the Passport service that your server is still in the default installation environment. You are then redirected to the .NET Passport test environment for credential authentication. Windows 2000 or earlier clients open a logon Web page. Windows XP clients (properly configured according to "Client Computer Requirements" in .NET Passport SDK Help) open the Stored User Names and Passwords dialog box.
  3. Type valid .NET Passport credentials and click OK.
  4. .NET Passport validates the credentials and displays hard-coded, generic user information. The server running IIS collects a cookie with the generic information. The display does not contain any confidential material. The .NET Passport User ID (PUID) is not real because, at this point, your IIS server has not established a contract with .NET Passport.

Mapping to Active Directory

In certain scenarios (for example Business-to-Business [B2B] or Business-to-Consumer [B2C]) you might want to set up Access Control Lists (ACL) on specific Web pages or content and then have selective members or groups access the Web pages using .NET Passport authentication. As an example, a large company with multiple vendors may establish a timecard reporting site for all contingent staff. By setting up the timecard reporting online, vendors can access the Web page from any Web browser, and the company can control security using Passport authentication.

In order to set up this kind of .NET Passport authentication (with ACLs), the .NET Passport user needs to have a PUID mapped to an account in Active Directory® directory service. A passport ticket contains the PUID. The initial mapping of PUIDs to accounts in Active Directory is called provisioning. Provisioning is described later in this topic.

The Active Directory attribute altSecurityIdentity is used to map the passport user to an Active Directory account. The value of altSecurityIdentity looks like this: kerberos:0124ABCD78787878@domain.com. This essentially is a User Principal Name (UPN) where the PUID is the UPN prefix and everything after the "@" is the UPN suffix. The UPN suffix determines where the mapping lives. The UPN suffix should be the domain where the mapping is created or exists. In other words, in the sample mapping kerberos:0124ABCD78787878@domain.com, domain.com is the UPN suffix. The UPN suffix can be configured in the IIS authentication dialog. The UPN suffix value must be the same as the value configured in the IIS authentication dialog or the same as the domain name of the server.

The IIS metabase property AuthFlags contains the available settings for Windows authentication schemes and the file access authentication flags. By default, IIS 6.0 with .NET Passport authentication enabled tries to map the .NET Passport user to an account in Active Directory. This default behavior can create performance overhead for sites that do not want to use .NET Passport Active Directory mapping. The mapping behavior can be controlled by the PassportRequireADMapping flag. The flag values are:

  • PassportRequireADMapping set to 0: IIS does not attempt Active Directory mapping. The request is handled as Anonymous User.
  • PassportRequireADMapping set to 1 (default setting): In this situation the worker process must have TCB privileges (meaning, the worker process acts as part of the operating system). IIS then attempts to map to an Active Directory account (called LsaLogonUser). If this attempt fails, the request is handled as Anonymous User.

  • PassportRequireADMapping set to 2: IIS enforces a mapping from the .NET Passport account to an Active Directory account before returning the requested Web page. If the mapping fails, IIS returns a 401 error.

For .NET Passport mapping to work, the account used for the IIS worker process must meet the following criteria:

  • The IIS worker process must be running as LocalSystem if the computer is a domain member. To change the account on the worker process, see Configuring Worker Process Identities.
  • If using a service account, the domain account must have TCB privilege on the local box (meaning, the account acts as part of the operating system).
  • The account must be a member of the pre-Windows 2000 compatible access group, or have Read access to list group memberships.

The following WMI script sets the PassportRequireADMapping flag in the IIS metabase:

dim g_PPADMapping : g_PPADMapping = 0
call ValidateArgs(WScript.Arguments)
Set g_Locator = CreateObject("WbemScripting.SWbemLocator")
Set g_IIS = g_Locator.ConnectServer ("","root\MicrosoftIISv2","", "")
Set g_NodeObj = g_IIS.Get("IIsWebVirtualDirSetting='" & WScript.Arguments(0) & "'")
g_NodeObj.PassportRequireADMapping.Value = g_PPADMapping
g_NodeObj.Put_
WScript.Echo WScript.Arguments(0) & "/PassportRequireADMapping changed to: " & g_PPADMapping
sub ValidateArgs(args)
      if args.Count <> 2 then
            call Usage
      end if
      if args(1) = "no" then
            g_PPADMapping = 0
      elseif args(1) = "try" then
            g_PPADMapping = 1
      elseif args(1) = "enforce" then
            g_PPADMapping = 2
      else
            call Usage
      end if
end sub
sub Usage
      WScript.echo "Usage: " & WScript.ScriptName & " metabase_path no|try|enforce"
      WScript.Echo "Example: " & WScript.ScriptName & """w3svc/1/root/passportvdir enforce"""
      WScript.Echo " ------- Enforces mapping for virtual directory passportvdir"
      WScript.Quit
end sub

Provisioning

In order to establish ACLs on a Web page for .NET Passport authentication, PUIDs need to be mapped to a corresponding account in Active Directory, called provisioning. The sample code in this section provisions PUIDs to Active Directory accounts. In order to provision the Active Directory, you must have administrator credentials on the Active Directory server. Normally this provisioning is accomplished by a .NET Passport-enabled Web page which collects information about the .NET Passport user and then saves the data so an administrator can perform the provisioning against Active Directory.

The following sample code is taken from Subscribe.asp. Use this code on your .NET Passport-enabled ASP page to collect .NET Passport user IDs and create Active Directory user accounts with the .NET Passport mapping.

%
    '
    ' instantiate Passport Manager
    '
    Set objPassportManager = Server.CreateObject("Passport.Manager.1")
    '
    ' get whatever information about the user that we can from Passport
    '
    strCurrentUserEmail = objPassportManager.Profile("PreferredEmail")
    strMemberIDHigh = objPassportManager.Profile("MemberIDHigh")
    strMemberIDLow = objPassportManager.Profile("MemberIDLow")
    strHex = Hex(strMemberIDHigh)
        '
    ' convert the PUID into the form we need
    '
    strPUID = String(8 - Len(strHex), "0") & strHex
    strHex = Hex(strMemberIDLow)
    strPUID = strPUID & String(8 - Len(strHex), "0") & strHex
    strLastName = objPassportManager.Profile("LastName")
    strFirstName = objPassportManager.Profile("FirstName")
    '
    ' connect to AD and find the default naming context for the default domain
    '
    set rootDSE = GetObject("LDAP://RootDSE")
    if Err.Number <> 0 then
        Response.Write "GetObject Error = " & Hex(Err.Number) & " (Source: " & Err.Source & ")"
    end if
    Err.Clear
    strDomainDN = rootDSE.Get("defaultNamingContext")
    if Err.Number <> 0 then
        Response.Write "Get Domain DN Error = " & Hex(Err.Number) & " (Source: " & Err.Source & ")"
    end if
    Err.Clear
    strdnsName = rootDSE.Get("dnsHostName")
      FirstDot = Instr( strdnsName, "." )
      strDomainName = Right( strdnsName, Len( strdnsName ) - FirstDot )
    strContainerDN = "cn=users, " & strDomainDN

    ' bind to the users container
    set cont = GetObject("LDAP://" & strContainerDN )
    if Err.Number <> 0 then
        Response.Write "GetObject Users Container Error = " & Hex(Err.Number) & " (Source: " & Err.Source & ")"
    end if
    Err.Clear
    ' create the user account
    Set user = cont.Create("user", "cn=" & strCurrentUserEmail)
        if Err.Number <> 0 then
        Response.Write "Create User Error = " & Hex(Err.Number) & " (Source: " & Err.Source & ")"
    end if
    user.put "samAccountName", strPUID
    strFullAccountName = strPUID & "@" & strDomainName
        user.put "altSecurityIdentities", "Kerberos:" & strFullAccountName
      ' set the UPN of the user to equal the PP e-mail address
      user.put "userPrincipalName", strCurrentUserEmail
      user.put "givenName", Request.form("fname")(1)
      user.put "sn", Request.form("lname")(1)
    '
      '   WARNING!!!
      ' Before going live with a site based on this sample code,
      ' the following must be changed so that a random password
      ' is assigned to each account. A recommended way to do this
      ' is to use the CAPICOM Utilities.GetRandom function.
    '
      user.put "userPassword", "89sd53ET!23kL"
    ' write the property cache
    user.SetInfo
    ' refresh the property cache
    user.GetInfo
    ' clear the account disabled flag and set neccessary flags
    flags = user.get("userAccountControl")
    flags = flags OR &H00010000
    flags = flags AND &HFFFFFFFD
    user.put "userAccountControl", flags
    user.SetInfo
%

Configuring for Preproduction

Real-world .NET Passport users probably do not have existing e-mail names within the PREP environment. Part of your site's development and testing effort may require that you first create a store of users within the PREP environment and then use these accounts for testing against the .NET Passport authentication and profile-access portions of your site's code. The .NET Passport server code that runs the services in the PREP environment is essentially identical to the code that runs live in the Production environment; Production and PREP are released in tandem. This means that going live should be a matter of simply stopping the servers on a site currently running against the PREP environment, reconfiguring Passport Manager on those servers to run against the Production environment instead, and then restarting the servers.

For more information about getting a PREP site ID, see "Registering Your .NET Passport Site" in .NET Passport SDK (version 2.1 or later) Help. For more information about PREP Passports, see "Get a PREP Passport" and "Sign in to PREP Passport" in .NET Passport SDK (version 2.1 or later) Help. Also, see "Going Live: Deploying Passport Manager and Site Code."

Upon completion of the registration process, you will see a confirmation page that indicates your new .NET Passport sign-in name. This is the name you will use while in the development phase.

Configuring for Production

All Microsoft .NET Passport users already have an account in this environment. Users of Microsoft® MSN® Internet Access and MSN Explorer, as well as users who registered directly at the Passport.com Web site, also have passports in this environment. Within the Production environment, sites can expect to handle many real-world .NET Passport users who may already have been authenticated at various other Passport participating sites.

To deploy your site's .NET Passport code, the Passport Manager server-side object must be reconfigured to work against the Production environment. In order to deploy against the Production environment, your site must also register for a site ID in the Production environment, and must also supply some configuration information about your site that is specific to the Production deployment. Approval of a site ID in the Production environment may require some basic remote checking of your site's .NET Passport implementation by the .NET Passport team, and may also require some additional contracts or agreements.

important Important Do not place co-branded URLs in a virtual directory on which .NET Passport authentication is enabled. If a co-branded URL resides in a virtual directory on which .NET Passport authentication is enabled, client requests are challenged to authenticate before the co-branded information is passed to the client. This can result in a situation where a client may not be able to authenticate and view the desired page.

To deploy against the .NET Passport Production environment, see "Registering Your Passport Web Site" in .NET Passport SDK (version 2.1 or later) Help. To disable the default installation environment and enable normal operation, enter a different site ID in the Site ID field and commit changes. Note that if you change the site ID to something other than 1, a matching encryption key must also be installed. The key, as well as the unique site ID assigned to any particular participating site can be obtained only by registering as a .NET Passport participating site.

note Note Be sure to reconfigure your Windows XP clients for .NET Passport production mode as well. For more information, see ".NET Passport SDK: System Requirements" in .NET Passport SDK (version 2.1 or later) Help. More specifically, read the section titled "Client Computer Requirements."

Passport Manager Administration Utility

The Microsoft Passport Manager Administration utility is a graphical-interface alternative to editing the registry when changing Passport Manager object settings. The most common use of the Passport Manager Administration utility is to change the default settings. For details about how defaults can be set and affect the behavior of Passport Manager methods, see "Setting Passport Manager Defaults" in .NET Passport SDK Help.

To access the Passport Manager Administration utility

  1. From the Start menu, click Run.
  2. In the Open box, type msppcnfg.exe, and click OK.
Related Topics
  • For helpful whitepapers that include information on everything from the benefits of enabling .NET Passport on your Web sites, to the .NET Passport Software Development Kit (SDK), see the Microsoft .NET Passport Web site.
  • For sample code to help you set up your own sites, see the Sample .NET Passport Web site.
  • For more information about methods of authenticating users, see Web Site Authentication.
  • For more information about IIS and Web site security, see Security.


Enabling .NET Passport Authentication

This topic describes how to enable Microsoft .NET Passport authentication on Web site through IIS Manager. When .NET Passport is enabled, requests coming into IIS must contain .NET Passport credentials on either the query string or within a cookie. The credentials also have to be valid, meaning the ticket has not expired. If IIS does not detect .NET Passport credentials, requests are redirected to the .NET Passport sign-in page.

.NET Passport uses cookies, which contain information that can be compromised. However, .NET Passport authentication can be used over a Secure Sockets Layer (SSL) connection, which reduces the potential of replay attacks.

important Important You must be a member of the Administrators group on the local computer to perform the following procedure (or procedures), or you must have been delegated the appropriate authority. As a security best practice, log on to your computer using an account that is not in the Administrators group, and then use the Run as command to run IIS Manager as an administrator. From the command prompt, type runas /user:administrative_accountname "mmc %systemroot%\system32\inetsrv\iis.msc".

To enable .NET Passport authentication on a Web site

  1. In IIS Manager, expand the local computer, expand the Web Sites folder, right-click the Web site on which you want to enable .NET Passport authentication, and click Properties.
  2. Click the Directory Security tab.
  3. In the Anonymous access and authentication control section, click Edit.
  4. Select the .NET Passport Authentication check box. There are fundamental differences in the way .NET Passport validates user credentials, so .NET Passport cannot be used with other authentication methods. When .NET Passport authentication is selected, all other authentication methods are unavailable.
  5. Click OK.
Related Topics
  • For comprehensive developer and technical support resources to help businesses implement .NET Passport services, including information on licensing and implementing .NET Passport, see the Microsoft .NET Passport Business Services Web site.
  • For information about configuring .NET Passport authentication programmatically, see AuthFlags in the Metabase Property Reference.
  • For more information about SSL, see Configuring SSL on Servers.
  • For more information about secure protocols, see Authentication.


Configuring Active Directory for .NET Passport Authentication

When using Microsoft .NET Passport authentication, you can store account information and user credentials in Active Directory. If account information is not mapped in Active Directory, IIS automatically creates an Anonymous authentication session with anonymous user account credentials. In most cases, anonymous user account credentials equal IUSR_<computername>. There only difference between .NET Passport authentication IUSR credentials and standard Anonymous authentication IUSR credentials is that .NET Passport authentication creates an IIS authentication token for the anonymous account that contains a security identifier, known as the .NET Passport User ID (PUID).

If account information is mapped in Active Directory, the user authentication token is returned by Active Directory and the corresponding user is logged on to the local computer.

Related Topics
  • For information about enabling .NET Passport authentication with PUID account mapping in Active Directory, see the "Logon and Authentication" chapter in the Distributed Services book in the latest edition of the Windows Server Resource Kit.


Setting the Default Logon Domain

Users authenticated with Basic authentication must log on with a valid Windows user name and password. The user name usually includes:

  • A Windows domain name.
  • An account user name.

These names identify a computer or group of computers administered by your Web server as a single entity. For example, a user who logged on using an account called PhilSpencer on the Sales1 domain would log on as Sales1\PhilSpencer. However, you can configure your Web server to assume a default logon domain for Basic authentication if users do not provide a domain name.

important Important You must be a member of the Administrators group on the local computer to perform the following procedure (or procedures), or you must have been delegated the appropriate authority. As a security best practice, log on to your computer using an account that is not in the Administrators group, and then use the Run as command to run IIS Manager as an administrator. From the command prompt, type runas /user:administrative_accountname "mmc %systemroot%\system32\inetsrv\iis.msc".

To set the default logon domain

  1. In IIS Manager, right-click the Web Sites folder, Web site, directory, virtual directory, or file, and click Properties.

    note Note Configuration settings made at the Web Sites folder level can be inherited by all Web sites.

  2. Click the Directory Security or File Security tab, depending upon what level you are configuring security settings.
  3. In the Anonymous access and authentication control section, click Edit.
  4. In the Authenticated access section, select the Basic authentication check box.
  5. Because Basic authentication sends passwords over the network unencrypted, a dialog box appears asking if you want to proceed. Click Yes to proceed.
  6. In the Default domain box, either type the domain name you want to use, or click Select to browse to a new default logon domain. If the Default domain box is filled in, the name is used as the default domain. If the Default domain box is left empty, IIS uses the domain of the computer that is running IIS as the default domain. IIS configures the value of the DefaultLogonDomain property, which determines the default domain used to authenticate clients accessing your IIS server using Basic authentication. However, the domain specified by the DefaultLogonDomain property is used only when a client does not specify a domain in the logon dialog box that appears on the client computer.
  7. Optionally, you can enter a value in the Realm box, which configures the value of the Realm property. If the Realm property is set, its value appears on the client's logon dialog box, when Basic authentication is used. The value of the Realm property is sent to the client for informational purposes only, and is not used to authenticate clients using Basic authentication.
  8. Click OK twice.
Related Topics
  • For information on the Realm property, see Realm.
  • For information on the DefaultLogonDomain property, see DefaultLogonDomain.


FTP Site Authentication

Based on your security requirements, you can select an Internet Information Services (IIS) authentication method to validate users requesting access to your FTP sites. For a summary of the characteristics of IIS FTP authentication methods, see the table at the bottom of this page.

In IIS, you can set the authentication method for your FTP resources using property sheets at the FTP site, directory, or file level using IIS Manager.

The following table summarizes FTP authentication methods.

Method | Security Level | Sends Passwords How? | Usable Across Proxy Servers and Firewalls? | Client Requirements
Anonymous FTP Authentication | None | N/A | Yes | Any FTP client
Basic FTP Authentication | Low | Plaintext | Yes | Any FTP client

This section includes the following information:

  • Anonymous FTP Authentication: Describes the authentication method that does not require authenticated user credentials and is best used to grant public access to information that requires no security.
  • Basic FTP Authentication: Describes the authentication method that requires a user name and password, provides a low level of security, and is best used for granting access to information with little or no need for privacy. Security is considered to be low because passwords are sent across the network in plaintext (unencrypted text), making them vulnerable to interception.
phrase 1, phrase 2, phrase 3


Anonymous FTP Authentication

You can configure your FTP server to allow anonymous access to FTP resources. If you select Anonymous FTP authentication for a resource, all requests for that resource are accepted without prompting the user for a user name or password. This is possible because IIS automatically creates a Windows user account called IUSR_computername, where computername is the name of the server on which IIS is running. This is very similar to Web-based Anonymous authentication. If Anonymous FTP authentication is enabled, IIS always try to use it first, even if you enable Basic FTP authentication.

Digest and Integrated Windows authentication cannot be used with FTP sites. Available authentication settings must be set at the site level for FTP sites.

important Important You must be a member of the Administrators group on the local computer to perform the following procedure (or procedures), or you must have been delegated the appropriate authority. As a security best practice, log on to your computer using an account that is not in the Administrators group, and then use the Run as command to run IIS Manager as an administrator. From the command prompt, type runas /user:administrative_accountname "mmc %systemroot%\system32\inetsrv\iis.msc".

To enable the Anonymous FTP authentication method

  1. If the IUSR_computername account is not used for Anonymous FTP authentication, you must create a Windows user account appropriate for the authentication method and add the account to a Windows user group.
  2. Configure NTFS permissions for the directory or files for which you want to control access, using the user account you selected in step 1.
  3. In IIS Manager, right-click the FTP site, directory, virtual directory, or file, and click Properties.
  4. Click the Security Accounts tab.
  5. Select the Allow anonymous connections check box.
  6. To allow your users to gain access by Anonymous authentication only, select the Allow only anonymous connections check box.
  7. In the User name and Password boxes, enter the anonymous logon user name and password you want to use. The user name is the name of the anonymous user account, which is typically designated as IUSR_computername.
  8. Click OK.
  9. Set the appropriate NTFS permissions for the anonymous account.

important Important If you change the security settings for your Web site or virtual directory, your Web server prompts you for permission to reset the security settings for the child keys of that site or directory. If you choose to accept these settings, the child keys inherit the security settings from the parent site or directory.

Related Topics
  • For information about creating Windows user accounts, see Securing Files with NTFS.
  • For information on setting NTFS permissions for an anonymous account, see Setting NTFS Permissions for Directories or Files.
  • For information about setting properties, see Configuring the Metabase.


Basic FTP Authentication

To establish an FTP connection with your Web server by using the Basic FTP authentication method, users must log on with a user name and password corresponding to a valid Windows user account. If the FTP server cannot verify a user's identity, the server returns an error message. Basic FTP authentication provides only low security because the user transmits the user name and password across the network in an unencrypted form. For more information, see About Access Control.

Digest authentication and Integrated Windows authentication cannot be used with FTP sites. Available authentication settings must be set at the site level for FTP sites.

important Important You must be a member of the Administrators group on the local computer to perform the following procedure (or procedures), or you must have been delegated the appropriate authority. As a security best practice, log on to your computer using an account that is not in the Administrators group, and then use the Run as command to run IIS Manager as an administrator. From the command prompt, type runas /user:administrative_accountname "mmc %systemroot%\system32\inetsrv\iis.msc".

To enable the Basic FTP authentication method

  1. Create a Windows user account appropriate for the authentication method. If appropriate, add the account to a Windows user group.
  2. Configure NTFS permissions for the directory or file for which you want to control access.
  3. In IIS Manager, right-click the FTP site, directory, virtual directory, or file, and click Properties.
  4. Click the Security Accounts tab.
  5. Clear the Allow anonymous connections check box.
  6. Click OK.
  7. Set the appropriate NTFS permissions for the account.

important Important If you change the security settings for your Web site or virtual directory, your Web server prompts you for permission to reset the security settings for the child nodes of that site or directory. If you choose to accept these settings, the child nodes inherit the security settings from the parent site or directory.

Related Topics
  • For information about creating Windows user accounts, see Securing Files with NTFS.
  • For information on setting NTFS permissions for an anonymous account, see Setting NTFS Permissions for Directories or Files.
  • For information about setting properties, see Configuring the Metabase.


Access Control

You can control which users and computers are allowed to access your Web server and its resources. You can use both NTFS and Internet Information Services (IIS) security features, such as Web permissions and IP address restrictions, to specific access rights to Web sites, directories, and files.

This section includes the following information:

  • About Access Control: Describes the access control model.
  • NTFS Permissions: Describes how to use NTFS permissions to secure your Web content.
  • Web Site Permissions: Describes how to set Web permissions to protect your Web content.
  • IIS and Built-in Accounts: Describes the accounts created during IIS installation, as well as built-in accounts used by IIS.
  • Anonymous Access: Describes the anonymous access account.
  • Configuring Worker Process Identities: Describes how to configure the worker process identity so an application can run with the appropriate access rights for your Web server.
  • Securing Sites with IP Address Restrictions: Describes how to prevent specific computers, groups of computers, or entire networks from accessing your Web content.
  • Securing Virtual Directories: Describes guidelines for securing virtual directories.
  • URL Authorization: Describes how to use role-based Web site authorization methods.
Related Topics
  • For information on FTP user isolation, which prevents users from viewing or overwriting other users' Web content, see Using Content Ratings.
  • For information on configuring content rating features to warn users about objectionable Web content, see Isolating FTP Users.
  • For information on configuring your Web server's Secure Sockets Layer (SSL) security features, see Configuring SSL on Servers.


About Access Control

Properly controlling access to your Web and FTP content is crucial for running a secure Web server. With Windows and the security features in IIS, you can effectively control how users access your Web and FTP content. You can control access on multiple levels, from entire Web and FTP sites to individual files.

Each account is granted user rights and permissions. User rights are rights to perform specific actions on a computer or network. Permissions are rules associated with an object, such as a file or folder, to regulate which accounts can gain access to that object.

How Access Control Works

You can control user access to your Web server content by properly configuring your Windows file system and Web server security features. When a user attempts to access your Web server, the server carries out several access control processes to identify the user and determine the allowed level of access.

Access control flow chart

The following is an outline of the access control process:

  1. The client requests a resource on the server.
  2. The IP address of the client is checked against any IP address restrictions in IIS. If the IP address is denied access, then the request fails and a "403 Access Forbidden" message is returned to the user.
  3. The server, if configured to require it, requests authentication information from the client. The browser either prompts the user for a user name and password, or offers this information automatically.
  4. IIS checks if the user has a valid Windows user account. If the user does not, then the request fails, and a "401 Access is denied" message is returned to the user.
  5. IIS checks if the user has Web permissions for the requested resource. If the user does not, then the request fails, and a "403 Access Forbidden" message is returned to the user.
  6. Any security modules, such as Microsoft ASP.NET impersonation, are added.
  7. IIS checks the NTFS permissions on static files, Active Server Pages (ASP), and Common Gateway Interface (CGI) files for the resource. If the user does not have NTFS permissions for the resource, then the request fails, and a "401 Access is denied" message is returned to the user.
  8. If the user has NTFS permissions, the request is fulfilled.
Related Topics
  • For more information about authentication, see Authentication.


NTFS Permissions

It is strongly recommended that you use the NTFS file system for you application server. NTFS is a more powerful and secure file system than FAT and FAT32. With NTFS, you can limit access to your Web server's files and directories. You can also configure the access level granted to a particular user or group for the files and directories on your server. In addition to allowing for larger volume sizes than FAT, NTFS offers more benefits as outlined in the following table.

NTFS | FAT
Allows administrators to secure directories and files using NTFS permissions. Permissions can be set on the file level, as well as the directory level. | Does not allow administrators to secure directories and files.
Supports file encryption, which greatly enhances file security. | Does not support file encryption.
Allows administrators to enable Web Distributed Authoring and Versioning (WebDAV) properties. | Does not allow administrators to enable WebDAV properties.
Supports Active Directory® and domain-based security. | Does not support Active Directory and domain-based security.

This section includes the following information:

  • Securing Files with NTFS: Provides procedural information about configuring your Web site to use the NTFS security features.
  • Setting NTFS Permissions for Directories or Files: Provides procedural information about configuring NTFS permissions, which define the level of file or directory access assigned to a Windows user account.
Related Topics
  • For more information on converting a volume from the FAT or FAT32 file system to NTFS, see Convert in Windows Help.
  • For more information on NTFS permissions, see Access Control in Windows Help.


Securing Files with NTFS

With the NTFS file system, you can limit access to your Web site's files and directories. You can grant or deny access to a particular user account or user group. For example, you can configure your Web server to enable a specific user to view and execute a file, while excluding all other users from accessing that file.

IIS relies on NTFS permissions for securing individual files and directories from unauthorized access. Unlike Web site permissions, which apply to all users, you can use NTFS permissions to precisely define which Windows users can access your content and how those users are allowed to manipulate that content.

The NTFS permission levels are as follows:

  • Full Control: Users can do anything to the file, including taking ownership of it. It is recommended that you only grant this level of access to administrators.
  • Modify: Users can view and modify files and file properties, including deleting and adding files to a directory or file properties to a file. Users cannot take ownership or change permissions on the file.
  • Read & Execute: Users can run executable files, including scripts.
  • List Folder Contents: Users can view a list of a folder's contents.
  • Read: Users can view files and file properties.
  • Write: Users can write to a file.

important Important If you do not assign Read & Execute permissions to the IUSR_computername account for a resource, this will result in anonymous users being denied access to that resource. The default permissions assigned when you add a user or group to the Access Control List (ACL) are Read & Execute, List Folder Contents, and Read.

The following is a list of best practices when setting NTFS permissions:

  • Assign permissions to groups rather than to users. Because it is inefficient to maintain user accounts directly, assigning permissions on a user basis should be the exception.
  • If possible, avoid changing the default permission entries on file system objects, particularly on system folders and root folders. Changing default permissions can cause unexpected access problems or reduce security.
  • Never deny the Everyone group access to an object. If you deny Everyone permission to an object, it includes administrators. A better solution is to remove the Everyone group, as long as you give other users, groups, or computers permissions to that object. You may also need to assign Full Control to the Administrators group and LocalSystem.
  • Inherited Deny permissions do not prevent access to an object if the object has an explicit Allow permission entry. Explicit permissions take precedence over inherited permissions, including inherited Deny permissions.
  • Deny permissions should be used only for the following special cases:
    • To exclude a subset of a group which has Allowed permissions.
    • To exclude one special permission when you have already assigned Full Control to a user or group.
  • Be careful when configuring your Web site's NTFS permissions. Inappropriately set permissions can deny valid users access to required files and directories. For example, even though a user may have the correct user rights to view and execute a program, the user might not have permission to access a particular dynamic-link library (DLL) that is required to run that program. To guarantee users secure and uninterrupted file access, place related files in the same directory, and then assign the appropriate NTFS permissions.
Related Topics
  • For more information about permissions, see Access Control in Windows Help.
  • For more information, see Setting NTFS Permissions for Directories or Files.


Setting NTFS Permissions for Directories or Files

You can control access to your Web site's directories and files by setting NTFS access permissions. You can use NTFS permissions to define the level of access that you want to grant to specific users, and groups of users. Proper configuration of file and directory permissions is crucial for preventing unauthorized access to your resources.

important Important You must be a member of the Administrators group on the local computer to perform the following procedure (or procedures), or you must have been delegated the appropriate authority. As a security best practice, log on to your computer using an account that is not in the Administrators group, and then use the Run as command to run IIS Manager as an administrator. From the command prompt, type runas /user:administrative_accountname "mmc %systemroot%\system32\inetsrv\iis.msc".

To secure a Web site using NTFS permissions

  1. In IIS Manager, expand the local computer, right-click a Web site or file, and click Permissions.
  2. Do one of the following:
    3. To | Do this
Add a group or user that does not appear in the Group or user names list box | Click Add, and in the Name box, type the name of the user or group, and then click OK.
Change or remove permissions from an existing group or user | In the Group or user name list box, click the name of the group or user.
  3. To allow or deny a permission, in the Permissions for User or Group list box, select the Allow or Deny check box.

important Important Inherited Deny permissions do not prevent access to an object if the object has an explicit Allow permission entry. Explicit permissions take precedence over inherited permissions, including inherited Deny permissions.

With NTFS permissions, you also have the choice of assigning special permissions to groups or users. Special permissions are permissions on a more detailed level. For better management, it is recommended you assign broad-level permissions to users or groups, where it is applicable. For descriptions of permissions, see Permissions for Files or Folders in Windows Help.

To secure a Web site using NTFS special permissions

  1. In IIS Manager, expand the local computer, right-click a Web site or file, and click Permissions.
  2. Click the Advanced tab, and then do one of the following:
    3. To | Do this
Set special permissions for an additional group or user | Click Add, and in the Enter the object name to select box, type the name of the user or group, and then click OK.
View or change special permissions for an existing group or user | Click the name of the group or user and then click Edit.
Remove an existing group or user and its special permissions | Click the name of the group or user and then click Remove. If the Remove button is unavailable, clear the Allow inheritable permissions from the parent to propagate to this object and all child objects. Include these with entries exclusively defined here. check box, and then click Remove. Click OK and skip steps 3-6 below.
  3. In the Permissions box, select or clear the appropriate Allow or Deny check boxes.
  4. In the Apply onto list box, click the folders or subfolders you want these permissions to be applied to.
  5. To prevent the subfolders and files from inheriting these permissions, clear the Apply these permissions to objects and/or containers within this container only check box.
  6. Click OK three times.

important Important It is recommended that you assign permissions to the highest-level folders as possible and then apply inheritance to propagate the settings to lower-level subfolders and files. For more information on inheritance, see How Inheritance Affects File and Folder Permissions in Windows Help.

Related Topics
  • For more information about access control, see Access Control in Windows Help.


Web Site Permissions

Web permissions apply to all users accessing your Web sites. You can configure your Web server's access permissions for specific sites, directories, and files. These permissions apply to all users, regardless of their specific access rights.

This section includes the following information:

  • About Web Site Permissions: Describes how to use Web permissions to secure your Web site.
  • Securing Sites with Web Site Permissions: Provides procedural information about configuring Web site permissions, which define the level of access assigned to a user.


About Web Site Permissions

It is important to understand the distinction between Web and NTFS permissions. Unlike NTFS, Web permissions apply to all users accessing your Web sites. NTFS permissions apply only to a specific user or group of users with a valid Windows account. NTFS permissions control access to physical directories on your server, whereas Web permissions control access to virtual directories on your Web site. For example, you can use Web permissions to control whether users visiting your Web site are allowed to view a particular page, upload information, or run scripts on the site. For more information, see About Access Control.

important Important If Web permissions conflict with NTFS permissions for a directory or file, the more restrictive settings are applied.

The following is a list of the Web permission levels:

  • Read: (selected by default) Users can view file content and properties.
  • Write: Users can change file content and properties.
  • Script Source Access: Users can access the source code for files, such as the scripts in an Active Server Pages (ASP) application. This option is available only if either Read or Write permissions are assigned. Users can access source files. If Read permission is assigned, then source code can be read. If Write permission is assigned, then source code can be written to as well.

    important Important Allowing users to have read and write access to source code can compromise the security of you server.

  • Directory browsing: Users can view file lists and collections.
  • Log visits: A log entry is created for each visit to the Web site.
  • Index this resource Allows Indexing Service to index this resource.

The Execute permissions control the security level of script execution, and are as follows:

  • None: Set permissions for an application to None to prevent any programs or scripts from running.
  • Scripts only: Set permissions for an application to Scripts only to enable applications mapped to a script engine to run in this directory without having permissions set for executables. Setting permissions to Scripts only is more secure than setting them to Scripts and Executables because you can limit the applications that can be run in the directory.
  • Scripts and Executables: Set permissions for an application to Scripts and Executables to allow any application to run in this directory, including applications mapped to script engines and Windows binaries (.dll and .exe files).
Related Topics
  • For information on setting Web site permissions, see Securing Sites with Web Site Permissions.
  • For information on setting NTFS permissions, see NTFS Permissions.


Securing Sites with Web Site Permissions

Web permissions are not meant to be used in place of NTFS permissions, they are used with NTFS permissions. You can configure your Web site's access permissions for specific sites, directories, and files. Unlike NTFS permissions Web permissions affect everyone who tries to access your Web site.

note Note If Web permissions conflict with NTFS permissions for a directory or file, the more restrictive settings are applied.

To set permissions for Web content (including WebDAV)

  1. In IIS Manager, select a Web site, virtual directory, or file, and open its property sheets.
  2. On the Home Directory, Virtual Directory, or File property sheet, select or clear any of the following check boxes (if available):
    • Read (selected by default) Users can view directory or file content and properties.
    • Write Users can change directory or file content and properties.
    • Script Source Access Users can access source files. If Read is selected, then source can be read, if Write is selected, then source can be written to. Script Source Access includes the source code for scripts. This option is not available if neither Read nor Write is selected.
    • Directory browsing Users can view file lists and collections.
    • Log visits A log entry is created for each visit to the Web site.
    • Index this resource Allows Indexing Service to index this resource. This allows searches to be performed on the resource.
  3. Under Execute Permissions select the appropriate level of script execution:
    • None Don't run scripts or executables on the server.
    • Scripts only Run only scripts on the server.
    • Scripts and Executables Run both scripts and executables on the server.
  4. Click OK.
    • Disabling permissions restricts all users. For example, disabling the Read permission restricts all users from viewing a file, regardless of the NTFS permissions applied to those users' accounts. However, enabling the Read permission can allow all users to view that file, unless NTFS permissions that restrict access have also been applied.
    • If both IIS and NTFS permissions are set, the permissions that explicitly deny access take precedence over permissions that grant access.

important Important When you select Script Source Access, users may be able to view sensitive information such as a user name and password.. They may also be able to change source code that runs on your server, and seriously affect your server's security and performance.

Related Topics
  • For information on securing WebDAV, see Managing WebDAV Security.
  • For information on setting NTFS permissions, see NTFS Permissions.
phrase 1, phrase 2, phrase 3


IIS and Built-in Accounts

The following is a list of the built-in accounts that are used by IIS, as well as IIS-specific accounts and their associated user rights.

Account | Description
LocalSystem | A built-in account that has a high level of access rights. If a worker process identity runs as the LocalSystem account, then that worker process has full access to the entire system.
Network Service A built-in account that has fewer access rights on the system than the LocalSystem account, but is still able to interact throughout the network with the computer account's credentials. For IIS 6.0 it is recommended that the worker process identity defined for application pools runs as the Network Service account. The worker process identity runs as Network Service by default.

Default user rights:

  • Replace a process-level token (SeAssignPrimaryTokenPrivilege)
  • Adjust memory quotas for a process (SeIncreaseQuotaPrivilege)
  • Generate security audits (SeAuditPrivilege)
  • Bypass traverse checking (SeChangeNotifyPrivilege)
  • Access this computer from a network (SeNetworkLogonRight)
  • Log on as a batch job (SeBatchLogonRight)
  • Log on as a service (SeInteractiveLogonRight)
  • Allow log on locally (SeInteractiveLogonRight)
Local Service A built-in account that has fewer access rights on the computer than the Network Service account, and whose user rights are limited to the local computer. The Local Service account is used if the worker process does not require access outside of the server on which it is running.

Default user rights:

  • Replace a process-level token (SeAssignPrimaryTokenPrivilege)
  • Adjust memory quotas for a process (SeIncreaseQuotaPrivilege)
  • Generate security audits (SeAuditPrivilege)
  • Bypass traverse checking (SeChangeNotifyPrivilege)
  • Access this computer from a network (SeNetworkLogonRight)
  • Log on as a batch job (SeBatchLogonRight)
IIS_WPG An IIS group account that has been assigned the minimum permissions and user rights necessary to start up and run a worker process on a Web server.

Default user rights:

  • Bypass traverse checking (SeChangeNotifyPrivilege)
  • Log on as a batch job (SeBatchLogonRight)
  • Access this computer from a network (SeNetworkLogonRight)
IUSR_computername An IIS account for anonymous access to IIS. By default, when a user accesses a Web site set to Anonymous authentication, that user is mapped to the IUSR_comptername account. The user has all the same user rights on the computer as that account.

Default user rights:

  • Access this computer from a network (SeNetworkLogonRight)
  • Bypass traverse checking (SeChangeNotifyPrivilege)
  • Log on as a batch job (SeBatchLogonRight)
  • Allow log on locally (SeInteractiveLogonRight)
IWAM_computername An IIS account for starting out-of-process applications in IIS 5.0 isolation mode.

Default user rights:

  • Replace a process-level token (SeAssignPrimaryTokenPrivilege)
  • Adjust memory quotas for a process (SeIncreaseQuotaPrivilege
  • Bypass traverse checking (SeChangeNotifyPrivilege)
  • Access this computer from a network (SeNetworkLogonRight)
  • Log on as a batch job (SeBatchLogonRight)
ASPNET A built-in account for running Microsoft ASP.NET worker process in IIS 5.0 isolation mode.

Default user rights:

  • Access this computer from a network (SeNetworkLogonRight)
  • Log on as a batch job (SeBatchLogonRight)
  • Log on as a service(SeInteractiveLogonRight)
  • Deny log on locally (SeDenyInteractiveLogonRight)
  • Deny log on through Terminal Services (SeDenyRemoteInteractiveLogonRight)
Related Topics
  • For descriptions of each user right, see User Rights Assignment in Windows Help.
  • To modify user rights, see Edit Local Security Settings or Edit a Security Setting on a Group Policy Object in Windows Help.
  • For information on isolating Web applications, see Web Application Isolation.


Anonymous Access

Anonymous access, the most common Web site access control method, allows anyone to visit the public areas of your Web sites. In IIS 6.0, anonymous users are assigned to the IUSR_computername account, which is a valid Windows account that is a member of the Guests group. The IUSR_computername account can be defined on a computer or on a domain.

By default, your Web server will log on all users through the anonymous account. During installation of IIS, your server creates a special anonymous user account called IUSR_computername. For example, if your computer name is SalesDept1, then the anonymous account name is IUSR_SalesDept1. Each Web site on your server can use either the same or different anonymous user logon accounts.

To create a new "anonymous logon" user account

  1. Change the account used for anonymous authentication. For more information, see Configuring Anonymous Authentication.
  2. Assign the following NTFS permissions on the Web site directory for the anonymous account: Read & Execute, List Folder Contents, and Read. When setting permissions on a Web site, be aware that all subfolders and files inherit these permissions by default. For more information on changing NTFS permissions on a Web site directory, see Setting NTFS Permissions for Directories or Files and Access Control in Windows Help.

For security reasons, in order to run most executables (such as cmd.exe) in the system folder, you must be a member of the Administrators group, the LocalSystem, Interactive, or Service account. Because this limits remote access to administrators, an anonymous user will not be able to run these executables (such as a CGI program).

note Note In IIS 6.0, the IUSR_ COMPUTERNAME account has been denied write access to Web content by default.

Related Topics
  • For information on creating a user account, see Create a Local User Account.
  • To modify user rights, see Edit Local Security Settings or Edit a Security Setting on a Group Policy Object in Windows Help.


Configuring Worker Process Identities

In previous versions of IIS, the worker processes ran as the LocalSystem account. Because the LocalSystem account has access to almost all resources on the operating system, this had serious security implications. IIS 6.O offers better security in that the worker process runs under the new built-in Network Service account by default. IIS 6.0 also allows you to configure which account worker processes will run as. You have the option of using one of the three predefined accounts, or creating your own account.

important Important You must be a member of the Administrators group on the local computer to perform the following procedure (or procedures), or you must have been delegated the appropriate authority. As a security best practice, log on to your computer using an account that is not in the Administrators group, and then use the Run as command to run IIS Manager as an administrator. From the command prompt, type runas /user:administrative_accountname "mmc %systemroot%\system32\inetsrv\iis.msc".

To configure a worker process identity for an application pool using a predefined account

  1. In IIS Manager, expand the local computer, expand the Application Pools folder, right-click the application pool you would like to configure, and click Properties.
  2. Click the Identity tab.
  3. Click Predefined, and in the list box beside it, click Network Service, Local Service, or Local System.

    note Note Network Service, Local Service and Local System are members of the IIS_WPG group.

  4. Click OK.

To configure a worker process identity for an application pool using a configurable account

  1. In IIS Manager, expand the local computer, expand the Application Pools folder, right-click the application pool you would like to configure, and click Properties.
  2. Click the Identity tab.
  3. Click Configurable.
  4. Click Browse, and under Enter the object name to select, type the account name in which you want your worker process to run, and click OK.
  5. In the Password box, type the password associated with this account. If there is no password associated with the account, leave the Password box blank.
  6. Click OK.

important Important When you configure a worker process identity for an application pool using a configurable account, you must add the account you created to the IIS_WPG group in order for the worker process to run.

IIS_WPG

The IIS_WPG group is a user group provided by IIS 6.0. IIS_WPG group membership provides the minimum set of user rights and permissions required to run an application. It provides a convenient way to use a specific user account which would be a member of IIS_WPG for the worker process identity account without having to manually assign the user rights and permissions to that account. In the cases where the account is not in the IIS_WPG group and does not have the appropriate permissions, the worker process will fail to start.

note Note By default, the IIS_WPG group does not have the right to start CGI processes. If you create a new account and add it to the IIS_WPG group to run a worker process identity, you still must assign this new account two user rights to start CGI processes. These user rights are Adjust memory quotas for a process and Replace a process level token.

Configuring a User Account for Application Isolation

Application isolation is the separation of applications through process boundaries to prevent them from affecting one another.

For worker process isolation mode, you can configure isolation using application pools. You can either place single applications into their own application pool or group multiple applications into a single application pool.

To configure applications to run independently of each other

  1. Create a new account and configure a worker process identity for an application pool.
  2. Add the account to the IIS_WPG group. The IIS_WPG group has Read & Execute, List Folder Contents, and Read permissions on every Web site directory by default. In a case where the account is not in the IIS_WPG group and does not have the appropriate permissions, the worker process will fail to start.
Related Topics
  • For information on adding user accounts to groups, see Add a Member to a Local Group in Windows Help.
  • For information on application pools, see Configuring Application Pools.
  • For information on configuring NTFS permissions, see Securing Files with NTFS.


Securing Sites with IP Address Restrictions

You can configure your Web site to grant or deny specific computers, groups of computers, or domains access to Web sites, directories, or files. For example, if your intranet server is connected to the Internet, you can prevent Internet users from accessing your Web server by granting access only to members of your intranet, and explicitly denying access to outside users.

IP address restrictions apply only to IPv4 addresses.

important Important You must be a member of the Administrators group on the local computer to perform the following procedure (or procedures), or you must have been delegated the appropriate authority. As a security best practice, log on to your computer using an account that is not in the Administrators group, and then use the Run as command to run IIS Manager as an administrator. From the command prompt, type runas /user:administrative_accountname "mmc %systemroot%\system32\inetsrv\iis.msc".

To grant or deny access to a computer

  1. In IIS Manager, expand the local computer, right-click a Web site, directory, or file, and click Properties.
  2. Click the Directory Security or File Security tab. In the IP address and domain name restrictions section, click Edit.
  3. Click Granted access or Denied access. When you select Denied access, you deny access to all computers and domains, except to those that you specifically grant access. When you select Granted access, you grant access to all computers and domains, except to those that you specifically deny access.
  4. Click Add.
  5. Click Single computer.
  6. Click DNS Lookup to search for computers or domains by name, rather than by IP address.
  7. Type the DNS name for the computer. IIS searches on the current domain for the computer, and if found, enters its IP address in the IP address box.

    The following information is important to remember when using the DNS Lookup feature:

    • It causes a performance decrease on your server while it is looking up DNS addresses.
    • A user accessing your Web server through a proxy server will appear to have the IP address of the proxy server.
    • Some user server access problems can be corrected by entering the "*.domainname.com" syntax rather than the "domainname.com" syntax.
  8. Click OK three times.

To grant or deny access to a domain

  1. In IIS Manager, expand the local computer, right-click a Web site, directory, or file, and click Properties.
  2. Click the Directory Security or File Security tab. In the IP address and domain name restrictions section, click Edit.
  3. Click Granted access or Denied access. When you select Denied access, you deny access to all computers and domains, except to those that you specifically grant access. When you select Granted access, you grant access to all computers and domains, except to those that you specifically deny access.
  4. Click Add.
  5. Click Domain name.
  6. In the Domain name box, type the domain name.
  7. Click OK three times.

Using the Network ID and Subnet Mask

A group of computers can be either denied or granted access based upon their network ID and a subnet mask. The network ID is the IP address of a host computer, usually a router for the subnet. The subnet mask determines which part of the IP address is a subnet ID, and which part is a host ID. All computers in a subnet have the same subnet ID, but have their own unique host ID. By specifying a network ID and a subnet mask, you can select a group of computers.

For example, if the host computer has an IP address of 172.16.16.1 and a subnet mask of 255.255.0.0, all of the computers in that subnet would have IP addresses that began with 172.16. To select all of the computers in the subnet, enter 172.16.16.1 in the Network ID box and 255.255.0.0 in the Subnet Mask box.

To grant or deny access to a group of computers
  1. In IIS Manager, expand the local computer, right-click a Web site, directory, or file, and click Properties.
  2. Click the Directory Security or File Security tab. In the IP address and domain name restrictions section, click Edit.
  3. Click Granted access or Denied access. When you select Denied access, you deny access to all computers and domains, except to those that you specifically grant access. When you select Granted access, you grant access to all computers and domains, except to those that you specifically deny access.
  4. Click Add.
  5. Click Group of computers.
  6. In the Network ID box, type the IP address of the host computer.
  7. In the Subnet mask box, type the subnet ID for the computer you want grant or deny access to.
  8. Click OK three times.


Securing Virtual Directories

IIS administrators can secure virtual directories using local user authentication. A feature of IIS 6.0 and the Windows Server 2003 family, delegation of authentication allows virtual directories mapped to remote Universal Naming Convention (UNC) shares to use local user authentication for access to the shares.

Securing Virtual Directories Mapped to Local Directories

IIS supports controlling access to directories and files on a local computer using all Windows authentication methods. The procedures below describe securing both new and existing virtual directories mapped to directories and files on the local computer.

important Important You must be a member of the Administrators group on the local computer to perform the following procedure (or procedures), or you must have been delegated the appropriate authority. As a security best practice, log on to your computer using an account that is not in the Administrators group, and then use the Run as command to run IIS Manager as an administrator. From the command prompt, type runas /user:administrative_accountname "mmc %systemroot%\system32\inetsrv\iis.msc".

To create a secure virtual directory mapped to resources on the local computer

  1. In IIS Manager, expand the local computer, expand the Web Sites folder, right-click the Web Site or folder within which you wish to create the virtual directory, point to New, then click Virtual Directory.
  2. Click Next.
  3. In the Alias box, type the alias for the new virtual directory, and click Next.
  4. In the Path box, type the path to the local directory, and click Next.
  5. Select the appropriate check boxes for the access permissions you want to allow, and clear the check boxes for the permissions you want to deny.
  6. Click Next to complete the wizard.

To change security on an existing virtual directory mapped to resources on the local computer

  1. In IIS Manager, right-click the virtual directory you want to secure, and click Properties.
  2. On the Virtual Directory tab, under Local Path, select the check boxes for the access permissions you want to allow, and clear the check boxes for the permissions you want to deny.
  3. Click OK.

Securing Virtual Directories Mapped to UNC Shares

In IIS 6.0, you can use delegation of authentication to pass the authenticated credentials of the request user to a remote file server on which a UNC share is located. This is preferable to the alternative of using a static user name and password because you can limit access to specific portions of the UNC share for each user or group.

If you use a static user name and password to secure the virtual directory, each user will have access to every directory and file on the share. This means that files belonging to one user on a UNC share could be accessed by another user. By impersonating the credentials of the authenticated user to the computer hosting the share, the remote computer uses the credentials to limit access to only those resources to which the user has access permissions.

IIS can be configured to secure a virtual directory as you create it or to configure an existing directory.

To create a secure virtual directory with a UNC path

  1. In IIS Manager, expand the local computer, expand the Web Sites folder, right-click a Web site, Web application, directory, or virtual directory, point to New, and then click Virtual Directory.
  2. Click Next.
  3. In the Alias box, type the alias for the new virtual directory, and click Next.
  4. In the Path box, type the path to the directory on the UNC share, and click Next.
  5. The Virtual Directory Creation Wizard recognizes the path format as UNC and the User Name and Password dialog box appears.
  6. To impersonate the requested user credentials to the remote computer, select the Always use the authenticated user's credentials when validating access to the network resource check box and leave the User name and Password boxes blank. Click Next and proceed to step 8.
  7. To secure the virtual directory and share with a static user name and password, complete the User name and Password boxes, and clear the Always use the authenticated user's credentials when validating access to the network resource check box, and click Next.
  8. Select the appropriate check boxes for the access permissions you want to allow, and clear the check boxes for the permissions you want to deny.
  9. Click Next to complete the wizard.

To secure an existing virtual directory with a UNC path

  1. In IIS Manager, right-click the virtual directory you want to secure, and click Properties.
  2. Click Connect As....
  3. To use delegation to pass the local user's credentials to the remote computer, select the Always use the authenticated user's credentials when validating access to the network resource check box and leave the Username and Password boxes blank. Proceed to step 5.
  4. To secure the virtual directory and share with a static user name and password, complete the User name and Password boxes, and clear the Always use the authenticated user's credentials when validating access to the network resource check box.
  5. Click OK.
Related Topics
  • For information on delegation, see Delegation of Authentication.


URL Authorization

Internet Information Services (IIS) 6.0 works with Authorization Manager, a management tool that is available with the Microsoft® Windows® Server 2003 family of operating systems, to implement IIS URL authorization.

Overview

Authorizing user access to Web application resources requires the management of many Access Control Lists (ACLs). In turn, maintaining ACLs requires administrators to track precisely which permissions are needed on each resource for each user or group to perform meaningful tasks. IIS URL authorization allows Windows administrators to simplify access management by authorizing user access to the URLs that comprise a Web application.

When a user requests access to a URL, IIS URL authorization validates the user's access based on that user's roles, which can be defined in Lightweight Directory Access Protocol (LDAP) queries, custom user roles, and Authorization Manager scripts (BizRules). This allows administrators to simplify access control management by controlling all user access to URLs instead of controlling access per ACL on each resource.

IIS URL authorization is implemented as an Internet Server API (ISAPI) interceptor (in the diagram below, URL Authz ISAPI). When an application, virtual directory, or URL is configured to use IIS URL authorization, each request to a URL will be routed to the URL authorization ISAPI interceptor. The URL authorization ISAPI interceptor will use Authorization Manager (in the diagram, .NET Authz Framework) to authorize access to the requested URL. The URL must be associated with an Authorization Manager policy store that contains the authorization policy for the URL. Once the client has been authorized to access the URL, the URL authorization ISAPI's Execute URL feature (in the diagram, ExecURL) will pass the request to the appropriate handler for the URL, such as ASP.dll, another ISAPI, or the Static File Handler.

IIS URL Authorization

By using IIS 6.0 URL authorization, an administrator can control access based on information that is only available at runtime. For example, if you have a Web page that should only be available to employees in a given cost center or to employees of a certain age, you can assign roles to the correct users based on LDAP queries that will check the cost center or age attributes on a user's object. If employees can only access certain pages on certain days of the week or during a certain time of day, a BizRule can be created which grants access to the URL based on these values or any value that can be asserted at runtime, including IIS Server Variables.

Using URL Authorization

To use URL authorization in IIS 6.0 you must enable the ISAPI interceptor, Urlauth.dll. In addition, you must set the following metabase properties on the application, virtual directory, or URL (Web site):

  1. AzEnable: Enables URL authorization for the virtual directory, application, or URL that corresponds to the entry in the metabase.
  2. AzStoreName: Associates an Authorization Manager store with the virtual directory, application, or URL.
  3. AzScopeName: Associates the virtual directory, application, or URL with a scope. This scope will be the name of a scope in the IIS 6.0 URL authorization application in the Authorization Manager policy store referred to in the AzStoreName attribute. If no scope or an empty string is specified, the default scope of the IIS 6.0 URL authorization will be used.
  4. AzImpersonationLevel: Determines the impersonation behavior for the application. This allows you to configure the Web application to impersonate the client user, the IIS worker process, or the IUSER_computername account for the worker process. Each setting significantly changes the environment and implied design of the Web application.

Sample Script

The sample script below, written in Microsoft Visual Basic® Scripting Edition (VBScript), marks the root of the first site as a URL in "MyAZScope", which is defined in the MyAZStore.xml file. Users with URLAccess rights in this scope will be able to access the site.

var objVDir = GetObject("IIS://localhost/w3svc/1/root");
objVDir.AzEnable = true;
objVDir.AZStoreName = "MSXML://d:\MyAZStore.xml";
objVDir.AzScopeName = "MyAZScope";
objVDir.AZImpersonationLevel = 0;
objVDir.SetInfo();

While URL authorization controls access to other forms of authorization, such as ACLs or IIS directory security permissions settings, the application context still requires the correct IIS directory security and ACL permissions. IIS URL authorization allows the IIS directory security and ACL permissions to be more easily maintained.

When IIS 6.0 URL authorization is configured, the AzStoreName attribute in the IIS metabase entry for the application, virtual directory, or URL will identify an Authorization Manager policy store. To manage the authorization policy, run Authorization Manager and use the Open Policy Store. IIS 6.0 URL authorization is an application in this store. The AzScopeName attribute in the metabase entry will be an authorization manager scope in the IIS 6.0 URL authorization application. Use this scope to manage access to the corresponding URL. When configuring an application, virtual directory, or URL for URL authorization, a scope must be created in the authorization policy store with the same name as that specified in the corresponding metabase entries AzScopeName attribute.

Enabling the ISAPI Interceptor

To use the URL authorization ISAPI interceptor (Urlauth.dll), you must first enable it for each Web site that requires URL authorization.

important Important You must be a member of the Administrators group on the local computer to perform the following procedure (or procedures), or you must have been delegated the appropriate authority. As a security best practice, log on to your computer using an account that is not in the Administrators group, and then use the Run as command to run IIS Manager as an administrator. From the command prompt, type runas /user:administrative_accountname "mmc %systemroot%\system32\inetsrv\iis.msc".

To enable the URL authorization ISAPI interceptor

  1. In IIS Manager, expand the local computer, expand the Web Sites folder, right-click the Web site that you want, and then click Properties.
  2. Click the Home Directory tab, and then in the Application settings section, click Configuration.
  3. Click the Mappings tab, and then in the Wildcard application maps section, click Insert.
  4. In the Add/Edit Application Extension Mapping box, click Browse and browse to the Windows\system32\inetsrv directory.
  5. Click urlauth.dll, click Open, and then click OK.
Related Topics
  • For more information on Authorization Manager, see Authorization Manager in Windows Help.


TCP/IP Port Filtering

Filtering TCP/IP ports allows you to control the types of traffic that reach your servers and network devices. Although firewall software deployed at your Internet access point is typically used to restrict traffic that originates outside your private network, network firewalls might not protect servers from "backdoor" attacks or internal attacks originated by malicious users within your private network.

TCP/IP port filtering is the practice of selectively enabling or disabling Transmission Control Protocol (TCP) ports and User Datagram Protocol (UDP) ports on computers or network devices. Used in conjunction with other security practices, applying port filters to intranet and Internet servers insulates those servers from many TCP/IP-based security attacks, including internal attacks by malicious users.

To guard against such attacks, you can configure port filters on your individual servers. This provides an additional layer of protection against many TCP/IP-based security attacks.

TCP and UDP Ports

An Internet or intranet host (for example, a computer or network device on a TCP/IP-based network) uses a combination of an Internet Protocol (IP) address and port number to communicate with an application or service running on another Internet or intranet host. Together, an IP address and port number make up a socket. Because TCP/IP hosts are assigned a unique IP address and standard TCP/IP-based applications and services typically use a specific TCP or UDP port number, sockets can direct communications between specific applications or services running on specific hosts.

A port number, identified in a TCP or UDP packet header, represents the transport protocol address of a specific application and service that uses TCP or UDP. For example, HTTP services use TCP port 80 by default, Telnet uses TCP port 23 by default, and Simple Network Management Protocol (SNMP) uses UDP port 161 by default.

The Internet Assigned Numbers Authority (IANA) categorizes TCP and UDP ports into three categories, as shown in the following table.
Port Category | Port Number Range | Description
Well-known ports | 0 - 1023 | Typically used by standard system processes or programs executed by users with administrator credentials. Assigned by IANA.
Registered ports | 1024 - 49151 | Used by ordinary user processes or programs executed by ordinary users. IANA does not assign these ports, but registers use of them as a convenience for the TCP/IP community.
Dynamic or private ports | 49152 - 65535 | Unassigned and unregistered ports for private applications, client-side processes, or other processes that dynamically allocate port numbers.

Typically, the server side of a TCP or UDP process listens to the associated well-known port number. The client side of the process uses either the well-known port number or, more commonly, a dynamically allocated port number that is assigned only for the duration of the process.

note Note Windows Sockets applications can use the GetServByName( ) function to refer to a port number by name. The name is resolved to the port number through the values designated in the services text file in the systemroot\System32\Drivers\Etc folder.

To enable communications with applications and services used by your servers, you must ensure that the associated ports are enabled. However, because malicious users on your internal network can attempt to exploit enabled ports to attack your servers, you should disable the TCP and UDP ports on your servers that are not used. This reduces the avenues of attack to your servers and improves the security of hosts connecting to your servers.

important Important Server-based port filtering is not the only method you should use to secure your servers and network from TCP/IP-based security attacks. To provide a more complete network security solution, you should also deploy network firewall software, at your Internet access point. Network firewalls allow you to establish specific rules to control what types of hosts, networks, applications, and services can communicate with your servers and other network resources. Used in combination with other security tools and practices, server-based port filtering and network firewalls provide an important first line of defense against network security attacks. For more information about network firewalls, search for "firewall" on the Microsoft Internet Security and Acceleration Server Web site.

This section includes the following information:

  • Port Assignments for Internet Services: Lists and explains the use of TCP ports that are commonly used by IIS.
  • Port Filtering Tools: Describes software tools that are used to filter TCP ports and data packets on servers.


Port Assignments for Internet Services

There are 65,535 port numbers available for application processes that use Transmission Control Protocol (TCP). The same number of ports are available for application processes that use User Datagram Protocol (UDP).

The following table lists some of the default TCP port numbers for processes that are commonly used with Internet services.

Default TCP Port Number | Internet Service
20 | File Transfer Protocol (FTP) Data Channel
21 | File Transfer Protocol (FTP) Control Channel
23 | Telnet (enabled on some intranet or Internet servers)
25 | Simple Mail Transfer Protocol (SMTP)
80 | Hypertext Transfer Protocol (HTTP) used for World Wide Web
119 | Network News Transfer Protocol (NNTP)
443 | Hypertext Transfer Protocol over TLS/SSL (HTTPS) for secure World Wide Web
563 | Network News Transfer Protocol over TLS/SSL (NNTPS)

note Note Windows Media Services (WMS) can provide streaming media services over unicast or multicast IP, through a variety of static or dynamic UDP and TCP ports, or through a single port, depending on the configuration. You can also configure WMS to provide HTTP streaming media services through the default HTTP port, which is TCP port 80. For more information, search for "Windows Media Services" in Windows Help.

The following table lists the well-known UDP port numbers for processes commonly used with Internet services.

UPD Port Number | Service
53 | Domain Name System (DNS) name queries (supports some Internet services)
161 | Simple Network Management Protocol (SNMP)

important Important Your servers might need to support additional processes, including processes that support remote administration tools or application processes that are unique to your environment. Before configuring port filters, take a careful inventory of the processes used on each server.

For a list of TCP and UDP port numbers used by the Windows Server 2003 family, see the services.txt file in the systemroot\System32\Drivers\Etc folder.

Related Topics
  • For a comprehensive list of TCP and UDP port numbers, see the Internet Assigned Numbers Authority Web site.


Port Filtering Tools

The Windows Server 2003 family includes several tools to filter ports and packets on individual servers. You can also use Microsoft Internet Security and Acceleration Server (available separately) to filter network traffic at your Internet exit point.

Balancing Security and Service

To use TCP-UDP port filtering tools effectively, configure the filtering tool to accept requests through each port that your server applications require, and to refuse requests from all other TCP or UDP ports. Making a careful determination of your applications' TCP-UDP port requirements and setting your filtering tools accordingly will allow you to avoid mistakes that would deny access to the services you are trying to provide. Filtering out all traffic to other TCP and UDP ports will eliminate unnecessary exposure to attack. See Port Assignments for Internet Services for a representative sample of Web applications that require TCP or UDP ports for communication.

Port Filtering Tools

The following table lists the tools you can use to filter traffic on your servers or network.

Filtering Tool | Description | Reference
Internet Protocol security (IPSec) filtering policies | Supports policy-based stateful packet filtering rules that can be used with IPSec authentication and encryption to provide robust end-to-end security. Recommended if your organization has deployed IPSec. | For more information, search for "Internet Protocol security" in Windows Help.
Internet Connection Firewall (ICF) | Enables stateful filters based on configurable service definitions. Supports logging and notification services. Recommended if your organization has not deployed IPSec. | For more information, search for "Internet Connection Firewall" in Windows Help.
Internet Authentication Service (IAS) | Provides network access control services, including traffic filters, for wireless networks, remote access, virtual private networks, Internet resources, and extranets. | For more information, search for "Internet Authentication Service" in Windows Help.
TCP/IP Filtering | Limited to stateless packet and protocol filtering. Not recommended. IPSec and ICF provide more useful and robust stateful filters. | For more information, search for "Configure TCP/IP" in Windows Help.
Microsoft Internet Security and Acceleration Server | Available as a separate product (not included with Windows Server 2003 family). Includes advanced network firewall software that enables you to configure sophisticated traffic and application filtering rules for computers and network devices. | For more information, see the Microsoft Internet Security and Acceleration Server Web site.


Encryption

You can use your Web server's Secure Sockets Layer (SSL) encryption features to cryptographically encode information transmitted and received by your Web server. When you enable SSL encryption, you can prevent unauthorized individuals from decoding the original content of your transmissions.

This section includes the following information:

  • About Encryption: Provides a conceptual overview of SSL secure communications, including how encryption can protect information that is transmitted over unsecured networks , such as the Internet.
  • Enabling Encryption: Outlines how to enable your Web server's SSL encryption features.
  • Setting Encryption Strength: Describes how to require users to establish 128-bit session-key secure communications with your Web server.


About Encryption

Sensitive information transmitted across an unsecured network, such as the Internet, can be intercepted. For this reason, if you plan to provide users with access to Web sites that process sensitive financial or personal information, you need to encrypt your data to keep it private.

This topic includes the following information:

  • How Encryption Works
  • Public Key Encryption
  • Session Key Encryption Strength
  • Server-Gated Cryptography
  • Selectable Cryptographic Service Provider

How Encryption Works

Encryption is the process of scrambling information by applying a mathematical function in such a way that it is extremely difficult for anyone other than an intended recipient to retrieve the original information. Central to this process is a mathematical value, called a key, which is used by the function to scramble the information in a unique and complex way.

Your Web server uses essentially the same encryption process to secure communication links with users. After establishing a secure link, a special session key is used by both your Web server and the user's Web browser to both encrypt and decrypt information. For example, when an authenticated user attempts to download a file from a Web site requiring a secure channel, your Web server uses a session key to encrypt the file and related HTTP headers. After receiving the encrypted file, the Web browser then uses a copy of the same session key to recover the file.

This method of encryption, although secure, has an inherent drawback: During the process of creating a secure link, a copy of the session key might be transmitted across an unsecured network. This means that a computer vandal intent on compromising the link need only intercept and steal the session key. To safeguard against this possibility, however, your Web server implements an additional method of encryption.

Public Key Encryption

Your Web server's Secure Sockets Layer (SSL) security feature utilizes a technique known as public key encryption to shield the session key from interception during transmission. Public key encryption, which involves the use of two additional keys, a private and a public key, works in the following manner:

  1. The user's Web browser establishes a secure (https://) communication link with your Web server.
  2. The user's Web browser and your server engage in negotiation to determine the degree of encryption to use for securing communications.
  3. Your Web server sends the browser its public key.
  4. The Web browser encrypts information used in generating a session key with the server's public key and sends it to the server.
  5. Using the private key, your server decrypts the message, generates a session key, encrypts it with the public key, and sends it to the browser.
  6. Your Web server and the browser both use the session key to encrypt and decrypt transmitted data.
Diagram of encryption and decryption

Notice that the private key serves an important role in ensuring that your communication link remains secure. You should take every reasonable precaution to protect the private key from loss or theft. If you suspect that your private key has been compromised, notify your certification authority, use the Web Server Certificate Wizard to create a new certificate request, and then obtain a new server certificate. For more information, see Using Certificate Wizards.

Session Key Encryption Strength

A session key's strength is proportional to the number of binary bits comprising the session key file. This means that session keys with a greater number of bits have a greater degree of security, and are considerably more difficult to forcibly decode.

When a user attempts to establish a secure communication channel with your Web server, the user's browser must negotiate the strongest possible level of encryption, or session key strength, that can be used to secure communications over that channel. This means that both your Web server and the user's browser must be equipped with compatible session key encryption and decryption capabilities. For example, when you configure your Web server to require a session key with a minimum 40-bit (default) encryption strength, a user attempting to secure a connection must have a Web browser capable of processing information with a 40-bit session key.

Server-Gated Cryptography

Server-Gated Cryptography (SGC) offers financial institutions the solution for worldwide secure financial transactions using 128-bit encryption. SGC is an extension of Secure Sockets Layer (SSL) that allows financial institutions with export versions of IIS to use strong encryption.

SGC does not require an application to run on the client's browser and can be utilized by standard export versions of IIS, version 4.0 or later. A server configured for SGC can facilitate both 128-bit and 40-bit encryption. Although SGC capabilities are built into IIS 4.0 and later versions, a special SGC certificate is required to use SGC. Contact your certification authority for availability information. For more information about SGC, see the article titled Secured online banking goes global! at the Server-Gated Cryptography (SGC) Web site.

Selectable Cryptographic Service Provider

Selectable Cryptographic Service Provider (CSP) allows you to select a Microsoft or third party cryptographic provider to handle cryptography and certificate management. Each cryptographic provider can create a public and private key to encrypt and decrypt data. The private key is stored at the server in the file system, on a PCI card, on a SmartCard, or in the registry, as it is for the two default providers that Microsoft installs: Microsoft DH SChannel Cryptographic Provider and Microsoft RSA SChannel Cryptographic Provider. The Microsoft Cryptographic API (CryptoAPI) for every provider contains identical methods and properties. This allows you to switch between providers without having to rewrite code. For more information on CSP and managing installed third-party cryptographic providers, search MSDN Online, using keywords such as "selectable", "cryptographic", and "provider".

Related Topics

  • For more information on encryption, see Geek Speak Decoded #9: Cryptography and Encryption.


Enabling Encryption

You can require users to establish an encrypted channel (https:// rather than http://) with your server before accessing a restricted Web site, directory, or file. The use of an encrypted channel, however, requires that the user's Web browser and your Web server both support the encryption scheme used to secure the channel. Specifically, when you enable your Web server's default secure communication settings, you require the user's Web browser to support a session key strength of 40 bits, or greater.

  • When you set security properties for a specific Web site, you automatically set the same security properties for directories and files belonging to that site, unless the security properties of the individual directories and files have been previously set.
  • Your Web server will prompt you for permission to reset the properties of individual directories and files when you attempt to set security properties for your Web site. If you choose to reset these properties, your previous security settings will be replaced by the new settings. The same condition applies when you set security properties for a directory containing subdirectories or files with previously set security properties.

To maintain the performance level of your Web server, consider using SSL encryption only for sensitive information, such as financial transactions. Encrypted transmissions can significantly reduce transmission rates and server performance.

Before enabling encryption you must install a valid server certificate. See Using Certificate Wizards and Obtaining and Installing Server Certificates for more information.

To require encryption in IIS 6.0, follow the procedure for enabling Secure Sockets Layer (SSL) in Configuring SSL on Servers.


Setting Encryption Strength

You can configure your Web server to require a 128-bit minimum session-key strength, the default for members of the Microsoft Windows Server 2003 family, for all Secure Socket Layer (SSL) secure communication sessions. If you set a minimum 128-bit key strength, however, users attempting to establish a secure communications channel with your server must use a browser capable of communicating with a 128-bit session key. The session key is not the same as an SSL key pair, which is used to negotiate and establish a secure communication link. For information about upgrading browsers to 128-bit encryption capability, visit the Windows Support Web site.

To establish encrypted communications, you must have a valid server certificate installed. See Using Certificate Wizards and Obtaining and Installing Server Certificates for more information.

important Important You must be a member of the Administrators group on the local computer to perform the following procedure (or procedures), or you must have been delegated the appropriate authority. As a security best practice, log on to your computer using an account that is not in the Administrators group, and then use the Run as command to run IIS Manager as an administrator. From the command prompt, type runas /user:administrative_accountname "mmc %systemroot%\system32\inetsrv\iis.msc".

To set encryption strength

  1. In IIS Manager, expand the local computer, and then right-click the Web site, directory, or file that you want and click Properties.
  2. On the Directory Security or File Security tab, under Secure Communications, click Edit.
  3. In the Secure Communications box, select the Require secure channel (SSL) check box.
  4. If 128-bit encryption is required, select the Require 128-bit Encryption check box.
  5. Click OK.
Related Topics
  • For more information on server certificates, see About Certificates.
  • For more information on SSL encryption, see Secure Sockets Layer.


Certificates

Certificates are a form of digital identification for your server, and for clients that are requesting information from your server. Their function is similar to that of a passport, or other official identity card, which identifies the person carrying it. Certificates are part of the Secure Sockets Layer (SSL) features of Internet Information Services (IIS) that establish an encrypted connection over which sensitive information can be sent.

This section includes the following information:

  • About Certificates: Provides a conceptual overview of certificates.
  • Obtaining and Installing Server Certificates: Describes how to obtain a server certificate needed to use SSL.
  • Using Certificate Trust Lists: Explains how to add new certification authorities to your server's list of trusted issuing authorities.
  • Using Certificate Wizards: Provides a conceptual overview of the features accessible in the Certificate and CTL wizards.
  • Managing Server Certificates Programmatically: Describes using the certificate component to import, copy, save, and back up server certificates.
  • Obtaining Client Certificates: Describes how to obtain user digital identifications, called client certificates.
  • Enabling Client Certificates: Outlines a procedure for enabling SSL authentication of client certificates.
  • Using Certificate Revocation Lists: Explains how to verify the validity of your users' client certificates.
  • Client Certificate Mapping: Describes how to use client certificates to connect users directly to Windows user accounts.
Related Topics
  • For information on regulating how users access your Web server files and directories, see Access Control.
  • For information on setting up or changing encryption, see Encryption.


About Certificates

Certificates contain information that is used in establishing identities over a network—a process called Authentication. Similar to conventional forms of identification, certificates enable Web servers and users to authenticate each other before establishing a connection. Certificates also contain encryption values, or keys, that are used in establishing a Secure Sockets Layer (SSL) connection between the client and server. Information, such as a credit card number, that is sent over this connection is encrypted so it cannot be intercepted and used by unauthorized parties.

There are two types of certificates that are used in SSL, each with its own format and purpose: server certificates and client certificates. Server certificates contain information about the server that allows the client to positively identify the server before sharing sensitive information. Client certificates contain personal information about the clients that are requesting access to your site, enabling you to positively identify them before allowing them access to the site.

This topic includes the following information:

  • Certification Authorities
  • Server Certificates
  • Server-gated Cryptography
  • Selectable Cryptographic Service Provider
  • Client Certificates
  • Certificate Trust Lists
  • Detection of Revoked Client Certificates

Certification Authorities

You can obtain a certificate from a mutually trusted, third-party commercial organization called a certification authority (CA). The primary responsibility of the CA is to confirm the identity of the party that is seeking a certificate, thus ensuring the validity of the identification information that is contained in the certificate.

Before issuing a certificate, the CA requires you to provide identification information, such as name, address, and organization. The extent of this information can vary with the identification assurance requirements of the certificate. If you need a certificate to provide absolute assurance about your identity, then the CA will require substantial information from you; gathering this information may require a personal interview with the CA as well as the endorsement of a notary.

For a list of certification authorities, see Obtaining and Installing Server Certificates.

note Note Ultimately, the success of certification authentication depends on whether the party receiving a certificate trusts the authority who issued the certificate, and that the authority properly verified the certificate owner's identity. But beyond this trust, certificates do not provide conclusive proof of the identity, trustworthiness, or intentions of the user or server.

Server Certificates

To activate your Web server's SSL security features, you must obtain and install a valid server certificate. Server certificates are digital identifications containing information about your Web server and the organization that is sponsoring the server's Web content. A server certificate enables users to authenticate your server, check the validity of the Web content, and establish a secure connection. The server certificate also contains a public key, which is used in creating a secure connection between the client and server.

The success of a server certificate as a means of identification depends on whether the user trusts the validity of the information that is contained in the certificate. For example, a user logging on to your company's Web site might be hesitant to provide credit card information, despite having viewed the contents of your company's server certificate. This may be especially true if your company is new and not well known. If this is the case, consider obtaining a server certificate from a certification authority.

Alternatively, depending on your organization's relationship with its Web site users, you can issue your own server certificates. For example, in the case of a large corporate intranet handling employee payroll and benefits information, corporate management may decide to run a certificate service assuming responsibility for validating identification information and issuing server certificates. For more information see Obtaining and Installing Server Certificates.

Server-Gated Cryptography

Server-Gated Cryptography (SGC) offers financial institutions the solution for worldwide secure financial transactions using 128-bit encryption. SGC is an extension of Secure Sockets Layer (SSL) that allows financial institutions with export versions of IIS to use strong encryption.

SGC does not require an application to run on the client's browser and can be utilized by standard export versions of IIS 4.0 or later. A server configured for SGC can facilitate both 128-bit and 40-bit encryption sessions so multiple versions of IIS are not required. Although SGC capabilities are built into IIS 4.0 and later versions, a special SGC certificate is required to use SGC. Contact your certification authority for availability information. For more information about SGC, see the article titled Secured online banking goes global! at the Server-Gated Cryptography (SGC) Web site.

note Note If you open your SGC certificate, you might receive the following notice on the General tab: "The certificate has failed to verify for all of its intended purposes." This notice is issued because of the way SGC certificates interact with Windows 2000, and does not necessarily indicate that the certificate does not work properly.

Selectable Cryptographic Service Provider

Selectable Cryptographic Service Provider (CSP) allows you to select a Microsoft or third-party cryptographic provider to handle cryptography and certificate management. Each cryptographic provider can create a public and private key to encrypt data sent to and from the Web server. The private key is stored at the server end on hardware, a PCI card, a SmartCard, or in the registry as it is for the two default providers that Microsoft installs: Microsoft DH SChannel Cryptographic Provider and Microsoft RSA SChannel Cryptographic Provider. The Microsoft Cryptographic API (CryptoAPI) for every provider contains identical methods and properties. This allows you to switch between providers without having to rewrite code. For more information on CSP and managing installed third-party cryptographic providers, see the Microsoft CryptoAPI Overview on the MSDN Web Workshop. For the latest list of cryptographic service providers supporting IIS, select Endorsements on that page.

Client Certificates

Client certificates are electronic documents that contain information about clients. These certificates, like server certificates, contain not only this information but also public encryption keys that form part of the SSL security feature of IIS. The public keys, or encryption codes, from the server and the client certificates facilitate encryption and decryption of transmitted data over an open network, such as the Internet. For more information on encryption, see About Encryption.

The typical client certificate contains several items of information: the identity of the user, the identity of the certification authority, a public key that is used for establishing secure communications, and validation information, such as an expiration date and serial number. Certification authorities offer different types of client certificates, which contain differing amounts of information, depending on the level of authentication that is required. For more information, see Obtaining Client Certificates.

Certificate Trust Lists

By maintaining a certificate trust list (CTL), Web site administrators can automatically verify client certificates against a predefined list of trusted certification authorities.

For example, an intranet administrator might create a different list of trusted certification authorities for each department on the network. IIS would only accept client certificates supplied by certification authorities in the CTL for that department. For more information, see Using Certificate Trust Lists.

Detection of Revoked Client Certificates

Most reputable certification authorities maintain a certificate revocation list (CRL), which is a list of current client certificates that were revoked before their scheduled expiration dates.

For example, if a certification authority (CA) issues a client certificate to a user and then later determines that the user submitted false information, the authority can revoke that user's client certificate. However, because the CA cannot physically revoke a client certificate, the authority alerts Web administrators by adding information about the revoked client certificate to a CRL. By default, IIS checks for a CRL, and if it finds one, uses it.

For more information about revocation service providers, contact your CA. For more information on CRLs, see Using Certificate Revocation Lists


Obtaining and Installing Server Certificates

You can obtain server certificates from an outside certification authority (CA), or you can issue your own server certificates using Microsoft Certificate Services. Once you have obtained a server certificate, you can install it. When you use the Server Certificate Wizard to obtain and install a server certificate, the process is referred to as creating and assigning a server certificate.

The topics below explain the issues in deciding whether to obtain your server certificates from an outside CA, or to issue your own server certificates. Procedures describe obtaining, installing, and backing up server certificates. To learn more about certificates, see About Certificates.

This topic includes the following information:

  • Obtaining Server Certificates from a certification authority
  • Issuing Your Own Server Certificates
  • Installing Server Certificates
  • Backing Up Server Certificates

Obtaining Server Certificates from a certification authority

If you are replacing your current server certificate, IIS will continue to use the old certificate until the new request has been completed.

When you are choosing a certification authority (CA), consider the following questions:

  • Will the CA be able to issue a certificate that is compatible with all of the browsers used to access my server?
  • Is the CA a recognized and trusted organization?
  • How will the CA provide verification of my identity?
  • Does the CA have a system for receiving online certificate requests, such as requests generated by the IIS Web Server Certificate Wizard?
  • How much will the certificate cost initially, and how much will renewal or other services cost?
  • Is the CA familiar with my organization or my company's business interests?

To obtain a server certificate from a certification authority

  1. Use the Web Server Certificate Wizard to create a certificate request.
  2. In the Web Server Certificate Wizard, on the Delayed or Immediate Request page, click Prepare the request now, but send it later.
  3. Use the Web Server Certificate Wizard to send the request to the certification authority. The CA will process the request and then send you the certificate.
  4. Finish using the Web Server Certificate Wizard.

note Note Some certification authorities require you to prove your identify before they will process your request or issue a certificate.

Issuing Your Own Server Certificates

When deciding whether to issue your own server certificates, consider the following:

  • Microsoft Certificate Services accommodates different certificate formats and provides for auditing and logging of certificate-related activity.
  • Compare the cost of issuing your own certificates against the cost of buying a certificate from a certification authority.
  • Remember that your organization will require an initial adjustment period to learn, implement, and integrate Certificate Services with existing security systems and policies.
  • Assess the willingness of your connecting clients to trust your organization as a certificate supplier.

Use Microsoft Certificate Services to create a customizable service for issuing and managing certificates. You can create server certificates for the Internet or for corporate intranets, giving your organization complete control over certificate management policies. For more information, see Certificate Services in Windows Server 2003 family Help.

Online requests for server certificates can only be made to local and remote Enterprise Certificate Services and remote stand-alone Certificate Services. The IIS Web Server Certificate Wizard does not recognize a stand-alone installation of Certificate Services on the same computer when requesting a certificate. To get around this, use the offline certificate request to save the request to a file and then process as an offline request (see Certificate Services Help).

note Note If you open an Server Gated Cryptography (SGC) certificate, you might receive a notice on the General tab that reads as follows: "The certificate has failed to verify for all of its intended purposes." This notice is issued because of the way SGC certificates interact with Windows, and does not necessarily indicate that the certificate does not work properly.

Installing Server Certificates

After obtaining a server certificate from a CA, or after issuing your own server certificate using Certificate Services, use the Web Server Certificate Wizard to install it. For instructions on how to install your server certificate, see Using Certificate Wizards.

Backing Up Server Certificates

The Web Server Certificate Wizard is used to back up server certificates. Because IIS works closely with Windows, you can use Certificate Manager, which is called "Certificates" in Microsoft Management Console (MMC), to export and back up your server certificates.

To back up your server certificate

  1. If you do not have Certificate Manager installed in the MMC, you will need to install it.
  2. Locate the correct certificate store. This is typically the Local Computer store in Certificate Manager.
  3. In the Personal store, click the certificate that you want to back up.
  4. On the Action menu, point to All tasks, and then click Export.
  5. In the Certificate Manager Export Wizard, click Yes, export the private key.
  6. Follow the wizard default settings, and enter a password for the certificate backup file when prompted.

    note Note Do not select Delete the private key if export is successful, because this will disable your current server certificate.

  7. Complete the wizard to export a backup copy of your server certificate.

To add Certificate Manager to the MMC

If you already have Certificate Manager installed in the MMC, it will point to the correct Local Computer certificate store.

  1. To open an MMC console:
    • From the Start menu, click Run.
    • In the Open box, type the following: mmc
    • Click OK
  2. On the File menu, click Add/Remove Snap-in.
  3. In the Add/Remove Snap-in box, click Add.
  4. In the Available Standalone Snap-ins list, click Certificates, and then click Add.
  5. In the Certificates snap-in box, click Computer Account, and then click Next.
  6. In the Select Computer box, click Local Computer, and then click Finish.


Using Certificate Trust Lists

You can configure computers running a member of the Windows Server 2003 family with IIS 6.0 to accept certificates from a predefined list of certification authorities (CAs). Each Web site can be configured to accept certificates from a different list by using certificate trust lists (CTLs). You can automatically verify client certificates against your CTL. You can use the Certificate Trust List Wizard to create and edit CTLs and to add new root certificates to your CTLs.

For example, an intranet administrator creates a different list of trusted certification authorities for each department's Web site on an intranet, in the form of a CTL. As a result, IIS only accepts certificates from certification authorities that are on the department's CTL. When members of the department log on with a client certificate from a CA on the department's CTL, they are automatically authenticated.

When using CTLs, keep in mind the following:

  • The most commonly used CA root certificates are already installed by IIS.
  • CTLs can be applied only at the Web site level, and not for virtual directories or files.
  • CTLs are not available on FTP sites.

important Important You must be a member of the Administrators group on the local computer to perform the following procedure (or procedures), or you must have been delegated the appropriate authority. As a security best practice, log on to your computer using an account that is not in the Administrators group, and then use the Run as command to run IIS Manager as an administrator. From the command prompt, type runas /user:administrative_accountname "mmc %systemroot%\system32\inetsrv\iis.msc".

To create a certificate trust list on your server

  1. In IIS Manager, expand the local computer, and then expand the Web Sites folder.
  2. Right-click the Web site that you want, and then click Properties.
  3. On the Directory Security tab, under Secure Communications, click Edit.

    note Note The Edit button is enabled only if a server certificate has been attached, or bound, to the site. For information on obtaining and installing a server certificate, see Using Certificate Wizards.

  4. In the Secure Communications box, select the Enable certificate trust list check box, and then click New.
  5. Follow the Certificate Trust List Wizard, which will guide you through the process of creating a CTL.

To modify a certificate trust list on your server

  1. In IIS Manager, expand the local computer, and then expand the Web Sites folder.
  2. Right-click the Web site that you want, and then click Properties.
  3. On the Directory Security tab, under Secure Communications, click Edit.
  4. In the Secure Communications box, scroll through the Current CTL list, click the CTL that you want to modify, and then click Edit.
  5. Follow the Certificate Trust List Wizard, which will guide you through the process of modifying a CTL.


Using Certificate Wizards

Internet Information Services (IIS) 6.0 includes two Wizards that simplify the tasks necessary to establish and maintain secure communications for a Web site using server certificates: Web Server Certificate Wizard, and Certificate Trust List Wizard. You can use the Web Server Certificate Wizard to obtain and manage server certificates, which are used in negotiating a secure link between your server and a user's browser. You can use the Certificate Trust List Wizard to manage certificate trust lists (CTLs), which are lists of certification authorities that are trusted by each Web site or virtual directory.

This topic includes the following information:

  • About Certificate Wizards
  • Using the Web Server Certificate Wizard
  • Using the Certificate Trust List Wizard

About Certificate Wizards

IIS 6.0 includes two new Wizards for managing certificates. You can use Web Server Certificate Wizard to simplify obtaining and configuring server certificates. If you are requiring client certificates, you can create and maintain certificate trust lists (CTLs) with the CTL Wizard. Both Wizards feature self-documenting operation.

The Web Server Certificate Wizard

In IIS, you can obtain, configure, and renew server certificates using the Web Server Certificate Wizard. The wizard detects whether a server certificate has already been installed and if it is about to expire. You can use the wizard to create a certificate request, replace the server certificate with another one from a certification authority (CA), from an online CA, such as Microsoft Certificate Services, or from a file previously obtained in Key Manager. You can also reassign a certificate from one Web site to another Web site. You can also use the wizard to view certificates.

When creating a new certificate, the Web Server Certificate Wizard allows you to choose the strength of encryption, the type of certificate, and a cryptographic service provider for your certificate.

Online requests for server certificates can only be made to local and remote Enterprise Certificate Services and remote Stand-alone Certificate Services. The IIS Web Server Certificate Wizard does not recognize a stand-alone installation of Certificate Services on the same computer when requesting a certificate. To get around this, use the offline certificate request to save the request to a file and then process as an offline request (see Certificate Services Help).

If you are not using an online certification authority, you will need to save the request file generated by the Web Server Certificate Wizard to disk and send it to the CA. When the response is received, you can start the wizard and it will begin where it left off. If you are replacing a certificate, IIS will continue to use the old certificate until the new request is completed.

The Certificate Trust List Wizard

You can use the Certificate Trust List Wizard to obtain and manage certificate trust lists (CTLs). A CTL is a list of trusted certification authorities (CA) for a particular Web site. By configuring your CTL, you can allow client certificates issued by one CA to be used but not from another CA. CTLs are especially useful for Internet Service Providers (ISPs) who have several Web sites on their server and who need to have a different list of approved certification authorities for authenticating clients at each site. CTLs are available only at the Web site level and are not available for FTP sites.

Guidelines for Assigning Resources to Server Certificates

Use the following guidelines when assigning IP addresses, Web sites, and SSL ports to your server certificates:

  • You cannot assign multiple server certificates per Web site.
  • You can assign a certificate to multiple Web sites.
  • You can assign multiple IP addresses per Web site.
  • You can assign multiple SSL ports per Web site.

Using the Server Certificate Wizard

important Important You must be a member of the Administrators group on the local computer to perform the following procedure (or procedures), or you must have been delegated the appropriate authority. As a security best practice, log on to your computer using an account that is not in the Administrators group, and then use the Run as command to run IIS Manager as an administrator. From the command prompt, type runas /user:administrative_accountname "mmc %systemroot%\system32\inetsrv\iis.msc".

To obtain a new server certificate using the Web Server Certificate Wizard

  1. In IIS Manager, expand the local computer, and then expand the Web Sites folder.
  2. Right-click the Web site or file that you want, and then click Properties.
  3. On the Directory Security or File Security tab, under Secure communications, click Server Certificate.
  4. In the Web Server Certificate Wizard, click Create a new certificate.
  5. Follow the Web Server Certificate Wizard, which will guide you through the process of requesting a new server certificate.

To install a server certificate using the Web Server Certificate Wizard

  1. In IIS Manager, expand the local computer, and then expand the Web Sites folder.
  2. Right-click the Web site or file that you want, and then click Properties.
  3. On the Directory Security or File Security tab, under Secure communications, click Server Certificate.
  4. In the Web Server Certificate Wizard, click Assign an existing certificate.
  5. Follow the Web Server Certificate Wizard, which will guide you through the process of installing a server certificate.

    note Note The Web Server Certificate Wizard always denotes this step as "assigning" a certificate to a resource (such as a file, directory, or site), not as "installing".

Using the Certificate Trust List Wizard

To use the Certificate Trust List Wizard

  1. In IIS Manager, expand the local computer, and then expand the Web Sites folder.
  2. Right-click the Web site or file that you want, and then click Properties.
  3. On the Directory Security or File Security tab, under Secure communications, click Edit.
  4. To enable a CTL, select the Enable certificate trust list check box.
  5. To create a new CTL, click New; to edit an existing CTL, click Edit.
  6. Follow the Certificate Trust List Wizard, which will guide you through creating or modifying a CTL.


Managing Server Certificates Programmatically

You can use scripts in conjunction with IISCertObj, a Component Object Model (COM) object, to manage certificates remotely and programmatically. You can use IISCertObj to perform the following tasks:

  • Import copies of a certificate from a .pfx file (a file containing a PFX-encrypted certificate and a private key) from a server onto multiple servers.
  • Save backup copies of certificates on a central site.
  • Copy a certificate from one server onto multiple servers.

This topic includes the following information:

  • IISCertObj Component Properties and Methods
  • Sample Scripts

To learn about obtaining SSL server certificates, see Obtaining and Installing Server Certificates.

IISCertObj Component Properties and Methods

This section lists the IISCertObj properties and methods that are supported in IIS.

IISCertObj Properties

Because a method will return an error message if the required properties for that method are not available when the method is called, you should set properties before calling methods. Use the following IISCertObj properties to generate certificate requests.

Property | Attribute Name | Attribute Value | Description
ServerName | Data Type | String, write only | Contains the name of the computer on which certificate operations are executed.
UserName | Data Type | String, write only | Specifies the username that is used to log on to the remote machine. If UserName is empty, the credentials of the user that is currently logged on are used. To install a certificate into a remote certificate store, the user must have administrator privileges on the remote machine.
UserPassword | Data Type | String, write only | Specifies the password used for logon to the remote machine.
InstanceName | Data Type | String, write only | Identifies the targeted metabase instance. W3svc/1 is an example.

IISCertObj Methods

Copy

The Copy method allows you to copy a certificate from one instance of IIS to another, and from one computer to another.

Copy (bAllowExport, bOverwriteExisting, DestinationServerName, DestinationServerInstance, DestinationServerUserName, DestinationServerPassword)

The Copy method uses the following parameters.

Name | Data Type | Description
bAllowExport | Boolean | Specifies whether the imported certificate will be exportable (true) or not exportable (false).
bOverWriteExisting | Boolean | Specifies that if an identical certificate already exists, it should be overwritten (true) or not overwritten (false).
DestinationServerName | String | Identifies the servers to which the certificate will be moved.
DestinationServerInstance | String | Identifies the IIS metabase instance at which the certificate will be pointed. For example, w3svc/1.
DestinationServerUserName | String | Optional username for the destination server. If empty, the username of the user who is currently logged on will be used.
DestinationServerPassword | String | Specifies the password for the destination server when DestinationServerUserName is used.

Export

The Export method exports a copy of a certificate to a file. The target file may be on a local or remote computer.

Export(FileName, Password, bPrivateKey, bCertChain, bRemoveCert)

The Export method requires the following parameters.

Name | Data Type | Description
FileName | String | Specifies the name of the targeted file. For example, c:\mydir\mycert.pfx
Password | String | Contains the password that is used to secure the file specified as Filename.
bPrivateKey | Boolean | Specifies that the private key is exported (true) or not exported (false).
bCertChain | Boolean | Specifies that the certificate trust chain is exported (true) or not exported (false).
bRemoveCert | Boolean | Specifies that the binding of a certificate is removed (true) or not removed (false).

GetCertInfo

The GetCertInfo method allows you to acquire information on a certificate that is installed on the computer specified by the ServerName and InstanceName properties.

GetCertInfo()

The GetCertInfo method uses no parameters.

Import

The Import method imports a copy of a certificate from a file to a local or remote computer.

Import(bAllowExport, bOverwriteExisting, FileName, Password)

The Import method requires the following parameters.

Name | Data Type | Description
FileName | String | Specifies the name of the certificate file to import.
Password | String | Contains the password that is used to secure the file specified as Filename.
bAllowExport | Boolean | Specifies whether the imported certificate is exportable (true) or not exportable (false).
bOverwriteExisting | Boolean | Specifies that if an identical certificate already exists, it is overwritten (true) or not overwritten (false).

ImportToCertStore

The ImportToCertStore method imports a copy of a certificate from a file to the ceritficate store on a local or remote computer.

ImportToCertStore(bAllowExport, bOverwriteExisting, FileName, Password)

The ImportToCertStore method requires the following parameters.

Name | Data Type | Description
FileName | String | Specifies the name of the certificate file to import.
Password | String | Contains the password that is used to secure the file specified as Filename.
bAllowExport | Boolean | Specifies whether the imported certificate is exportable (true) or not exportable (false).
bOverwriteExisting | Boolean | Specifies that if an identical certificate already exists, it is overwritten (true) or not overwritten (false).
BinaryVariant | Variant | Output variant.

IsExportable

The IsExportable method allows you to determine whether or not a certificate is exportable from a computer that is specified by the ServerName and InstanceName properties.

IsExportable()

The IsExportable method uses no parameters.

IsInstalled

The IsInstalled method allows you to determine whether or not a certificate is installed on a computer that is specified by the ServerName and InstanceName properties.

IsInstalled()

The IsInstalled method uses no parameters.

Move

The Move method allows you to move a certificate from one instance of IIS to another, and from one computer to another.

Move (bAllowExport, bOverwriteExisting, DestinationServerName, DestinationServerInstance, DestinationServerUserName, DestinationServerPassword)

The Move method uses the following parameters.

Name | Data Type | Description
bAllowExport | Boolean | Specifies whether the imported certificate is exportable (true) or not exportable (false).
bOverWriteExisting | Boolean | Specifies that if an identical certificate already exists, it is overwritten (true) or not overwritten (false).
DestinationServerName | String | Identifies the servers to which the certificate will be moved.
DestinationServerInstance | String | Identifies the IIS metabase instance at which the certificate will be pointed. For example, w3svc/1.
DestinationServerUserName | String | Optional username for the destination server. If empty, the username of the user that is currently logged on will be used.
DestinationServerPassword | String | Specifies the password for the destination server when DestinationServerUserName is used.

RemoveCert

The RemoveCert method allows you to delete a certificate from a certificate store.

Copy (bRemoveFromCertStore, bPrivateKey)

The RemoveCert method uses the following parameters.

Name | Data Type | Description
bRemoveFromCertStore | Boolean | Specifies whether the certificate is removed (true) or not removed (false).
bPrivateKey | Boolean | Specifies the private key of the certificate to be removed.

Sample Scripts

After acquiring an SSL server certificate from a certificate authority, distributing copies to all of the servers requires one or more of the following steps:

  • Import copies of master certificates onto multiple servers.
  • Save backup copies of certificates in a central archive.
  • Export certificates across multiple servers.

In IIS, if you use Windows Script Host (WSH) or Active Server Pages (ASP), you can execute scripts that communicate with IISCertObj programmatically to import, archive, or export certificates.

Import Certificates to Multiple Servers (CertImport.vbs)

Large sites often need to use one SSL certificate for secure user logon to multiple servers. It would be very time-consuming to use the MMC to add copies of the certificate to each server. What you need is a scripted solution that installs copies of the same certificate to all of the targeted servers.

Save the following script as CertImport.vbs. Modify the command-line statement arguments to match your network resources. Then use the command-line statement to import a certificate from a certificate store on one server to other servers.

Option Explicit
Dim iiscertobj, pfxfile, pfxfilepassword, InstanceName, WebFarmServers, IISServer
Set iiscertobj = WScript.CreateObject("IIS.CertObj")
pfxfile = WScript.Arguments(0)
pfxfilepassword = WScript.Arguments(1)
InstanceName = WScript.Arguments(2)
WebFarmServers = split(WScript.Arguments(3), ",")
iiscertobj.UserName = WScript.Arguments(4)
iiscertobj.UserPassword = WScript.Arguments(5)
For Each IISServer in WebFarmServers
  iiscertobj.ServerName = IISServer
  iiscertobj.InstanceName = InstanceName
  iiscertobj.Import pfxfile, pfxfilepassword, true, true
Next

Command-line statement:

Certimport.vbs cert.pfx pfxpassword w3svc/1 iisserver1,iisserver2,iisserver3 Administrator aal34290

Save Certificates in a Central Archive (Save_all_certs.vbs)

Using the IISCertObj export method, you can archive a backup of each certificate on your server farm to a central site.

Save the following script as Save_all_certs.vbs in your text editor. Modify the command-line statement arguments to match your network resources. Then use the command-line statement to export copies of certificates to the central site.

Option Explicit
Dim iiscertobj, targetServer, targetServers, pfxbasename, pfxpassword, InstanceName
Set iiscertobj = WScript.CreateObject("IIS.CertObj")
pfxbasename = WScript.Arguments(0)
pfxpassword = WScript.Arguments(1)
InstanceName = WScript.Arguments(2)
targetServers = split(WScript.Arguments(3), ",")
iiscertobj.UserName = WScript.Arguments(4)
iiscertobj.UserPassword = WScript.Arguments(5)
iiscertobj.InstanceName = InstanceName
For Each targetServer in targetServers
  iiscertobj.ServerName = targetServer
  iiscertobj.Export pfxbasename + targetServer + ".pfx", pfxpassword, true, false, false
Next

Command-line statement:

Save_all_certs.vbs C:\certbackup\ adsf-0324 w3svc/1 iisserver2,iisserver3,iisserver4 Administrator aal34290

Copy a Certificate from an Existing Server to a New Server (CertCopy.vbs)

With the script and command-line statement below you can use the copy method of IISCertObj to copy a certificate to a new server after you add the server to a server farm.

Save the script below as certcopy.vbs. Modify the command-line statement arguments to match your network resources. Then run the command-line statement.

Option Explicit
Dim iiscertobj, targetServer, targetServers, targetInstance
Set iiscertobj = WScript.CreateObject("IIS.CertObj")
iiscertobj.ServerName = WScript.Arguments(0)
iiscertobj.Instancename = WScript.Arguments(1)
targetServers = split(WScript.Arguments(2), ",")
targetInstance = WScript.Arguments(3)
iiscertobj.UserName = WScript.Arguments(4)
iiscertobj.UserPassword = WScript.Arguments(5)
For Each targetServer in targetServers
  iiscertobj.Copy true, true, targetServer, targetInstance
Next

Command-line statement:

Certcopy.vbs iisServer1 w3svc/1 iisServer2 w3svc/1 Administrator asdf-0324


Obtaining Client Certificates

You can obtain a client certificate from a trustworthy, third-party organization, called a certification authority (CA). Before issuing a certificate, the aCA may need to verify your identity. The identification information required by the CA varies, depending on the type of certificate that you want to obtain. How these certificates are obtained and implemented depends upon the browser that is being used. The procedures in this topic are for Microsoft Internet Explorer version 3.0 and later, only. For client certificate procedures for other browsers, see the browser documentation.

To obtain a client certificate

  1. Choose a certification authority.

    When choosing a CA, consider the following:
    • Is the certification authority a well known and trusted organization?
    • What type of information will the authority require from you in order to verify your identity? Most certification authorities will require you to provide detailed identification information, such as your name, address, organization name, and e-mail address.
    • Does the CA have a Web site that you can use to request your client certificate?
    • Are the certificates issued compatible with the browser and server that are being used?

    note Note For the latest list of certification authorities supporting Internet Information Services, visit the Microsoft Security Services Partner Program Web site. In the Search by Product & Technology list, select IIS or PKI and Certificates.

  2. Refer to the specific ordering instructions that are provided by the certification authority.
  3. Order your certificate. Some client certificates are valid only for the computer and Web browser that are used to generate the certificate request. When this is the case, be sure to make the online request from the computer where you intend to install the certificate.
  4. When you receive your client certificate, use your Web browser's security features to install the certificate. (Some Web browsers may refer to client certificates as "browser certificates" or "personal certificates".)


Enabling Client Certificates

You can require users attempting to access your Web site to log on with a client certificate. Requiring a client certificate, however, does not reliably protect your content from unauthorized access. Any user with a valid and trusted client certificate can establish a secure connection and access your resource. To protect your Web content from unauthorized access you must do one of the following:

  • Use Basic, Digest, or Integrated Windows authentication, in addition to requiring a client certificate.
  • Create a Windows account mapping for client certificates. For more information, see Client Certificate Mapping.

Your Web server cannot process client certificates unless you have previously installed a server certificate and enabled your server's secure communication features. For more information on authentication and certificates, see Authentication and Obtaining and Installing Server Certificates.

When you attempt to set properties for a specific Web site, your Web server will prompt you for permission to reset the properties of individual directories and files in the Web site. If you choose to reset these properties, your previous settings will be replaced by the new settings. The is also true for setting properties for a directory containing subdirectories or files with previously set security properties.

If client certificates are enabled on individual directories or files instead of the whole Web site, the following issue may arise:

  • The client sends a long HTTP request (such as POST) to a computer running a member of the Windows Server 2003 family with IIS 6.0.
  • The IIS worker process receives enough data to parse request headers, but not the entire request entity body.
  • The IIS worker process detects that client certificates are required for a return of data to the client.
  • IIS tries to renegotiate the connection with the client.
  • The client cannot renegotiate because it is waiting to send the remaining data in the request to IIS.

The solution is to assure that client is not blocked from sending the entire entity body. If client renegotiation is requested, it is necessary to preload the request entity body using SSL preload. SSL preload will use the value of UploadReadAheadSize used for ISAPI extensions. However, if UploadReadAheadSize is smaller than Content length, then an HTTP Error 413 is returned and the connection is closed to prevent deadlock. (Deadlock occurs because a client is waiting to complete sending a request entity, while the server is waiting for renegotiation to complete, but renegotiation requires that the client to be able to send data, which it cannot).

important Important You must be a member of the Administrators group on the local computer to perform the following procedure (or procedures), or you must have been delegated the appropriate authority. As a security best practice, log on to your computer using an account that is not in the Administrators group, and then use the Run as command to run IIS Manager as an administrator. From the command prompt, type runas /user:administrative_accountname "mmc %systemroot%\system32\inetsrv\iis.msc".

To enable client certificates

  1. In IIS Manager, expand the local computer, and then right-click the Web site, directory, or file that you want and click Properties.
  2. If you have not previously obtained a server certificate, click the Directory Security tab, and then under Secure Communications, click Server Certificate. For more information, see Using Certificate Wizards.
  3. If you have previously obtained a server certificate, click the Directory Security or File Security tab, and then under Secure Communications, click Edit.
  4. In the Secure Communications box, select the Require secure channel (SSL) check box. Requiring a secure channel means that users cannot connect to this site without using a secure link (that is, the link's URL must begin with https://).
  5. Under Client certificates select one of the following to enable client Certificate authentication:
    • Accept client certificates Users can access the resource with a client certificate, but the certificate is not required.
    • Require client certificates The server will request a client certificate before connecting the user to the resource. Users without a valid client certificate will be denied access.
    • Ignore client certificates Users with or without a client certificate will be granted access.


Using Certificate Revocation Lists

Certification authorities (CAs) cannot physically revoke your users' client certificates. However, they may publish Certificate Revocation Lists (CRLs) that are copied onto your computer (see Windows Help for more information on retrieving CRLs from a CA and storing it on your computer), where they can be searched for client certificates that are in revoked status. This process, called CRL checking, allows IIS to reject client certificates that do not meet the CA criteria for validity. CRLs pair subscribers and revocation status, along with a description of the reason for the revocation. Most CRL services also include a prospective date for the next CRL to be published. Frequent updates help you stay current with subscribers' status with the CA.

CRL checking is managed by setting metabase properties. The metabase properties that control CRL checking can be set or viewed using a COM object, or WMI scripts, or ADSI scripts. For more information on configuring the metabase, see Configuring the Metabase.

To use a CRL, take the following actions:

  • Enable CRL checking.
  • Optionally, configure the CRL on your computer to refresh at a fixed interval, even when the CRL on your computer is still valid.
  • Optionally, change the default time interval for refreshing the CRL on your computer at a fixed interval.

Enabling and Disabling CRL Checking

You can enable and disable CRL Checking by setting the metabase property, CertCheckMode. CRL Checking is enabled by default. The CRL will be refreshed by the CA when a new CRL is issued, unless you intervene by setting a CRL refresh interval.

Setting the CRL Refresh Interval

Optionally, you can refresh the CRL on your computer with the CRL on the CA server even when the cached CRL on your computer is valid, by changing the setting of the metabase property, RevocationFreshnessTime.

You can change the default interval to a time you set, in minutes, by setting the metabase property, RevocationURLRetrievalTimeout.


Client Certificate Mapping

You can authenticate users who log on with a client certificate by creating mappings, which relate the information that is contained in the certificate to a Microsoft® Windows® user account. There are three ways to map client certificates: Directory Service (DS) mapping, one-to-one mapping, and many-to-one mapping.

This section includes the following information:

  • About Mapping: Provides an overview of the three client certificate mapping methods.
  • Mapping Strategies: Describes the situations in which client certificate mapping is used.
  • Mapping Client Certificates One-to-One: Describes the mapping method that maps one client certificate to one user account.
  • Mapping Client Certificates Many-to-One: Describes the mapping method that maps one or more client certificates to a user account.


About Mapping

Directory Service Mapping

Directory Service (DS) certificate mapping uses native Windows Active Directory® service features to authenticate users with client certificates. There are advantages and disadvantages to using DS mapping. For example, an advantage is that the client certificate information is shared across many servers. A disadvantage, however, is that wildcard matching is not as advanced as it is in the IIS mapper.

You can enable DS mapping only at the Master properties level, and only if you are a member of a Windows domain. Activating DS mapping will exclude the use of one-to-one and many-to-one mapping for the entire World Wide Web Publishing Service (WWW service).

One-to-One Mapping

One-to-one mapping maps individual client certificates to accounts. The server compares the copy of the client certificate it holds with the client certificate that is sent by the browser. The two must be absolutely identical for the mapping to proceed. If a client gets another certificate containing all of the same user information, it must be mapped again.

Many-to-One Mapping

Many-to-one mapping uses wildcard matching rules that verify whether a client certificate contains specific information, such as issuer or subject. This mapping does not compare the actual client certificate, but rather accepts all client certificates fulfilling the specific criteria. If a client gets another certificate containing all of the same user information, the existing mapping will work.

Related Topics
  • For more information on Directory Service certificate mapping, see Mapping Certificates to User Accounts in Windows Help.
  • For information on how to map a specific client certificate to a user account, see Mapping Client Certificates One-to-One.
  • For information on how to add a client certificate mapping using wildcard rules, see Mapping Client Certificates Many-to-One.
  • For information on when to use each type of client certificate mapping, see Mapping Strategies.
  • For more information on certificates, see About Certificates.


Mapping Strategies

Client certificate mapping is very flexible because any of the three mapping methods can be used to map client certificates to user accounts. You can map a client certificate to any number of user accounts. Likewise, you can map any number of client certificates to a single user account.

Certificate mapping can be used in several situations, including the following:

  • Large Networks Networks with a large number of client certificates can use many-to-one or Directory Service (DS) mapping. You can create one or more matching rules to map certificates to one or more Windows user accounts.
  • Small Networks Networks with very few users can use one-to-one mapping to provide greater control of certificate usage and revocation, or use many-to-one mapping to facilitate easier administration.
  • Additional Security For resources that have few users and that require additional security, you can use one-to-one mapping. In this way, you can be sure that only particular certificates are used. This allows better certificate revocation policies to be enforced.
  • Internet Internet sites that use certificate authentication can use many-to-one mapping by accepting a wide range of certificates and mapping them all to an account with rights that are similar to the IUSR_computername account.
  • By certification authority To map all users who log on with a client certificate that was issued by a particular organization, you can use many-to-one mapping. Then you can define a matching rule that automatically maps any certificate issued by that organization to a user account.

note Note If you are using mapping to integrate your Web sites into a Windows domain, the Windows Directory Service mapper will best suit your purpose. For more information, see Mapping Certificates to User Accounts in Windows Help.

Related Topics
  • For information on how to map a specific client certificate to a user account, see Mapping Client Certificates One-to-One.
  • For information on how to add a client certificate mapping using wildcard rules, see Mapping Client Certificates Many-to-One.


Mapping Client Certificates One-to-One

One-to-one mapping maps individual client certificates to Windows user accounts. The server compares the copy of the client certificate it holds with the client certificate that is sent by the browser. The two must be absolutely identical for the mapping to proceed. If a client gets another certificate containing all of the same user information, it must be mapped again.

Some client certificates, however, need to be exported for use in IIS one-to-one mapping. For more information on whether or not you should export client certificates, contact your certification authority.

To export a certificate using Microsoft Internet Explorer, version 5.0, or later

  1. On the Tools menu in Internet Explorer, click Internet Options, and then click the Content tab.
  2. On the Content tab, click Certificates, and then click the Personal tab.
  3. On the Personal tab, in the list of certificates, click the certificate that you want, and then click Export.
  4. In the Certificate Export Wizard, click Next.
  5. On the next page in the wizard, click No, do not include any private keys in the export, and then click Next.
  6. On the next page in the wizard, click Base64 Encoded X.509 (*.CER), and then click Next.
  7. Follow the remaining steps in the Certificate Export Wizard to complete the procedure.

note Note You can also use this procedure to create a backup copy of your certificate.

The certificate is now ready for any subsequent IIS one-to-one mapping. This procedure needs to be completed only one time per certificate.

important Important You must be a member of the Administrators group on the local computer to perform the following procedure (or procedures), or you must have been delegated the appropriate authority. As a security best practice, log on to your computer using an account that is not in the Administrators group, and then use the Run as command to run IIS Manager as an administrator. From the command prompt, type runas /user:administrative_accountname "mmc %systemroot%\system32\inetsrv\iis.msc".

To map a specific client certificate to a user account

  1. In IIS Manager, expand the local computer, and then expand the Web Sites folder.
  2. Right-click the Web site that you want to configure authentication for, and then click Properties.
  3. Click the Directory Security tab, and then in the Secure Communications section, click Edit.
  4. In the Secure Communications box, select the Enable client certificate mapping check box, and then click Edit.
  5. In the Account Mappings box, click the 1-to-1 tab.
  6. On the 1-to-1 tab, either add a new certificate by clicking Add, or edit an existing mapping by selecting the mapping and clicking Edit Map.
  7. If you are adding a new certificate, browse to the certificate file and open it.

    note Note If you cannot find the certificate file, then it might need to be exported. Use the procedure above to export a certificate file.

  8. In the Map to Account box, enter a map name for the mapping. This is the name that will be displayed in the selection list on the Account Mappings box.
  9. Either type or browse to a Windows user account. Type the password of the account that the certificate is mapping to.
  10. Click OK.
  11. Repeat these steps to map other certificates, or to map this certificate to other accounts.
Related Topics
  • For information on how to add a client certificate mapping using wildcard rules, see Mapping Client Certificates Many-to-One.
  • For information on when to use each type of client certificate mapping, see Mapping Strategies.
  • For information on certificates, see About Certificates.


Mapping Client Certificates Many-to-One

Many-to-one mapping uses wildcard matching rules that verify whether a client certificate contains specific information, such as issuer or subject. This mapping does not compare the actual client certificate, but rather accepts all of the client certificates that fulfill the specific criteria. If a client gets another certificate containing all of the same user information, the existing mapping will work.

When using many-to-one mapping, keep the following information in mind:

  • Specific client certificate mappings always take precedence over wildcard mappings.
  • Some client certificates offer more identification information and may contain additional, custom subfields. For information about certificate formats, contact your certification authority.
  • Use matching rules that are as specific as possible. A good wildcard rule matches information from several different fields and subfields. For example, the names "Accounting", "Shipping", and "Sales" can appear in the organization unit subfield of more than one company's client certificate. A matching rule that mapped certificates based exclusively on this subfield would probably result in unintended mappings.

important Important You must be a member of the Administrators group on the local computer to perform the following procedure (or procedures), or you must have been delegated the appropriate authority. As a security best practice, log on to your computer using an account that is not in the Administrators group, and then use the Run as command to run IIS Manager as an administrator. From the command prompt, type runas /user:administrative_accountname "mmc %systemroot%\system32\inetsrv\iis.msc".

To add a client certificate mapping using wildcard rules

  1. In IIS Manager, expand the local computer, and then expand the Web Sites folder.
  2. Right-click the Web site that you want to configure authentication for, and then click Properties.
  3. Click the Directory Security tab, and then in the Secure Communications section, click Edit.
  4. In the Secure Communications box, select the Enable client certificate mapping check box, and then click Edit.
  5. In the Account Mappings box, click the Many-to-1 tab, and then click Add
  6. In the General box, type a name for the rule. This is the name that will be displayed in the selection list on the Account Mappings box. You can create rules for future use or disable rules without deleting them by selecting or clearing the Enable this wildcard rule check box. Click Next.
  7. In the Rules box, click New.
  8. In the Edit Rule Element box, select the appropriate criteria and click OK.

    note Note Steps 6 and 7 can be repeated to define the rule more stringently.

  9. When finished editing the rule, click Next.
  10. In the Mapping box, either type or browse to a Windows user account. Type the password of the account that the rule is mapping to.

    note Note If the account you are mapping to is on a computer that is a member of a workgroup, you will need to specify the computer name and the account name. For example, if you are mapping to the "RegionalSales" account on the computer called "Sales1", the mapping account name would be "Sales1\RegionalSales".

  11. Click OK.
  12. Repeat these steps to create other mapping rules.
  13. Use the Move Up and Move Down buttons to establish the precedence given to the rules. Rules that are higher in the list take precedence.

To edit an existing wildcard rule

  1. In IIS Manager, expand the local computer, and then expand the Web Sites folder.
  2. Right-click the Web site that you want to configure authentication for, and then click Properties.
  3. Click the Directory Security tab, and then in the Secure Communications section, click Edit.
  4. In the Secure Communications box, select the Enable client certificate mapping check box, and then click Edit.
  5. In the Account Mappings box, click the Many-to-1 tab.
  6. On the Many-to-1 tab, in the list of rules, click the rule that you want to modify, and then click Edit Rule.
  7. Make the necessary changes, and when you are finished editing the rule, click OK.
Related Topics
  • For information on how to map a specific client certificate to a user account, see Mapping Client Certificates One-to-One.
  • For information on when to use each type of client certificate mapping, see Mapping Strategies.
  • For more information on certificates, see About Certificates.


Auditing

You can use security auditing techniques to track the activities of users and to detect unauthorized attempts to access your NTFS file system directories and files. Activities that you can audit include the following:

  • User attempts to log on, both successful and unsuccessful.
  • User attempts to access restricted accounts.
  • User attempts to execute restricted commands.
Related Topics
  • For information on auditing files and auditing, see Auditing security events.
  • For information on how to log user Web site and FTP site activity, see Logging Site Activity.
  • For information on how to control access to your Web site and FTP site, see Access Control.


Secure Sockets Layer

By sending encrypted information over the Internet, you can enable users to exchange secure, private information with your server, such as credit card numbers or phone numbers. In Internet Information Services (IIS) 6.0, the basis for using encryption is the Secure Sockets Layer (SSL) protocol, which provides a secure way of establishing an encrypted communication link with users. SSL confirms the authenticity of your Web site and, optionally, confirms the identity of users that are accessing restricted Web sites.

This section includes the following information:

  • About SSL: Defines SSL, and explains how SSL is used in securing IIS communications.
  • Configuring SSL on Servers: Describes how to set SSL to secure communications between IIS and clients.
Related Topics
  • For more information on encryption, see Encryption.


About SSL

Secure Sockets Layer (SSL) is a public key-based security protocol that is used by Internet services and clients to authenticate each other and to establish message integrity and confidentiality. SSL uses certificates for authentication, and it uses encryption for message integrity and confidentiality.

Certificates include keys, which are used to authenticate the server and the client in establishing an SSL connection. A public key and a private key form an SSL key pair. The World Wide Web Publishing Service (WWW service) utilizes this key pair to negotiate a secure connection with the user's Web browser and to specify the required encryption strength.

During the exchange of information that establishes a secure connection, the server creates a session key, also called an encryption key. IIS and the browser use the session key to encrypt and decrypt information that is exchanged during a session. The required encryption strength is measured in bits (for example, 40-bit encryption or 128-bit encryption). The encryption strength provides the degree of confidentiality that is deemed necessary for the application. The larger the number of bits, the greater the encryption strength because larger encrypted strings are more difficult to decrypt by attackers who do not have the session key.

Related Topics
  • For more information on certificates, see Certificates.
  • For more information on encryption, see Encryption.
  • For information on how to set up SSL on your Web server, see Configuring SSL on Servers.


Configuring SSL on Servers

You can configure Secure Sockets Layer (SSL) security features on your Web server to verify the integrity of your content, verify the identity of users, and encrypt network transmissions.

Your Web server requires a valid server certificate to establish SSL communications. Use the Web Server Certificate Wizard to either generate a certificate request file (NewKeyRq.txt, by default) that you can send to a certification authority, or to generate a request for an online certification authority, such as Microsoft® Certificate Services. For more information, see Using Certificate Wizards.

If you are not using Microsoft Certificate Services to issue your own server certificates, then a third-party certification authority must approve your request and issue your server certificate. For more information see Obtaining and Installing Server Certificates. Depending on the level of identification assurance offered by your server certificate, you can expect to wait anywhere from several days to several months for the certification authority to approve your request and send you a certificate file. You can have only one server certificate per Web site.

After you receive a server certificate file, use the wizard to install it. The installation process attaches, or binds, your certificate to a Web site.

important Important You must be a member of the Administrators group on the local computer to perform the following procedure (or procedures), or you must have been delegated the appropriate authority. As a security best practice, log on to your computer using an account that is not in the Administrators group, and then use the Run as command to run IIS Manager as an administrator. From the command prompt, type runas /user:administrative_accountname "mmc %systemroot%\system32\inetsrv\iis.msc".

To set up SSL on your Web server

  1. In IIS Manager, expand the local computer, and then expand the Web Sites folder.
  2. Right-click the Web site or file that you want to protect with SSL, and then click Properties.
  3. Under Web site identification click Advanced.
  4. In the Advanced Web site identification box, under Multiple identities for this Web site, verify that the Web site IP address is assigned to port 443, the default port for secure communications, and then click OK. Optionally, to configure more SSL ports for this Web site, click Add under Multiple identities of this Web site, and then click OK.
  5. On the Directory Security or File Security tab, under Secure communications, click Edit.
  6. In the Secure Communications box, select the Require secure channel (SSL) check box.
  7. To enable SSL client Certificate authentication and mapping features, select the Enable client certificate mapping check box, and then click Edit. For detailed information on client certification and mapping, see the following:
    • Enabling Client Certificates
    • Client Certificate Mapping

If you require 128-bit key encryption, your users must use Web browsers that support 128-bit encryption. For more information, see Encryption. For information on upgrading to 128-bit encryption capability, visit the Microsoft Product Support Services Web site.


Performance Tuning

Tuning your Web server and improving performance enables you to maximize throughput and to minimize Web application response times, which create a better experience for clients trying to access your Web server. Clients do not have to wait as long or as often while the server responds to client requests. Tuning helps avoid bottlenecks and can help extend the time between hardware upgrades.

This section includes the following information:

  • About Performance Tuning: Describes a general methodology for testing and tuning your Internet Information Services (IIS) Web server.
  • Performance and Security: Describes how to balance server security with performance needs.
  • Performance Settings: Describes specific registry and metabase settings that you can adjust to improve IIS performance.
  • Performance Monitoring: Describes the tools and counters that are used to monitor server performance.
  • Scalability: Describes different methods of hardware scaling to improve IIS performance.
Related Topics
  • For information on performance results based on site content choices, see Configuring Applications.
  • For information on tracking Web site traffic, see Logging Site Activity.
  • For information on programmatic administration, see Programmatic Administration Guide.


About Performance Tuning

Performance tuning a Web server is an art as much as it is a science. Trial and error are necessary in determining what settings and hardware work best for your Web site's requirements. It is important for you to have a plan before you begin to evaluate your Web server's performance. It is equally important that you understand the profile of your applications or Web sites and how they behave under different conditions.

The first step in your performance tuning plan is to set up a controlled environment in which to test your Web sites, conduct performance analysis of predicted loads, and measure performance in that controlled environment before you expose your Web server to the Internet. The performance of the server can vary greatly, depending on the number of page requests during different periods, so be sure to monitor your test site under a number of different loads to capture a true picture of activity on the server.

To improve server performance, examine every part of the system for potential bottlenecks, including custom applications, memory, CPU, the network, the hard disk, and connections to back-end servers and databases. Bottlenecks also can result from improperly configured hardware or software settings in either IIS or Microsoft® Windows®. A good monitoring plan checks performance in every part of the Web server system.

After you determine your server's performance statistics, you can improve performance by enabling some of the Quality of Service features listed in later topics, or by making changes to metabase and registry settings. You should enable features and make changes to the metabase or the registry one-at-a-time and with a tested restoring plan. If you make multiple changes at one time, it becomes difficult to assess the performance impact of individual changes. After you make each change, continue to monitor your server to see if the change has the desired effect. If you see unwanted effects, restore the server to its previous state. After making a change, monitor the performance of resources such as memory, CPU, and hard disk. An adjustment to one setting can create bottlenecks in other parts of the system. After you have assessed the impact of a change, determine whether additional changes are needed.

Related Topics
  • For information on performance monitoring, see Performance Monitoring.


Performance and Security

Balancing performance with user concerns about the security of your Web applications is one of the most important issues you will face, particularly if you run an e-commerce Web site. Secure Web communications require more resources than Web communications that aren't secure, so it is important that you know when to use various security techniques, such as the Secure Sockets Layer (SSL) protocol, certificates, or any of the Windows authentication methods. For example, your home page or a search results page most likely do not need to be run through SSL. However, you will want to make sure that a checkout or purchase page is secure.

If you use SSL, be aware that establishing the initial connection takes five times longer than reconnecting using security information in the SSL session cache. The default time-out for the SSL session cache has been changed to five minutes in Microsoft Windows 2000 and later. After this data is deleted, or "flushed", from the cache, the client and server must establish a completely new connection.

If you plan to support long SSL sessions, consider lengthening this time-out with the ServerCacheTime registry setting. If you expect thousands of users to connect to your site using SSL, a safer approach is to estimate how long you expect SSL sessions to last, and then set the ServerCacheTime parameter to slightly longer than your estimate. Do not set the time-out much longer than this, because your server might leave stale data in the cache. Also, make sure that HTTP Keep-Alives are enabled (on by default). SSL sessions do not expire when used in conjunction with HTTP Keep-Alives, unless the browser explicitly closes the connection.

The Microsoft Windows Server 2003 family and Internet Information Services (IIS) 6.0 security services are integrated into a number of operating system services. This means that you cannot monitor security features separately from other aspects of those services. Instead, the most common way to measure security overhead is to run tests comparing server performance with and without a security feature. The tests should be run with fixed workloads and a fixed server configuration so that the security feature is the only variable. During the tests, measure the following:

  1. Processor Activity and the Processor Queue: The following security features require significant processing, so it is important to balance the use of these security features with your performance objectives:
    • Authentication
    • Certificates
    • Secure Sockets Layer
    • Encryption
    You are likely to see increased processor activity, both in privileged and user modes, and an increase in the rate of context switches and interrupts. If the processors in the server are not sufficient to handle the increased load, queues are likely to develop. Custom hardware, such as cryptographic accelerators that perform encryption, may help. When you create a certificate with the Using Certificate Wizards, you can select a cryptographic service provider that uses cryptographic accelerators. Note that if the SSL protocol is being used, Lsass.exe may consume a surprising amount of CPU power because SSL processing occurs in the Lsass.exe process.
  2. Memory: Security requires that the system store and retrieve more user information.
  3. Network Traffic: You are also likely to see an increase in traffic between the IIS server and the domain controller that is used for authenticating logon passwords and verifying IP addresses.
  4. Latency and Delays: The most obvious performance degradation resulting from complex security features, like SSL, is the time and effort involved in encryption and decryption, both of which use many processor cycles. Downloading files from servers using the SSL protocol can be 10 to 100 times slower than from servers that are not using SSL.

note Note If a server is used both for running IIS and as a domain controller, the proportion of processor use, memory, and network and disk activity consumed by domain services is likely to increase significantly. The increased activity can be enough to prevent IIS services from running efficiently. It is highly recommended that you do not run a high-traffic Web server on a domain controller.

Related Topics
  • For more information on IIS security features, see Security.


Performance Settings

You can adjust both Internet Information Services (IIS) metabase properties and registry keys to tune the performance of your Web server. Increasing or decreasing settings can often alleviate bottlenecks and improve performance, but changes to the metabase or the registry also can cause bottlenecks in other parts of your server environment. It is important to monitor performance before and after making changes to your server environment to determine if the changes were beneficial.

This topic describes suggested values for metabase and registry settings that pertain to Web server performance.

important Important Using Registry Editor incorrectly can cause serious problems that require reinstalling the operating system. Because Registry Editor bypasses the standard safeguards that prevent you from entering settings that are conflicting or likely to degrade performance or damage your system, exercise caution when making changes to the registry. Microsoft cannot guarantee that problems resulting from the incorrect use of Registry Editor can be solved. For information about how to edit the registry, see the Changing Keys and Values topic in Registry Editor Help.

For performance issues, try changing metabase and cache settings before making changes to the registry. To configure or customize Windows and IIS, use the programs in Control Panel or Microsoft Management Console (MMC) whenever possible.

Metabase Settings

The following table includes the most important metabase properties for tuning your Web servers. For information about default values of the metabase properties, click the corresponding links. These properties can be retrieved and changed by using Windows Management Instrumentation (WMI), or by directly editing the metabase using a text editor. Changes to most of these properties do not take effect until you restart the World Wide Web Publishing Service (WWW service).

Metabase Property | Description
AppAllowDebugging | Specifies whether Active Server Pages (ASP) debugging is enabled on the server. When this property is enabled, IIS application threads are serialized; only one thread is allowed to execute at a time for each application. Serialized threads adversely affect Web server performance. It is recommended that you set this property to false on all production servers.
AspBufferingOn | Allows all output from an application to be collected in the ASP output buffer before the buffer is flushed to the client browser (default behavior). If this property is set to false, output from ASP scripts are written to the client browser as the client browser becomes available. It is recommended that you set this property to true on all production Web servers.
AspQueueConnectionTestTime Ensures that IIS does not waste time processing a request that has been abandoned by the user. This setting aids significantly in the performance of Web applications. If a request has been in the queue longer than the queue connection test time, the server checks whether the client is still connected before beginning execution.

This feature handles the problem of impatient users filling up the request queue with numerous attempts at the same page. The value should be small, for example, three seconds. Base your decision to change this value on the type of Web application that your server is running. Long-running ASP pages can also use the Response.IsClientConnected method to check whether the client is still waiting for the rest of the page. Long-running pages should make judicious use of Response.Flush to ensure that users perceive that the page is still alive and doing productive work.
AspRequestQueueMax | Specifies the maximum number of concurrent ASP requests that are permitted into the queue. The effectiveness of this setting depends on the behavior of the application. If the request's execution time is very short and the time in the queue is short, it is reasonable to increase the limit of the default value.
AspScriptEngineCacheMax | Specifies the maximum number of scripting engines that ASP pages keep cached in memory. Adjust the default value according to the type of content in the application. (The default value does not include currently running script engines.) If there are thousands of unique pages, you may experience some gain associated with increasing the cache size so that the most frequently requested pages can be readily accessed. A hit in the script engine cache means that you can avoid recompiling the template into byte code.
AspScriptFileCacheSize | Specifies the number of precompiled script files to store in the ASP template cache. If set to 0, no script files are cached. If set to -1, all requested script files are cached. Increase the default value if you have many different ASP pages. Do not set the value of this property to 0. A value of 0 turns off all ASP caching and severely impairs your server's performance.
AspSessionMax and AspSessionTimeout AspSessionMax: Specifies the maximum number of concurrent sessions that IIS permits.

AspSessionTimeout: Specifies, in minutes, the default amount of time that a session object is maintained after the last request associated with the object is made.

For applications that take advantage of sessions, it may be prudent to reduce the Session time-out to lessen the overhead that is required of the server. However, if concurrent sessions increase to overly heavy proportions, it might be necessary to include a Session maximum.
AspProcessorThreadMax Specifies the maximum number of worker threads per processor that IIS creates.

The maximum number of worker threads that IIS allows per ASP process is AspProcessorThreadMax multiplied by the number of processors on your server. You can reduce this value and monitor performance. If performance degrades, bring the AspProcessorThreadMax value back up.
AspTrackThreadingModel Specifies whether IIS checks the threading model of any components that your application instantiates. It is not recommended that you enable this property. If this metabase property is set to false, the overhead incurred by the ASP threading model tracking is avoided, and you might see performance improvements in your ASP application. However, if this property is set to true, any components that you plan to give application scope must be agile; in other words, either marked as both-threaded and aggregate the free-threaded marshaller, or marked as ThreadingModel=Neutral.

If an application-scoped component is not agile, ASP generates an error when you try to instantiate the component. In addition, if this property is false, any objects that lack OnStartPage or OnEndPage methods and are instantiated in your ASP application are released earlier than they would be otherwise. This should improve your application's scalability.
CacheISAPI Indicates whether Internet Server API (ISAPI) extensions are cached in memory after use. If the value of this property is true, the DLL file remains in the cache until the server is stopped. If the value is false, ISAPI extensions are unloaded from memory after the extension DLL is no longer in use. ISAPI extensions are cached or not cached, based on the value of this property at the time they were loaded into memory for use. Therefore, if this property is changed after an extension has been loaded and cached, the change has no effect on that extension.

Setting this property to false can be helpful for debugging, but it is recommended that you set this value to true on all production Web servers. Reloading an ISAPI extension DLL file for every request degrades performance. ASP.dll is itself an ISAPI extension, so disabling this property also degrades ASP performance.

Registry Settings

This section lists the registry keys that you should consider as you tune your Web server. Each listed registry key includes the registry path for settings that reside in the same location, along with the name, range, default value, and a description of what each setting does. You need to restart IIS for new WWW service settings to take effect.

DisableMemoryCache
Registry Path: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\InetInfo\Parameters
Data Type:REG_DWORD
Default value: 0 (disabled)
Range: 0 - 1
DisableMemoryCache disables server caching. Make sure that this parameter is set to 0 on all production servers. If this parameter is set to 1, static file caching is disabled. While this may be useful during debugging, disabling the cache can severely compromise production server performance. This parameter cannot be configured using IIS Manager.
MaxCachedFileSize
Registry Path: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet \Services\InetInfo\Parameters
Data Type:REG_DWORD
Default value: 256 KB (262,144 bytes)
MaxCachedFileSize determines the maximum size of a file that can be placed in the cache. IIS does not cache files that are larger than MaxCachedFileSize bytes. If you are running large, dedicated Web servers, you may want to add this value to the registry to increase the file size that the cache can hold.
MemCacheSize
Registry Path: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet \Services\InetInfo\Parameters
Data Type:REG_DWORD
Default Value: approximately one half the available physical memory, calibrated in megabytes
Range: 0 - 2500MB
MemCacheSize specifies the maximum amount of memory that IIS uses for its file cache. If IIS does not need this much memory, it is left for other applications to use. If this value is not in the registry, IIS uses no more than half of the available memory on the Web server (which is dynamically calculated every 60 seconds). If you are running large dedicated Web servers, you may want to add this value to the registry and increase the amount of memory that IIS can use. You must specify this size in megabytes when you add this object to the registry.
ObjectCacheTTL
Registry Path: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet \Services\InetInfo\Parameters
Data Type:REG_DWORD
Default Value: 30 (seconds)
Range: 0 - 4,294,967,295 (unlimited)
ObjectCacheTTL controls the Time To Live (TTL) setting of the static file cache, which defines the length of time that objects, including files, are held in the memory cache. If an object in the memory cache has not been referenced during the defined period, that object is phased out of the cache. By default, this value is not included in the registry. If you wish to change it, you must add it manually. If system memory is limited, or if the server's contents are dynamic, you can use a lower TTL to prevent system memory from being used to cache a large number of volatile objects. Setting the value to 0xFFFFFFFF disables the object-cache scavenger and allows cached objects to remain in the cache until they are overwritten. Disabling the cache scavenger is useful, if your server has ample system memory and your data is relatively static. Other sites may prefer the compromise of raising this value to several minutes.
PoolThreadLimit
Registry Path: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet \Services\InetInfo\Parameters
Data Type:REG_DWORD
Default value: 2 * # MB
Range: 0 - 4,294,967,295 (unlimited)
PoolThreadLimit specifies the maximum number of I/O worker threads that can be created in the Inetinfo.exe process, which limits the number of simultaneous connections. IIS sets PoolThreadLimit to two times the number of megabytes of RAM present in the machine. If this value is larger than 256, it is held at 256. If a value is present in the registry, it overrides the IIS calculation. Each pool thread watches for a network request and processes it, either by sending back a static file or by passing the request to an ISAPI extension DLL (such as ASP) or to a Common Gateway Interface (CGI). If the ISAPI extension processes a request synchronously, and it takes a long time to process requests, it ties up the worker thread, leaving IIS with fewer worker threads to process other requests. For this reason, well-written ISAPI extensions, such as ASP, implement their own thread pools, place requests in a queue, and process them asynchronously with their own threads, so as not to tie up IIS worker threads. In general, if you find that the default limit of 256 threads is inadequate, you probably have a poorly written ISAPI extension tying up IIS worker threads.

PoolThreadLimit is a hard limit that includes all IIS worker threads, including the HTTP, FTP, NNTP, and SMTP services. PoolThreadLimit is always greater than or equal to MaxPoolThreads.

The ASP thread pool is a separate set of threads. Its size is controlled by the AspProcessorThreadMax metabase setting. The largest possible number of outstanding ASP requests is the sum of AspRequestQueueMax and AspProcessorThreadMax.

PoolThreadLimit is a hard limit that includes all IIS threads and is always greater than or equal to MaxPoolThreads.
MaxPoolThreads
Registry Path: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet \Services\InetInfo\Parameters
Data Type:REG_DWORD
Default value: 4
Range: 0 - 4,294,967,295 (unlimited)
MaxPoolThreads specifies the number of I/O worker threads to create per processor. Each pool thread watches for a network request and processes it. The MaxPoolThreads count does not include threads that are consumed by ISAPI applications; it refers only to the number of worker threads available to process request for static files. IIS creates more threads, as needed, to process ISAPI requests. The total number of IIS worker threads can be no greater than PoolThreadLimit.

By default, only four CGI applications can run concurrently. If you run many CGI applications, you should increase this value in order to increase the throughput. You could set the UsePoolThreadForCGI value (under ..\Services\W3SVC\Parameters) to false (or, 0); however, this is somewhat dangerous because it can significantly decrease performance during high usage of CGI applications. Generally, it is not good to create more than 20 threads per processor.
ListenBackLog
Registry Path: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet \Services\InetInfo\Parameters
Data Type:REG_DWORD
Default value: 15
Range: 1 - 250
ListenBackLog specifies the maximum number of active connections to hold in the queue, while they wait for server attention. It is typically unnecessary to use or modify this entry, although with extremely heavy use, it could be beneficial to increase this value up to 300.

Related Topics

  • For more information on performace tuning, see Performance Monitoring.
  • For more information on metabase properties, see Metabase Property Reference.
  • For more information on registry settings, see Global Registry Entries.
  • For information on how to administer IIS with scripts and programmatic tools, see Programmatic Administration Guide.
  • For more information on the IIS registry and metabase, see Reference.


Performance Monitoring

Performance monitoring is an essential part of server administration. By monitoring a server's performance, you can recognize problematic trends as they develop and prevent larger performance problems. Monitoring also helps you decide when to upgrade your hardware and whether upgrades are actually improving your server's performance. While some problems are obvious, others develop over time. If you do not have a baseline against which to judge and compare the performance of your servers, you can experience problems that you might have avoided. This section describes how to monitor server performance by using System Monitor and the Performance Logs and Alerts tool, along with other monitoring tools.

note Note Internet Information Services 6.0 (IIS) uses two modes of operation: worker process isolation mode and IIS 5.0 isolation mode. IIS typically scales and performs better while running in worker process isolation mode, though results depend on a variety of factors, including the design of your applications. Also note that each mode uses different counters to monitor performance.

This section includes the following information:

  • About Performance Monitoring: Provides a high-level overview of performance monitoring and includes descriptions of response time, resource utilization, and performance bottlenecks.
  • Performance Monitoring and Scalability Tools: Describes a variety of Microsoft® Windows® operating system tools that you can use to monitor performance and scalability. Also describes how to monitor and tune applications to improve server performance.
  • Monitoring and Tuning Hardware Performance: Describes the counters that are associated with memory, processor capacity, and multiprocessor systems. This topic also describes processor affinity, network capacity, latency, bandwidth, disk optimization, and security.

Related Topics

  • For more information on performance monitoring, including procedural information on how to work with counters; how to create and configure counter logs, trace logs, and alerts; and a list of best practices; see Monitoring Performance in Windows Help.
  • For information on monitoring the performance of your ASP.NET applications, see ASP.NET Performance Monitoring.
  • The Microsoft Servers Web site offers detailed information and case studies on other Microsoft server products designed to increase the performance, scalability, and reliability of your Web presence. A few of these products include the following:
    • Microsoft SQL Server™
    • Microsoft Application Center
    • Microsoft BizTalk® Server
    • Microsoft Commerce Server
    • Microsoft Host Integration Server
    • Microsoft Exchange Server


About Performance Monitoring

Performance monitoring is the process of capturing and analyzing performance data from various components of your server environment (including applications, memory, CPU, hardware, and your network) to locate bottlenecks. A bottleneck can be caused by processes backing up because the server does not have enough processor cycles to efficiently complete a request, poorly designed code in a custom application, or a multitude of problems related to the network and hardware.

By monitoring performance and analyzing performance data, you can begin to see patterns in the data that will help you locate bottlenecks. After you have located a bottleneck, you can make changes to the component to improve performance. Bottlenecks can occur anywhere in your server environment at any time, so it is important to capture baseline performance information about your system and monitor performance regularly.

You can monitor performance by writing a program that uses the Performance Monitor registry interface or the Performance Data Helper (PDH) interface, or by using System Monitor, Performance Logs and Alerts, and monitoring tools provided with Windows. The technique you choose typically depends on how much data you want to monitor and what kind of analysis you want to perform on that data.

Response Time and Resource Utilization

Response time represents the time (often an average) that elapses between the issue of a request and the return of the requested data (or notification of the server's inability to provide it). You can use response time to measure your server's and Web sites' performance. When your server is processing a large number of requests (under load), requests may take longer to complete than if the server were unloaded. For user requests, this can result in increased response time for clients. If the server is under an excessive load, users may perceive the server as slow or unresponsive.

The ability of IIS to handle heavy loads and maintain good response time is primarily dependent on the performance and scalability of your applications. Factors such as network latency (the time it takes for information to be transferred between computers in a network) and database processing also affect response time, but these factors may be out of your control. You can improve response time through better application design and by using the IIS features designed to manage your server resources (a list of features is included at the end of this topic), so heavy loads do not cause bottlenecks or overload the World Wide Web Publishing Service (WWW service).

By monitoring your server performance, you can determine if poor response time is actually a symptom of a bigger problem on the server side (for example a poorly designed application, poor resource utilization, or improper cache settings), or if the problem is network latency. Before making any changes to your system, use the System Monitor tool to establish a performance baseline about your system and to monitor memory, CPU utilization, and disk space to make certain your system has enough of these resources. You can also use System Monitor to see how often your system reads from disk. If your system is accessing the disk often, see Monitoring and Tuning Hardware Performance for ways to decrease hard-disk bottlenecks.

If, after monitoring your hardware, you determine that your server environment has enough resources, you must monitor and tune your applications. For more information, see Monitoring and Tuning Hardware Performance.

If you need to redesign an application to improve response time, consider replacing Microsoft Visual Basic® Scripting Edition (VBScript) applications with managed-code applications developed with C# or Microsoft Visual Basic .NET. Test your applications at twice the expected load to see how they perform. You can load-test and measure response time by using the Microsoft Web Application Stress tool and the Application Center test tool.

If, after monitoring your hardware, you determine that a lack of server resources is causing problems, consider adding resources like memory and CPUs. You should also consider enabling the following features to help manage system resources:

  • Application pool queue length limits: Prevents too many requests from queuing up and overloading the system.
  • CPU monitoring: Includes several features that control system resources used by a process or group of processes.
  • Bandwidth throttling: Controls the maximum amount of bandwidth dedicated to Internet traffic on a server.
  • Process recycling: Enables you to configure IIS to periodically restart worker processes in an application pool for better process management.
  • Web gardens: Creates an application pool that has multiple worker processes serving the requests routed to that pool, which reduces lock contention.
Related Topics
  • For more information on the System Monitor tool, Web Application Stress tool, and Application Center test tool, see Performance Monitoring and Scalability Tools
  • For more information on performance monitoring, including procedural information on how to work with counters; how to create and configure counter logs, trace logs, and alerts; and a list of best practices; see Monitoring Performance in Windows Help.


Performance Monitoring and Scalability Tools

Monitoring your server is a crucial part of server administration. Using appropriate monitoring tools, you can detect server problems, evaluate the results of changes to your Web site content, and plan upgrades to make your sites more accessible to users. The appropriate monitoring tool and method depends on the information you need.

You can also monitor your server by examining logs generated by IIS. These logs extend beyond those generated by Microsoft Windows. For more information on logging, see Logging Site Activity.

This topic includes information on the following monitoring tools:

  • System Monitor
  • Performance Logs and Alerts
  • Events Viewer
  • Task Manager
  • Network Monitor
  • Log Manager
  • Web Application Stress Tool
  • Application Center Test Tool

System Monitor

The Windows performance monitoring tool, System Monitor (formerly known as Performance Monitor), is a Microsoft Management Console (MMC) snap-in that you can use to monitor your server's activity and to summarize its performance at selected intervals. By using this tool, you can display performance data in real-time charts or reports, collect data in files, and generate alerts when critical events occur. The data can be used to determine the cause of system bottlenecks and to fine-tune system and application performance.

Performance Bottlenecks

A bottleneck is a point of slow data transmission in your server environment. Bottlenecks most often result from insufficient resources, like memory or CPU, or from improper configuration of software, hardware, and network resources. For example, a processor bottleneck occurs when processes begin backing up because the server does not have enough processor cycles to efficiently complete the number of requests. Poor application design is also a common cause of bottlenecks. A poorly designed application can influence a server like IIS, which is capable of processing thousands of requests per second, and reduce processing to a fraction of the server's capabilities.

Fixing bottlenecks requires you to monitor your server environment, with the help of performance counters and monitoring tools, like System Monitor, and to collect data about specific components and resources like the CPU, memory, applications, and hardware. Analysis of your monitoring data may reveal problems, such as excessive demand on certain resources or components, which causes bottlenecks.

Performance Counters

System Monitor examines the output of performance counters. Performance counters monitor the activity of specific performance objects. In other words, performance counters monitor specific services or mechanisms controlling server resources. For example, if you click Add (the plus sign) on the System Monitor toolbar, you can view a list of performance objects from the Performance Object list. Click the Processor object to view a list of corresponding counters, like the % Processor Time counter. From this window, you can add or remove counters to the graphic display of System Monitor, or you can configure the counters to log in a particular way. Numerous counters running at the same time can cause a small decrease in performance, so be selective.

Members of the Microsoft Windows Server 2003 family include hundreds of counters. IIS installs its own counters, including World Wide Web Publishing Service (WWW service), WWW service cache, FTP service, and Microsoft Active Server Pages (ASP). The WWW service counters, FTP service counters, and ASP object counters monitor connection activity for scripts. For a detailed list of counters that are related to performance, see Performance Counters Reference.

System Monitor is designed to provide both short-term and long-term information about the load on your server and sites. The following table lists some useful counters and provides ideal average values for each counter. The System Monitor graph plots on a scale of zero to 100 (by default), so it may be necessary to change the scale for individual counters that register small values.

Object\Counter | Ideal Value
Memory\Pages/sec | 0-20 (if over 80, indicates problem)
Memory\Available Bytes | At least 20 MB
Memory\Committed Bytes | Not more than about 75 percent of physical memory size
Memory\Pool Nonpaged Bytes | Steady (slow rise may indicate a memory leak)
Processor\% Processor Time | Less than 75 percent
Processor\System Processor Queue Length | Four or less
(Logical or Physical) Disk\% Disk Time | As low as possible
(Logical or Physical) Disk\ Avg. Disk Queue Length | Less than 4
(Logical or Physical) Disk\Avg Disk Bytes/Transfer | As high as possible
System\Context Switches/sec | Monitor to make certain this number is low (relative to the number of system calls per second).
System\System Calls/sec | As low as possible
WWW service\Bytes Total/sec | As high as possible
WWW service cache\File Cache Hits % | As high as possible (static content) note Note This value may be low if the Kernel URI cache hits percentage is high.
WWW service cache\Kernel: URI Cache Flushes | Monitor to make certain this number is low (relative to the number of requests). note Note This number goes up every time a file is flushed from the HTTP.sys response cache (HTTP.sys is the kernel-mode device driver in IIS 6.0), which means that the content has not been accessed in the last two to four minutes. The only way to reduce this is to flush this cache less frequently, although this can mean that HTTP.sys uses more memory on content that is not being accessed or is simply outdated.
WWW service cache\Kernel: URI Cache Misses | As low as possible
WWW service cache\Kernel: URI Cache Hits % | As high as possible (static content)
Active Server Pages\Request Wait Time | As low as possible
Active Server Pages\Requests Queued | As low as possible
Active Server Pages\Transactions/sec | As high as possible note Note ASP transactions degrade overall server performance because each transaction requires interaction with a database. If you are concerned with performance on your machine, use ASP transactions sparingly.

For more information, search for "system monitor" in Windows Help.

Performance Logs and Alerts

Performance logs and alerts contain features for logging counter and event trace data, and for generating performance alerts. With counter logs, you can record data about hardware usage and the activity of system services from local or remote computers. Logging can occur manually on demand or automatically based on a user-defined schedule. Continuous logging, subject to file-size or duration limits, is also available. Logged data can be viewed using the System Monitor display, or can be exported to spreadsheet programs or databases for analysis and report generation.

Trace logs record data as certain activity occurs, for example disk I/O or page faults. When the event occurs, the provider sends the data to the log service. For more information on this tool, see Capacity Planning Tracing.

Events Viewer

The Event Log service records events such as errors or the successful starting of a service. You can view the event logs with the Events Viewer. You can also use Events Viewer to monitor system, security, and application event logs. You can use this information to better understand the sequence and types of events that resulted in a particular performance problem. For more information on this tool, search for "event viewer" in Windows Help.

Task Manager

Task Manager displays real-time network utilization data (including CPU and memory usage) for the various network interfaces on your computer. Use Task Manager to view ongoing tasks and threads, to change the assigned priority of processes, and to monitor networking and user information. For more information on this tool, search for "task manager" in Windows Help.

Network Monitor

Network Monitor captures network traffic information and gives detailed information about the frames being sent and received. This tool can help you analyze complex patterns of network traffic. Network Monitor can help you view the header information included in HTTP and FTP requests. Generally, you need to design a capture filter, which functions like a database query and singles out a subset of the frames being transmitted. You can also use a capture trigger that responds to events on your network by initiating an action, such as starting an executable file. An abbreviated version of Network Monitor is included with members of the Windows Server 2003 family. A complete version of Network Monitor is included with Microsoft Systems Management Server. For more information on this tool, search for "network monitor" in Windows Help.

Log Manager

As you plan a Web site, it is important to account for future growth and understand which parts of the IIS subsystem within the Windows Server 2003 family are likely to be performance-affected by increasing loads. This is called capacity planning. See Capacity Planning Tracing for information on how to use Log Manager for capacity planning.

Web Application Stress Tool

The Web Application Stress tool is designed to realistically simulate multiple browsers requesting pages from a Web application. The Web Application Stress tool can be used to generate customizable loads on various Internet services. The Web Application Stress tool does have a limitation on the number of URLs that can be stressed at one time (approximately 100). For this reason, when testing large quantities of sites, the Web Application Stress tool may need to be used in conjunction with other tools, such as the Microsoft Web Capacity Analysis tool. The Web Application Stress tool is available on the latest versions of the Windows Resource Kit companion CD or from the Microsoft Web Application Stress Tool Web site. The Microsoft Web site also provides information on test tools, including scenarios and results. For more information, see Performance Testing with the Web Application Stress Tool.

Application Center Test

The Microsoft Application Center Enterprise Edition includes a variety of high-end server monitoring tools, such as the Application Center Test.

Related Topics

  • For more information on performance monitoring, see Monitoring Performance.
  • For more information on the tools used to monitor performance, see Using the Performance tools and Solving Performance Problems in Windows Help.


Monitoring and Tuning Web Application Performance

If a Web application runs slowly or does not perform properly, the performance of your server can be affected. This topic describes how to monitor and tune applications to improve your server's performance.

note Note Upgrading a poorly designed application to one that is well designed and thoroughly tested can improve server performance dramatically. Keep in mind, however, that your Web applications can be affected by back-end latencies, such as legacy systems and remote data sources. If developers design applications to get data from another Web site, service, or server, and that remote entity experiences problems, your server might encounter a bottleneck that you may not be able to remedy.

You can monitor the following performance counters to determine if your Web applications are creating a bottleneck on your server.

ASP Counters

If you are running Active Server Pages (ASP) applications on your server, these counters can help you determine how well the applications are performing. The counters are the sum of the ASP performance counters for all processes hosting ASP and cannot be broken down by process. For information on monitoring the performance of your ASP.NET applications, see ASP.NET Performance Monitoring.

Counters | Description
Active Server Pages\ Requests/Sec | Excludes requests for static files or other dynamic content, and can fluctuate considerably based on the complexity of the ASP pages and the capacity of your Web server. If this counter is low during spikes in traffic on your server, your applications may be causing a bottleneck.
Active Server Pages\ Requests Executing | Indicates the number of requests currently executing (for example, the number of active worker threads). Request Execution Time can be somewhat misleading because it is not an average. For example, if you regularly receive 30 requests for a page that executes in 10 milliseconds (ms) to every one request for a page that executes in 500 ms, the counter is likely to indicate 10 ms, although the average execution time is over 25 ms. It is difficult to give an ideal value for Requests Executing. If pages execute quickly and don't wait for I/O (for example, loading a file or making a database query), this number is likely to be low (little more than the number of processors when the machine is busy). If pages must wait for I/O, the number of pages executing is likely to be higher (anything up to AspProcessorThreadMax multiplied by the number of processors, multiplied by the number of processes hosting ASP). If Requests Executing is high, Requests Queued is large, and the CPU utilization is low, you may need to increase AspProcessorThreadMax. When enabled, thread gating seeks to optimize Requests Executing.
Active Server Pages\ Request Wait Time

Active Server Pages\ Request Execution Time

 Request Wait Time indicates the number of milliseconds the most recent request was waiting in the queue. Request Execution Time indicates how many milliseconds the most recent request took to execute. The user's response time is proportional to Request Wait Time plus Request Execution Time, plus network latency.
Active Server Pages\ Requests Queued | Ideally, Requests Queued and Request Wait times should remain close to zero, but they go up and down under varying loads. The maximum number for Requests Queued is determined by the metabase setting for AspRequestQueueMax. If the limit is reached, client browsers display "HTTP 500/ Server Too Busy." If these numbers deviate a great deal from their expected range, you probably need to rewrite your ASP applications to improve performance.

WWW Service Counters

These counters will help you determine how well the World Wide Web Publishing Service (WWW service) is processing Common Gateway Interface (CGI), Internet Server API (ISAPI), Post, and Get requests.

Counters | Description
WWW service\ CGI Requests/sec WWW service\ ISAPI Extension Requests/Sec | These counters report the rates that your server is processing CGI and ISAPI application requests. If these values drop while under increasing loads, you might need to redesign the applications. note Note ASP is an ISAPI extension and is included by the second counter.
WWW service\ Get Requests/sec WWW service\ Post Requests/Sec | These counters reflect the rate at which these two common HTTP request types are made to your server. Post requests are generally used for forms and are sent to ISAPIs (including ASP) or CGIs. Get requests make up almost all other requests from browsers and include requests for static files, ASPs and other ISAPIs, and CGI requests.

Tuning Web Applications

This section does not attempt to discuss in detail the intricacies of tuning your Web applications, but it provides general recommendations to improve application performance. Consider the following information when planning and testing your Web applications:

  • Whenever possible, use managed code (C#, or Visual Basic .NET), Microsoft ASP.NET, or ISAPI applications. C# and Visual Basic .NET applications run faster than ASP applications because the run-time environment executes compiled code. All of these types of applications run faster than equivalent CGI applications.
  • Avoid managed code to unmanaged code hops in your applications, if possible.
  • Use static files wherever possible. Static files do not require large amounts of memory or disk activity to process.
  • Minimize initialization processing wherever possible.
  • Design your site so that applications push the processing load onto the client. Client-side processing helps to avoid network latencies, conserves server-side resources, and allows changes to appear instantaneously to the user. A common example is adding client-side code to validate that forms have been filled out with good data, such as checking that e-mail addresses are well formed or credit card numbers have a correct checksum. However, the server must still validate the data, because malicious clients could send malformed data. Client-side checks reduce roundtrips and improve interactivity.
  • Make sure that debugging for ASP is turned off on your production servers, and verify that the AppAllowDebugging metabase property is set to false.
  • Set expire headers for all images and for HTML wherever possible so that these types of files are stored in the client's cache.
  • Avoid storing apartment-threaded components in ASP application or session state, which includes all Visual Basic components. Java and most C++ objects are not included.
  • Use Secure Sockets Layer (SSL) only when necessary. Using the HTTPS protocol is much more expensive than standard HTTP. If you do use SSL, ensure that the information being sent, such as credit card numbers or medical information, is sensitive enough to warrant the added performance expense. For more information about security tuning issues, see Performance and Security.
  • Run IIS in Worker Process Isolation Mode, which can be configured to periodically restart worker processes assigned to an application pool. Recycling worker processes minimizes some problems attributed to faulty Web applications.
  • Establish Web gardens. A Web garden is an application pool running multiple worker processes.
  • Enhance database-driven performance in a production environment by using Microsoft SQL Server™. Be sure to create and maintain good indexes to minimize I/O on your database queries. Also, use stored procedures. Stored procedures take much less time to execute and are easier to write than an ASP script designed to do the same task.
  • As a general rule, if you have an ASP script that is more than 100 lines long (counting lines of code in files brought in using the #include processing directive), consider creating a COM+ component to provide the same function. If written efficiently and debugged properly, COM+ components can offer 20 to 30 times the processing speed of a script for the same dynamic page. The easiest way to measure the size of an ASP script with #include is to change the file extension of the page from .asp to .stm, and then open the .stm file by using your browser. Use your browser's View Source command to display the .asp file and lines of code from the included files.
  • Test applications before they go live on your site. If your production Web server is a multiprocessor system, be sure to stress test on a multiprocessor system so that you can identify multiprocessor scaling problems and race conditions in your script and components. The Web Application Stress tool is good for this kind of stress testing. For more information, see Performance Monitoring and Scalability Tools.

Related Topics

  • For more information on performance monitoring, see Monitoring Performance and Solving Performance Problems in Windows Help.
  • For more information on configuring applications to run on IIS, including information about application isolation modes and configuring ASP applications, see Configuring Applications.
  • For information on configuring IIS to host your applications, including features such as application pools, Web gardens, and CPU monitoring, see Configuring Servers for Applications.
  • For information on developing and using ASP.NET and ASP Web applications, see Web Application Guide


Monitoring and Tuning Hardware Performance

By using the performance counters that are built into Microsoft Windows, you can monitor performance to determine equipment needs. After changes are made, monitoring can be used to determine whether the changes had the desired effect, or if additional changes are needed.

This topic describes the counters you can use to monitor the following hardware components, including recommended values and other tuning strategies for each component:

  • Monitoring Memory
  • Monitoring Processor Capacity
  • Monitoring Multiprocessor Systems
  • Monitoring Network Capacity and Bandwidth
  • Monitoring and Optimizing the Hard Disk

Monitoring Memory

The biggest performance gains with IIS occur when you resolve insufficient memory issues. Before making any decisions about changing your hardware configuration, rule out memory problems. You should monitor memory first to verify that your server has enough memory, and then move on to other parts of your server environment. Problems caused by memory shortages can often appear to be problems in other parts of the system. To run a member of the Microsoft Windows Server 2003 family with IIS 6.0, a dedicated Web server must have a minimum of 128 MB of RAM, although depending on the resource needs of your custom applications, more RAM might be necessary. If your custom applications require large amounts of memory resources, use 256 megabytes (MB) to 1 gigabytes (GB) of RAM. Additional memory is particularly beneficial for e-commerce sites, sites with a lot of content, and sites that experience a high volume of traffic.

You can use System Monitor to determine if the current amount of memory on your server is sufficient for your needs. System Monitor graphically displays counter readings as they change over time. For more information on System Monitor, see Performance Monitoring and Scalability Tools.

Monitor the following counters to determine if there are performance bottlenecks associated with memory.

Counters | Monitor
Memory\Available Bytes | Try to reserve at least ten percent of memory available for peak use.
Memory\Page Faults/sec

Memory\Pages Input/sec

Memory\Page Reads/sec

Memory\Transition Faults/sec

 If a process requests a page in memory and the system cannot find it at the requested location, this constitutes a page fault. If the page is elsewhere in memory, the fault is called a soft page fault (measured by Transition Faults/sec). If the page must be retrieved from disk, the fault is called a hard page fault. Most processors can handle large numbers of soft faults without consequence. However, hard faults can cause significant delays.

Page Faults/sec is the overall rate at which the processor handles both hard and soft page faults. Pages Input/sec is the total number of pages read from disk to resolve hard page faults. Page Reads/sec is the number of times the disk was read to resolve hard page faults. Pages Input/sec will be greater than or equal to Page Reads/sec and can give you a good idea of your hard page fault rate. If these numbers are low, your server should be responding to requests quickly. If they are high, it can be because you have dedicated too much memory to the caches, not leaving enough memory for the rest of the system. You might need to increase the amount of RAM on your server, although lowering cache sizes can also be effective.
Memory\Cache Bytes | Reveals the size of the file system. The cache is set to use up to 50 percent of available physical memory by default. Because IIS automatically trims the cache if it is running out of memory, be sure to monitor the trends of this counter.
WWW service cache\File Cache Flushes

WWW service cache\File Cache Hits

WWW service cache\File Cache %

These counters describe the user-mode file cache. The file cache is basically a file name or file-contents cache. If a user requests a file, IIS searches the file cache and returns the file, if it is located in the cache. If IIS does not locate the file in the cache, it will read from the hard disk and return the file, thereby causing a hard page fault.

File Cache Flushes represents the number of times IIS purges an entry from the World Wide Web Publishing Service (WWW service) cache. An entry is purged if the file has changed or if the file wasn't accessed within 30 seconds. If the counter value is high, IIS is filling the cache with files that are not being accessed and are subsequently flushed.

File Cache Hits is the number of times IIS locates a file in the cache.

File Cache % is the cache hit rate. This is the percentage of times IIS locates a requested file in the cache. If your cache-hit rate is low (for example, 70 percent) you might want to consider redesigning your site around a smaller amount of "hot" information that is readily found in the file cache and thereby improves performance.
Process\Page File Bytes

Process\Page File Bytes Peak

Paging File\% Usage

Paging File\% Usage Peak

 These counters reflect the amount of the Page File instance in use. The larger the Page File, the more memory the system commits to it. A member of the Windows Server 2003 family creates a Page File on the system drive. You can create a Page File on each logical disk, and you can change the sizes of the existing files. In fact, striping a Page File across separate physical drives improves paging file performance (that is, it uses drives that do not contain your site's content or log files). Remember that the paging file on the system drive should be at least twice the size of the physical memory, so that the system can write the entire contents of RAM to disk if the system unexpectedly locks up or shuts down.
Memory\Pool Paged Bytes

Memory\Pool Non-paged Bytes

Process\Virtual Bytes (W3wp.exe)

Process\Virtual Bytes (Inetinfo.exe)

Process\Working Set (W3wp.exe)

Process\Working Set (Inetinfo.exe)

 Pool Paged Bytes and Pool Non-paged Bytes monitor the pool space for all processes on the server.

The Virtual Bytes counters monitor the amount of virtual address space reserved directly by IIS, either by the Inetinfo.exe process (in which the core of IIS runs when set to IIS 5.0 isolation mode) or by the W3wp.exe process (in which isolated or pooled applications run when set to worker process isolation mode) instantiated on your server.

The Working Set counters measure the number of memory pages used by each process. Be sure that you monitor counters for all instances of W3wp.exe on your server; otherwise, you will not get an accurate reading of virtual memory used by IIS. The system's memory pools hold objects created and used by applications and the operating system. The contents of the memory pools are accessible only in privileged mode. That is, only the kernel of the operating system can directly use the memory pools; user processes cannot. On servers running IIS 6.0, threads that service connections are stored in the non-paged pool along with other objects used by the service, such as file handles and sockets.

In addition to adding more RAM, you can employ the following processes to enhance memory performance. For specific details about how to perform these processes, see the latest version of the Internet Information Services Resource Kit.

  • Improve data organization.
  • Employ disk mirroring or striping.
  • Replace Common Gateway Interface (CGI) applications with managed code (ASP.NET) or Internet Server API (ISAPI) applications.
  • Enlarge paging files.
  • Eliminate unnecessary features.
  • Change the balance of the file system cache to the IIS working set.

Monitoring Processor Capacity

With users demanding quick response time from Web sites and the increasing amount of dynamically generated content on these sites, a premium is placed on fast and efficient processor usage. Bottlenecks occur when one or more processes consume the majority of the processor time. This forces threads that are ready to be executed to wait in a queue for processor time. Adding other hardware, whether memory, hard disks, or network connections, to try to overcome a processor bottleneck is not effective and may create larger problems.

Monitor the following counters to determine whether there are performance bottlenecks associated with processor capacity.

Counter | Monitor
System\Processor Queue Length | Displays the number of threads waiting to be executed in the queue that are shared by all processors on the system. The server has a bottleneck if this counter has a sustained value of two or more threads.
Processor\%Processor Time | Processor bottlenecks are characterized by situations in which % Processor Time numbers are high, while the network adapter card and disk I/O remain well below capacity. On a multiprocessor computer, examine the % Processor Time counter to pick up any imbalance between processors and processing time.
Thread (svchost/host number)\Context Switches/sec

System\Context Switches/sec

 If you decide to increase the size of any of the thread pools, you should monitor this counter. Increasing the number of threads may increase the number of context switches to the point that performance decreases rather than increases. Ten thousand or more context switches per second is high. If you see numbers this high, consider reducing thread pool size. Balancing threads against overall performance as measured by connections and requests can be difficult. Any time you tune threads, follow up with overall Performance Monitoring to see whether performance increases or decreases.

To determine if you should adjust the thread count, compare the number of threads and the processor time for each thread in the process to the total processor time. If the threads are constantly busy, but are not fully using the processor time, performance might improve by creating more threads. However, if all the threads are busy and the processors are close to their maximum capacity, it is best to distribute the load across more servers rather than increasing the number of threads.
Processor\Interrupts/sec

Processor\% DPC Time

 Use these counters to determine how much time the processor is spending on interrupts and deferred procedure calls. These two factors can be another source of load on the processor. Client requests can be a major cause of interrupts and deferred procedure calls. Some new network adapter cards include interrupt moderation, which accumulates interrupts in a buffer when the level of interrupts becomes too high.

Monitoring Multiprocessor Systems

IIS is designed to scale on multiprocessor machines, but scalability can be undermined by poor Web site and Web application design. Web gardens and process recycling can help minimize performance issues related to faulty applications. However, be sure to monitor and test the scalability of your Web site and Web applications on a multiprocessor machine. Rule out bottlenecks in all other areas of the system before changing settings on your multiprocessor machine.

You should also consider assigning processes to a specific processor (called processor affinity) to better manage how your server handles requests and application processing. In addition, you should enable the Quality of Service features in IIS before changing settings on your multiprocessor machines. The Quality of Service features are designed to limit resources to particular Web sites or Web applications to ensure that there are enough resources for the rest of the system.

Monitor the following counters to determine if there are performance bottlenecks associated with your multiprocessor machine.

Counter | Monitor
Processor\% Processor Time (_Total) | Measures processor activity for all processors in the computer by taking the sum of the average non-idle time of all processors during the sample interval and dividing that sum by the number of processors. For example, if all processors are busy for half of the sample interval, on average, it displays 50 percent. It also displays 50 percent if half of the processors are busy for the entire interval, and if the others are idle.
Thread\% Processor Time (_Total/_Total) | Measures the amount of processor time for a thread.

Managing Processor Affinity on Multiprocessor Systems

Setting processor affinity means assigning specific processes or applications to a specific processor. Controlling processor affinity can improve performance by reducing the number of processor cache flushes as threads move from one processor to another. This can be a good option for dedicated file servers. However, be aware that dedicating a program to a particular processor may not allow other program threads to migrate to the least-busy processor.

If you want to assign a particular process or program to a single processor to improve its performance at the expense of other processes, change the SMPProcessorAffinityMask property in the IIS Metabase.

Monitoring Network Capacity and Bandwidth

The time it takes for requests and responses to travel to and from your server is one of the largest limiting factors in user-perceived server performance. On a site consisting primarily of static content, network bandwidth is the most likely source of a performance bottleneck. You can mitigate some of these issues by tuning the connection you have to the network and maximizing your effective bandwidth.

The simplest way to measure effective bandwidth is to determine the rate at which your server sends and receives data. There are a number of performance counters that measure data transmission in many components of your server. These include counters on the WWW service, FTP service, and SMTP service, as well as the TCP object, the IP object, and the Network Interface object. Each of these counters reflects different Open Systems Interconnection (OSI) layers. For a detailed list of these counters and their analyses, see Performance Counters Reference. For information on how to manage the amount of bandwidth your applications use, see Throttling Bandwidth.

Monitor the following counters to determine network capacity and bandwidth.

Counters | Description
Network Interface\Bytes Total/sec | To determine if your network connection is creating a bottleneck, compare the Bytes Total/sec counter to the total bandwidth of your network adapter card. To allow headroom for increases in traffic, you should limit normal usage to no more than 50 percent of capacity. If this number is very close to the capacity of the connection, and processor and memory use are moderate, the connection can be a problem.
WWW service\Current Connections WWW service\Total Connection Attempts | If you are running other services that also use the network connection on the computer, you should monitor these counters to check whether your Web server can use as much of the connection as it needs. Remember to compare these numbers to memory and processor usage figures so that you can be certain that the connection is the problem.

Monitoring and Optimizing the Hard Disk

Optimizing the number of times IIS accesses the hard disk can reduce hard-disk bottlenecks and greatly improve your server's performance. Optimizing disk access involves monitoring memory requirements and determining the size and number of files being requested. Hard-disk bottlenecks are most often seen on sites composed of very large file sets that are accessed randomly. If your server has a small amount of RAM, and either a large number of different files are being requested or the size of the requested files is large, IIS is unable to maintain copies of the files in RAM for faster access. As a result, IIS must retreive the files from the hard disk. The access speed and size of the hard disk determine how quickly IIS can locate a requested file.

IIS writes logs to disk, so you should see regular disk activity even with 100 percent client cache hits. Generally speaking, if there is high disk read or write activity other than logging, it means that other areas of your system need to be tuned. For example, hard-page faults cause large amounts of disk activity, but they are indicative of insufficient RAM.

To improve disk access, use a redundant array of independent disks (RAID) and striped disk sets. For more information on RAID and striped disk sets, see Windows Server 2003 family Help. If you run IIS on the same machine as your database server, you may need either gigabytes of RAM to minimize access delays or a drive controller with a large RAM cache. You should also maintain redundancy, so that you are not forced to restore from backup copies when a single drive ceases to function. Many newer controllers permit hot swapping, which replaces a failed drive without forcing server downtime.

To monitor your disk drives, use System Monitor to log the percentage of CPU used, network card saturation, and the % Disk Time counter of the Physical Disk object. If the % Disk Time counter is high, but the CPU and network card are not saturated, the disk drive is creating a bottleneck.

Typically, you will use the Physical Disk counters to watch for spikes in the number of disk reads when your server is busy. If you have enough RAM, most connections result in cache hits, unless you have a database stored on the same server and clients are making dissimilar queries. This situation precludes caching.

Be aware that logging also can cause disk bottlenecks. To avoid bottlenecks caused by logging, put your logs on a separate device. If there are no obvious disk-intensive issues on your server, but you see lots of disk activity anyway, you should check the amount of RAM on your server immediately to make sure that you have enough memory.

To determine the frequency of disk access, log the following counters.

Counters | Monitor
Processor\% Processor Time Network Interface Connection\Bytes Total/sec PhysicalDisk\% Disk Time PhysicalDisk\Current Disk Queue Length | If all four of these counters have high values, the hard disk is not causing a bottleneck for your site. However, if the % Disk Time is high and the processor and network connection are not saturated, the hard disk may be creating a bottleneck. The Current Disk Queue Length value should not be greater than 2 for any sustained period of time. If the Physical Disk performance counters are not enabled on your server, use the diskperf -yd command at the command prompt.

Related Topics

  • For more information on performance monitoring, see Solving Performance Problems in Windows Help.
  • For more information on improving performance on multiprocessor systems, see Processor Affinity and Configuring Web Gardens.


Scalability

Scalability is the capability of a piece of hardware or software to easily expand to meet future computing needs. Each version of Internet Information Services (IIS) is designed for better performance and scalability than the previous version. However, scalability can be impaired by hardware configurations and bottlenecks in poorly designed or poorly tested Web applications. Administrators can dramatically improve the scalability of their IIS server environment with careful planning and assessment of their infrastructure, which includes hardware, distributed applications, and custom components.

This section includes the following information, describing how to assess and plan for improved scalability with your IIS Web server:

  • Designing Scalability into Server Environments: Describes methods for scaling, as well as planning and designing scalability into a Web server environment.
  • Scaling Up: Describes the gains and regressions that administrators might experience when trying to improve scalability by adding resources like RAM and CPUs to a server.
  • Scaling Out: Describes the gains and regressions that administrators might experience when trying to improve scalability by adding more Web servers to their existing system. This topic also describes Web farms and Web gardens.
Related Topics
  • The Microsoft Servers Web site offers scalability scenarios and solutions using other Microsoft products, including the following:
    • Microsoft Application Center
    • Microsoft® BizTalk® Server
    • Microsoft Commerce Server
    • Microsoft SQL Server™


Designing Scalability into Server Environments

Scalability is a concern to Web administrators because they need to ensure that their Web presence can handle steady traffic growth, as well as unanticipated traffic volumes. If the software and hardware are not scalable, clients connecting to that server experience errors or problems. IIS is designed to be scalable, though hardware configurations and custom applications can undermine the software.

This topic descries how to design scalability into your Web server environment so that your IIS server performs optimally for your needs.

The scalability of your Web server is dependent on the least scalable part in the Web server environment; if one piece fails, the scalability of the whole Web server environment suffers. Scalability in a Web server environment can only be achieved if it is designed into every piece of the system. The server environment, including hardware, software, Internet Server API (ISAPI) filters, custom components, and applications must be scalable. For this reason, improving scalability requires long-term assessment, planning, and relentless testing.

Typically, administrators cannot build a scalable Web presence and underlying infrastructure on their own; they have to work with designers and managers through every step of the process, from conception to production. How you scale and the method you choose to scale depends largely on the goals for your Web presence, budget, and architectural guidelines for your organization.

This topic includes the following information, describing from a high level what designing scalability into your system requires:

  • Define the Long-Term Objective for Your Web Presence
  • Know Your Users
  • Define Your Design Goals with Scalability as a Priority
  • Test the Server Environment, Client Connections, and Applications
  • Keep Lines of Communication Open

Define the Long-Term Objectives for Your Web Presence

The long-term objectives for your Web presence are probably determined by the nature of your business. For example, Internet service providers (ISPs) want to host as many sites on one server as they possibly can while maintaining good performance and with minimal server administration. And e-commerce sites typically want fast and efficient processing of financial transactions through secure connections. If you are using IIS for your intranet, your long-term objective may be to place all of your human resources benefits and payroll forms online. Defining your objectives helps determine how you build your infrastructure.

Know Your Users

Determine what your users want and how they'll access your site's products and services. For example, are your users accessing your site through a T1 connection or a 56K modem? If the products and services offered on your site require large amounts of bandwidth to view or experience properly, you may frustrate a large population of potential users. Also, the strain of sending large image files or music files to a dial-up modem will undermine the performance and scalability of your system for other users. Design your site so that users connecting with a dial-up modem will still have a rich experience.

Define Your Design Goals with Scalability as a Priority

Ensure that all parties involved in the development of your Web presence understand that scalability is to be designed into every part of the server environment. Establish plans for redundancy and consider designing your server environment along the following guidelines:

  • Be consistent with the frequently used functions in your code base.
  • Make configurations simple.
  • Ensure that your site is configurable by feature so that the feature can be removed, if it compromises scalability and performance.
  • Minimize the number of roundtrips between the middle tier and the back end.
  • Minimize the number of roundtrips between the client and the server.
  • Optimize data flow.
  • Consider a distributed architecture and distributed applications.
  • Determine critical components and ensure that those components are scalable to your defined goals.
  • Consider offline processing.
  • Make specific error events consistent across features; that is, use the same error code for issues requiring similar fixes.
  • Define standards for rendering, writes, membership, and notifications.
  • Use services that already exist.

Test the Server Environment, Client Connections, and Applications

Consider the following recommended practices for testing your server:

  • Test the server with a larger number of connections than you ever expect to have on the server.
  • Know how the server performs under load.
  • Know when performance begins to degrade.
  • Know what you can do to prevent the server from failing.
  • When preparing your production servers, perform a scriptable install across the platform for consistency and also to reduce human costs.

You can also monitor your server by examining logs generated by IIS. These logs extend beyond those generated by the Microsoft Windows® Server 2003 family.

In addition, you should perform client testing to verify that the site works according to the design.

Lastly, be sure to test applications for scalability. Any application (managed Microsoft ASP.NET or unmanaged ISAPI) can have design flaws that result in scalability issues. You may need to remove or redesign an application if you determine through testing that the application reduces your performance or scalability.

Keep Lines of Communication Open

You should maintain communication with designers and testers for efficient troubleshooting. Administrators need to know when it is time to scale with hardware or software versus a redesign of site features.

Related Topics
  • For more information on monitoring and improving server performance, see Performance Monitoring.
  • For information on tools for monitoring performance and scalability, see Performance Monitoring and Scalability Tools, and see Using the Performance Tools in Windows Help.
  • For information on logging, see Logging Site Activity.


Scaling Up

Scaling up means adding hardware, such as RAM or CPUs, to a Web server to increase the number of sites that a server can host. Scaling up can be an inexpensive way to boost performance, especially if you host static-content Web sites. For example, an Internet service provider (ISP) that wants to scale up can add more RAM and CPUs to an existing server that currently serves 5,000 Web sites to potentially enable the server to handle 8,000 Web sites. The impact to the budget and resources is limited to adding pieces of hardware, in comparison to adding servers, software licenses, and more administrators to help manage more servers.

One of the primary benefits of scaling up pertains to finding and fixing errors. If performance issues arise, problems are typically easier to locate when scaling up because the number of servers and connections to back-end servers has not grown.

Performance results when scaling up are typically not as good as when scaling out. Adding more resources to a server can increase performance, but requests coming into the server still have to share resources. In other words, performance does not double because you have doubled the amount of RAM in a server. Shared resources can result in lock contention, which is a much bigger issue when scaling up than scaling out.

Before making changes to your server, establish a baseline for the performance and scalability of your server in a test environment that mimics your production environment. After you have established this baseline, you will know very quickly if a change to your system has positive or negative effects.

For ISPs looking to host tens of thousands of sites on IIS 6.0, the Microsoft Web site provides information about the Scalable Hosting Solution (SHS), an IIS virtual hosting Internet Server API (ISAPI) filter. The SHS filter enhances the ability of IIS to host thousands of static-content sites by using an ISAPI filter that provides an alternate approach to configuring individual sites in the metabase.

Related Topics
  • For information on adding servers to an existing server, see Scaling Out.
  • For more information on SHS, see Scalable Hosting Solution Overview.


Scaling Out

Scaling out is the process of adding servers to an existing server environment to improve performance and to increase the number of Web sites that the system can host or publish. Scaling out reduces bottlenecks and lock contention because requests coming into the system do not share resources. The request load is balanced among servers.

Scaling out requires the purchase of more equipment and software licenses, so you need to understand exactly what is causing your performance and scalability issues before deciding to scale out. Keep in mind that scalability and performance results vary depending on your configuration, your site, and the size and types of downloadable files.

Web Farms

The best way to guarantee the availability and reliability of your Internet services is to publish your site with more than one computer, or a Web farm.

With several computers, your server environment can easily handle large volumes of client requests without creating delays. Sharing the load among more than one computer is especially vital for ISPs that support critical applications, such as those that conduct financial transactions, access databases, support corporate intranets, and perform other key functions on a daily basis.

Setting up a Web farm involves clustering and load balancing. For more information about these concepts and the specific processes for setting up replication and clustering on IIS, search for "clustering" and "load balancing" in Windows Help.

Web Gardens

A Web garden is an application pool that has multiple processes serving the requests routed to that pool. Web applications have increased scalability in a Web garden configuration because a lock does not block all processors in the multiprocessor machine. If one worker process serving a pool experiences an ASP lock, the other worker processes are still able to serve content and take over for the locked worker process. Web gardens use recyclable worker processes.

Related Topics
  • For information on increasing the number of sites that your server can host, see Scaling Up.
  • For information on tools and counters that can help you locate where your performance and scalability problems originate, see Performance Monitoring
    • .
  • For information on enabling and configuring a Web garden, see Configuring Web Gardens.


Quality of Service

Quality of Service (QoS) encompasses the set of methods or processes that a service-based organization implements to maintain a specific level of quality. In the context of Microsoft® Windows®, QoS is a set of service requirements that the network must meet to assure an adequate service level for data transmission. The goal of QoS is to ensure that particular sites or applications do not monopolize server resources like memory or CPU cycles. QoS helps administrators control how components of Internet Information Services (IIS) use resources, such as sites, application pools, or the World Wide Web Publishing Service (WWW service) as a whole.

This section includes the following information:

  • Limiting Connections : Describes how to set limits on the number of connections allowed to a Web server.
  • Setting Connection Timeouts: Describes how to set connection time-out values on a Web server.
  • Utilizing HTTP Compression: Describes HTTP compression and how it can improve bandwidth usage.
  • Throttling Bandwidth: Describes how to change the bandwidth used by a Web server and individual Web sites.
  • Enabling HTTP Keep-Alives: Describes how to use HTTP Keep-Alive requests to maintain an open connection.
  • Enabling CPU Monitoring: Describes how to monitor and stop problematic applications.
  • Configuring Application Pool Queue Length Limits: Describes how to limit the number of requests IIS stores in any application pool queue so the requests do not grow to such a large size as to exhaust server resources.


Limiting Connections

Connection limits restrict the number of simultaneous connections to your Web sites and your Web server. If the number of connections reaches the maximum allotted, all subsequent connection attempts are returned with an error, and then disconnected.

Limiting connections is a way to conserve bandwidth for other uses, such as e-mail servers, news servers, or another Web site running on the same installation. Limiting connections also conserves memory and protects against malicious attacks designed to overload your Web server with thousands of client requests.

To determine whether you should limit connections, use System Monitor to log the Current Connections, Maximum Connections, and Total Connection Attempts counters in the WWW Service and FTP Service objects. Continue logging until you have a good sense of the normal range; typically, this can take several days to a week or more and should be repeated at regular intervals. For more information, see Performance Monitoring.

You can establish global WWW service or FTP service connection limits for all Web and FTP sites, or you can establish connection limits on individual Web or FTP sites. IIS checks the global connection limit before checking connection limits set on individual sites. If the global connection limit has been exceeded, IIS returns error 403.9 (Forbidden - Too Many Users) regardless of the connection limit set for individual sites. While you can customize the connection limit error in IIS 5.0, IIS 6.0 does not allow you to customize this error.

The Unlimited connections option permits as many simultaneous connections as your network's bandwidth and processor can support. Be aware that allowing an unlimited number of simultaneous connections to your Web server exposes all sites on the server to the threat of a malicious attack where thousands of clients are instructed to connect to the server and delay subsequent service by consuming memory and bandwidth resources.

important Important You must be a member of the Administrators group on the local computer to perform the following procedure (or procedures), or you must have been delegated the appropriate authority. As a security best practice, log on to your computer using an account that is not in the Administrators group, and then use the Run as command to run IIS Manager as an administrator. From the command prompt, type runas /user:administrative_accountname "mmc %systemroot%\system32\inetsrv\iis.msc".

To set a global WWW or FTP service connections limit

  1. In IIS Manager, expand the local computer, right-click the Web Sites or FTP Sites folder, and then click Properties.
  2. Click the FTP Site tab to limit connections on the FTP service, or click the Performance tab to limit connections on the WWW service.
  3. Click the Connections limited to option, and in the box next to it, type the maximum number of simultaneous connections you want to allow on your Web or FTP service.
  4. Click Apply, and then click OK.

To set a Web or FTP site connections limit

  1. In IIS Manager, expand the local computer, expand the Web Sites or FTP Sites folder, right-click the Web or FTP site on which you want to set the connections limit, and click Properties.
  2. Click the FTP Site tab to limit connections on the FTP site, or click the Performance tab to limit connections on the Web site.
  3. Click the Connections limited to option, and in the box next to it, type the maximum number of simultaneous connections you want to allow on your Web or FTP site.
  4. Click Apply, and then click OK.
Related Topics
  • For information on another way to limit connections to your Web server, see Throttling Bandwidth.
  • For information about setting the CGI time-out, see Configuring CGI Applications.
  • For a list of counters related to performance, see Performance Counters Reference.
  • For information on connection timeouts, see Setting Connection Timeouts.


Setting Connection Timeouts

Connection time-outs help reduce the loss of processing resources consumed by idle connections. When you enable connection time-outs, IIS enforces the following types of connection time-outs at the connection level:

  • A connection time-out when the client has actually sent data to the server, but is now idle.
  • A server listen time-out when the connection to the server has been made, but no data has been sent by the client.
  • A response time-out (based on a configurable minimum bytes per second value).
  • A request time-out that prevents clients from issuing unreasonably slow requests to the server (for example, 1 bit per second).

To determine whether you should establish a connection time-out, use System Monitor to log the current connections, maximum connections, and total connection attempts counters in the World Wide Web Publishing Service (WWW service) and FTP service objects. Continue logging until you have a good sense of the normal range; typically, this can take several days to a week or more and should be repeated at regular intervals. For more information see, Performance Monitoring.

The ServerListenTimeout metabase property no longer exists. ServerListenTimeout has been replaced by the following metabase properties:

  • ConnectionTimeout: Specifies the amount of time, in seconds, that the server will wait before disconnecting an inactive connection.
  • MinFileBytesPerSec: When IIS responds to a client request, the MinFileBytesPerSec property determines the length of time the client has to receive the entire response. If the client machine takes too long to receive the entire response, the kernel-mode driver, HTTP.sys, terminates the connection according to the timeout value. The timeout value is calculated by dividing the size of the entire response (including headers) by the MinFileBytesPerSec property to obtain a maximum allowable response time period, in seconds. For example, a response whose size is 2 KB is given one second to complete if the MinFileBytesPerSec setting is configured to 2048. The default value is 240 bytes per second. This time period prevents a client machine from sending a request for a large response (like a file download) and then consuming the response at a maliciously slow rate to consume resources on the server and potentially interrupt service for other client machines.

important Important You must be a member of the Administrators group on the local computer to perform the following procedure (or procedures), or you must have been delegated the appropriate authority. As a security best practice, log on to your computer using an account that is not in the Administrators group, and then use the Run as command to run IIS Manager as an administrator. From the command prompt, type runas /user:administrative_accountname "mmc %systemroot%\system32\inetsrv\iis.msc".

To set a global WWW or FTP service connection time-out value

  1. In IIS Manager, expand the local computer, right-click the Web Sites or FTP Sites folder, and click Properties.
  2. On the Web Site or FTP Site tab, in the Connection timeout box, type the maximum number of seconds that IIS should maintain an idle connection before resetting the connection.
  3. For the WWW service, verify that the Enable HTTP Keep-Alives box is selected. For more information, see Enabling HTTP Keep-Alives.
  4. Click Apply, and then click OK.

To set a connection time-out value for a specific Web or FTP site

  1. In IIS Manager, expand the local computer, expand the Web Sites or FTP Sites folder, right-click a Web or FTP site, and click Properties.
  2. On the Web Site or FTP Site tab, in the Connection timeout box, type the maximum number of seconds that IIS should maintain an idle connection before resetting the connection.
  3. For the WWW service, verify that the Enable HTTP Keep-Alives box is selected. For more information, see Enabling HTTP Keep-Alives.
  4. Click Apply, and then click OK.
Related Topics
  • For information about how to throttle bandwidth, which is another way to limit connections to your Web server, see Throttling Bandwidth.
  • For information about setting the CGI time-out, see Configuring CGI Applications.
  • For a list of counters related to performance, see Performance Counters Reference.


Utilizing HTTP Compression

If your sites use large amounts of bandwidth, or if you would like to more effectively use bandwidth, consider enabling HTTP compression. HTTP compression provides faster transmission time between compression-enabled browsers and IIS. You can compress either static files only, or both static files and dynamic application responses. If your network bandwidth is restricted, HTTP compression can be beneficial, at least for static files, unless your processor utilization is already extremely high.

Dynamic processing can impact CPU resources. When compression is enabled on dynamic responses, the dynamic response is compressed every time it is requested. This means the dynamic response is not cached and your server may require more CPU cycles to compress and send the response every time it is requested. Compressed static responses can be cached and therefore do not impact CPU resources like dynamic responses do.

How HTTP Compression Works

When IIS receives a request, it checks whether the browser is compression-enabled. IIS then checks the file name extension to determine whether the requested file is a static file or contains dynamic content. If the file contains static content, IIS checks whether the file has previously been requested and is already stored in a compressed format in the temporary compression directory. If the file is not stored in a compressed format, IIS sends the uncompressed file to the browser and adds a compressed copy of the file to the temporary compression directory. If the file is stored in a compressed format, IIS sends the compressed file to the browser. No file is compressed until a browser requests it for the first time.

If the file contains dynamic content, IIS compresses the response as it is generated and sends the compressed response to the browser. No copy of the file is stored.

The performance cost of compressing a static file is modest and is typically incurred only once because the file is then stored in the temporary compression directory. The cost of compressing dynamically generated files is somewhat higher because they are not stored and must be regenerated with each request. The cost of expanding the file at the browser is minimal. Compressed files download faster, which makes them particularly beneficial to the performance of any browser that uses a network connection with restricted bandwidth (a modem connection, for example).

By default, compressed files are given an expiration date of January 1, 1997, to prevent proxy servers from serving cached copies of compressed files to browsers that are not compression-enabled. This also means that browsers do not display a cached copy of the file on the next user request, but return to the server for a fresh copy.

Enabling HTTP Compression

If your server generates a large volume of dynamic content, consider whether the additional processing cost of HTTP compression is one that you can reasonably afford. If the % Processor Time counter is already 80 percent or higher, enabling HTTP compression is not recommended.

To test HTTP compression

  1. To establish a baseline, use System Monitor to log the % Processor Time counter of the Processor object over several days. This counter has a total instance and a separate instance for each processor in the system. (If your server has more than one processor, you should watch the individual processors as well as the total to discover any imbalance in the workload.) Additionally, you should log the Bytes Sent/sec counter of the Network Interface object.
  2. Enable compression and continue to log the value of these counters for an extended period, preferably for several days, so you have a good basis for comparison.
  3. Compare the values with and without compression.

note Note If you see signs of blocking or bottlenecking during the test, you should promptly stop the test. A significant drop in the value of either counter indicates that performance with compression enabled has decreased relative to performance without compression enabled.

important Important You must be a member of the Administrators group on the local computer to perform the following procedure (or procedures), or you must have been delegated the appropriate authority. As a security best practice, log on to your computer using an account that is not in the Administrators group, and then use the Run as command to run IIS Manager as an administrator. From the command prompt, type runas /user:administrative_accountname "mmc %systemroot%\system32\inetsrv\iis.msc".

To enable HTTP compression

  1. In IIS Manager, expand the local computer, right-click the Web Sites folder, and then click Properties.
  2. Click the Service tab, and in the HTTP compression section, select the Compress application files check box to compress application files.
  3. Select the Compress static files check box to compress only static files for transmission to compression-enabled clients.
  4. In the Temporary directory box, type the path to a local directory or click Browse to locate a directory. Compressed files are kept in this temporary directory. The directory must be on a local drive on an NTFS-formatted partition. The directory cannot be a compressed directory and should not be shared.
  5. Under Maximum temporary directory size, click a folder size option. If you click the Limited to (in megabytes) option and enter a number in the text box next to it, IIS automatically cleans up the temporary directory according to a "least recently used" rule when the set limit is reached.
  6. Click Apply, and then click OK.

Related Topics

  • For a list of counters provided by IIS, see Performance Counters Reference.
  • For a list of all time-out values that can be set by IIS, see Timeouts Reference.


Throttling Bandwidth

note Note Bandwidth throttling is not supported on Internet Protocol Version 6 (IPv6) Web sites.

If the network or Internet connection used by your Web server is also used by other services such as e-mail or news, you may want to limit the bandwidth used by your Web server so it is available for those other services. If your Web server hosts more than one Web site, you can individually throttle the bandwidth used by each site.

Bandwidth throttling uses Packet Scheduler to manage when data packets are sent. When you configure a site to use bandwidth throttling using IIS Manager, Packet Scheduler is automatically installed, and IIS automatically sets bandwidth throttling to a minimum of 1024 bytes/second. However, if you use another method (for example, Active Directory® Service Interfaces [ADSI] or Windows Management Instrumentation [WMI]), you must install Packet Scheduler for bandwidth throttling to work correctly.

You should also note that when using ADSI or WMI to configure bandwidth throttling, you must set bandwidth throttling to 1024 bytes/second or greater because Packet Scheduler cannot enforce bandwidth throttling settings below 1024 bytes/second. Packet Scheduler should be uninstalled when it is not being used by individual sites or the World Wide Web Publishing Service (WWW service) as a whole. See Microsoft Windows Server 2003 family Help for the procedure to install or uninstall Packet Scheduler.

Before enabling bandwidth throttling, use System Monitor to examine the Bytes Total/sec or Current Bandwidth counter in the Network Interface object. If you want to compare incoming and outgoing traffic, examine both Bytes Sent/sec and Bytes Received/sec.

You should also compare the values from the Network Interface object with the total bandwidth of your network connection. With a "normal" load, your server should not use more than 50 percent of its total available bandwidth. If your server is subject to large peaks, keep the normal load lower than 50 percent. The remaining bandwidth can be used during peak periods.

If your server or a particular site is consistently using more than 50 percent of the available bandwidth, use the following procedures to throttle bandwidth.

Setting a global WWW service maximum bandwidth does not override already established bandwidth maximums for individual Web sites on the server. Individual sites throttle bandwidth according to their established maximum, while the global setting throttles all other unthrottled Web sites as a whole.

Global WWW service bandwidth throttling settings do no affect FTP sites or the FTP service as a whole.

important Important You must be a member of the Administrators group on the local computer to perform the following procedure (or procedures), or you must have been delegated the appropriate authority. As a security best practice, log on to your computer using an account that is not in the Administrators group, and then use the Run as command to run IIS Manager as an administrator. From the command prompt, type runas /user:administrative_accountname "mmc %systemroot%\system32\inetsrv\iis.msc".

To globally throttle WWW service bandwidth

  1. In IIS Manager, expand the local computer, right-click the Web Sites folder, and click Properties.
  2. Click the Performance tab, and in the Bandwidth throttling section, select the Limit the total network bandwidth available for all Web sites on this server check box.
  3. In the Maximum bandwidth (in kilobytes per second) box, type the maximum number of kilobytes per second you want each site contained in the directory to use.
  4. Click
  5. Click the Connections limited to option, and in the box next to it, type the maximum number of simultaneous connections you want to allow on your Web or FTP service.
  6. Click Apply, and then click OK.

To throttle the bandwidth used by an individual Web site

  1. In IIS Manager, expand the local computer, expand the Web Sites folder, right-click the Web site, and click Properties.
  2. Click the Performance tab, and in the Bandwidth throttling section, select the Limit the network bandwidth available to this Web site check box.
  3. In the Maximum bandwidth (in kilobytes per second) box, type the maximum number of kilobytes per second you want this site to use.
  4. Click Apply, and then click OK.

    5. important Important To disable bandwidth throttling on an individual site when a global bandwidth throttling setting is not present, clear the Limit the network bandwidth available to this Web site check box or set the MaxBandwidth metabase property to -1 using ADSI or WMI. If a global bandwidth throttling setting is present, the global setting automatically applies to the individual site when the check box is cleared. If you want an individual site to have virtually unlimited bandwidth when a global bandwidth throttling setting is present, do not clear the Limit the network bandwidth available to this Web site check box. Instead, enter a very high number in the Maximum bandwidth (in kilobytes per second) box, or set the MaxBandwidth metabase property to -2 using ADSI or WMI.

Related Topics

  • For more information about administering IIS with ADSI, see Using the IIS ADSI Provider.
  • For more information about administering IIS with WMI, see Using the IIS WMI Provider.


Enabling HTTP Keep-Alives

Most Web browsers request that the server keep the connection open across multiple requests. This is referred to as an HTTP Keep-Alive. Keep-Alive is an HTTP specification that enables greatly enhanced server performance. Without it, a browser has to make numerous connection requests for a page containing multiple elements, such as graphics. A separate connection may need to be made for each element. These additional requests and connections require additional server activity and resources, decreasing server efficiency. They also make a browser much slower and less responsive, especially across a slow connection.

HTTP Keep-Alives are enabled by default during the installation process. If enabled, Keep-Alives last for as long as the Connection Timeout setting allows.

HTTP Keep-Alives are required for integrated security or connection-based authentication services. Anonymous authentication (using NTLM) requires HTTP Keep-Alives. Disabling HTTP Keep-Alives for Web sites using Anonymous authentication will cause requests to that Web site to fail.

important Important You must be a member of the Administrators group on the local computer to perform the following procedure (or procedures), or you must have been delegated the appropriate authority. As a security best practice, log on to your computer using an account that is not in the Administrators group, and then use the Run as command to run IIS Manager as an administrator. From the command prompt, type runas /user:administrative_accountname "mmc %systemroot%\system32\inetsrv\iis.msc".

To disable HTTP Keep-Alives

  1. In IIS Manager, expand the local computer, expand the Web Sites folder, right-click the Web site, and click Properties.
  2. On the Web Site tab, in the Connections section, clear the Enable HTTP Keep-Alives check box.
  3. Click Apply, and then click OK.


Enabling CPU Monitoring

CPU monitoring is a tool that monitors and automatically shuts down worker processes that consume large amounts of CPU time. CPU monitoring is enabled for individual application pools. There are two CPU monitoring actions that administrators can set for application pools.

  • Error event logging: When the CPU usage for a specific application pool or group of pools reaches the set limit, IIS writes an error in the Windows Events log. The error includes the specific worker processes and the name of the application pool that exceeded the CPU limit. When enabling CPU monitoring using IIS Manager, this is displayed as No Action.
  • Stop problematic applications: After IIS writes an error in the Windows Events log, it then initiates a shutdown of all worker processes in the application pool by giving each worker process the pool's ShutdownTimeLimit set number of seconds to shut down. If the processes do not shut down in that time frame, IIS terminates the worker processes if IIS is not configured to replace the worker process or if the worker process is not configured for debugging. The application pool shuts down and remains down until the CPUResetInterval time window has expired. Once the CPUResetInterval time window has expired, the application pool starts again. When enabling CPU monitoring using IIS Manager, this is displayed as Shutdown.

Before enabling CPU monitoring, take note of the following:

  • IIS must be operating in Worker Process Isolation Mode.
  • CPU monitoring is available only for application pools.
  • CPU monitoring does not apply to CGI applications.

important Important You must be a member of the Administrators group on the local computer to perform the following procedure (or procedures), or you must have been delegated the appropriate authority. As a security best practice, log on to your computer using an account that is not in the Administrators group, and then use the Run as command to run IIS Manager as an administrator. From the command prompt, type runas /user:administrative_accountname "mmc %systemroot%\system32\inetsrv\iis.msc".

To enable CPU monitoring

  1. In IIS Manager, expand the local computer, expand the Application Pools folder, right-click the application pool for which you want to enable CPU accounting, and click Properties.
  2. Click the Performance tab, and select the Enable CPU monitoring check box.
  3. In the Maximum CPU use box, click the up and down arrows to set the maximum percentage of the CPU the application pool should use. If the application pool uses more than the designated maximum, IIS generates an error in the Windows Events log.
  4. In the Refresh CPU usage numbers (in minutes) box, click the up and down arrows to set the refresh rate.
  5. In the Action performed when CPU usage exceeds maximum CPU use list box, click the appropriate action for the designated application pool. Click No Action to have IIS generate an error in the Windows Events Log when the designated application pool reaches the maximum CPU usage. Click Shutdown to shut down the application pool altogether. Click Shutdown to stop the problematic application by terminating its host worker process.
  6. Click Apply, and then click OK.
Related Topics
  • For more information about administering IIS through the metabase, see the Programmatic Administration Guide.
  • For more information about administering IIS by changing metabase property values, see the Metabase Property Reference.


Configuring Application Pool Queue Length Limits

Application pool queue length limits prevent large numbers of requests from queuing up and overloading your server. When application pool queue length limits are enabled, IIS monitors the number of requests for a designated application pool queue before queuing a new request. If adding the new request to the queue exceeds the queue size, the server rejects the request and sends a 503-error response (that can't be customized) to the client. However, requests that are already queued remain queued even if the limit is changed to a value that is less than the current queue length.

important Important You must be a member of the Administrators group on the local computer to perform the following procedure (or procedures), or you must have been delegated the appropriate authority. As a security best practice, log on to your computer using an account that is not in the Administrators group, and then use the Run as command to run IIS Manager as an administrator. From the command prompt, type runas /user:administrative_accountname "mmc %systemroot%\system32\inetsrv\iis.msc".

To change an application pool queue length limit

  1. In IIS Manager, expand the local computer, expand the Application Pools folder, right-click the application, and then click Properties.
  2. Click the Performance tab.
  3. In the Request queue limit section, select the Limit the kernel request queue to check box, and click the up and down arrows in the requests box to set the maximum number of queued requests.
  4. Click Apply, and then click OK.

note Note If you clear the Limit the kernel request queue to check box, IIS does not enforce a request limit. Because IIS queues an unlimited number of requests, IIS might queue requests until your server runs out of memory.

Related Topics

  • For information about directly configuring application pool queue length limits in the metabase, see AppPoolQueueLength.


Logging Site Activity

You can collect information about user activity by enabling logging for your Web sites. The information is stored in ASCII files or in a database that complies with Open Database Connectivity (ODBC). Logging information in Internet Information Services (IIS) goes beyond the scope of the event logging or performance monitoring features provided by Microsoft® Windows®. The logs can include information such as who has visited your site, what the visitor viewed, and when the information was last viewed. You can use the logs to assess content popularity or to identify information bottlenecks.

note Note If the owner of a log file directory or file is not the Local Administrators group, the HTTP protocol stack (HTTP.sys) publishes an error to the NT Event log, indicating that the owner of the directory or file is not in the Local Administrators group and that logging has been suspended for that site until the owner is added to the Local Administrators group, or the existing directory or log file is deleted. You can avoid this error by allowing HTTP.sys to create log file directories and files.

This version of IIS includes Centralized Binary Logging. Binary logging allows multiple sites to write to a single log file in a binary format. This logging format preserves valuable memory resources and improves performance by eliminating the time it takes to write data to the hard disk. In a hosting scenario with tens of thousands of sites writing tens of thousands of log files to disk, the performance improvements can be dramatic.

This section includes the following information:

  • About Logging Site Activity: Provides an overview of logging, a description of logging formats, a discussion of log file size, and a discussion about the creation of new log files.
  • Enabling Logging: Describes how to enable or disable logging for a Web or FTP site, or for directories.
  • Customizing W3C Extended Logging: Describes the logging options for W3C Extended log files.
  • Saving Log Files: Describes how to specify the log-file directory and the options for creating new log files.
  • Converting Log Files to NCSA Format: Describes how to use the command-line utility Convlog.exe to convert logs to NCSA Common log file format.
  • Centralized Binary Logging: Describes the process of saving all log files for all Web sites on a specific IIS server in a centralized container, in binary format. This topic also describes how to query and retrieve specific data from the raw logs.
  • Custom Logging Modules: Describes how to enable your own logging modules (Component Object Model [COM] objects) on IIS for the purpose of customizing or manipulating log data.
  • Remote Logging: Describes how to store log data on a remote share using a UNC path.
  • Substatus Error Codes in Log Files: Describes the IIS 6.0 implementation of substatus error codes, how to log these codes in IIS log files, and how to use these codes to debug IIS problems.
  • Capacity Planning Tracing: Describes how to use Log Manager to trace IIS and kernel events and how to determine, based on these events, where your server can be tuned to improve performance.
Related Topics
  • For information on using monitoring tools other than logging, see Performance Tuning.
  • For information on generating, viewing, or understanding security logs (auditing), see Security.


About Logging Site Activity

You can configure your Web or FTP sites to record log entries generated from user and server activity. IIS log data can help you regulate access to content, determine content popularity, plan security requirements, and troubleshoot potential Web site or FTP site problems. Logging IIS site activity should not be confused with the event logging carried out by members of the Microsoft Windows Server 2003 family, which you can view by using the Event Viewer. The logging function in IIS is more extensive.

note Note If the owner of a log file directory or file is not in the Local Administrators group, the HTTP protocol stack (HTTP.sys) publishes an error to the NT Event log, indicating that the owner of the directory or file is not in the Local Administrators group and that logging has been suspended for that site until the owner is added to the Local Administrators group, or the existing directory or log file is deleted. You can avoid this error by allowing HTTP.sys to create log file directories and files.

This topic includes the following sections:

  • Logging Process
  • Log File Formats
  • Log File Size and Creation of New Log Files
  • Log File Names

Logging Process

You can choose the log format for individual Web or FTP sites. If logging is enabled for a site, you can disable or enable it for individual directories on that site. To enable or disable logging for sites or directories, see Enabling Logging. The logs created by IIS can be read in a text editor, but typically the files are loaded in a report-generating software tool. ODBC logging is logged to a database, and the database can be used to generate reports.

Different log formats use different time zones for the basis of times listed in the logs. W3C Extended format uses Coordinated Universal Time (UTC), basically the same as Greenwich Mean Time (GMT). The other formats use local time. The times listed in log files reflect the time the server uses to process requests and responses, but do not reflect network travel time to the client or client processing time.

When Secure Sockets Layer (SSL) is enabled and when logging bytes are exchanged between the server and the client computer, IIS 6.0 logs the number of decrypted bytes. IIS 5.1, however, logged the number of encrypted bytes.

IIS 6.0 supports writing log files for Web sites in UTF-8, instead of just ASCII (or local code page). IIS 6.0 does not support UTF-8 logging for FTP sites. When enabled (through the Local Computer property sheet), all Web sites on your IIS server begin logging in UTF-8. If UTF-8 is not selected, IIS logs in the Local Character Set.

For all log formats except ODBC logging, Time Taken is logged, in milliseconds, according to the following technical breakdown:

  • The client-request timestamp is initialized when HTTP.sys (the kernel mode driver) receives the first byte (before HTTP.sys begins parsing the request).
  • The client-request timestamp is stopped when the send completion happens (for the last send) in IIS.

Time Taken does not reflect time across the network. The first request to the site shows a slightly longer time taken than other similar/same requests because HTTP.sys opens the log file with the first request.

Log File Formats

The following formats are available when logging user activity on your Web server:

  • W3C Extended log file format
  • IIS log file format
  • NCSA Common log file format
  • ODBC logging
  • Centralized binary logging

The W3C Extended log file format, IIS log file format, and NCSA Common log file format are all ASCII text formats (unless UTF-8 is enabled for your Web sites). The W3C Extended and NCSA Common formats record logging data in four-digit year format. The IIS format uses a two-digit year format for years 1999 and earlier, and a four-digit format thereafter. For NCSA and IIS log file format , the data logged for each request is fixed. However, W3C Extended allows you to choose the properties you want to log for each request.

W3C Extended Log File Format

W3C Extended format is a customizable ASCII format with a variety of different properties. You can log properties important to you, while limiting log size by omitting unwanted property fields. Properties are separated by spaces. Time is recorded as UTC. For information about customizing this format, see Customizing W3C Extended Logging. For more information on the W3C Extended format specification, see the World Wide Web Consortium Web site.

The following example shows lines from a file using the following properties: time, client IP address, method, URI stem, protocol status, and protocol version.

#Software: Internet Information Services 6.0
#Version: 1.0
#Date: 2001-05-02 17:42:15
#Fields: time c-ip cs-method cs-uri-stem sc-status cs-version
17:42:15 172.16.255.255 GET /default.htm 200 HTTP/1.0

The preceding entry indicates that on May 2, 2001, at 5:42 P.M., UTC, a user with HTTP version 1.0 and the IP address of 172.16.255.255 issued an HTTP GET command for the /Default.htm file. The request was returned without error. The #Date: property field indicates when the first log entry was made, which is when the log was created. The #Version: property field indicates that the W3C Extended logging format was used.

Any of the properties can be selected, but some properties may not have information available for some requests. For properties that are selected, but for which there is no information, a hyphen (-) appears in the property field in the log file as a placeholder.

IIS Log File Format

IIS format is a fixed (cannot be customized) ASCII format. IIS format records more information than NCSA Common format. The IIS format includes basic items, such as the user's IP address, user name, request date and time, service status code, and number of bytes received. In addition, IIS format includes detailed items, such as the elapsed time, number of bytes sent, action (for example, a download carried out by a GET command), and target file. The items are separated by commas, making the format easier to read than the other ASCII formats, which use spaces for separators. The time is recorded as local time.

When you open an IIS-format file in a text editor, the entries are similar to the following examples:

192.168.114.201, -, 03/20/01, 7:55:20, W3SVC2, SALES1, 172.21.13.45, 4502, 163, 3223, 200, 0, GET, /DeptLogo.gif, -,

172.16.255.255, anonymous, 03/20/01, 23:58:11, MSFTPSVC, SALES1, 172.16.255.255, 60, 275, 0, 0, 0, PASS, /Intro.htm, -,

The preceding sample entries are interpreted in the following tables. The top row in each table is from the second Web site instance (which appears under Service as W3SVC2), the bottom row is from the first FTP site instance (which appears under Service as MSFTPSVC1). The example is presented in three tables because of page-width limitations.

IP Address of User User Name Date Time Service and Instance Computer Name
192.168.114.201
-
03/20/01

7:55:20

W3SVC2

SALES1

172.16.255.255

anonymous

03/20/01

23:58:11

MSFTPSVC1

SALES1

IP Address of Server Time Taken Bytes Sent Bytes Received Service Status Code Windows Status Code
172.21.13.45

4502

163

3223

200

0

172.16.255.255,

60

275

0

0

0

Request Type Target of the Operation Parameters
GET

/DeptLogo.gif

-

[376] PASS

/Intro.htm

-

In the previous example, the first entry indicates that an anonymous user with the IP address of 192.168.114.201 issued an HTTP GET command for the image file /DeptLogo.gif at 7:55 A.M. on March 20, 2001, from a server named SALES1 at IP address 172.21.13.45. The 163-byte HTTP request had an elapsed processing time of 4502 milliseconds (4.5 seconds) to complete, and returned, without error, 3223 bytes of data to the anonymous user.

In the log file, all property fields are terminated with a comma (,). A hyphen (-) acts as a placeholder if there is no valid value for a property.

NCSA Common Log File Format

National Center for Supercomputing Applications (NCSA) Common format is a fixed (cannot be customized) ASCII format, available for Web sites but not for FTP sites. NCSA Common format records basic information about user requests, such as remote host name, user name, date, time, request type, HTTP status code, and the number of bytes sent by the server. Items are separated by spaces; time is recorded as local time.

When you open an NCSA Common format file in a text editor, the entries are similar to the following example:

172.21.13.45 - Microsoft\fred [08/Apr/2001:17:39:04 -0800] "GET /scripts/iisadmin/ism.dll?http/serv HTTP/1.0" 200 3401

note Note In the preceding entry, the second property field (which shows the remote log name of the user) is empty and is represented by the hyphen following the IP address 172.21.13.45.

The preceding sample entry is interpreted in the following tables. The example is shown in two tables because of page-width limitations.

Remote Host Name Remote Log Name User Name Date Time and GMT Offset
172.21.13.45

-

Microsoft\fred

08/Apr/2001

17:39:10 -0800

Request/Version Service Status Code Bytes Sent
GET /scripts/iisadmin/ism.dll?http/serv HTTP/1.0

200

3401

The previous entry indicates that a user named Fred in the Microsoft domain, with the IP address of 172.21.13.45, issued an HTTP GET command (that is, downloaded a file) at 5:39 P.M. on April 8, 2001. The request returned, without error, 3401 bytes of data to the user named Fred.

ODBC Logging

ODBC logging format is a record of a fixed set of data properties in a database that complies with Open Database Connectivity (ODBC), such as Microsoft Access or Microsoft SQL Server™. Some of the items logged include the user's IP address, user name, request date and time (recorded as local time), HTTP status code, bytes received, bytes sent, action carried out (for example, a download carried out by a GET command), and the target (for example, the file that was downloaded). With ODBC logging, you must both specify the database to be logged to, and set up the database to receive the data.

When ODBC logging is enabled, IIS disables the kernel-mode cache. For this reason, implementing ODBC logging can degrade overall server performance.

important Important For security reasons, do not use the SQL SA account for ODBC logging. If a malicious user were to access the worker process, they could use the SA account to access the SQL server. Instead, remove the SQL SA account and create a new account with the least necessary permissions. For more information, see Access Control and consult SQL Help.

To use ODBC logging

  1. Create a database containing a table with the appropriate properties for the logging data. IIS includes an SQL template file that can be run in an SQL database to create a table that accepts log entries from IIS. The file is named Logtemp.sql and is located at systemroot\System32\Inetsrv if you accepted the setup defaults. The following properties are required:
    Property Name | Property Type
    ClientHost | varchar(255)
    Username | varchar(255)
    LogTime | datetime
    Service | varchar(255)
    Machine | varchar(255)
    ServerIP | varchar(50)
    ProcessingTime | int
    BytesRecvd | int
    BytesSent | int
    ServiceStatus | int
    Win32Status | int
    Operation | varchar(255)
    Target | varchar(255)
    Parameters | varchar(255)
  2. Give the database a system Data Source Name (DSN), which is a name that the ODBC software uses to find the database.
  3. Supply IIS with the name of the database and table. If a user name and password are needed for accessing the database, you must also specify these in IIS.

Centralized Binary Logging

Centralized binary logging is the process where multiple Web sites write binary, unformatted log data to a single log file. Each Web server running IIS creates one log file for all sites on that server. Centralized binary logging preserves valuable memory resources. Depending on your configuration, you could see dramatic performance and scalability gains with centralized binary logging. For more information, see Centralized Binary Logging.

Log File Size and Creation of New Log Files

When users access your server that is running IIS, IIS logs the information. Depending on the amount of traffic to your site, the size of your log file (or the number of log files) can begin to consume valuable memory resources and CPU cycles. You may need to balance the gathering of detailed data against the need to limit files to a manageable size and number. If you are planning to put thousands of Web sites on one Web server running IIS with high traffic volumes and disk writes, you may want to use centralized binary logging to preserve server resources.

You can also preserve server resources by customizing W3C Extended logging so that you gather only the data you need. For more information, see Customizing W3C Extended Logging.

Also consider limiting log size by changing the frequency of log file creation. For more information, see Saving Log Files.

Log files are simply ASCII (text) files. If you find you have created many small files when you prefer one large file, you can combine the files as you can with any ASCII file. For information about using the copy command for combining files, at the command prompt, type copy /?.

If your server runs out of disk space when IIS is attempting to add a log entry to a file, IIS logging shuts down. At the same time, an event is logged in the Windows Event Viewer application log. When disk space becomes available, IIS logging resumes, which also logs in the Windows Event Viewer application log.

Log File Names

Log file names use the first several letters to represent the logging format and the remaining numbers to represent the time frame or sequence of the log. The following table provides more information. The italicized letters represent digits:

  • nn for sequential digits
  • yy for the year
  • mm for the month
  • ww for the week of the month
  • dd for the day
  • hh for the hour in 24-hour format (for example, 1700 is 5:00 P.M.)
Format | Criterion for New Logs | File Name Pattern
IIS log format | By file size | inetsv nn.log
 | Hourly | in yymmddhh.log
 | Daily | in yymmdd.log
 | Weekly | in yymmww.log
 | Monthly | in yymm.log
NCSA Common log file format | By file size | ncsa nn.log
 | Hourly | nc yymmddhh.log
 | Daily | nc yymmdd.log
 | Weekly | nc yymmww.log
 | Monthly | nc yymm.log
W3C Extended log file format | By file size | extend nn.log
 | Hourly | ex yymmddhh.log
 | Daily | ex yymmdd.log
 | Weekly | ex yymmww.log
 | Monthly | ex yymm.log
Centralized Binary log file format
 | Hourly | raw yymmddhh.ibl
 | Daily | raw yymmdd.ibl
 | Weekly | raw yymmww.ibl
 | Monthly | raw yymm.ibl

note Note When enabled, IIS creates a centralized binary log file with an .ibl file name extension, where .ibl abbreviates Internet binary log. This new file name extension ensures that text utilities do not read it as a .log file name extension and attempt to open the binary log file.

Related Topics
  • To log user data in a new log file format, see Enabling Logging.


Enabling Logging

You can choose a format and enable logging for individual Web and FTP sites. After you enable logging on a Web or FTP site, all traffic to the site (including virtual directories) is written to the corresponding file for each site. You can, however, disable logging for specific virtual directories.

important Important You must be a member of the Administrators group on the local computer to perform the following procedure (or procedures), or you must have been delegated the appropriate authority. As a security best practice, log on to your computer using an account that is not in the Administrators group, and then use the Run as command to run IIS Manager as an administrator. From the command prompt, type runas /user:administrative_accountname "mmc %systemroot%\system32\inetsrv\iis.msc".

To enable logging on a Web or FTP site

  1. In IIS Manager, expand the local computer, expand the Web or FTP Sites directory, right-click the Web or FTP site, and click Properties.
  2. On the Web Site or FTP Site tab, select the Enable logging check box.
  3. In the Active log format list box, click a format. By default, the format is W3C Extended Log File Format.

    note Note If you select ODBC logging, click Properties and type the ODBC Data Source Name (DSN) and the name of the table within the database in the text boxes. If a user name and password are required to access the database, type the necessary credentials, and click OK.

  4. Click Apply, and then click OK.

To disable logging for a specific virtual directory on a site

  1. In IIS Manager, expand the local computer, expand the Web Sites directory, right-click the virtual directory, and select Properties.
  2. On the Virtual Directory or Directory tab, and clear the Log visits check box. By default, the check box is selected.
  3. Click Apply, and then click OK.
Related Topics
  • For descriptions of the available log file formats, see About Logging Site Activity.
  • For information about setting W3C Extended logging fields, see Customizing W3C Extended Logging.


Customizing W3C Extended Logging

If you are using the W3C Extended log file format for a Web or FTP site, you can customize the data by selecting the properties you want to log. You can also limit unnecessary data and reduce the size of the log file by omitting unneeded properties. The following extended properties are available for this version of IIS.

Property | Description
Client IP Address | The IP address of any client that accessed your server.
User Name | The name of the user who accessed your server.
Service Name | The Internet service running on the client computer.
Server Name | The name of the server on which the log entry was generated.
Server IP | The IP address of the server on which the log entry was generated.
Server Port | The port number the client is connected to.
Method | The action the client was trying to perform (for example, a GET command).
URI Stem | The resource accessed, such as an HTML page, a CGI program, or a script.
URI Query | The query, if any, the client was trying to perform. One or more search strings that the client was seeking to match are recorded in the log.
Protocol Status | The status of the action, in HTTP terms.
Win32® Status | The status of the action, in terms used by Windows.
Bytes Sent | The number of bytes sent by the server.
Bytes Received | The number of bytes received by the server.
Time Taken | The length of time the action took. note Note For all log formats except ODBC logging, Time Taken is logged, in milliseconds, according to the following technical breakdown: The client-request timestamp is initialized when HTTP.sys (the kernel-mode driver) receives the first byte (before HTTP.sys begins parsing the request). The client-request timestamp is stopped when the send completion happens (for the last send) in IIS. Time Taken does not reflect time across the network. Also note, the first request to the site shows a slightly longer time taken than other similar/same requests because HTTP.sys opens the log file with the first request.
Protocol Version | The protocol (HTTP, FTP) version used by the client. For HTTP, this is either HTTP 1.0 or HTTP 1.1.
Host | The computer name.
User Agent | The browser used on the client.
Cookie | The content of the cookie sent or received, if any.
Referrer | The site that directed the user to the current site.
Protocol substatus | Additional status of the action, in HTTP terms. note Note For more information about the Protocol Substatus property, see Substatus Error Codes in Log Files.

important Important You must be a member of the Administrators group on the local computer to perform the following procedure (or procedures), or you must have been delegated the appropriate authority. As a security best practice, log on to your computer using an account that is not in the Administrators group, and then use the Run as command to run IIS Manager as an administrator. From the command prompt, type runas /user:administrative_accountname "mmc %systemroot%\system32\inetsrv\iis.msc".

To customize W3C Extended logging

  1. In IIS Manager, expand the local computer, expand the Web or FTP Sites folder, right-click the Web or FTP site, and click Properties.
  2. On the Web or FTPSite tab, select the Enable logging check box (if it is not already selected).
  3. In the Active log format list box, click W3C Extended Log File Format.
  4. Click Properties.
  5. On the Advanced tab, select the properties you want to log.
  6. Click OK.
Related Topics
  • For a description of the W3C Extended log file format, see About Logging Site Activity.
  • For information about logging frequency and log size, see Saving Log Files.
  • For a reference list of logging properties, see Logging Properties Reference.


Saving Log Files

You can specify the directory into which log files are saved, and you can determine when new log files are started.

In order to protect logged data, be sure to set proper access control on the log file directory. Consider allowing only the administrator and the IIS_WPG group to have access to the log file directory.

important Important You must be a member of the Administrators group on the local computer to perform the following procedure (or procedures), or you must have been delegated the appropriate authority. As a security best practice, log on to your computer using an account that is not in the Administrators group, and then use the Run as command to run IIS Manager as an administrator. From the command prompt, type runas /user:administrative_accountname "mmc %systemroot%\system32\inetsrv\iis.msc".

To set options for saving log files

  1. In IIS Manager, expand the local computer, expand the Web or FTP Sites directory, right-click the Web or FTP site, and click Properties.
  2. On the Web Site or FTP Site tab, click Properties next to the Active log format list box.
  3. Select the log schedule to use when starting a new log file. The options are as follows:
    • Hourly: Log files created hourly, starting with the first entry that occurs for each hour. This option is typically used for high-volume Web sites.
    • Daily: Log files created daily, starting with the first entry that occurs after midnight.
    • Weekly: Log files created weekly, starting with the first entry that occurs after midnight on Saturday.
    • Monthly: Log files created monthly, starting with the first entry that occurs after midnight of the last day of the month.
    • Unlimited file size: Data is always appended to the same log file. You should access this log file only after stopping the site.
    • When file size reaches: A new log file is created when the current log file reaches a given size. Specify the size you want in the box.

    note Note "Midnight" is midnight local time for all log file formats except the W3C Extended format. For W3C Extended log file format, "midnight" is midnight Greenwich Mean Time (GMT), by default, but can be changed to midnight local time. To open new W3C Extended logs using local time, select the Use local time for file naming and rollover check box. The new log starts at midnight local time, but the time recorded in the log files is still GMT.

  4. Under Log file directory, type the directory where log files should be saved. The directory must be a local drive and the path cannot be relative. You cannot use mapped drives or the characters . .\ when you specify the log file directory. For information about how to map to a network drive, see Windows Help.
  5. Click Apply, and then click OK twice.
Related Topics
  • For descriptions of the available log file formats, see About Logging Site Activity.
  • For a reference list of logging properties, see Logging Properties Reference.


Converting Log Files to NCSA Format

National Center for Supercomputing Applications (NCSA) Common is a standardized and commonly used log format. Use the convlog utility to convert your Web server's log files to NCSA Common log file format. The converter can also replace IP addresses with Domain Name System (DNS) names during conversion of IIS and W3C Extended format log files to NCSA Common format, or it can be used to replace IP addresses with DNS names inside an NCSA Common log file. You can also use the convlog utility to convert time offsets.

caution Caution Using this utility with W3C Extended log files that contain process accounting log information results in the loss of any process accounting information.

To convert log files to other formats

  • At the command prompt, type convlog and one of more of the following switches:
    -i ( i, n , e ) Specifies the format of the input file.
    • i IIS log file format
    • n NCSA Common log file format
    • e W3C Extended log file format
    filename.log | Specifies the input file name.
    -t (ncsa:GMTOffset) Specifies the output type default as NCSA Common log file format.
    • GMTOffset Offset, in hours, from Greenwich Mean Time (GMT). The offset is a four-digit number preceded by a plus or minus sign, depending on your local time difference from GMT. An empty space following the GMT offset enables replacement of IP address by DNS name (for IIS log file format only).
    -l ( 0 , 1 , 2 ) Specifies the date format used in an IIS log input file. The utility accepts whatever format you specify, so you must determine what format was used in the input file.
    • 0 MM/DD/YY default (U.S. date format)
    • 1 YY/MM/DD (Japanese date format)
    • 2 DD.MM.YY (German date format)
    -o output directory | Specifies the output directory. The default is the current directory (that is, systemroot\System32).
    -x | Saves non-HTTP transaction entries to a .dmp file.
    -d | Enables DNS replacement of user IP address during the conversion process.
    -c | Continues logging even if incorrectly formatted line is found.

The following examples describe how you can use the previous switches.

  • The command convlog -ii inetsv1.log -d -t ncsa:-0700 converts the Inetsv1.log file to an NCSA Common log file format with DNS names, corrected for a seven-hour, GMT offset.
  • The command convlog -ii inetsv1.log -l1 -t ncsa:+0900 -o \Logfiles\Japan\ converts the Inetsv1.log file from an IIS log file format to an NCSA Common log file format, corrected for a nine-hour, GMT offset (that is, Tokyo time), sets its date to the Japanese date format, and sends it to the Japan subdirectory, which is in the Logfiles directory on the current drive.
  • The command convlog -ie extend1.log -o D:\Temp\NCSALogs converts the Extend1.log file from W3C Extended log file format to an NCSA Common log file format and outputs it to the NCSALogs subdirectory in the Temp directory on drive D. The IP addresses are not replaced by DNS names.
  • The command convlog -in ncsa1.log -o -d \\REMOTE_MACHINE\REMOTE_SHARE\NCSALogs outputs the Ncsa1.log file in NCSA Common log file format to the NCSALogs subdirectory in the shared directory of a remote drive. The IP addresses are replaced by DNS names, and the file format is not converted.

The file names produced by the DNS conversion process use the following conventions:

  • Log files converted to NCSA Common without DNS conversion retain the original file name and have an .ncsa file name extension.
  • Log files with IP addresses converted to DNS names retain the original file names with an an .ncsa.dns file name extension.

For example, if Inetsv1.log is a log file using the IIS log file format, without DNS conversion, the resulting output log file is Inetsv1.log.ncsa. However, if you enable the DNS conversion feature, the resulting output log file is Inetsv1.log.ncsa.dns.

Related Topics
  • For descriptions of the available log file formats, see About Logging Site Activity.
  • For more information on the convlog utility, search for "convlog" in Windows Help.


Centralized Binary Logging

Centralized binary logging is the process by which multiple Web sites write binary, unformatted log data to a single log file. When enabled, all Web sites on your Web server running IIS write log data to a single log file. In contrast, most logging methods create one log file per Web site. For companies with large numbers of Web sites, the process of creating hundreds or thousands of formatted log files, and writing the log data to disk, can quickly consume valuable CPU and memory resources on your servers running IIS, thereby creating performance and scalability problems.

Centralized binary logging preserves memory resources because the log data is in binary form and is stored in one file. Depending on your configuration, you could see dramatic performance and scalability gains by switching to centralized binary logging.

Centralized binary logging is a server property, not a site property. This means that when you enable centralized binary logging, all Web sites on that server begin writing binary, unformatted log data to the centralized log file. You do not have the option to log specific sites in a different log format after centralized binary logging is enabled on your server running IIS.

note Note Enabling centralized binary logging disables all other logging formats on your server.

When you enable centralized binary logging, the HTTP protocol stack (HTTP.sys) automatically creates a log file directory. By default, the log file directory has the following access controls:

  • NT Authority\System: Full access
  • Built-in\Administrators: Full access
  • Everyone: Read access

Individual log files in the log file directory have the following controls:

  • NT Authority\System: Full access
  • Built-in\Administrators: Read & Delete access
  • Everyone: No access

If you chose to create your own log file directory, be sure to establish proper access controls to protect log files from malicious users. When you enable centralized binary logging, if the log file directory already exists but the access controls do not match the HTTP.sys defaults, HTTP.sys writes a warning to the event log and then disables centralized binary logging. To reestablish centralized binary logging in this situation, set access controls to match the defaults and re-enable centralized binary logging through the command prompt. For more information on file and directory security and access control, see Access Control.

important Important You must be a member of the Administrators group on the local computer to run scripts and executables, or you must have been delegated the appropriate authority. As a security best practice, log on to your computer using an account that is not in the Administrators group, and then use the Run as command to run your script or executable as an administrator. From the command prompt, type runas /user:administrative_accountname "script or executable command".

To enable centralized binary logging for all Web sites on your server running IIS

  1. From the Start menu, click Run.
  2. In the Open box, type cscript.exe adsutil.vbs SET W3SVC/CentralBinaryLoggingEnabled true, and click OK.
  3. The World Wide Web Publishing Service (WWW service) must be stopped and restarted for changes to take effect. From the command prompt, type net stop W3SVC, and press ENTER. The WWW service stops.
  4. From the command prompt, type net start W3SVC, and press ENTER. The WWW service starts, and centralized binary logging is enabled.

When centralized binary logging is enabled on your Web server running IIS, all log entries from that server are placed in the centralized binary log file. The log file is made up of fixed-length records or index records that contain string identifiers. In an effort to log as much information as possible to maintain the richness of W3C Extended logs (the default log format), variable-length strings fields are substituted with numeric identifiers (indexes) that map the variable length string to the logged identifier.

When enabled, IIS creates a centralized binary log file with an .ibl file name extension, for example, rawyymmddhh.ibl. The .ibl file name extension stands for Internet binary log. This new file name extension ensures that text utilities do not read it as a .log file name extension and attempt to open the binary log file.

When you are ready to extract data from a raw log file, you can do one of the following:

  1. Create a tool that locates and extracts the data you want from the raw file and converts the data into formatted text. You can view a header file and log file format descriptions in the IIS 6.0 Software Development Kit, located on MSDN.
  2. Use the parsing tool for Centralized Binary Logging that ships with the IIS 6.0 Resource Kit.
Related Topics
  • For more information on how to improve performance on your server running IIS, see Performance Tuning.
  • For more information on logging site activity, including logging formats, see About Logging Site Activity.


Custom Logging Modules

IIS supports custom logging modules, or Component Object Model (COM) objects, that implement the ILogPlugin or ILogPluginEx interface. Developers and system administrators implement custom logging modules when creating their own log file formats, or when manipulating log data. When the globally unique identifier (GUID) of this COM object is specified in the LogPluginClsid metabase property, IIS instantiates the custom logging module and uses its methods to log entries.

note Note When a custom logging module is loaded, IIS disables the kernel-mode cache. For this reason, implementing a custom logging module can degrade overall server performance.

Custom logging modules work with the LogInfo object, an IIS-instantiated COM object that implements the ILogInformation interface. The ILogInformation interface is a placeholder for log information. The custom logging module collects information from the ILogInformation interface and then writes this information in the log.

The latest version of the IIS Software Development Kit (SDK), available on the MSDN Web site, contains the IIS Logging Reference and a description of the methods for the ILogPlugin, ILogPluginEx, and ILLEGIBILITY interfaces. Search for "ILogPlugin interface" on the MSDN Web site.

In IIS 6.0, the kernel-mode HTTP listener, named HTTP.sys, uses LocalSystem and the LocalSystem accounts when writing log data to the LogFiles directory. Custom logging modules, however, use the accounts on the application pool in which they are running, which is NetworkService, by default. For this reason, custom logging modules can cause write problems or errors when writing to the default LogFiles directory. You can correct this problem by having your custom logging modules write to a different directory.

If you choose to have custom logging modules write to a different directory, be sure to set a proper Access Control List (ACL) on the new directory. You should consider giving the IIS_WPG group write permissions. The IIS_WPG group is a user group provided by IIS 6.0. The IIS_WPG group provides the minimum set of permissions required by IIS and provides a convenient way to use a specific user for the identity account without having to manually assign the permissions to that identity. In the cases where the account is not in the IIS_WPG group and does not have the appropriate permissions, the worker process will fail to start. For more information on Access Control Lists, see Access Control.

Once you have created a custom logging module, you can add this log format to the Active Log Format list in IIS Manager. To add the custom format to the Active Log Format list, you must edit the metabase with the adsutil.vbs administrative utility script.

important Important You must be a member of the Administrators group on the local computer to run scripts and executables, or you must have been delegated the appropriate authority. As a security best practice, log on to your computer using an account that is not in the Administrators group, and then use the Run as command to run your script or executable as an administrator. From the command prompt, type runas /user:administrative_accountname "script or executable command".

To add your custom logging module to the Active Log Format list in IIS Manager

  1. Create a key in the metabase under LocalDrive:/Logging with the same name as the logging module friendly name (for example, Log Module X).
    2. C:\Inetpub\AdminScripts>cscript adsutil.vbs enum "/Logging"
KeyType                         : (STRING) "IIsLogModules"
[/Logging/Custom Logging]
[/Logging/Microsoft IIS Log File Format]
[/Logging/NCSA Common Log File Format]
[/Logging/ODBC Logging]
[/Logging/W3C Extended Log File Format]
[/Logging/Log Module X]
  2. Create a "KeyType" value in the "LocalDrive:/Logging/New Log Format" key, whose value is the STRING "IIsLogModule".
    3. C:\Inetpub\AdminScripts>cscript adsutil.vbs enum "/Logging/Log Module X"
KeyType                         : (STRING) "IIsLogModule"
  3. Create a "LogModuleId" value in the "LocalDrive:/Logging/Log Module X" key, whose value is the STRING "{cls_id of Log Module X COM object}".
    4. C:\Inetpub\AdminScripts>cscript adsutil.vbs enum "/Logging/Log Module X"
KeyType                         : (STRING) "IIsLogModule"
LogModuleId                     : (STRING) "{FF16065B-DE82-11CF-BC0A-00AA006111E0}"
  4. Create a "LogModuleUiId" value in the "LocalDrive:/Logging/Log Module X" key, whose value is the STRING "{cls_id of Log Module X UI COM object}".
    5. C:\Inetpub\AdminScripts>cscript adsutil.vbs enum "/Logging/Log Module X"
KeyType                         : (STRING) "IIsLogModule"
LogModuleId                     : (STRING) "{FF16065B-DE82-11CF-BC0A-00AA006111E0}"
LogModuleUiId                   : (STRING) "{31DCAB86-BB3E-11d0-9299-00C04FB6678B}"
  5. Add your Logging Module friendly name to the /W3SVC/Info/LogModuleList property (comma-separated from the already existing ones).
    6. C:\Inetpub\AdminScripts>cscript adsutil.vbs get "/W3SVC/Info/LogModuleList"
LogModuleList                   : (STRING) "NCSA Common Log File Format,
Microsoft IIS Log File Format,W3C Extended Log File Format,
ODBC Logging,Log Module X"
Related Topics
  • For information about different log file formats supported in IIS, see About Logging Site Activity.


Remote Logging

In this version of IIS, you can write log data to a remote share over a network using a full, Universal Naming Convention (UNC) path. For example, you can specify \\servername\LogFiles as the storage directory for your log files, where servername represents the name of the remote server, and LogFiles represents the name of the directory where the log files are stored.

Remote logging enables you to set up centralized log file storage and backup; however, it is slower than standard methods of logging. Although HTTP.sys, the kernel-mode driver in IIS 6.0, buffers 64 KB of log data before writing to the log file, remote logging writes the log file over the network, which can negatively impact performance.

If a log file directory or file owner is not in the Local Administrators group, HTTP.sys publishes an error to the NT Event log, indicating that the owner of the directory or file is not in the Local Administrators group and that logging has been suspended for that site until the owner is added to the Local Administrators group, or the existing directory or log file is deleted. You can avoid this error by allowing HTTP.sys to create log file directories and files.

It is highly recommended that you enable Internet Protocol security (IPSec) between your Web server running IIS and the remote server before configuring remote logging. IPSec is a framework of open standards for ensuring private, secure communications over Internet Protocol (IP) networks, through the use of cryptographic security services. If IPSec is not enabled between the Web server running IIS and the remote server, data packets containing log data are potentially at risk of being intercepted by malicious individuals and wire "sniffing" applications while the data packet travels through the network.

important Important You must be a member of the Administrators group on the local computer to perform the following procedure (or procedures), or you must have been delegated the appropriate authority. As a security best practice, log on to your computer using an account that is not in the Administrators group, and then use the Run as command to perform this procedure as an Administrator.

To log Web site data on a remote share

  1. Create a log file directory on a remote server in the same domain as your Web server running IIS.
  2. Change the directory properties so the directory is a share and assign the Everyone group Full Control permissions. If you want to write log files to a remote server in a different domain, see the Setting Up a Null Session for Cross-Domain Logging section in this topic.
  3. Ensure that your server running IIS has Full Control access permission on the remote share and read and write permissions on the remote log file directory. For more information, see Configuring Permissions for Remote Logging in this topic.
  4. In IIS Manager, expand the local computer, right-click the Web Sites folder, and click Properties.
  5. On the Web Site tab, ensure that the Enable logging check box is selected.
  6. In the Active log format list box, click a log file format. For a description of the different log file formats, see About Logging Site Activity.
  7. Click Properties.
  8. Click the General tab, and in the Log file directory box, type the full UNC path. For example, \\servername\LogFiles, where servername represents the name of the remote server, and LogFiles represents the name of the share where the log files are stored.
  9. Click Apply, and then click OK. All Web sites within the directory begin logging data to the remote share.

In the remote share, IIS creates a unique directory for each Web site, for example W3SVCX, where X is a random number generated by IIS to represent the specific Web site. IIS also creates the log file with exclusive write access, so that multiple machines cannot write to the same log file.

Setting Up a Null Session for Cross-Domain Logging

Remotely logging files to a UNC share in a different domain requires configuring the remote share as a null session share. When IIS attempts to access a remote Microsoft Windows server resource, such as a file share using a null session, the operation may fail if the file share is not configured as a null session share, or if there are any registry, group, or policy restrictions set on the server hosting the file share.

Several settings govern null session access on Windows. When you configure null session shares, you must first explicitly enable null session access on shares by modifying the registry of each remote resource computer. If you configure a shared resource in this manner, the resource is not secure. Microsoft does not recommend that you use this configuration if you are considering null session security.

Before you edit the registry, make sure you understand how to restore it if a problem occurs. For information about how to restore the registry, see the "Restoring the Registry" and the "Restoring a Registry Key" topics in Registry Editor Help.

important Important Using Registry Editor incorrectly can cause serious problems that require reinstalling the operating system. Because Registry Editor bypasses the standard safeguards that prevent you from entering settings that are conflicting or likely to degrade performance or damage your system, exercise caution when making changes to the registry. Microsoft cannot guarantee that problems resulting from the incorrect use of Registry Editor can be solved. For information about how to edit the registry, see the Changing Keys and Values topic in Registry Editor Help.

Note that you should back up the registry before you edit it. If you are running Microsoft® Windows® NT® or later, you should also update your Emergency Repair Disk (ERD).

For information about how to edit the registry, see the "Changing Keys and Values", "Add and Delete Information in the Registry", and "Edit Registry Data" topics in Registry Editor Help.

To enable null session access

  1. From the Start menu, click Run.
  2. In the Open box, type Regedit.exe, and click OK.
  3. Navigate to and double-click the following key in the registry:
    HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\LanmanServer\Parameters\NullSessionShares.
    Note that NullSessionShares is a REG_MULTI_SZ value.
  4. On a new line in the NullSessionShares key, type the name of the share that you want to access with a null session, for example, public.
  5. Navigate to and click the following key in the registry:
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA.
  6. From the Edit menu, point to Add, click DWORD Value and then add the following registry value:
    Name: RestrictAnonymous
    Type: REG_DWORD
    Data: 0
  7. Quit Registry Editor.
  8. Restart the server.

If the remote share does not allow your IIS server to write the log file to the designated share after restarting the server, you might need to adjust the Windows security groups and security policies on the remote machine to enable anonymous access.

Configuring Permissions for Remote Logging

To configure permissions for remote logging

  1. On the remote computer, navigate to systemroot\System32, right-click the LogFiles folder, and click Sharing and Security.
  2. On the Sharing tab, click Share this folder, and click Permissions.
  3. Click Add.
  4. Click Object Types.
  5. Select the Computers check box, and click OK. If you like, you can deselect all other options.
  6. In the Enter the object name to select box, type the object name —Domain\WebServer, and click OK.
  7. In the Group or user names list, select the Domain\WebServer object, and in the Permissions section, select the Allow check box next to Full Control.
  8. In the Group or user names list, select Everyone.
  9. In the Permissions section, clear all permissions and click OK. The remote computer now has the appropriate access permissions.
  10. To set the appropriate file permissions, click the Security tab.
  11. Select the Domain\WebServer object and in the Permissions section, select the Allow check box next to Full Control.
  12. Click Apply, and then click OK.
Related Topics
  • To set up remote logging programmatically, see the LogFileDirectory metabase property.


Substatus Error Codes in Log Files

In an effort to reduce the attack surface of IIS, custom error messages do not return specific error message content, including the substatus code, to remote client computers. If a custom error message contains too much information about the core Web server and an explanation of why a particular request failed to execute, malicious individuals could use the information from the error message to attack the Web server. For this reason, an error code like 404.2, returns to the client computer as 404 and thereby gives no indication to a remote client computer of why the request failed.

note Note Substatus error codes can only be logged using W3C Extended logging.

While these changes to error messages reduce the possibility of an attack by a malicious individual as a result of disclosing too much information, administrators may experience difficulties in debugging a failed request without the substatus error code. For this reason, (when enabled) substatus error codes are written to IIS log files whenever a client request fails. By default, these log files can only be accessed by administrators and members of the LocalSystem group. Remote authenticated users and local users cannot access log files and determine substatus error codes. The administrator simply needs to locate the error and substatus code in the log file and check the code against the table in About Custom Error Messages. For example, if a client request to an ASP page returned a 404 error, the administrator can determine, by viewing the log file, that the actual error was a 404.2 error. In this situation, the file or directory was not found because the associated .dll file(s) had not been enabled on the Web server. To learn how to lock or unlock .dll files in IIS, see Enabling and Disabling Dynamic Content.

important Important You must be a member of the Administrators group on the local computer to perform the following procedure (or procedures), or you must have been delegated the appropriate authority. As a security best practice, log on to your computer using an account that is not in the Administrators group, and then use the Run as command to run IIS Manager as an administrator. From the command prompt, type runas /user:administrative_accountname "mmc %systemroot%\system32\inetsrv\iis.msc".

To log substatus error codes

  1. In IIS Manager, expand the local computer, expand the Web Sites folder, right-click the Web site, and click Properties.
  2. On the Web Site tab, ensure that the Enable logging check box is selected.
  3. In the Active log format list box, click W3C Extended Log File Format.
  4. Click Properties.
  5. Click the Advanced tab, and under Extended properties, select the Protocol Substatus check box.
  6. Click OK twice.
Related Topics
  • For information on the logging process and logging formats in IIS, see About Logging Site Activity.
  • For information on custom error messages and a table that defines error and substatus error codes, see About Custom Error Messages.


Capacity Planning Tracing

A Web request goes through many layers of the operating system, most of which can be tuned. Using Log Manager to trace IIS and kernel events can help you determine where your server can be tuned to improve performance, and to pinpoint Web bottlenecks on your server.

Log Manager and Trace Report are general-purpose tools supplied with members of the Windows Server 2003 family. Log Manager creates trace data, which is then processed by the Windows Trace Report utility. The Trace Report utility creates a formatted, detailed report that is useful in assessing IIS and IIS-related activity in the operating system. By supplying a list of the specific IIS events to trace, the amount of time that data is in each IIS subsystem is recorded in the log. Log Manager can be used in either Application mode or Dedicated mode.

For simplicity, a specific trace report is illustrated below. There are many possible variations on this example, as well as other subsystems you might want to trace.

important Important You must be a member of the Administrators group on the local computer to run scripts and executables, or you must have been delegated the appropriate authority. As a security best practice, log on to your computer using an account that is not in the Administrators group, and then use the Run as command to run your script or executable as an administrator. From the command prompt, type runas /user:administrative_accountname "script or executable command".

To perform a capacity planning trace

  1. Create a plain text file containing the following list of Log Manager Query Providers. Be sure there are no blank lines in the file. To see a complete list of of Log Manager Query Providers you can include in this file, open a command-prompt window and type logman query provider.
    {1fbecc45-c060-4e7c-8a0e-0dbd6116181b} 0 5 IIS: SSL Filter
{3a2a4e84-4c21-4981-ae10-3fda0d9b0f83} 0 5 IIS: WWW Server
{06b94d9a-b15e-456e-a4ef-37c984a2cb4b} 0 5 IIS: Active Server Pages (ASP)
{dd5ef90a-6398-47a4-ad34-4dcecdef795f} 0 5 Universal Listener Trace
{a1c2040e-8840-4c31-ba11-9871031a19ea} 0 5 IIS: WWW ISAPI Extension
  2. Save the file as iistrace.guid in the systemroot\System32 directory.
  3. Create a plain text file containing the following. Make sure there are no blank lines in the file. Depending on your server load, you might want to add the -bs (block size) and -nb (number of blocks) options to the following commands. For a detailed explanation of Log Manager options, search for "logman" in Windows Help.
    logman start "NT Kernel Logger" -p "Windows Kernel Trace" (process,thread,disk) -ct perf -o krnl.etl -ets
logman start "IIS Trace" -pf iistrace.guid -ct perf -o iis.etl -ets
  4. Save the file as startlogiis.bat in the systemroot\System32 directory.
  5. Create a plain text file containing the following. Make sure there are no blank lines in the file:
    logman stop "IIS Trace" -ets
logman stop "NT Kernel Logger" -ets
  6. Save the file as stoplogiis.bat in the systemroot\System32 directory.
  7. Make sure that the sites and processes you want to trace are running.
  8. Open a command-prompt window and switch to the systemroot\System32 directory.
  9. At the command prompt, type startlogiis, and press ENTER. The trace begins. Wait for a period of time for the trace data to be collected. The amount of data logged to disk is approximately 1 KB per request. The amount of time you log activity is dependent on the number of requests and the amount of disk space available of the drive to which you are logging. One to two minutes of logging is usually sufficient.
  10. At the command prompt, type stoplogiis, and press ENTER. The trace ends.
  11. At the command prompt, type tracerpt iis.etl krnl.etl -o -report -summary, and press ENTER. The trace report tool analyzes the log files and creates three formatted reports: workload.txt, summary.txt, and dumpfile.csv — located in the systemroot\System32 directory. The dumpfile.csv file is a comma-separated-value text file useful for importing into spreadsheet software for detailed analysis and troubleshooting of the traced events. Refer to the Windows Server 2003 Resource Kit for a detailed discussion of how to analyze the dumpfile.csv file.
  12. View the report files using the editor of your choice.

Sample Workload Report

Looking at the testreport.txt file, you see that the longest running requests are those for ASP, which also consume the most CPU resources. We can also see from the "10 most requested static URLs" table that many of the static file requests were served from the HTTP.sys kernel cache. We can also see from the "10 Most Requested URLs" table that ASP responses were not cached.

+-----------------------------------------------------------------------------------------------------------------------------------+
| Windows Event Trace Session Report v. 9999                                                                                        |
+-----------------------------------------------------------------------------------------------------------------------------------+
| Build     :  9999      Processors:  4     CPU Speed:   700 MHz  Memory:  2048 MB                                                  |
|                                                                                                                                   |
| Trace Name:  IIS Trace                                                                                                            |
| File Name :  c:\windows\System32\iis.etl                                                                                          |
| Start Time:   7 Jun 2002     9:00:12.060       |_____________________________________________________________________|            |
| End Time  :   7 Jun 2002     9:16:53.700                                                                                          |
| Duration  :  1001            sec                                                                                                  |
|                                                                                                                                   |
| Trace Name:  NT Kernel Logger                                                                                                     |
| File Name :  c:\windows\System32\krnl.etl                                                                                         |
| Start Time:   7 Jun 2002     9:00:01.607       |______________________________________________________________________|           |
| End Time  :   7 Jun 2002     9:16:54.935                                                                                          |
| Duration  :  60              sec                                                                                                  |
+-----------------------------------------------------------------------------------------------------------------------------------+

+-----------------------------------------------------------------------------------------------------------------------------------+
| Http Requests Response Time Statistics                                                                                            |
+---------------------+-------------------------------------------------------------------------------------------------------------+
| Request Type        |      Rates (/s)    Avg Resp. Time (ms)          UL %       W3 %   W3Fltr %    ISAPI %      ASP %      CGI % |
+---------------------+-------------------------------------------------------------------------------------------------------------+
| Cached Requests     |   533.842 ( 74.8%)                   0.064    100.0%       0.0%       0.0%       0.0%       0.0%       0.0% |
+---------------------+-------------------------------------------------------------------------------------------------------------+
| Non Cached Requests |   180.316 ( 25.2%)                  33          7.7%       2.0%       0.0%      34.1%      56.1%       0.0% |
+---------------------+-------------------------------------------------------------------------------------------------------------+
| --- ASP             |   178.368 ( 25.0%)                  33          7.5%       2.0%       0.0%      34.2%      56.2%       0.0% |
| --- Static http     |     1.947 (  0.3%)                   7         93.3%       6.5%       0.3%       0.0%       0.0%       0.0% |
| --- CGI             |     0.000 (  0.0%)                   0          0.0%       0.0%       0.0%       0.0%       0.0%       0.0% |
+---------------------+-------------------------------------------------------------------------------------------------------------+
| Total               |   714.158 (100.0%)                   8          8.3%       2.0%       0.0%      33.9%      55.7%       0.0% |
+---------------------+-------------------------------------------------------------------------------------------------------------+

+-----------------------------------------------------------------------------------------------------------------------------------+
| Http Requests CPU Time Usage Statistics                                                                                           |
+---------------------+-------------------------------------------------------------------------------------------------------------+
| Request Type        |      Rates (/s)             % CPU Time          UL %       W3 %   W3Fltr %    ISAPI %      ASP %      CGI % |
+---------------------+-------------------------------------------------------------------------------------------------------------+
| Cached Requests     |   533.842 ( 74.8%)                0.1%        100.0%       0.0%       0.0%       0.0%       0.0%       0.0% |
+---------------------+-------------------------------------------------------------------------------------------------------------+
| Non Cached Requests |   180.316 ( 25.2%)               70.0%          2.6%       3.0%       0.1%       1.6%      92.7%       0.0% |
+---------------------+-------------------------------------------------------------------------------------------------------------+
| --- ASP             |   178.368 ( 25.0%)               68.1%          2.6%       0.2%       0.1%       1.7%      95.4%       0.0% |
| --- Static http     |     1.947 (  0.3%)                2.0%          2.0%      98.0%       0.0%       0.0%       0.0%       0.0% |
| --- CGI             |     0.000 (  0.0%)                0.0%          0.0%       0.0%       0.0%       0.0%       0.0%       0.0% |
+---------------------+-------------------------------------------------------------------------------------------------------------+
| Total               |   714.158 (100.0%)               70.2%          2.8%       3.0%       0.1%       1.6%      92.5%       0.0% |
+---------------------+-------------------------------------------------------------------------------------------------------------+

+-----------------------------------------------------------------------------------------------------------------------------------+
|  10 Most Requested URLs                                                                                                           |
+----------------------------------------------------------------------------------+------------------------------------------------+
|  URL                                                                             | SiteID  Rates (/s)  CacheHits  Avg RespTime(ms)|
+----------------------------------------------------------------------------------+------------------------------------------------+
|  http://example/file2K.txt                                                       |      1      85.158     100.0%           0.1    |
|  http://example/file3K.txt                                                       |      1      63.316     100.0%           0.1    |
|  http://example/file512.txt                                                      |      1      50.579     100.0%           0.1    |
|  http://example/file256.txt                                                      |      1      43.368     100.0%           0.1    |
|  http://example/file1K.txt                                                       |      1      42.053     100.0%           0.1    |
|  http://example/file4K.txt                                                       |      1      35.842     100.0%           0.1    |
|  http://example/app.asp                                                          |      1      29.526       0.0%          11.7    |
|  http://example/Session.asp                                                      |      1      28.789       0.0%          12.0    |
|  http://example/file5K.txt                                                       |      1      28.158     100.0%           0.1    |
|  http://example/QueryStr.asp                                                     |      1      27.789       0.0%          11.4    |
+----------------------------------------------------------------------------------+------------------------------------------------+

+-----------------------------------------------------------------------------------------------------------------------------------+
|  10 Most Requested Static URLs                                                                                                    |
+----------------------------------------------------------------------------------+------------------------------------------------+
|  URL                                                                             | SiteID  Rates (/s)  CacheHits  Avg RespTime(ms)|
+----------------------------------------------------------------------------------+------------------------------------------------+
|  http://example/file2K.txt                                                       |      1      85.158     100.0%           0.1    |
|  http://example/file3K.txt                                                       |      1      63.316     100.0%           0.1    |
|  http://example/file512.txt                                                      |      1      50.579     100.0%           0.1    |
|  http://example/file256.txt                                                      |      1      43.368     100.0%           0.1    |
|  http://example/file1K.txt                                                       |      1      42.053     100.0%           0.1    |
|  http://example/file4K.txt                                                       |      1      35.842     100.0%           0.1    |
|  http://example/file5K.txt                                                       |      1      28.158     100.0%           0.1    |
|  http://example/file6K.txt                                                       |      1      27.368     100.0%           0.1    |
|  http://example/file7K.txt                                                       |      1      21.211     100.0%           0.1    |
|  http://example/file12K.txt                                                      |      1      16.474     100.0%           0.1    |
+----------------------------------------------------------------------------------+------------------------------------------------+

+-----------------------------------------------------------------------------------------------------------------------------------+
|  10 Slowest URLs                                                                                                                  |
+----------------------------------------------------------------------------------+------------------------------------------------+
|  URL                                                                             | SiteID  Rates (/s)  CacheHits  Avg RespTime(ms)|
+----------------------------------------------------------------------------------+------------------------------------------------+
|  http://example/fibo.asp                                                         |      1       5.947       0.0%         521.3    |
|  http://example/server.asp                                                       |      1      23.842       0.0%          38.4    |
|  http://example/hello.asp                                                        |      1      22.211       0.0%          17.1    |
|  http://example/sessid.asp                                                       |      1      20.947       0.0%          14.3    |
|  http://example/Form.asp                                                         |      1      19.316       0.0%          13.3    |
|  http://example/Session.asp                                                      |      1      28.789       0.0%          12.0    |
|  http://example/app.asp                                                          |      1      29.526       0.0%          11.7    |
|  http://example/QueryStr.asp                                                     |      1      27.789       0.0%          11.4    |
|  http://example/file512K.txt                                                     |      1       1.000       0.0%           9.2    |
|  http://example/file1M.txt                                                       |      1       0.947       0.0%           5.1    |
+----------------------------------------------------------------------------------+------------------------------------------------+

+-----------------------------------------------------------------------------------------------------------------------------------+
|  10 URLs with the Most CPU Usage                                                                                                  |
+----------------------------------------------------------------------------------+------------------------------------------------+
|  URL                                                                             | SiteID        Rates (/s)         CPU Time      |
+----------------------------------------------------------------------------------+------------------------------------------------+
|  http://example/fibo.asp                                                         |      1             5.947           59.03%      |
|  http://example/server.asp                                                       |      1            23.842            3.71%      |
|  http://example/file1M.txt                                                       |      1             0.947            1.41%      |
|  http://example/app.asp                                                          |      1            29.526            1.09%      |
|  http://example/Session.asp                                                      |      1            28.789            1.00%      |
|  http://example/QueryStr.asp                                                     |      1            27.789            1.00%      |
|  http://example/Form.asp                                                         |      1            19.316            0.78%      |
|  http://example/hello.asp                                                        |      1            22.211            0.78%      |
|  http://example/sessid.asp                                                       |      1            20.947            0.70%      |
|  http://example/file512K.txt                                                     |      1             1.000            0.55%      |
+----------------------------------------------------------------------------------+------------------------------------------------+

+-----------------------------------------------------------------------------------------------------------------------------------+
|  10 URLs with the Most Bytes Sent                                                                                                 |
+----------------------------------------------------------------------------------+------------------------------------------------+
|  URL                                                                             | SiteID  Rates (/s)  CacheHits  Bytes Sent (/s) |
+----------------------------------------------------------------------------------+------------------------------------------------+
|  http://example/file1M.txt                                                       |      1       0.947       0.0%      993656      |
|  http://example/file128K.txt                                                     |      1       7.000     100.0%      919079      |
|  http://example/file200K.txt                                                     |      1       3.789     100.0%      776936      |
|  http://example/file256K.txt                                                     |      1       2.316     100.0%      607591      |
|  http://example/file512K.txt                                                     |      1       1.000       0.0%      524571      |
|  http://example/file32K.txt                                                      |      1      15.632     100.0%      515717      |
|  http://example/file64K.txt                                                      |      1       7.579     100.0%      498391      |
|  http://example/file33K.txt                                                      |      1       7.684     100.0%      261386      |
|  http://example/file16K.txt                                                      |      1      13.895     100.0%      230763      |
|  http://example/file3K.txt                                                       |      1      63.316     100.0%      208625      |
+----------------------------------------------------------------------------------+------------------------------------------------+

+-----------------------------------------------------------------------------------------------------------------------------------+
|  10 Clients with the Most Requests                                                                                                |
+-----------------------------------------------------------------------------------------------------------------------------------+
|      IP Address            Rates (/s)       CacheHits        Avg Resp Time (ms)                                                   |
+-----------------------------------------------------------------------------------------------------------------------------------+
|  192.168.1.42                                                         357.789           74.3%                    9                |
|  192.168.1.43                                                         356.368           75.2%                    7                |
+-----------------------------------------------------------------------------------------------------------------------------------+

+-----------------------------------------------------------------------------------------------------------------------------------+
|  10 Clients with the Slowest Responses                                                                                      |
+-----------------------------------------------------------------------------------------------------------------------------------+
|      IP Address            Rates (/s)       CacheHits        Avg Resp Time (ms)                                                   |
+-----------------------------------------------------------------------------------------------------------------------------------+
|  192.168.1.42                                                         357.789           74.3%                    9                |
|  192.168.1.43                                                         356.368           75.2%                    7                |
+-----------------------------------------------------------------------------------------------------------------------------------+

+-----------------------------------------------------------------------------------------------------------------------------------+
|  10 Sites with the Most Requests                                                                                                  |
+-----------------------------------------------------------------------------------------------------------------------------------+
|   Site ID   Rates (/s)                  Avg Resp Time (ms)          Cached Requests    Static File           CGI          ASP     |
+-----------------------------------------------------------------------------------------------------------------------------------+
|         1      714.158                                   8                    74.8%           0.3%          0.0%        25.0%     |
+-----------------------------------------------------------------------------------------------------------------------------------+

+-----------------------------------------------------------------------------------------------------------------------------------+
|  10 Sites with the Slowest Responses                                                                                        |
+-----------------------------------------------------------------------------------------------------------------------------------+
|   Site ID   Rates (/s)                  Avg Resp Time (ms)          Cached Requests    Static File           CGI          ASP     |
+-----------------------------------------------------------------------------------------------------------------------------------+
|         1      714.158                                   8                    74.8%           0.3%          0.0%        25.0%     |
+-----------------------------------------------------------------------------------------------------------------------------------+

+-----------------------------------------------------------------------------------------------------------------------------------+
|  10 Sites with the Most CPU Time Usage                                                                                            |
+-----------------------------------------------------------------------------------------------------------------------------------+
|   Site ID   Rates (/s)     CacheHits        Avg Resp Time (ms)        Avg CPU Time (ms)                % CPU Time                 |
+-----------------------------------------------------------------------------------------------------------------------------------+
|         1      714.158         74.8%                    8                        3                        70.182%                 |
+-----------------------------------------------------------------------------------------------------------------------------------+

+-----------------------------------------------------------------------------------------------------------------------------------+
|  10 Sites with the Most Bytes Sent                                                                                                |
+-----------------------------------------------------------------------------------------------------------------------------------+
|   Site ID   Rates (/s)                     Bytes Sent (/s)          Cached Requests    Static File           CGI          ASP     |
+-----------------------------------------------------------------------------------------------------------------------------------+
|         1      714.158                             7565233                    74.8%           0.3%          0.0%        25.0%     |
+-----------------------------------------------------------------------------------------------------------------------------------+

+-----------------------------------------------------------------------------------------------------------------------------------+
| Image Statistics                                                                                                                  |
+-----------------------------------------------------------------------------------------------------------------------------------+
| Image Name          PID       Threads    Threads        Process             Transaction                CPU%                       |
|                               Launched    Used     KCPU(ms)  UCPU(ms)    KCPU(ms)   UCPU(ms)                                      |
+-----------------------------------------------------------------------------------------------------------------------------------+
| logman.exe       0x00000594          4        1         45         15          0          0            0.06                       |
| wmiprvse.exe     0x00000888          5        0          0          0          0          0            0.00                       |
| w3wp.exe         0x00000AC4         47       26       2070      72795          0          0           69.68                       |
| cmd.exe          0x00000CAC          1        1         30         30          0          0            0.06                       |
| Idle             0x00000000          5        4      13185          0          0          0           12.27                       |
| System           0x00000004        211       11       2430          0          0          0            2.26                       |
| .                                                                                                                                 |
| .                                                                                                                                 |
+-----------------------------------------------------------------------------------------------------------------------------------+
|                                    612       63      19680      73215          0          0   Total:  86.46%                      |
+-----------------------------------------------------------------------------------------------------------------------------------+

+-----------------------------------------------------------------------------------------------------------------------------------+
| Disk Totals                                                                                                                       |
+-----------------------------------------------------------------------------------------------------------------------------------+
| Disk Name        Reads         Avg KB           Writes         Avg KB                                                             |
+-----------------------------------------------------------------------------------------------------------------------------------+
|      0              0               0              21               3                                                             |
+-----------------------------------------------------------------------------------------------------------------------------------+

+-----------------------------------------------------------------------------------------------------------------------------------+
| Disk   0                                                                                                                          |
+-----------------------------------------------------------------------------------------------------------------------------------+
| Authority                PID          Image Name                             Read     Avg      Write    Avg                       |
|                                                                              Count     Kb      Count     Kb                       |
+-----------------------------------------------------------------------------------------------------------------------------------+
| system                   0x00000004   System                                     0      0         21      3                       |
+-----------------------------------------------------------------------------------------------------------------------------------+
Related Topics
  • Log Manager has many logging and tracing options. For information on the available options, see Logman in Windows Help.
  • The Trace Report tool has several options for creating reports. For information on the available options, see Tracerpt in Windows Help.
  • For a detailed discussion of capacity planning tracing, including interpreting trace reports, refer to the Windows Server 2003 Resource Kit.
  • For information about IIS logging, see Logging Site Activity.


Custom Error Messages

You can configure Internet Information Services (IIS) to send custom error messages instead of the default HTTP 1.1 error messages. These custom error messages can be mapped to a file name or to a URL.

This section includes the following information:

  • About Custom Error Messages: Provides information on default and custom HTTP 1.1 errors.
  • Enabling Detailed Custom Error Messages: Describes how to use the detailed (or "friendly") HTTP 1.1 errors that are included with IIS.
  • Enabling ASP Error Processing: Describes how to use the 500-100.asp custom error file to process Microsoft® Active Server Pages (ASP) errors.
  • Creating Custom ASP Error Messages: Provides information on customizing ASP error files.
Related Topics
  • For information on logging substatus error codes, see Substatus Error Codes in Log Files.
  • For information on Web site content, see Web Site Administration.
  • For information on Microsoft Windows® Events, see Events Reference.
(The following words are used by Search; they are not intended to be displayed on the page.) custom error, errors, message, messages, text, dialog box, customize, modify, alternate, friendly, informative, default, detail, detailed, defaults, list, lists, table, tables, chart, charts, sheet, card, reference, detailed, 400, 401, 403, 404, 405, 406, 407, 412, 414, 500, 501, 502, http 1.1, asp, 500-100.asp, warning, warnings, process, processing, mean, meaning, interpret, define, definition, explain, explanation, links, more information


About Custom Error Messages

HTTP 1.1 Error Messages

HTTP 1.1 error messages are returned to the client browser in the form of an HTML page that contains a generic message. When a user attempts to connect to a Web site and an HTTP error occurs, an error message is sent back to the client browser with a brief description of what happened during the attempt to establish a connection. For example, if a user attempts to connect to a Web site that has reached its maximum connection capacity, an HTTP error is returned to the client that contains the statement "Too many users."

Custom Error Messages

All IIS custom error messages display industry-standard HTTP codes, which ensure consistency with HTTP 1.1 error messages. However, you can use the Custom Errors property sheet in IIS to customize generic HTTP error messages.

Custom error messages appear as a list in IIS Manager, which is treated as a single property by IIS. For example, when a set of custom error messages is configured at the Web-site level, all directories under that server inherit the entire list of custom error messages. That is, the two custom error message lists (for the server and the directory) are not merged.

The following HTTP error messages can be customized with IIS.

Error Code | Error Message
400 | Cannot resolve the request.
401.1 | Unauthorized: Access is denied due to invalid credentials.
401.2 | Unauthorized: Access is denied due to server configuration favoring an alternate authentication method.
401.3 | Unauthorized: Access is denied due to an ACL set on the requested resource.
401.4 | Unauthorized: Authorization failed by a filter installed on the Web server.
401.5 | Unauthorized: Authorization failed by an ISAPI/CGI application.
401.7 | Unauthorized: Access denied by URL authorization policy on the Web server.
403 | Forbidden: Access is denied.
403.1 | Forbidden: Execute access is denied.
403.2 | Forbidden: Read access is denied.
403.3 | Forbidden: Write access is denied.
403.4 | Forbidden: SSL is required to view this resource.
403.5 | Forbidden: SSL 128 is required to view this resource.
403.6 | Forbidden: IP address of the client has been rejected.
403.7 | Forbidden: SSL client certificate is required.
403.8 | Forbidden: DNS name of the client is rejected.
403.9 | Forbidden: Too many clients are trying to connect to the Web server.
403.10 | Forbidden: Web server is configured to deny Execute access.
403.11 | Forbidden: Password has been changed.
403.12 | Forbidden: Client certificate is denied access by the server certificate mapper.
403.13 | Forbidden: Client certificate has been revoked on the Web server.
403.14 | Forbidden: Directory listing is denied on the Web server.
403.15 | Forbidden: Client access licenses have exceeded limits on the Web server.
403.16 | Forbidden: Client certificate is ill-formed or is not trusted by the Web server.
403.17 | Forbidden: Client certificate has expired or is not yet valid.
403.18 | Forbidden: Cannot execute requested URL in the current application pool.
403.19 | Forbidden: Cannot execute CGIs for the client in this application pool.
403.20 | Forbidden: Passport logon failed.
404 | File or directory not found.
404.1 | File or directory not found: Web site not accessible on the requested port. note Note The 404.1 error can occur only on computers with multiple IP addresses. If a specific IP address/port combination receives a client request, and the IP address is not configured to listen on that particular port, IIS returns a 404.1 HTTP error. For example, if a computer has two IP addresses and only one of those IP addresses is configured to listen on port 80, any requests received on the other IP address with port 80 result in IIS returning a 404.1 error. This error should be set only at the service level because it is returned to clients only when multiple IP addresses are used on the server.
404.2 | File or directory not found: Lockdown policy prevents this request.
404.3 | File or directory not found: MIME map policy prevents this request.
405 | HTTP verb used to access this page is not allowed.
406 | Client browser does not accept the MIME type of the requested page.
407 | Initial proxy authentication required by the Web server.
410 | File has been removed.
412 | Precondition set by the client failed when evaluated on the Web server.
414 | Request URL is too large and therefore unacceptable on the Web server.
500 | Internal server error.
500.11 | Server error: Application is shutting down on the Web server.
500.12 | Server error: Application is busy restarting on the Web server.
500.13 | Server error: Web server is too busy.
500.14 | Server error: Invalid application configuration on the server.
500.15 | Server error: Direct requests for GLOBAL.ASA are not allowed.
500.16 | Server error: UNC authorization credentials incorrect.
500.17 | Server error: URL authorization store cannot be found.
500.18 | Server error: URL authorization store cannot be opened.
500.19 | Server error: Data for this file is configured improperly in the metabase.
500.20 | Server error: URL authorization scope cannot be found.
500 100 | Internal server error: ASP error.
501 | Header values specify a configuration that is not implemented.
502 | Web server received an invalid response while acting as a gateway or proxy server.
Related Topics
  • For more information on custom error messages, see Custom Error Messages.
  • For information on logging substatus codes, see Substatus Error Codes in Log Files.


Enabling Detailed Custom Error Messages

IIS features its own set of custom errors that provide more informative, or "friendly," feedback than default HTTP 1.1 error messages. For example, the default HTTP 1.1 404 error message that contains the statement "Object Not Found," is expanded to: "The Web server cannot find the file/script you asked for. Please check the URL to ensure that the path is correct. Please contact the server's administrator if this problem persists." These detailed custom error messages are set by default for the default Web site through IIS Manager.

important Important You must be a member of the Administrators group on the local computer to perform the following procedure (or procedures), or you must have been delegated the appropriate authority. As a security best practice, log on to your computer using an account that is not in the Administrators group, and then use the Run as command to run IIS Manager as an administrator. From the command prompt, type runas /user:administrative_accountname "mmc %systemroot%\system32\inetsrv\iis.msc".

To configure detailed custom error messages

  1. In IIS Manager, expand the local computer; right-click the Web site, virtual directory, directory, or file in which you want to customize HTTP error messages; and then click Properties.
  2. Click the Custom Errors tab.
  3. In the Error messages for HTTP errors list, click the HTTP error that you want to change, and then click Edit.
  4. In the Message Type list box, click File.
  5. Click Browse, navigate to systemroot\Help\IisHelp\Common\, and double-click the error message that you want to configure.

    note Note Friendly error messages are installed by default to the following location: systemroot\Help\IisHelp\Common. The file names are numbers that correspond to the specific HTTP errors; for example, 400.htm, 401-1.htm, and so on.

  6. Click OK, and then click OK again.

If you upgraded from IIS 4.0, and you previously created your own custom error files or modified the custom error files that IIS 4.0 installed in the systemroot\Help\Common folder, your custom error files have been moved to the systemroot\Help\IisHelp\Common folder and given a .bak file name extension. You can retrieve your custom errors and reuse them. For example, the custom error file 400.htm that IIS 4.0 installed is now named 400.bak and is located in the systemroot\Help\IisHelp\Common folder (in addition to the new IIS custom error files).

Related Topics
  • For information on customizing ASP error files, see Creating Custom ASP Error Messages.


Enabling ASP Error Processing

By default, the default Web site and all of its applications transfer the processing of Active Server Pages (ASP) errors to the 500-100.asp file. However, any new Web site that you create, or its applications, transfers the processing of 500-100 errors to the default, and not to a custom error file. If you want to develop additional error processing for .asp files, you can do so by either mapping the 500-100 error to the 500-100.asp file or by creating an error-processing .asp file of your own.

The 500-100.asp file processes any errors that occur during compilation or running of .asp files. When an ASP error occurs, IIS returns the 500-100.asp file with detailed information about the error, such as the line number in which the error occurred and a description of the error.

If the 500-100.asp file itself contains ASP errors, ASP does not return another 500-100.asp file. Instead, the error will be reported as if no custom error file exists for 500-100 errors. If the error-processing file (by default, 500-100.asp) contains run-time errors, only this error is displayed, regardless of the type of error in the requested .asp file. Finally, if the error-handling file has preprocessor or compilation errors, both errors are displayed in the browser (the error from the 500-100.asp file and the error in the requested .asp file).

If you create an ASP error-processing file of your own, you need to enable the custom error file through IIS Manager.

important Important You must be a member of the Administrators group on the local computer to perform the following procedure (or procedures), or you must have been delegated the appropriate authority. As a security best practice, log on to your computer using an account that is not in the Administrators group, and then use the Run as command to run IIS Manager as an administrator. From the command prompt, type runas /user:administrative_accountname "mmc %systemroot%\system32\inetsrv\iis.msc".

To enable ASP error processing by mapping to a URL

  1. Create a file that contains your custom error message, and save it to a virtual directory.
  2. In IIS Manager, expand the local computer; right-click the Web site, virtual directory, directory, or file in which you want to customize HTTP errors; and then click Properties.
  3. Click the Custom Errors tab.
  4. In the Error messages for HTTP errors list, click the HTTP error that you want to change, and then click Edit.
  5. In the Message Type list box, click URL.
  6. In the URL box, type the URL that points to your customized error message by entering the path to the URL, beginning with the virtual directory name.
  7. Click OK, and then click OK again.

If you have an ASP page defined to handle a custom error, the script is invoked as a URL that passes the context. For example, if you have a file called Handle405.asp that is defined to handle HTTP 405 errors, and a 405 error occurs when a user tries to access Example.htm, the Handle405.asp file is invoked as if the user had typed the following:

http://example.microsoft.com/handle405.asp?405;http://example.microsoft.com/example.htm

If you are using Windows with Microsoft Internet Explorer 5.0, Internet Explorer may replace the following custom errors with its own HTTP error. If the file size of the custom error is smaller than the size listed, the custom error is not used.

  • 403, 405, and 410 (must be greater than 256 bytes)
  • 400, 404, 406, 408, 409, 500, 500.12, 500.13, 500.15, 501, and 505 (must be greater than 512 bytes)
Related Topics
  • For information on customizing ASP error files, see Creating Custom ASP Error Messages.


Creating Custom ASP Error Messages

If you develop an application using Internet Server API (ISAPI) or Active Server Pages (ASP) to handle errors, you should customize an error message by mapping to a URL. Note that the error status is handed to the application in the URL parameters, and the application must set the HTTP header status. Otherwise, the HTTP response status is "HTTP 1.1 200 OK."

If you map a custom error message to an ASP file, you must use Server.HTMLEncode to encode your output to avoid cross-site scripting vulnerabilities. Malicious users can send false headers that contain characters like < > " ' % ; ) ( & + - to inject script into the response that is compiled by your ASP custom error file. For example, if you use a header to generate a personal greeting, HTML-encode your output as shown the following example:

<%@ LANGUAGE="VBScript" %>
<%
  Response.CodePage = 1252
  Response.Write("Hello, " & Server.HTMLEncode(Request.Form("UserName")));
  Response.Write("This is why you received an error:");
%>

An alternate solution is to add a function to your ASP custom error file that uses the Regular Expression object of Windows Script Host to remove potentially harmful characters from a string that is sent to the function. The following two ASP examples contain such a function. The first example is written in Microsoft Visual Basic® Scripting Edition (VBScript), and the second example is written in Microsoft JScript®:

<%@ LANGUAGE="VBScript" %>
<%
  Response.CodePage = 1252
  Response.Write("Hello, " & RemoveBadCharacters(Request.Form("UserName")))
  Response.Write("<BR>This is why you received an error:")

  Function RemoveBadCharacters(strTemp)
    Dim regEx
    Set regEx = New RegExp
    regEx.Pattern = "[^\s\w]"
    regEx.Global = True
    RemoveBadCharacters = regEx.Replace(strTemp, "")
  End Function
%>

<%@ LANGUAGE="JScript" %>
<%
  Response.CodePage = 1252;
  Response.Write("Hello, " + RemoveBadCharacters(Request.Form("UserName")));
  Response.Write("<BR>This is why you received an error:");

  function RemoveBadCharacters(strTemp) {
    strTemp = strTemp.replace(/[^\s\w]/g,");
    return strTemp;
  }
%>

In both examples above, the code page is specified to ensure proper encoding.

Related Topics
  • For information on how to use the 500-100.asp custom error file to process ASP errors, see Enabling ASP Error Processing.


Restarting IIS

You might need to restart Internet Information Services (IIS) before certain configuration changes take effect or when applications become unavailable. Restarting IIS is the same as first stopping IIS, and then starting it again, except it is accomplished with a single command. There are two ways to restart IIS:

  • Using IIS Manager.
  • Using the IISReset command-line utility.

Both methods allow you to stop, start, and restart IIS Internet services. The Restart IIS command in IIS Manager and the IISReset command-line utility do not restart the HTTP protocol stack (HTTP.sys) or Internet services outside of IIS. In previous versions of IIS, restarting IIS using the IISReset command-line utility was a common practice for recovering from an unresponsive application.

Restarting or stopping IIS, or rebooting your Web server, is a severe action. When you restart the Internet service, all sessions connected to your Web server (including Internet, FTP, SMTP, and NNTP) are dropped. Any data held in Web applications is lost. All Internet sites are unavailable until Internet services are restarted. For this reason, you should avoid restarting, stopping, or rebooting your server if at all possible. IIS 6.0 includes application pool recycling and several other features that provide alternatives to restarting IIS. For a list of features designed to improve IIS reliability and remedy the need to restart IIS, see Alternatives to Restarting IIS in this topic.

note Note Changes to the metabase can be lost when restarting IIS. To avoid losing metabase changes and to trigger history files that back up the metabase, use the SaveData method.

With IIS 6.0, the World Wide Web Publishing Service (WWW service) lives in the service host, Svchost.exe. The FTP, NNTP, and SMTP services and the IIS metabase, known as the IIS Admin service, lives in Inetinfo.exe. If the IIS Admin service terminates abnormally, IIS restarts automatically. This feature is known as Automatic Restart. Previously, in IIS 5.0, if the IIS Admin service terminated abnormally, both the WWW service and IIS Admin service had to be restarted because they shared the same application space. In IIS 6.0, if the IIS Admin service terminates abnormally, the WWW service does not go down because the IIS Admin service and the WWW service run in separate process spaces. In this case, the WWW service acknowledges that the metabase has terminated abnormally and checks to see if the IISReset command-line utility is configured on the IIS Admin service. If IISReset is configured on the IIS Admin service, IIS waits for the IIS Admin service to start again and reconnects the WWW service.

All of the Internet services listed below, if installed, are affected when you restart IIS. Not all of the services listed below are installed by default.

Service | Description
IIS Admin service | This service manages all the services of IIS other than the WWW service (FTP, NMTP, and SMTP).
WWW service | This service provides Web connectivity between clients and Web sites.
HTTP SSL service | This service provides secure Web connectivity between clients and Web sites.
FTP service | This service provides FTP connectivity and administration through IIS Manager.
SMTP service | This service transports electronic mail across the network.
NNTP service | This service transports network news across the network.

important Important You must be a member of the Administrators group on the local computer to perform the following procedure (or procedures), or you must have been delegated the appropriate authority. As a security best practice, log on to your computer using an account that is not in the Administrators group, and then use the Run as command to run IIS Manager as an administrator. From the command prompt, type runas /user:administrative_accountname "mmc %systemroot%\system32\inetsrv\iis.msc".

To restart IIS using IIS Manager

  1. In IIS Manager, right click the local computer, point to All Tasks, then click Restart IIS.
  2. In the What do you want IIS to do list, click Restart Internet Services on computername.
  3. IIS attempts to stop all services before restarting. IIS waits up to five minutes for all services to stop. If the services cannot be stopped within five minutes, all IIS services are terminated, and IIS restarts. In addition, clicking End now forces all IIS services to stop immediately, and IIS is restarted.

caution Caution If IIS is terminated before its services have stopped normally, data loss can result. If possible, back up your IIS configuration before restarting IIS. See Backing Up and Restoring the Metabase for information on backing up your IIS configuration.

To restart IIS using the IISReset command-line utility

  1. From the Start menu, click Run.
  2. In the Open box, type cmd, and click OK.
  3. At the command prompt, type iisreset /noforce computername, and press ENTER.

    4. note Note The /noforce parameter is recommended as a safeguard against data loss in case the IIS services cannot all be stopped within the one minute timeout period. If you are certain that it is safe to force IIS to restart, you can omit the /noforce parameter. In addition, if you are logged on locally, the computername parameter is not required. If you are administering an IIS server remotely, the computername parameter is the NetBIOS name of the computer on which you wish to restart IIS.

  4. IIS attempts to stop all services before restarting. The IISReset command-line utility waits up to one minute for all services to stop. If the services cannot be stopped within one minute, all IIS services are terminated, and IIS restarts.

    note Note You can adjust the timeout value using the iisreset /timeout command.

The IISReset command-line utility has several options available. For more information on the options available with the IISReset command-line utility, open a command-prompt window, and type iisreset /? You can also search for "iisreset" in Windows Help.

Automatic Restart

Automatic Restart is enabled by default for the IIS Admin service and WWW service. If a process within either service terminates abnormally, the service restarts automatically. The WWW service restarts using the net start command. The IIS Admin service restarts using the iisreset command. These commands are issued internally without user intervention. You can disable Automatic Restart using the following procedures.

To disable restart of IIS Admin service

  1. From the Start menu, right-click My Computer, and click Manage.
  2. In the console tree, expand the Services and Applications node, and click Services.
  3. Right-click IIS Admin Service, and click Properties.
  4. Click the Recovery tab, and in the First failure, Second failure, and Subsequent failureslist boxes, click Take No Action.
  5. Click OK.

The following command can only be issued on the local machine.

To disable restart of IIS Admin service from the command line

  1. From the Start menu, click Run.
  2. In the Open box, type cmd, and click OK.
  3. At a command prompt, type iisreset /disable, and press ENTER. This command disables IIS and prevents all iisreset calls from executing.

    note Note To re-enable the IIS Admin service, at the command prompt, type iisreset /enable, and press ENTER.

To disable restart of the WWW service

  1. From the Start menu, right-click My Computer, and click Manage.
  2. In the console tree, expand the Services and Applications node, and click Services.
  3. Right-click World Wide Web Publishing Service, and click Properties.
  4. Click the Recovery tab, and in the First failure, Second failure, and Subsequent failureslist boxes, click Take No Action.
  5. Click OK.

Alternatives to Restarting IIS

If you have to restart IIS often because of a faulty application, consider debugging or rewriting the application. To ensure that your applications do not interfere with other services and cause the need to restart IIS, it is recommended that you enable the following:

  • Worker Process Isolation Mode: Worker process isolation mode is the default service mode in IIS. Worker process isolation mode delivers all the benefits of IIS 6.0 new architecture: robust application pooling, automated restarts, scalability, debugging, and precise performance tuning.
  • Recycle Worker Process in the application pool: In worker process isolation mode, IIS can be configured to periodically restart worker processes in an application pool, allowing you to manage precisely those worker processes that are faulty.
  • Rapid Fail Protection: Worker process isolation mode can be configured so that if a particular application pool experiences consecutive multiple failures, the application can be automatically disabled, allowing for rapid-fail protection.
  • Enabling CPU Monitoring: CPU monitoring is a tool for monitoring and automatically shutting down worker processes that consume large amounts of CPU time.
Related Topics
  • For a list of features designed to help administrators control how aspects of IIS utilize resources like memory and CPU cycles, see Quality of Service.
  • For more information about configuring IIS to run Web applications and how to deal with reliability issues caused by Web applications, see Configuring Servers for Applications.
  • For information on starting and stopping individual Web and FTP sites, see Starting and Stopping Web Sites.


Internet Protocol Version 6

This version of IIS provides Internet services to clients connecting over the next generation of Internet Protocol (IP)—known as IP version 6, or IPv6. IPv6 is included with the Microsoft® Windows® XP networking platform and the Microsoft Windows Server 2003 family.

The Internet Server API (ISAPI) framework provides the appropriate local- and remote-host server variables for IPv6 network addresses: LOCAL_ADDR and REMOTE_ADDR. When clients connect over IPv6, these variables store the IPv6 address.

When writing applications that use the ISAPI server variables for network addressing over IPv6, remember that all buffers allocated for network address storage can be a maximum of 128 bits in size (56 character string), whereas buffers allocated for network address storage over IPv4 are limited to 32 bits (16 character string).

After the protocol stack is installed, IIS automatically begins supporting IPv6 on your Web server.

Web sites that are already running must be restarted before they begin listening for IPv6 requests. Sites created after IPv6 support is enabled automatically listen for IPv6.

Functionality

The IIS core functionality has not changed as a result of IPv6 support; however, only a subset of all IIS 6.0 functionality is available for IPv6.

  • IIS Manager does not display IPv6 addresses as it does for IPv4 addresses.
  • Bandwidth Throttling is not supported for IPv6 Web sites.
  • The ServerBindings metabase property does not support storing IPv6 literal addresses (as defined in RFC 2732). This behavior limits IIS to support host-header routing only.
  • The IP Address Restrictions feature in IIS does not support IPv6 addresses or IPv6 prefixes.
  • The EnableReverseDnsLookup metabase property is not supported. Setting this property to true does not cause the REMOTE_HOST server variable to return the DNS name of the client, as it does for IPv4. REMOTE_HOST will always contain the IPv6 address regardless of the EnableReverseDNSLookup setting.
  • Site routing based on IP addresses is not supported for IPv6. Server address with sites that are configured to route based on IPv4 addresses will not respond to IPv6 requests.
  • IPv6 is be enabled for all sites. You cannot configure IPv6 support at the machine level. In other words, you cannot configure individual sites to respond to IPv6 traffic while other sites on the same server respond to IPv4 traffic. It is possible, however, to limit IPv6 traffic to a specific site if that site is configured to use IP-based routing on an IPv4 address.
  • Logging. IIS writes IPv6 addresses to the log file when IPv6 is enabled and client computers connect to the server using IPv6 addresses. Log parsing tools must support IPv6 address formats if they are to be used with log files for IPv6 sites.
  • SSL. Due to the IP routing restriction for IPv6, IIS deployments designed for IPv6 addresses are limited to one Secure Sockets Layer (SSL) site per computer.
Related Topics
  • For information on how to install the IPv6 network protocol stack, see IPv6 in Windows Help.


Programmatic Administration Guide

Each system on your computer comes with a graphical user interface (GUI)—such as Internet Information Services (IIS) Manager, Computer Management Console, Control Panel, or Windows Explorer—to manage and configure your settings. However, if you manage systems frequently or access large amounts of data on multiple servers, then using each GUI can be time consuming. In these cases, it is faster to use command-line scripts that can manage single or multiple systems programmatically.

For example, if you have 20 IIS Web servers to which you want to add a script mapping, it would take a lot of mouse clicks and key strokes to do so through IIS Manager. However, if you wrote a command-line script that took as input a file containing the names of your Web servers and the name of the property you want to change, then you could make all of the changes from one server with a single command.

IIS provides powerful scripting and programming tools that you can use to access and configure settings from within a command-line script or compiled application. Beginning with IIS 6.0 on members of the Microsoft® Windows® Server 2003 family, you can efficiently monitor and manage the metabase by using a single COM-based programming interface and the IIS Windows Management Instrumentation (WMI) provider.

note Note You can query the metabase by using the IIS Admin Base Object (ABO), WMI, or Active Directory® Service Interfaces (ADSI). If you use ABO to query the metabase and the value being queried is not set, ABO returns a "data_not_found" message and the schema is not checked. If you use WMI or ADSI to query the metabase and the value being queried is not set, a lookup for the value is performed in the schema and the default value is returned. Therefore, if you want to query the metabase for a value that is potentially not enumerated and you want the query to continue to the schema to extract the default value, you should use ADSI or WMI, not ABO.

This section includes the following information:

  • Using the IIS WMI Provider: Describes how to use the IIS WMI provider in command-line scripts to manipulate the metabase for the purpose of administering IIS. The IIS WMI provider includes all of the functionality that is available with the IIS ADSI provider, and it includes new methods.
  • Using the IIS ADSI Provider: Describes how to use the IIS ADSI provider in command-line scripts to manipulate the metabase for the purpose of administering IIS. The IIS ADSI provider does not include all of the functionality that is available with the IIS WMI provider.
  • Using Command-Line Administration Scripts: Describes how to use the supported command-line administration scripts that are installed with IIS to help administer your server. These are useful for administrators who want command-line control of IIS or who want examples of WMI scripts.
Related Topics
  • For more information on developing administrative tools with Microsoft Visual C++®, see "Using IIS Interfaces for Advanced Programmatic Administration" in the Platform SDK.


Using the IIS WMI Provider

Windows Management Instrumentation (WMI) is a technology that allows Microsoft® Windows® operating system administrators to manage and configure Internet Infromataion Services (IIS) programmatically by using the IIS WMI provider. The IIS WMI provider exposes programming interfaces that can be used to query and configure the IIS metabase.

This section includes the following information:

  • About the IIS WMI Provider: Describes WMI technology, the IIS WMI provider, and how to use the IIS WMI provider for administration tasks.
  • IIS WMI Provider Object Hierarchy: Describes the WMI schema and how classes and instances correspond to the IIS metabase schema.
  • IIS WMI Provider Tutorial: Describes how to use the IIS WMI provider for metabase management tasks and provides WMI scripting examples.


About the IIS WMI Provider

Windows installations are composed of numerous smaller systems that provide network access, data storage, and other features and services. These systems include devices such as printers and modems, and services such as the World Wide Web Publishing Service (WWW service) and e-mail. There are graphical user interfaces (GUIs) for managing Windows features. However, for Windows administrators with numerous features or many computers to manage, a scripting/programming solution provides an efficient alternative to manipulating a GUI.

Windows Management Instrumentation (WMI) is a powerful provider-based technology for managing the diverse systems and objects that compose the Windows environment. Providers are developed to manage the objects of individual features, such as IIS or a printing service. The IIS WMI provider exposes a set of interfaces that offer administrators powerful and flexible ways to use scripts and programs to administer Web sites. Furthermore, the WMI provider is more full-featured than Active Directory® Service Interfaces (ADSI) for managing the configuration of IIS.

important Important You must be a member of the Administrators group on the local computer to run scripts and executables, or you must have been delegated the appropriate authority. As a security best practice, log on to your computer using an account that is not in the Administrators group, and then use the Run as command to run your script or executable as an administrator. From the command prompt, type runas /user:administrative_accountname "script or executable command".

WMI and System Management

Administrators using a member of the Microsoft Windows Server 2003 family can use WMI to manage systems composed of numerous devices, resources, and applications. Using WMI technology, these systems and components are represented using the Common Information Model (CIM). CIM can model anything in the managed environment, regardless of data-source location, by providing a consistent and unified view of objects. Managed objects are represented using object-oriented constructs, such as classes. These classes include properties that describe data and methods. WMI offers a powerful set of services that include manipulating managed objects, such as IIS metabase keys, or retrieving query-based information on managed objects.

WMI is designed to offer the following advantages over other available management technologies, such as ADSI:

  • Query Support: Administrators can select only the objects or properties they want to see, and WMI will return only the appropriate data. This high level of detail saves time for administrators, who no longer must sort through unneeded data.
  • Association: Because objects and properties may be associated outside the boundaries of a containment model, WMI allows selections and modifications by association across containment boundaries.
  • Global Object Model: A single Component Object Model (COM) application programming interface (API) exposes managed objects in IIS and other systems and applications depending only upon the availability of appropriate WMI providers.

The WMI Provider

When managing IIS with WMI, the object manager is the WMI provider and the managed object is the IIS metabase. The WMI provider serves as an instance and method provider. As an instance provider, the WMI provider maps the XML configuration elements from the metabase into WMI as a series of classes and instances. As a method provider, the WMI provider supports a series of methods you can call to add, remove, or modify the IIS configuration information in the metabase.

The WMI provider queries and manages the metabase in response to script or program commands as follows:

  1. A script or application executes and sends a query for IIS configuration classes to the WMI CIM Object Manager for validation. The query may select classes to acquire status, to call methods, or to set class properties.
  2. WMI CIM Object Manager compares the objects in the query with a database of WMI object definitions, the WMI Object Repository, to validate them as WMI objects.
  3. If the objects queried are all valid metabase objects, WMI CIM Object Manager forwards the query to the IIS WMI provider.
  4. The IIS WMI provider executes the query, call, or setting against the metabase configuration classes.

Diagram illustrating the steps that are required to update the metabase by using the WMI IIS provider.

The IIS WMI provider reads the metabase as a database of records, where each record is represented as an instance of a class. Each instance can then be queried to determine content, state, associations, and properties. The IIS WMI provider establishes relationships between objects, allowing you to tie together the various objects and all the objects contained within them. Management tasks can then be performed by using a single instance of the class, or many instances of the class.

Comparing the ADSI and the IIS WMI Providers

The IIS WMI schema is congruent with the IIS ADSI Admin Objects schema, although the two technologies differ in architecture and features. The following table compares the architecture and features of the IIS ADSI provider with those of the IIS WMI provider.

Issue | IIS ADSI provider | IIS WMI provider
Query capabilities | No. ADSI has no provision for queries. | Yes. By querying on metabase key types, the IIS WMI provider returns only the data you need.
Object model and access routes | COM: Scripts and programs. | COM: Scripts, programs, and UI tools; for example, the WMI Object Browser.
Extensible schema | Yes. ADSI provider supports metabase schema extensions. | No. The IIS WMI provider can return existing schema extensions, but cannot extend the metabase schema.
Association or containment of related data | Properties are related to IIS metabase keys by containment. You can use the ADSI container object methods of the IIS Admin Objects to manipulate keys in the IIS metabase. You can create, delete, and move keys by creating, deleting, and moving IIS Admin Objects within container objects. You can also enumerate contained objects, such as virtual directories or servers with container object methods. ADSI supports property inheritance. | Properties are related to IIS metabase keys by containment or by association. Also, in conjunction with other providers, WMI supports associations with managed objects not in the metabase. An association in WMI describes a relationship between classes and is in itself defined by a class. This powerful concept allows management information about an entire system of associated components to be viewed and traversed for tasks such as troubleshooting. Navigating associations to other classes is not limited by containment.
Related Topics
  • For information on the WMI SDK, see the Windows Management Instrumentation Platform SDK Web site.


IIS WMI Provider Object Hierarchy

Each Windows Management Instrumentation (WMI) provider maintains its own namespace for classes that are specific to that provider. Each WMI provider namespace is a collection of class definitions that describe objects hierarchically in a domain. The namespace for IIS WMI provider classes is MicrosoftIISv2. Script writers and programmers use the MicrosoftIISv2 namespace to read and configure the IIS metabase.

WMI Class Types

The classes that are defined in the MicrosoftIISv2 namespace correspond to the IIS metabase schema, which means that for every unique metabase key, there exists at least one WMI class defined for it. Most metabase keys have more than one WMI class defined for them: a WMI element class, containing read-only properties; and a WMI setting class, containing writable properties.

The following example shows the relationships between a few metabase keys and their corresponding WMI element classes (which have names identical to ADSI classes) and setting classes.

Generic Name | Element Class | Setting Class
Computer | IIsComputer | IIsComputerSetting
WWW service | IIsWebService | IIsWebServiceSetting
Web server | IIsWebServer | IIsWebServerSetting
Web virtual directory | IIsWebVirtualDir | IIsWebVirtualDirSetting
FTP service | IIsFtpService | IIsFtpServiceSetting

A third type of WMI class, the association class, exposes relationships between element classes and settings classes, and between element classes and other element classes.

The following sections describe the three types of WMI classes and how they are used.

WMI Element Classes

WMI element classes expose the following types of properties that cannot be changed, or written to:

  • Read-only properties, which belong to the element class.
  • Inherited properties, which belong to the parent class.
  • System properties, which belong to the system.

For example, the following are some of the unchangeable properties that are exposed by the WMI element class IIsWebVirtualDir:

  • Read-only: AppIsolated, AppPackageID, and AppPackageName.
  • Inherited: Caption, Description, and InstallDate.
  • System: _CLASS, _DERIVATION, and _NAMESPACE.

Because no WMI class contains read-only methods, WMI element class methods can be called and executed. For example, the IIsWebVirtualDir class methods, such as AppCreate, AppDelete, and AppUnload, can be called from a script or program.

You can use WMI element classes to do the following:

  • Navigate or enumerate objects.
  • Create new metabase nodes.
  • Call methods.
  • Query read-only properties.

WMI Setting Classes

WMI setting classes expose read/write properties, which you can change using a script or program. Setting classes do not contain methods.

For example, the IIsWebVirtualDirSettings setting class, a counterpart to the IIsWebVirtualDir element class, exposes the following writable metabase properties, in addition to others:

  • AccessFlags
  • AccessSSL
  • AspSessionTimeout
  • CacheISAPI
  • HttpRedirect

When setting metabase properties directly, use the setting classes. You need only use WMI element classes to read information. In the JScript code example below, a script uses the IIsWebVirtualDirSetting setting class to set the AccessFlags metabase property to zero. Note that no element class is used in the script.

var providerObj = GetObject("winmgmts:/root/MicrosoftIISv2");
var vdirObj = providerObj.Get("IISWebVirtualDirSetting='W3SVC/1/ROOT'");
vdirObj.AccessFlags = 0;
vdirObj.Put_();

You can also use WMI setting classes to set writable metabase properties.

WMI Association Classes

WMI element classes may be associated with other element classes or with setting classes. These associations are themselves classes. You can use WMI association classes to find element or setting objects that are associated with any element object. Association class names are distinguished by an underscore separating two names, such as IIsComputer_IIsComputerSetting or IIsComputer_IIsMimeMap.

The following list illustrates some of the associations of the element class IIsWebVirtualDir:

  • IIsWebVirtualDir_IIsWebVirtualDirSetting (associating with its counterpart WMI setting class).
  • IIsWebVirtualDir_IIsWebDirectory (associating with the WMI element class for Web directories).
  • IIsWebVirtualDir_IIsIPSecuritySetting (associating with the WMI setting class for Internet Protocol security).
  • IIsWebVirtualDir_IIsWebVirtualDir (associating parent-to-child with one virtual directory containing other virtual directories).

Association classes allow you to easily find associations between an instance of a WMI element class and instances of associated WMI classes. For example, by using the association of IIsWebDirectory and IISWebFile, you can find the IP security settings (IPSecuritySetting) for each of the files contained in a Web directory.

Similarly, you can find all of the child classes of an element class. For example, to find the child classes of a Web virtual directory, use the association class IIsWebVirtualDir_IIsWebVirtualDir.

Related Topics
  • For basic IIS WMI provider instruction and sample scripts that use WMI setting classes, see the IIS WMI Provider Tutorial.
  • For information on WMI reference material and WMI object browsing tools, see the Windows Management Instrumentation Platform SDK on MSDN.


IIS WMI Provider Tutorial

The goal of Windows Management Instrumentation (WMI) is to provide a common way to manage all systems, including system devices, resources, and applications. Active Directory® Service Interfaces (ADSI) were developed with the same goal in mind, but most ADSI interfaces are limited in what tasks they can perform and what information they can provide. WMI solves these problems by providing a structure that can satisfy the needs of all systems. In addition, WMI leverages the security features of Component Object Model (COM) interfaces to make managing remote computers easier and more secure. For more information, see the COM+ Software Developer Kit.

The goal of this tutorial is to prepare you to write your own Internet Information Services (IIS) administration scripts by walking you through the Windows Management Instrumentation Platform SDK and the IIS WMI Provider Reference, describing introductory WMI concepts, and instructing you to write basic WMI scripts.

This tutorial includes the following modules:

  • Module 1: Introduction to WMI Concepts: Explains the purpose, structure, and benefits of WMI. If you are already familiar with WMI, you can proceed to the next module.
  • Module 2: Using CIM Studio and the IIS Metabase for a Clearer Picture: Explains the relationship between the IIS metabase and the structure of WMI, and compares it to the structure of ADSI. A tool called CIM Studio walks you through the IIS WMI provider and the IIS metabase at the same time.
  • Module 3: Writing Administration Scripts that Use WMI: References what you learned in Module 2 while writing basic WMI scripts to administer IIS metabase properties. With your scripts, you will be able to query site properties, map virtual resources to real resources, create sites and set properties, export metabase nodes, use associations to find metabase elements, and use two providers in one script.

Before You Get Started

You must start Windows Management Services to use WMI on your machine.

important Important You must be a member of the Administrators group on the local computer to perform the following procedure (or procedures), or you must have been delegated the appropriate authority. As a security best practice, log on to your computer using an account that is not in the Administrators group, and then use the Run as command to perform this procedure as an Administrator.

To start Windows Management Services

  1. From the Start menu, click Run.
  2. In the Open box, type: net start winmgmt
  3. Click OK.
Related Topics
  • For complete conceptual information on the IIS WMI provider, see Using the IIS WMI Provider.
  • For complete reference information on the objects and methods of the IIS WMI provider, see IIS WMI Provider Reference.
  • For complete reference information on the objects and methods of all of the available WMI providers, see Windows Management Instrumentation Platform SDK on MSDN.
  • For complete language information on Microsoft® Visual Basic® Scripting Edition (VBScript), Microsoft JScript®, Perl, and Microsoft C++, or for topics on writing administration scripts, see ASP, Windows Script Technologies, Active Scripting with PerlScript, Programmatic Administration Guide, and Code Examples to Configure Metabase Properties.


Module 1: Introduction to WMI Concepts

This module explains the purpose, structure, and benefits of Windows Management Instrumentation (WMI). If you are already familiar with WMI, you can proceed to Module 2.

This module includes the following lessons:

  • Lesson 1: Managing Systems Using a Common Set of Tools: Explains what is meant by a system and how WMI enforces commonality among WMI providers.
  • Lesson 2: Organizing Information: Explains how to use the idea of a database to understand the structure of WMI. Compares the structure of WMI to the structure of Active Directory® Service Interfaces (ADSI).
  • Lesson 3: Organizing Data from the IIS Metabase: Applies the concepts learned in Lesson 2 to one of the many WMI providers, the Internet Information Services (IIS) WMI provider, and explains the classes that the IIS WMI provider uses.


Lesson 1: Managing Systems Using a Common Set of Tools

Microsoft® Windows® is an operating system that is composed of many smaller systems which provide network access, data storage, and other features. Operating systems often include devices such as printers, resources such as files, services such as the IIS Web server, and numerous applications. There are graphical user interfaces (GUIs) to manage and configure all of these systems, such as the Computer Management Console, Control Panel, Windows Explorer, IIS Manager, and so on. However, if administrators manage systems frequently, or access large amounts of data on multiple machines, then using each GUI can take a great deal of time. In these cases, it is faster to use command-line scripts that can manage single or multiple systems programmatically.

At first, designers of systems developed individual programmatic interfaces for managing their own systems. Consequently, administrators had to learn a different interface for each system.

Then, the Active Directory Service Interfaces (ADSI) were developed to give designers of all systems a way to provide programmatic access to their systems. It was entrusted to the designers to design their ADSI interfaces to be similar to each other. Because ADSI did not enforce similarity in implementation, the interfaces were not designed in a uniform manner. Administrators still felt as if they were learning a different interface for each system. They also found it difficult to manage many machines from a single remote machine by using ADSI.

Now, designers of systems can develop Windows Management Instrumentation (WMI) providers to help administrators manage their systems programmatically. With its object-oriented design, WMI enforces similarity in implementation. As a result, the WMI provider for one system has a similar look and feel to a WMI provider for another system. Managing many machines from a single remote machine is easier because WMI uses distributed COM (DCOM). This concept of managing multiple or single systems on multiple or single machines locally or remotely over the Internet is called Web Based Enterprise Management (WBEM). WMI is to WBEM as tools are to house-building.

note Note It is important to be familiar with the difference between writing a WMI provider for a system and using a WMI provider to manage a system. Information on both procedures is provided in the WMI SDK. It is also important to note that there are WMI providers for each system in your Windows installation. This tutorial deals specifically with using the IIS WMI provider to manage your IIS Web server. However, some general knowledge of WMI is necessary to complete the tutorial.

Related Topics
  • To proceed to the next lesson in this module, see Lesson 2: Organizing Information.


Lesson 2: Organizing Information

In Lesson 1, we learned that Windows Management Instrumentation (WMI) forces designers of systems to implement their WMI providers in the same way, a result of the Common Interface Model (CIM), an industry standard to represent systems. CIM is based on the idea that every system can be managed by manipulating the information that it contains. For example, when managing a printer, you need to know the path to the printer, what type of printer it is, how much memory the printer has, what files are in the queue, and so on. Any system can be represented by the properties that hold that type of information, and by the methods that work upon those properties. For example, the properties of the IIS metabase are represented by matching the WMI properties with the methods that change them.

Properties can be grouped together with their methods to form an element class. For example, the concept of an IIS Internet service is an element that groups World Wide Web Publishing Service (WWW service) properties, such as ServerState and ServerSize, together with WWW service methods, such as IIsWebServer.Stop (ADSI) and IIsWebServer.Start (ADSI).

Elements can be grouped together into classes. For example, elements that contain writable properties and methods can be grouped in one class, while elements that contain read-only properties and methods can be grouped in a different class.

All of the classes of a provider are contained in the namespace for that provider. For example, the namespace for your machine is called root. The root namespace contains all of the other namespaces, like the one for IIS which is called MicrosoftIISv2.

To help you understand the organization of information in WMI, think of a namespace as a database where the tables in the database are classes, the records are elements, and the cells contain the properties and methods (Figure 1).

Graphic illustrating the database analogy of the structure of WMI.

Figure 1

At first, you might think that the groupings of properties and methods in the elements, elements in the classes, and classes in the namespace do not follow a pattern. The logic behind grouping in WMI is dictated more by inheritance than by following a constricting pattern. For example, if one class needs to inherit properties, methods, or structure from another class, it can be a child of that other class. If elements contain read-only properties and methods, then they don't need to be contained in a class that inherits methods that write to properties.

One final concept to understand is association. Association is a solution to Active Directory Service Interfaces (ADSI) containment. For example, if two elements share methods or properties, or if one element contains the other element, an association can be created between the two elements to make the structure more efficient. In Figure 1, the arrows indicate association between elements.

note Note It is important to note at this point that we are still talking about the structure of a WMI provider without any mention of the data it contains. In other words, it is the schema of the classes, elements, and properties and not the physical instances of them which contain current system information, just as a schematic or blueprint for a house is not the actual house that is built from it. Unlike ADSI, WMI exposes the schema and the data at the same time, so it can be confusing. In Lesson 3, the IIS WMI provider is used to better explain WMI structure and to introduce the concept of instances.

Related Topics
  • To proceed to the next lesson in this module, see Lesson 3: Organizing Data from the IIS Metabase.


Lesson 3: Organizing Data from the IIS Metabase

In Lesson 2, we learned about the general structure of Windows Management Instrumentation (WMI): a provider namespace contains classes, which contain elements, which in turn contain properties and methods associated with those elements. The IIS WMI provider implements five different classes of elements beyond those that are inherited from the "root" namespace. Figure 2 illustrates how the IIS WMI provider follows the structure of WMI. Arrows indicate examples of association between elements.

Graphic applying the structure of WMI to the IIS WMI provider.

Figure 2

CIM_ManagedSystemElement

The CIM_ManagedSystemElement class contains elements that correspond to nodes of the metabase schema. For example, the IIsWebServer element is a schematic for an instance of an IIS Web server. The IIsWebVirtualDir element is a schematic for an instance of a Web virtual directory. These elements contain read-only properties and methods, whereas the matching elements of the CIM_Setting class contain the writable properties for the nodes. For example, the IIsWebServer element in the CIM_ManagedSystemElement class contains read-only properties for an IIS Web server, and methods that can set the properties in the IIsWebServerSetting element of the CIM_Setting class. The system was split in this way to take advantage of the inheritance that was possible in the CIM_ManagedSystemElement class. In Module 2 of this tutorial, the advantages of this structure are more apparent in CIM Studio.

CIM_Setting

As mentioned above, the elements of the CIM_Setting class correspond to nodes of the metabase schema, and they contain the properties that can be set at those nodes. The methods that manipulate those properties are contained in the matching elements of the CIM_ManagedSystemElement class. Remember this class when you advance to Module 2, Lesson 2 in this tutorial. Also, remember that the IIsWebServerSetting element in this class and the IIsWebServer element in the CIM_ManagedSystemElement class both refer to Web sites on your Web server, but the IIsWebServer element contains the read-only properties of a Web site and the IIsWebServerSetting element contains the writable properties of a Web site.

IIsStructuredDataClass

This is a unique class that contains elements whose data is represented in a complicated format in Active Directory Service Interfaces (ADSI). For example, the ServerBindings property in ADSI is a string whose format must be IP:Port:Hostname. If the parts are out of order, or missing colons, an error occurs. In WMI, an element class was created called ServerBinding with three properties corresponding to the IP address, the port number, and the host name. Instances of these elements are considered objects. In WMI, elements, such as the IIsWebServerSetting element of the CIM_Setting class, can contain a property called ServerBindings, which is an array of ServerBinding objects.

CIM_Component

This is an association class that maps each element in the CIM_ManagedSystemElement class to another element in the CIM_ManagedSystemElement class so the elements can mimic ADSI containment. The properties of the elements of this class are references to the two associated elements. Every possible association between elements in the CIM_ManagedSystemElement class is represented by an element in the CIM_Component class.

CIM_ElementSetting

This is an association class that maps each element in the CIM_ManagedSystemElement class to its matching element in the CIM_Setting class. The properties of the elements of this class are references to the two associated elements. Every possible association between elements in the CIM_ManagedSystemElement class and elements in the CIM_Setting class is represented by an element in the CIM_ElementSetting class.

The classes described above represent the structure of the metabase schema file. Instances of the elements in each class contain current system information, such as you would see in the metabase configuration file or in IIS Manager. For example, on a default installation of IIS 6.0, the IIsWebVirtualDir element of the CIM_ManagedSystemElement class and the IIsWebVirtualDirSetting element of the CIM_Setting class both contain three instances of Web virtual directories: one for W3SVC/1/Root, one for W3SVC/1/Root/Scripts, and one for W3SVC/1/Root/Printers. The instances contain current system data in their properties such as the physical paths to the virtual directories. The properties of the IIsWebVirtualDir instances are read-only, and the properties of the IIsWebVirtualDirSetting instances are writable. Figure 3 illustrates the schema for the IIsWebVirtualDir element of the CIM_ManagedSystemElement class and three possible instances of the class.

Graphic illustrating the difference between the schema of WMI and instances of data built on that schematic design.

Figure 3

Related Topics
  • To proceed to the next module in this tutorial, see Module 2: Using CIM Studio and the IIS Metabase for a Clearer Picture.


Module 2: Using CIM Studio and the IIS Metabase for a Clearer Picture

This module explains the relationship between the Internet Information Services (IIS) metabase and the structure of Windows Management Instrumentation (WMI), and compares it with the structure of Active Directory® Service Interfaces (ADSI). A tool called CIM Studio walks you through the IIS WMI provider and the IIS metabase at the same time. CIM Studio comes with the WMI SDK, which can be downloaded from Windows Management Instrumentation (WMI) SDK on MSDN. It is highly recommended that you install CIM Studio and use it as instructed to learn to use the IIS WMI provider more quickly. If you are already familiar with WMI, it is recommended that you skim through this section.

This module includes the following lessons:

  • Lesson 1: Navigating to the IIS WMI Provider in CIM Studio: Applies what you learned in Module 1 about the classes that are used by the IIS WMI provider to find the classes in CIM Studio.
  • Lesson 2: Viewing Properties and Methods of the IIS WMI Provider: Describes how to browse through the nodes of the classes to reach the properties of the IIS metabase and the methods that can be applied to them, and to view instances of the properties to see what data is currently in the IIS metabase.
  • Lesson 3: Changing Properties of the IIS Metabase: Describes how to back up the IIS metabase to protect your Web server; administer the IIS metabase by using IIS Manager, CIM Studio, and the IIS metabase file; and use simple scripts that use WMI and ADSI.


Lesson 1: Navigating to the IIS WMI Provider in CIM Studio

To quickly familiarize yourself with the IIS Windows Management Instrumentation (WMI) provider, review the information on managing IIS in IIS Manager, the IIS metabase schema and configuration files, the IIS Managed Object Format (MOF) file, and CIM Studio. As mentioned in Module 1, Lesson 1, most systems have management graphical user interfaces (GUIs) that are tedious to use if you have large amounts of data or frequent management tasks. But the GUI is the most modular way to learn how to manage a system, so it is used here as an orientation tool. The IIS metabase schema and configuration files are used to emphasize the difference between the structure of the IIS metabase and the data it contains that is unique to your machine. The IIS MOF file and CIM Studio give you a pictorial representation of the IIS WMI provider. If you have the tools for the IIS Resource Kit installed, consider opening the Metabase Editor which acts like a CIM Studio for IIS Active Directory Service Interfaces (ADSI); however, this tutorial does not reference the Metabase Editor tool.

Before Opening CIM Studio

If you incorrectly change data in the metabase schema file in its original location, IIS cannot function. Changing the metabase configuration file is allowed, and if done correctly, the results are the same as those obtained by using IIS Manager to change properties and settings (see Metabase Edit-While-Running Feature). If you change the IIS MOF file, the IIS WMI provider cannot function. For safety reasons, the steps below instruct you to make copies of these files and to work from the copies.

important Important You must be a member of the Administrators group on the local computer to perform the following procedure (or procedures), or you must have been delegated the appropriate authority. As a security best practice, log on to your computer using an account that is not in the Administrators group, and then use the Run as command to perform this procedure as an Administrator.

To open the IIS metabase schema file

  1. From the Start menu, click Run.
  2. In the Open box, type: Notepad %systemroot%\System32\Inetsrv\mbschema.xml
  3. From the File menu in Notepad, click Save As.
  4. In the File name box, type: C:\mbschema
  5. Click Save.

    note Note This procedure saves the file to C:\mbschema.txt so you can safely modify the file without altering the configuration of IIS.

To open the IIS metabase configuration file

  1. From the Start menu, click Run.
  2. In the Open box, type: Notepad %systemroot%\System32\Inetsrv\metabase.xml
  3. Click OK.
  4. From the File menu in Notepad, click Save As.
  5. In the File name box, type: C:\metabase
  6. Click Save.

    note Note This procedure saves the file to C:\metabase.txt so you can safely modify the file without altering the configuration of IIS.

To open the IIS WMI provider MOF file

  1. From the Start menu, click Run.
  2. In the Open box, type: Notepad %systemroot%\System32\wbem\iiswmi.mof
  3. Click OK.
  4. From the File menu in Notepad, click Save As.
  5. In the File name box, type: C:\iiswmi
  6. Click Save.

    note Note This procedure saves the file to C:\iiswmi.txt so you can safely modify the file without altering the configuration of IIS.

Opening CIM Studio

If you haven't done so already, download the WMI SDK tools from from Windows Management Instrumentation (WMI) SDK on MSDN. After you've downloaded the SDK, WMI SDK will appear in the Start menu.

To open CIM Studio

  1. From the Start menu, click All Programs, point to WMI SDK, and then click WMI CIM Studio. This opens an instance of Internet Explorer that contains the CIM Studio tool. If the tool is a pre-release version, you may get an error message that says "VBScript: Possible Version Incompatibility." This error message is just a disclaimer until the final version is released, so click OK.
  2. When the Connect to Namespace box appears, click Cancel. This dialog box only appears the first time you open CIM Studio. Afterward, whenever you want to go to a WMI namespace you can click the button with the computer icon (Browse for Namespace) to the right of the Classes in box in the main Internet Explorer window. In this tutorial, the button with the computer icon (Browse for Namespace) is referred to in order to reduce confusion.
  3. Click the button with the computer icon (Browse for Namespace) to the right of the Classes in box.
  4. In the Machine name box, type \\ and the name of the machine on which IIS 6.0 is installed. The default is the name of the local machine.
  5. In the Starting namespace box, type: root\MicrosoftIISv2 This tells CIM Studio that you want to connect to the IIS WMI provider on the above machine. If you want to see a list of other providers that are accessible, leave the starting namespace as root.
  6. In the Browse for Namespace box, click Connect.
  7. In the WMI CIM Studio box, click Options to view the entire box.
  8. If you aren't listed as an administrator, clear the Login as current user check box, and then enter an administrator user name and password in the appropriate fields.
  9. In the Impersonation level list, click Impersonate.
  10. In the Authentication level list, click Packet.
  11. Select the Enable all privileges check box only if you want to be able to change properties in the IIS metabase by using CIM Studio.
  12. Click OK to connect. If an Access Denied error appears, check your user name and password to make sure that they are correct.

    note Note If you left the Starting namespace box as root in step 5, then the Browse for namespace box opens again. To connect to the IIS WMI provider, expand the root directory to see all of the available WMI providers, click MicrosoftIISv2, and then click OK.

The CIM Studio window loads all of the classes for the IIS WMI provider in the left frame. All of the classes that start with a "__" are inherited from the root namespace. The other five classes are the classes that were previously described in Module 1, Lesson 3. They are CIM_ManagedSystemElement, CIM_Setting, IIsStructuredDataClass, CIM_Component, and CIM_ElementSetting.

Related Topics
  • To proceed to the next lesson in this module, see Lesson 2: Viewing Properties and Methods of the IIS WMI Provider.


Lesson 2: Viewing Properties and Methods of the IIS WMI Provider

Now that you have three views of IIS open, this lesson helps you make connections among them as you browse through the properties and methods in CIM Studio.

This lesson assumes that you have the World Wide Web Publishing Service (WWW service) installed, but you can also follow along if you have the FTP service, the SMTP service, or the NNTP service installed. If you have a service other than the WWW service installed, the property names will be different from the ones listed in this lesson.

important Important You must be a member of the Administrators group on the local computer to perform the following procedure (or procedures), or you must have been delegated the appropriate authority. As a security best practice, log on to your computer using an account that is not in the Administrators group, and then use the Run as command to run IIS Manager as an administrator. From the command prompt, type runas /user:administrative_accountname "mmc %systemroot%\system32\inetsrv\iis.msc".

To view the default Web site

  1. In IIS Manager, expand the local computer, and then expand the Web Sites folder.
  2. Right-click Default Web Site, and then click Properties.
  3. In the Default Web Site Properties box, click the Web Site tab, and then verify that Default Web Site is in the Description box.
  4. In the Default Web Site Properties box, click the Home Directory tab, and then verify that C:\Inetpub\Wwwroot is in the Local path box.
  5. Open Notepad, and then open MetaBase.txt, which is the IIS configuration file.
  6. From the Edit menu in Notepad, click Find, and then in the Find what box, type: Default Web Site The following text appears:
    <IIsWebServer Location="/LM/W3SVC/1"
    AppPool
    DefaultDoc="Default.htm,Default.asp,index.htm,iisstart.asp,Default.aspx"
    SecureBindings=":443:"
    ServerBindings=":80:"
    ServerComment="Default Web Site"
    ServerSize="1"
>
</IIsWebServer>
    The metabase files use Extensible Markup Language (XML), which is similar to HTML. The Default Web Site is an instance of the IIsWebServer class.
  7. The ServerComment property matches the Description box in IIS Manager. To find the property that matches the Local path box in IIS Manager, search for C:\Inetpub\Wwwroot in the MetaBase.txt file. The following text appears:
    <IIsWebVirtualDir Location="/LM/W3SVC/1/ROOT"
    AccessFlags="AccessRead | AccessScript"
    AppFriendlyName="Default Application"
    AppIsolated="2"
    AppPool
    AppRoot="/LM/W3SVC/1/ROOT"
    HttpErrors="400,*,FILE,F:\WINNT\help\iisHelp\common\400.htm"
    ...
    Path="c:\inetpub\wwwroot"
>
</IIsWebVirtualDir>
    The Default Web Site also appears to be a virtual directory, or in other words, an instance of the IIsWebVirtualDir class. This is because all Web sites must have a root virtual directory (notice the difference between the Location properties of each class). The Path property matches Local path in IIS Manager. The property sheet for the Default Web Site shows both the IIsWebServer properties and the IIsWebVirtualDir properties.
  8. Open the IIS schema file, MBSchema.txt, in Notepad and search for the schema of the IIsWebServer class until you find the following line:
    <Collection
    InternalName="IIsWebServer"
    MetaFlagsEx="NOTABLESCHEMAHEAPENTRY | CONTAINERCLASS"
    MetaFlags="HASUNKNOWNSIZES"
    ContainerClassList="IIsObject,IIsCertMapper,IIsFilters,IIsWebVirtualDir"
    InheritsPropertiesFrom="MetabaseBaseClass"
>
    All of the properties that belong to the IIsWebServer class, including ServerComment, are under this line.
  9. In the MBSchema.txt file, search for IIsWebVirtualDir until you find the following line:
    <Collection
    InternalName="IIsWebVirtualDir"
    MetaFlagsEx="NOTABLESCHEMAHEAPENTRY | CONTAINERCLASS"
    MetaFlags="HASUNKNOWNSIZES"
    ContainerClassList="IIsWebDirectory,IIsWebFile,IIsWebVirtualDir,IIsObject"
    InheritsPropertiesFrom="MetabaseBaseClass"
>
    The schema for the Path property is under this line.
  10. Open IisWmi.txt in Notepad, and search for IIsWebServer until you find the following line:
    class IIsWebServer : CIM_LogicalElement
    This is the definition of the IIsWebServer class, which WMI uses to access any instance of an IIS Web site. IIsWebServer is a subclass of the CIM_LogicalElement class, which in turn is a subclass of the CIM_ManagedSystemElement class. Notice that there are far fewer properties listed as members of this class than are listed under the metabase schema <Collection> tag for IIsWebServer.
  11. As you may recall from Module 1, Lesson 3, the CIM_ManagedSystemElement class contains only the read-only properties and methods for an object. Look at the above excerpt from the IisWmi.txt file and find the lines that begin with [Implemented. These lines define the methods that are contained in the IIsWebServer class. All of the writable properties are under the matching element class in the CIM_Setting class, in this case, IIsWebServerSetting.
  12. In the IisWmi.txt file, search for IIsWebServerSetting until you find the following line:
    class IIsWebServerSetting : IIsSetting
    The definition for the ServerComment property is under this line. All of the properties start with [Key or [read. [Key indicates that the property is the identification key for the element, and is usually the Name property.

    note Note CIM Studio graphically displays the IIS MOF file (or any service's MOF file). As a bonus, CIM Studio can also display instances of any class so that you can view current configuration settings on your Web server.

  13. Look at the Internet Explorer window that contains CIM Studio. As you saw in the IisWmi.txt file, the IIsWebServer class is a subclass of the CIM_LogicalElement class, which in turn is a subclass of the CIM_ManagedSystemElement class.
  14. Expand CIM_ManagedSystemElement, and then expand CIM_Logical.
  15. Click IIsWebServer. The read-only properties, methods, and associations appear in the right frame. The Name property is marked with a key icon to identify it as the key of the element.

To view instances of the IIsWebServer class (to view the Web sites that are on your server)

  • Click Instances above the right frame that looks like a window with two frames. If you are unsure which button you are looking at, mouse over the button and Instances should pop up. On a default installation, only one instance appears: W3SVC/1.
    All of the fields in the row correspond to the read-only properties for IIsWebServer, and in the fields are the current values in the metabase configuration file.

When you write administration scripts to read or change properties in the metabase, it helps to use the metabase files, the IIS MOF file, or CIM Studio to know which properties are available to an object. An advantage of CIM Studio is that you can view the parameters that you need to pass to a method.

To view the parameters of a method

  1. Click Instances again to go back to the schematic view.
  2. Click the Methods tab.
  3. Right-click a method name and click Edit Method Parameters. A window appears listing the parameters of the method. While there are no parameters for the methods of the IIsWebServer object, there are parameters for the IIsWebService object.

In Module 1, Lesson 2, you learned that organization in WMI is dictated by the needs of inheritance. The IIsWebService class is a prime example. The IIS services take advantage of inheritance of base service classes by being subclasses of those base service classes. To find IIsWebService, look under CIM_ManagedSystemElement, CIM_Service, Win32_BaseService, Win32_Service. This level of nesting does not make programmatic access difficult because you can directly refer to the IIsWebService class when writing a script.

To view the parameters of the IIsWebService object

  1. Click IIsWebService in the left frame.
  2. Click the Methods tab in the right frame.
  3. Right-click CreateNewSite, and then click Edit Method Parameters.

If you write a script that creates a new Web site using this method, you need to call the method with the following syntax:

siteID = IIsWebServiceObj.CreateNewSite("My New Site", arrBindings, "C:\Inetpub\NewSite")

The ServerID parameter (fourth parameter) is optional, which you can see by right-clicking ServerId in the right frame of CIM Studio and then clicking Parameter Qualifiers. The OPTIONAL qualifier is set to true.

To view the writable properties of the IIsWebServer object

  • In the left frame of CIM Studio, expand CIM_Setting, expand IIsSetting, and then click IIsWebServerSetting.
  • Click Instances in the right frame to view the current configuration settings of all of the Web sites on your server.

Go back to the schematic view of IIsWebServerSetting and click the Associations tab. This is how WMI determines that IIsWebServerSetting is related to IIsWebServer of the CIM_ManagedSystemElement class. This association is represented under the CIM_ElementSetting class as the IIsWebServer_IIsWebServerSetting class.

Go back to the IIsWebServer class and click the Associations tab. The association to IIsWebServerSetting is there, but so are several others. The other associations represent containment of one class in another, allowing for inheritance of some properties and methods. Each containment association is represented under the CIM_Component class.

Finally, there is the IIsStructuredDataClass. In Module 1, Lesson 3, you learned that this class contains elements that were represented in a complicated, error-prone manner in ADSI. You should become familiar with the elements of this class and their properties. Notice that they are not associated with any other class. They can exist on their own. As you saw in the parameters of the CreateNewSite method, an array of instances of these elements can be passed to methods.

Related Topics
  • To proceed to the next lesson in this module, see Lesson 3: Changing Properties of the IIS Metabase.


Lesson 3: Changing Properties of the IIS Metabase

The following table compares the different ways that you can change the properties of the IIS metabase.

Tool | Process | Advantages | Disadvantages
IIS Manager | Open the property sheets for a service, site, or virtual directory and change values. Changes take place immediately without having to stop and start the server. | IIS Manager informs you if the a new value is invalid. | Using IIS Manager is tedious when frequently managing multiple machines.
Metabase configuration file | In Notepad, open the metabase configuration file from its working location, systemroot\System32\Inetsrv\MetaBase.xml, and make changes. Save the file. A change notification is sent to the IIS server. | You can change multiple properties or create new nodes in one instance without having to open and close multiple property sheets. | If a value is invalid, there is no warning. It is too easy to make a mistake. One typing mistake can bring down your entire server. Sometimes it is necessary to stop and start the server before the changes take place.
Using WMI programmatically Write an ASP page, a command-line script, or compile a program that uses Windows Management Instrumentation (WMI) to access the metabase configuration file. Changes take place immediately without having to stop and start the server.
  • Programmatic administration is easy. You can change one property, or multiple properties on multiple machines across a network, securely.
  • Using the WMI Query Language, you can query an abnormally large server for one specific property to find the site or virtual directory where it is set.
  • One connection to WMI gives you access to all Windows providers.
 It can take a while to learn how to use WMI. In many cases, Active Directory Service Interfaces (ADSI) exhibit better performance than WMI.
Using ADSI programmatically | Write an ASP page or a command-line script; or compile a program that uses ADSI to access the metabase configuration file. Changes take place immediately without having to stop and start the server. | Programmatic administration is fast. You can change one property, or multiple properties on multiple machines across a network. | It can take a while to learn how to use each individual ADSI provider.
CIM Studio
  1. Connect to the MicrosoftIISv2 namespace with the Enable all privileges check box selected.
  2. Browse to a CIM_Setting element, and click Instances.
  3. Scroll to the property you want to change in the right frame, click the box containing the current data and change it.
  4. Create sites and virtual directories by clicking New Instance. Changes take place immediately.
 Everything is within your view. The schema, the instances, and all properties are visible without having to click a different tab in a property sheet. Using CIM Studio is tedious when frequently managing multiple machines.
Related Topics
  • To proceed to the next module in this tutorial, see Module 3: Writing Administration Scripts that Use WMI.


Module 3: Writing Administration Scripts that Use WMI

This module references what you learned in Module 2: Using CIM Studio and the IIS Metabase for a Clearer Picture, while helping you write basic Windows Management Instrumentation (WMI) scripts to administer Internet Information Services (IIS) metabase properties. With your scripts, you will be able to query site properties, map virtual resources to real resources, create sites and set properties, export metabase nodes, use associations to find metabase elements, and use two providers in one script. You'll find the objects and methods that you need to write your WMI scripts in the WMI SDK.

This module includes the following lessons:

  • Lesson 1: Simple WMI Tasks: Describes how to run a command-line administration script, the basic pattern of any simple WMI task. Also includes examples of that pattern in Microsoft® Visual Basic® Scripting Edition (VBScript) and Microsoft JScript®.
  • Lesson 2: Enumerating Properties to Be Displayed: Describes how to show all of the properties, in VBScript and JScript, for a particular key type.
  • Lesson 3: Creating Sites and Virtual Directories, and Setting Properties: Describes how to create a Web site by using the CreateNewSite method, set some basic properties, and use the IIS structured data class to set IP security settings and other properties.
  • Lesson 4: Exporting and Importing Metabase Nodes: Describes how to use special methods to export part of the IIS metabase and import it to another IIS 6.0 Web server.
  • Lesson 5: Using WMI Query Language to Find Specific Information: Describes how to search for a process ID that is unique to one unknown Web application by using the WMI Query Language (WQL), instead of setting properties. This method is useful for locating a troublesome Web application on a Web server that contains too many Web applications to search through manually.
  • Lesson 6: Using Associations to Find Metabase Elements: Describes how to use the association classes to find available information.

Before You Get Started

To verify which general WMI methods and properties are available to which classes, refer to the WMI SDK. You can download the WMI SDK from Windows Management Instrumentation (WMI) SDK on MSDN, or you can view it online at Windows Management Instrumentation Platform SDK.

To verify the methods and properties that are available to a class

  1. From the Start menu, point to All Programs, point to WMI SDK, and then click WMI SDK Documentation.
  2. In the left frame, expand Windows Management Instrumentation, expand WMI Reference, and then expand Scripting API for WMI. This is where you'll find the reference information for command-line scripts.
Related Topics
  • For reference information on the language of your script, see Windows Script Help.


Lesson 1: Simple WMI Tasks

How to Run a Command-line Administration Script

important Important You must be a member of the Administrators group on the local computer to run scripts and executables, or you must have been delegated the appropriate authority. As a security best practice, log on to your computer using an account that is not in the Administrators group, and then use the Run as command to run your script or executable as an administrator. From the command prompt, type runas /user:administrative_accountname "script or executable command".

To write your command-line administration script

  1. From the Start menu, click Run.
  2. In the Open box, type: Notepad
  3. Click OK.
  4. Create a test line by doing one of the following:
    • For VBScript, type: WScript.Echo "This is a test"
    • For JScript, type WScript.Echo("This is a test");

    5. note Note Because JScript is case-sensitive, make sure you do not mix VBScript and JScript in the same file.

  5. From the File menu, click Save.
  6. In the Save as type list, click All Files. Do not save the file as Text Documents (*.txt) because it automatically adds .txt to your file name, preventing it from running.
  7. In the File name box, type the name of the file, beginning with the drive letter and full path. If your administration script is written in VBScript, save the file with a .vbs file name extension—for example, C:\WmiTutorial.vbs. If your administration script is written in JScript, save the file with a .js file name extension—for example, C:\WmiTutorial.js.
  8. Click Save. Be sure to save the file very time you make a change.

To set security on your command-line adminstration script

  1. From the Start menu, click Run.
  2. In the Open box, type: Explorer
  3. Click OK.
  4. Navigate to the folder that contains your script file.
    To see your local drives, double-click My Computer.
  5. Right-click the name of your script file, and then click Properties.
  6. Click the Security tab to display the Access Control List (ACL) for the file, and then set the ACLs to restrict access to the Administrators group. For more information, see Access Control.
  7. When you are finished setting the ACLs, click OK.

To run your command-line administration script from a command-prompt window

  1. From the Start menu, click Run.
  2. In the Open box, type Cmd, and then click OK.
  3. Change the directory to the location of the script file by doing one of the following:
    • If the prompt says "D:\>" or "D:\Documents and Settings\myname", and your script file is on the C drive, type C: and then press ENTER. If your script file is in a subfolder on that drive, change to that folder by typing cd foldername, and then press ENTER.
    • To view the contents of the folder you are in, type dir, press ENTER, and then look for your script. After your prompt indicates that you are in the folder that contains your script, you are ready to run it.
  4. To run the WmiTutorial.vbs file with the CScript engine, type: CScript WmiTutorial.vbs

    note Note A window that says "This is a test" might appear. When you write a longer script with multiple WScript.Echo lines, receiving a pop-up window for each one is tedious. So to force the WScript.Echo lines to display in the command-prompt window, call your script by typing: CScript /nologo WmiTutorial.vbs. Now, when you press ENTER, you should see "This is a test" in the command-prompt window.

  5. Switch back and forth between Notepad, where you make changes to your script, and the command-prompt window where you run your script. One time-saving feature of the command-prompt window is that you can press the up arrow on your keyboard to automatically repeat the last line that you typed.

Basic Pattern of Simple WMI Tasks

All simple WMI tasks flow in the following basic pattern:

  1. Establish a connection to WMI. This is optional if you are making changes to only one machine.
  2. Connect to a machine through WMI. This step is always necessary.
  3. Create an instance of the appropriate object from which you need to access specific data.
  4. Using the instantiated objects, make your configuration changes, which might include gathering data, changing properties, adding objects, or removing objects.
  5. If you made changes to a data store (the IIS metabase properties, in this case), save them.

To establish a connection to WMI, use the following line of code in your script file. LocatorObj is a variable name that you can change to anything.

VBScript
set  locatorObj = CreateObject("WbemScripting.SWbemLocator")
JScript
var  locatorObj = new ActiveXObject("WbemScripting.SWbemLocator");

The WbemScripting object is the base object for WMI, in the same way that the WScript object is the basic object for general scripting tasks.

Writing scripts is a lot faster if you know your way around the necessary SDKs. Look for the SWbemLocator object in the WMI Reference, Scripting API for WMI section of the WMI SDK. Two methods are defined, one of which we use next, ConnectServer.

In the WMI SDK, look at the parameters that are listed for the ConnectServer method. Most of the parameters are optional, and their descriptions tell you what their default values are. For example, if you do not specify a machine name when calling the method, WMI assumes that you want to connect to the machine on which you run your script.

To connect to a machine with a user name and password, use the following line of code in your script file. This line might display as two separate lines on this page, but make it one line in your script file. Remember to use the same language as in the first line in your script, and remember that the user name must be an administrator on the machine.

The following sample uses the administrator account itself. Replace MyMachine with the name of a computer running a member of the Windows Server 2003 family with IIS 6.0, and replace Password with the administrator password.

VBScript
set  providerObj = locatorObj.ConnectServer("MyMachine", "root/MicrosoftIISv2", "MyMachine\administrator", "Password")
JScript
var  providerObj = locatorObj.ConnectServer("MyMachine", "root/MicrosoftIISv2", "MyMachine\\administrator", "Password");

In JScript, \ characters are special escape characters, therefore you must type them twice. Run your script now to see if there are any errors using the ConnectServer method. If you get an error, look for ConnectServer in the WMI Reference, Scripting API for WMI section of the WMI SDK. There you'll find a table of error values and possible causes that might guide you to a solution. Often, the error text in the command-prompt window provides enough information.

According to the WMI SDK information on ConnectServer, the return value, providerObj, is an SWbemService object. Click the link to SWbemService on the page to view the available methods. Take a moment to get familiar with the tasks that can be performed with this WMI object. Read the descriptions of the parameters for the Get method, which we use next.

To create an instance of the appropriate IIS WMI object that is listed in the IIS WMI Provider Reference in IIS Help, use the Get method. In the following line of code, we create an instance of the IIsWebVirtualDir (WMI) object, connected to the root virtual directory of the first Web site listed on your computer.

VBScript
set  nodeObj = providerObj.Get("IIsWebVirtualDir='W3SVC/1/Root'")
JScript
var  nodeObj = providerObj.Get("IIsWebVirtualDir='W3SVC/1/Root'");

The metabase path, W3SVC/1/Root, must match the IIS Admin object type, IIsWebVirtualDir, as listed in the Access Locations table in the Reference section for KeyType. For a different example, if you were to connect to a Web site, your IIS Admin object type would be IIsWebServer, and your key type would be W3SVC/n, where n would be the Web site number.

We should note that there is more than one way to get to this point. If you do not need to pass a user name and password, the following table shows three ways to instantiate nodeObj. Study each option for the differences to help you better understand what the possibilities are. The first option is what you already have in your script.

VBScript
set locatorObj = CreateObject("WbemScripting.SWbemLocator")
set providerObj = locatorObj.ConnectServer("MyMachine", "root/MicrosoftIISv2")
set nodeObj = providerObj.Get("IIsWebVirtualDir='W3SVC/1/Root'")

set providerObj = GetObject("winmgmts://MyMachine/root/MicrosoftIISv2")
set nodeObj = providerObj.get("IIsWebVirtualDir='W3SVC/1/ROOT'")

set nodeObj = GetObject("winmgmts://MyMachine/root/MicrosoftIISv2:IIsWebVirtualDirSetting='W3SVC/1/ROOT'")
JScript
var locatorObj = new ActiveXObject("WbemScripting.SWbemLocator");
var providerObj = locatorObj.ConnectServer("MyMachine", "root/MicrosoftIISv2");
var nodeObj = providerObj.Get("IIsWebVirtualDir='W3SVC/1/Root'");

var providerObj = GetObject("winmgmts://MyMachine/root/MicrosoftIISv2");
var nodeObj = providerObj.get("IIsWebVirtualDir='W3SVC/1/ROOT'");

var nodeObj = GetObject("winmgmts://MyMachine/root/MicrosoftIISv2:IIsWebVirtualDir='W3SVC/1/ROOT'")

Now that you have a connection to the root virtual directory of the Default Web Site, you can use the nodeObj variable to make configuration changes. See IIsWebVirtualDir (WMI) to see what methods and properties are available to you. For example, to unload the ASP application without unloading all the child applications, use the AppUnload method in following line of code:

VBScript
nodeObj.AppUnload False
JScript
nodeObj.AppUnload(false);

In IIS Manager, this is the same as clicking on the Unload button of the Home Directory property page for the Default Web Site.

To view the contents of one of the properties, use one of the following lines of code:

VBScript
WScript.Echo "AppRoot = " & nodeObj.AppRoot
' Or,
WScript.Echo "AppRoot = " & nodeObj.Properties_("AppRoot").Value
JScript
WScript.Echo("AppRoot = " + nodeObj.AppRoot);
// Or,
WScript.Echo("AppRoot = " + nodeObj.Properties_("AppRoot").Value)

The output of either line should be the following text:

AppRoot = /LM/W3SVC/1/ROOT
Both lines do the same thing. The second line allows for you to pass the property name as a variable, which is important if you want to write a script that allows the user to pass in a parameter as the property name. In the WMI SDK, look under SWbemObject for the Properties_ property for more information. The Properties_ property returns a set of SWbemProperty objects, which is where the Value property comes from.

important Important Everything in WMI is connected by object relationships. After you access one object, you can get to other objects by calling methods that return those objects. This is why you start at the top with the WbemScripting object if you are writing scripts. In the case of the IIS WMI provider, there isn't a long chain of objects, so you can usually connect directly to the one you want.

To change one of the properties and save the changes to the IIS metabase, use the following lines of code. The Put_ method is listed in the WMI SDK under SWbemObject:

VBScript
nodeObj.AppIsolated = 1
' Or,
nodeObj.Properties_("AppIsolated").Value = 1
' Save the changes.
nodeObj.Put_
JScript
nodeObj.AppIsolated = 1;
// Or,
nodeObj.Properties_("AppIsolated").Value = 1;
// Save the changes.
nodeObj.Put_();

Run your script. Is there an error? You should get the error Attempt to modify read-only object or property failed. As we learned in Lesson 3: Organizing Data from the IIS Metabase, the CIM_ManagedSystemElement class contains only the read-only properties and methods for an object. We need to connect to the IIsWebVirtualDirSetting (WMI) object to access properties that we can read and write. Delete the previous set of lines from your script, instantiate a new object, and set the AppFriendlyName property using the following code:

VBScript
set nodeObj = providerObj.Get("IIsWebVirtualDirSetting='W3SVC/1/Root'")
WScript.Echo "Before: AppFriendlyName = " & nodeObj.AppFriendlyName
nodeObj.Description = "Default Root Application"
' Or,
nodeObj.Properties_("AppFriendlyName").Value = "Default Root Application"
' Save the changes.
nodeObj.Put_
WScript.Echo "After: AppFriendlyName = " & nodeObj.AppFriendlyName
JScript
var nodeObj = providerObj.Get("IIsWebVirtualDirSetting='W3SVC/1/Root'");
WScript.Echo("Before: AppFriendlyName = " + nodeObj.AppFriendlyName);
nodeObj.Description = "Default Root Application";
// Or,
nodeObj.Properties_("AppFriendlyName").Value = "Default Root Application";
// Save the changes.
nodeObj.Put_();
WScript.Echo("After: AppFriendlyName = " + nodeObj.AppFriendlyName);

When you run this application, the output should be as follows:

Before: AppFriendlyName = Default Application
After: AppFriendlyName = Default Root Application

In IIS Manager, this is the same as changing the Application name in the Home Directory property page for the Default Web Site.

Related Topics
  • To proceed to the next lesson in this module, see Lesson 2: Enumerating Properties to Be Displayed.


Lesson 2: Enumerating Properties to Be Displayed

There are times when you want to view all of the properties at a specific node without having to open IIS Manager, the metabase file, or CIM Studio. The following code uses the VBScript For...Each loop and the JScript Enumerator object to display all of the properties for the root virtual directory of the Default Web Site. In the VBScript code, On Error Resume Next is used because some of the properties are objects, or arrays of objects, that need extra code to be displayed.

VBScript
On Error Resume Next
set providerObj = GetObject("winmgmts://janetfi-32/root/MicrosoftIISv2")
set IIsWebVirtualDirObj = providerObj.get("IIsWebVirtualDir='W3SVC/1/ROOT'")
set IIsWebVirtualDirSettingObj = providerObj.get("IIsWebVirtualDirSetting='W3SVC/1/ROOT'")

WScript.Echo "Read only properties of W3SVC/1/Root:"
For Each Property in IIsWebVirtualDirObj.Properties_
  WScript.Echo Property.Name & " = " & Property.Value
Next
WScript.Echo
WScript.Echo "Read/Write properties of W3SVC/1/Root:"
For Each Property in IIsWebVirtualDirSettingObj.Properties_
  WScript.Echo Property.Name & " = " & Property.Value
Next
JScript
var providerObj = GetObject("winmgmts://janetfi-32/root/MicrosoftIISv2");
var IIsWebVirtualDirObj = providerObj.get("IIsWebVirtualDir='W3SVC/1/ROOT'");
var IIsWebVirtualDirSettingObj = providerObj.get("IIsWebVirtualDirSetting='W3SVC/1/ROOT'");

WScript.Echo("Read only properties of W3SVC/1/Root:");
var e = new Enumerator(IIsWebVirtualDirObj.Properties_);
for(; ! e.atEnd(); e.moveNext())
{
  var Property = e.item();
  WScript.Echo(Property.Name + " = " + Property.Value);
}
WScript.Echo();
WScript.Echo("Read/Write properties of W3SVC/1/Root:");
var e = new Enumerator(IIsWebVirtualDirSettingObj.Properties_);
for(; ! e.atEnd(); e.moveNext())
{
  var Property = e.item();
  WScript.Echo(Property.Name + " = " + Property.Value);
}

To experiment with this example, change the bolded text in the code to other values that are listed in the Access Locations table on the KeyType page. Remember that the IIS Admin object type must match the metabase path.

To turn this into a tool that would take parameters for the machine name, IIS Admin object type, and metabase path, you could change the code above to the code below. Bolded items are new.

VBScript
On Error Resume Next
' Get the arguments.
set WshArgs = WScript.Arguments

if WshArgs.Length = 3 then

  dim machineName, adminObjType, metabasePath
  machineName = WshArgs(0)
  adminObjType = WshArgs(1)
  metabasePath = WshArgs(2)

  set providerObj = GetObject("winmgmts://" & machineName & "/root/MicrosoftIISv2")
  set IIsWebVirtualDirObj = providerObj.get(adminObjType & "='" & metabasePath & "'")
  set IIsWebVirtualDirSettingObj = providerObj.get(adminObjType & "Setting='" & metabasePath & "'")

  WScript.Echo "Read only properties of " & metabasePath & ":"
  For Each Property in IIsWebVirtualDirObj.Properties_
    WScript.Echo Property.Name & " = " & Property.Value Next  WScript.Echo WScript.Echo "Read/Write properties of
  " & metabasePath & ":"
  For Each Property in IIsWebVirtualDirSettingObj.Properties_
    WScript.Echo Property.Name & " = " & Property.Value
  Next

  ' end of if WshArgs.Length = 3 then

else
  WScript.Echo "Usage:"
  WScript.Echo "cscript /nologo " & WScript.ScriptName & " <computer name> <admin object type> <metabase path>"
  WScript.Echo "Example:"
  WScript.Echo "cscript /nologo " & WScript.ScriptName & " MyMachine IIsWebVirtualDir W3SVC/1/Root"
end if
JScript
// Get the arguments.
var WshArgs = WScript.Arguments;

if (WshArgs.Length == 3) {

  var machineName = WshArgs(0);
  var adminObjType = WshArgs(1);
  var metabasePath = WshArgs(2);

  var providerObj = GetObject("winmgmts://" + machineName + "/root/MicrosoftIISv2");
  var IIsWebVirtualDirObj = providerObj.get(adminObjType + "='" + metabasePath + "'");
  var IIsWebVirtualDirSettingObj = providerObj.get(adminObjType + "Setting='" + metabasePath + "'");

  WScript.Echo("Read only properties of " + metabasePath + ":");
  var e = new Enumerator(IIsWebVirtualDirObj.Properties_);

  for(; ! e.atEnd(); e.moveNext()) {
  var Property =
     e.item();
  WScript.Echo(Property.Name
    + " = "
    + Property.Value); }  WScript.Echo(); WScript.Echo("Read/Write properties
  of
  "
  + metabasePath + ":");
  var e = new Enumerator(IIsWebVirtualDirSettingObj.Properties_);
  for(; ! e.atEnd(); e.moveNext())
  {
    var Property = e.item();
    WScript.Echo(Property.Name + " = " + Property.Value);
  }

} // end of if (WshArgs.Length == 3)
else {
  WScript.Echo("Usage:");
  WScript.Echo("cscript /nologo " + WScript.ScriptName + " <computer name> <admin object type> <metabase path>");
  WScript.Echo("Example:");
  WScript.Echo("cscript /nologo " + WScript.ScriptName + " MyMachine IIsWebVirtualDir W3SVC/1/Root");
}
Related Topics
  • To proceed to the next lesson in this module, see Lesson 3: Creating Sites and Virtual Directories, and Setting Properties.


Lesson 3: Creating Sites and Virtual Directories, and Setting Properties

Because everything in Windows Management Instrumentation (WMI) is connected by object relationships, you need a connection to a service to create a site, and you need a connection to a site to create a virtual directory. It makes sense that the methods that create the child objects are in the parent objects. As you notice in the example below, the WMI method SpawnInstance_ is used to create a new instance of the ServerBinding object, instead of using a method from a parent object. This is because the elements of the IIsStructuredDataClass, such as ServerBinding, are on their own.

Before looking at the following code, read about the SpawnInstance_ method of the SWbemObject object in the WMI SDK. Also look at the IIsWebService.CreateNewSite (WMI) method of the IIsWebService (WMI) object. Remember to change the string MyMachine to the name of a machine running IIS 6.0. Also, change the path C:\Inetpub\Wwwroot to a valid path.

VBScript
' Make connections to WMI, to the IIS namespace on MyMachine, and to the Web service.
set locatorObj = CreateObject("WbemScripting.SWbemLocator")
set providerObj = locatorObj.ConnectServer("MyMachine", "root/MicrosoftIISv2")
set serviceObj = providerObj.Get("IIsWebService='W3SVC'")

' Build binding object, which is a required parameter of the CreateNewSite method.
' Use the SpawnInstance WMI method since we are creating a new instance of an object.
Bindings = Array(0)
Set Bindings(0) = providerObj.get("ServerBinding").SpawnInstance_()
Bindings(0).IP = ""
Bindings(0).Port = "8383"
Bindings(0).Hostname = ""

' Create the new Web site using the CreateNewSite method of the IIsWebService object.
Dim strSiteObjPath
strSiteObjPath = serviceObj.CreateNewSite("MyNewSite", Bindings, "C:\Inetpub\Wwwroot")
If Err Then
WScript.Echo "*** Error Creating Site: " & Hex(Err.Number) & ": " & Err.Description & " ***"
WScript.Quit(1)
End If

' strSiteObjPath is in the format of IIsWebServer='W3SVC/1180970907'
' To parse out the absolute path, W3SVC/1180970907, use the SWbemObjectPath WMI object.
Set objPath = CreateObject("WbemScripting.SWbemObjectPath")
objPath.Path = strSiteObjPath
strSitePath = objPath.Keys.Item("")

' Set some properties on the root virtual directory which was created by CreateNewSite.
Set vdirObj = providerObj.Get("IIsWebVirtualDirSetting='" & strSitePath & "/ROOT'")
vdirObj.AuthFlags = 5 ' AuthNTLM + AuthAnonymous
vdirObj.EnableDefaultDoc = True
vdirObj.DirBrowseFlags = &H4000003E ' date, time, size, extension, longdate
vdirObj.AccessFlags = 513 ' read, script
vdirObj.AppFriendlyName = "Root Application"

' Save the new settings to the metabase
vdirObj.Put_()

' CreateNewSite does not start the server, so start it now.
Set serverObj = providerObj.Get(strSiteObjPath)
serverObj.Start

WScript.Echo "A New site called MyNewSite was created with the path and unique site identification number of " & strSitePath
JScript
// Make connections to WMI, to the IIS namespace on MyMachine, and to the WWW service.
var locatorObj = new ActiveXObject("WbemScripting.SWbemLocator");
var providerObj = locatorObj.ConnectServer("MyMachine", "root/MicrosoftIISv2");
var serviceObj = providerObj.Get("IIsWebService='W3SVC'");

// Build binding object, which is a required parameter of the CreateNewSite method.
// Use the SpawnInstance WMI method since we are creating a new instance of an object.
var Bindings = new Array();
Bindings[0] = providerObj.get("ServerBinding").SpawnInstance_();
Bindings[0].IP = "";
Bindings[0].Port = "8383";
Bindings[0].Hostname = "";

// Create the new Web site using the CreateNewSite method of the IIsWebService object.
try {
var strSiteObjPath;
strSiteObjPath = serviceObj.CreateNewSite("MyNewSite", Bindings, "C:\\Inetpub\\Wwwroot");
}
catch(e) {
WScript.Echo("*** Error Creating Site: " + e + " " + e.Number + ", " + e.Description + " ***");
WScript.Quit(1);
}

// strSiteObjPath is in the format of IIsWebServer='W3SVC/1180970907'
// To parse out the absolute path, W3SVC/1180970907, use the SWbemObjectPath WMI object.
var objPath = new ActiveXObject("WbemScripting.SWbemObjectPath");
objPath.Path = strSiteObjPath;
strSitePath = objPath.Keys.Item("");

// var some properties on the root virtual directory which was created by CreateNewSite.
var vdirObj = providerObj.Get("IIsWebVirtualDirSetting='" + strSitePath + "/ROOT'");
vdirObj.AuthFlags = 5; // AuthNTLM + AuthAnonymous
vdirObj.EnableDefaultDoc = true;
vdirObj.DirBrowseFlags = 0x4000003E; // date, time, size, extension, longdate
vdirObj.AccessFlags = 513; // read, script
vdirObj.AppFriendlyName = "Root Application";

// Save the new settings to the metabase
vdirObj.Put_();

// CreateNewSite does not start the server, so start it now.
var serverObj = providerObj.Get(strSiteObjPath);
serverObj.Start;

WScript.Echo("A New site called MyNewSite was created with the path and unique site identification number of " + strSitePath);

If you run this script twice, you get the following error in the command-prompt window:

SWbemObjectEx: You were not connected because a duplicate name exists on the network. Go to System in Control Panel to change the computer name and try again.

The error in the command-prompt window is caused by both sites using the same port number in the server bindings, which means that both sites cannot run at the same time. However, the two Web sites are created successfully, and each site is created with a unique site identification number.

The following line in the VBScript example may seem complicated:

Set Bindings(0) = providerObj.get("ServerBinding").SpawnInstance_()

However, it just combines the following two lines:

Set ServerBinding = providerObj.get("ServerBinding")
Set Bindings(0) = ServerBinding.SpawnInstance_()

The following code example creates a virtual directory and sets some necessary properties.

VBScript
const APP_POOLED = 2
var strNewVdir
strNewVdir = "W3SVC/1/Root/newVdir"

' Make connections to WMI, to the IIS namespace on MyMachine.
set locatorObj = CreateObject("WbemScripting.SWbemLocator")
set providerObj = locatorObj.ConnectServer("MyMachine", "root/MicrosoftIISv2")

' Add a virtual directory to the site. This requires SpawnInstance().
Set vdirClassObj = providerObj.Get("IIsWebVirtualDirSetting")
Set vdirObj = vdirClassObj.SpawnInstance_()
vdirObj.Name = strNewVdir
vdirObj.Path = "C:\Inetpub\Wwwroot"
vdirObj.AuthFlags = 5 ' AuthNTLM + AuthAnonymous
vdirObj.EnableDefaultDoc = True
vdirObj.DirBrowseFlags = &H4000003E ' date, time, size, extension, longdate
vdirObj.AccessFlags = 513 ' read, script

' Save the new settings to the metabase
vdirObj.Put_()

' Create a pooled application on the new virtual directory.
Set vdirObj = providerObj.Get("IIsWebVirtualDir='" & strNewVdir & "'")
vdirObj.AppCreate2(2)

' Set the application name.
Set vdirObj = providerObj.Get("IIsWebVirtualDirSetting='" & strNewVdir & "'")
vdirObj.AppFriendlyName = "Root Application"
vdirObj.Put_()
JScript
var APP_POOLED = 2;
var strNewVdir = "W3SVC/1/Root/newVdir";

// Make connections to WMI, to the IIS namespace on MyMachine.
var locatorObj = new ActiveXObject("WbemScripting.SWbemLocator");
var providerObj = locatorObj.ConnectServer("MyMachine", "root/MicrosoftIISv2");

// Add a virtual directory to the site. This requires SpawnInstance().
var vdirClassObj = providerObj.Get("IIsWebVirtualDirSetting");
var vdirObj = vdirClassObj.SpawnInstance_();
vdirObj.Name = strNewVdir;
vdirObj.Path = "C:\\Inetpub\\Wwwroot"
vdirObj.AuthFlags = 5; // AuthNTLM + AuthAnonymous
vdirObj.EnableDefaultDoc = true;
vdirObj.DirBrowseFlags = 0x4000003E; // date, time, size, extension, longdate
vdirObj.AccessFlags = 513; // read, script

// Save the new settings to the metabase.
vdirObj.Put_();

// Create a pooled application on the new virtual directory.
var vdirObj = providerObj.Get("IIsWebVirtualDir='" + strNewVdir + "'");
vdirObj.AppCreate2(2);

// Set the application name.
var vdirObj = providerObj.Get("IIsWebVirtualDirSetting='" + strNewVdir + "'");
vdirObj.AppFriendlyName = "Root Application";
vdirObj.Put_();

In either of these examples, you could create sites in your FTP service, SMTP service, or NNTP service by replacing references to IIsWebService, IIsWebServer, and IIsWebVirtualDir with the appropriate object name as listed in the following table.

Web Objects | FTP Objects | SMTP Objects | NNTP Objects
IIsWebService | IIsFtpService | IIsSmtpService | IIsNntpService
IIsWebServiceSetting | IIsFtpServicSetting | IIsSmtpServiceSetting | IIsNntpServiceSetting
IIsWebServer | IIsFtpServer | IIsSmtpServer | IIsNntpServer
IIsWebServerSetting | IIsFtpServerSetting | IIsSmtpServerSetting | IIsNntpServerSetting
IIsWebVirtualDir | IIsFtpVirtualDir | IIsSmtpVirtualDir | IIsNntpVirtualDir
IIsWebVirtualDirSetting | IIsFtpVirtualDirSetting | IIsSmtpVirtualDirSetting | IIsNntpVirtualDirSetting
Related Topics
  • To proceed to the next lesson in this module, see Lesson 4: Exporting and Importing Metabase Nodes.


Lesson 4: Exporting and Importing Metabase Nodes

Server administrators often need to take a portion of an IIS configuration and duplicate it on another box. Before IIS 6.0, this had to be done manually, or the whole configuration had to be duplicated. Now, two methods of the IIsComputer (WMI) object allow you to save pieces of an IIS configuration to a file and import them to another IIS 6.0 Web server. Before you try the example code below, read about the IIsComputer.Export (WMI) and IIsComputer.Import (WMI) methods. As before, replace MyMachine with the name of an IIS 6.0 server and verify the other variables.

VBScript
Const EXPORT_CHILDREN = 0 ' Adds properties of child keys to the export file.
Const EXPORT_INHERITED = 1 ' Adds inherited properties of the exported keys to the export file.
Const EXPORT_NODE_ONLY = 2 ' Does not add subkeys of the specified key to the export file.

Dim strPassword, strFilePath, strMetabasePath, intFlags
strPassword = "ExportingPassw0rd"  ' Use the same password to import the configuration.
strFilePath = "C:\exported.xml"
strMetabasePath = "/lm/logging/custom logging" ' As represented in the metabase.xml file.
intFlags = EXPORT_NODE_ONLY OR EXPORT_INHERITED ' Show only the node with inherited properties.

' Make connections to WMI, to the IIS namespace on MyMachine, and to the IIsComputer object.
set locatorObj = CreateObject("WbemScripting.SWbemLocator")
set providerObj = locatorObj.ConnectServer("MyMachine", "root/MicrosoftIISv2")
Set computerObj = providerObj.get("IIsComputer='LM'")

' Call export method from the computer object.
computerObj.Export strPassword, strFilePath, strMetabasePath, intFlags

' Print results.
WScript.Echo "Exported the node at " & strMetabasePath & " to " & strFilePath
JScript
var EXPORT_CHILDREN = 0; // Adds properties of child keys to the export file.
var EXPORT_INHERITED = 1; // Adds inherited properties of the exported keys to the export file.
var EXPORT_NODE_ONLY = 2; // Does not add subkeys of the specified key to the export file.

var strPassword = "ExportingPassw0rd";
var strFilePath = "C:\\exported.xml";
var strMetabasePath = "/lm/logging/custom logging"; // As represented in the metabase.xml file.
var intFlags = EXPORT_NODE_ONLY | EXPORT_INHERITED; // Show only the node with inherited properties.

// Make connections to WMI, to the IIS namespace on MyMachine, and to the IIsComputer object.
var locatorObj = new ActiveXObject("WbemScripting.SWbemLocator");
var providerObj = locatorObj.ConnectServer("MyMachine", "root/MicrosoftIISv2");
var computerObj = providerObj.get("IIsComputer='LM'");

// Call export method from the computer object.
computerObj.Export(strPassword, strFilePath, strMetabasePath, intFlags);

// Print results.
WScript.Echo("Exported the node at " + strMetabasePath + " to " + strFilePath)

To import the keys that you exported, use the following code. These examples use the custom logging key of the metabase, which had one location, so the exported information must be imported to the same location on the destination server. However, if you exported a virtual directory, you could import it to any site on the destination server.

VBScript
Const IMPORT_CHILDREN = 0 ' Recursively imports the subkeys of the specified key.
Const IMPORT_INHERITED = 1 ' Imports the inherited properties of the keys.
Const IMPORT_NODE_ONLY = 2 ' Does not import subkeys from the specified file.
Const IMPORT_MERGE = 4 ' Merges the imported keys into the existing configuration instead of completely replacing what is there.

Dim strPassword, strFilePath, strMetabasePath, intFlags
strPassword = "ExportingPassw0rd"
strFilePath = "C:\exported.xml"
strSourceMetabasePath = "/lm/logging/custom logging" ' As represented in the metabase.xml file.
strDestinationMetabasePath = "/lm/logging/custom logging" ' Can be different from the source.
intFlags = IMPORT_NODE_ONLY OR IMPORT_INHERITED ' Import only the node with inherited properties.

' Make connections to WMI, to the IIS namespace on MyMachine, and to the IIsComputer object.
set locatorObj = CreateObject("WbemScripting.SWbemLocator")
set providerObj = locatorObj.ConnectServer("MyMachine", "root/MicrosoftIISv2")
Set computerObj = providerObj.get("IIsComputer='LM'")

' Call export method from the computer object.
computerObj.Import strPassword, strFilePath, strSourceMetabasePath, strDestinationMetabasePath, intFlags

' Print results.
WScript.Echo "Imported the node in " & strFilePath & " to " & strDestinationMetabasePath
JScript
var IMPORT_CHILDREN = 0; // Recursively imports the subkeys of the specified key.
var IMPORT_INHERITED = 1; // Imports the inherited properties of the keys.
var IMPORT_NODE_ONLY = 2; // Does not import subkeys from the specified file.
var IMPORT_MERGE = 4; // Merges the imported keys into the existing configuration instead of completely replacing what is there.

var strPassword = "ExportingPassw0rd";
var strFilePath = "C:\\exported.xml";
var strSourceMetabasePath = "/lm/logging/custom logging"; // As represented in the metabase.xml file.
var strDestinationMetabasePath = "/lm/logging/custom logging"; // Can be different from the source.
var intFlags = IMPORT_NODE_ONLY | IMPORT_INHERITED; // Import only the node with inherited properties.

// Make connections to WMI, to the IIS namespace on MyMachine, and to the IIsComputer object.
var locatorObj = new ActiveXObject("WbemScripting.SWbemLocator");
var providerObj = locatorObj.ConnectServer("MyMachine", "root/MicrosoftIISv2");
var computerObj = providerObj.get("IIsComputer='LM'");

// Call export method from the computer object.
computerObj.Import(strPassword, strFilePath, strSourceMetabasePath, strDestinationMetabasePath, intFlags);

// Print results.
WScript.Echo("Imported the node in " + strFilePath + " to " + strDestinationMetabasePath);
Related Topics
  • For more information on the export and import feature of IIS 6.0, see Importing IIS Configurations and Exporting IIS Configurations.
  • To proceed to the next lesson in this module, see Lesson 5: Using WMI Query Language to Find Specific Information.


Lesson 5: Using WMI Query Language to Find Specific Information

In the Windows Management Instrumentation (WMI) SDK, a method called ExecQuery exists for the C++ Provider object, the COM+ IWbemServices object, and the scripting SWbemServices object. You can use this method to query a data store, such as the metabase, just as you can query a SQL or Access database. The query string uses the WMI Query Language (WQL) as explained in the WMI SDK under WMI Development Environment, WMI Query Language. Read the first three documents which guide you through building a query string in WQL, and then read the section on Data Queries.

The following code example uses the SELECT statement to enumerate all of the services on your server.

VBScript
for each item in GetObject("winmgmts://MyMachine").ExecQuery("select * from win32_service")
  WScript.Echo item.name
next
JScript
var e = new Enumerator(GetObject("winmgmts://MyMachine").ExecQuery("select * from win32_service"));
for(; ! e.atEnd(); e.moveNext())
{
x = e.item();
WScript.Echo(x.Name);
}

You can do the same thing for objects in the IIS WMI provider. The following code sample enumerates all the instances of objects on your server that belong to the CIM_Setting class.

VBScript
for each item in GetObject("winmgmts://MyMachine/root/MicrosoftIISv2").ExecQuery("select * from CIM_Setting")
  WScript.Echo item.name
next
JScript
var e = new Enumerator(GetObject("winmgmts://MyMachine/root/MicrosoftIISv2").ExecQuery("select * from CIM_Setting"));
for(; ! e.atEnd(); e.moveNext())
{
x = e.item();
WScript.Echo(x.Name);
}

With the addition of a little extra code, you can print out all the properties in each of the instances. The on error resume next command is used because some properties are arrays of objects and need more specialized code to print them out.

VBScript
on error resume next
for each item in GetObject("winmgmts://MyMachine/root/MicrosoftIISv2").ExecQuery("select * from CIM_Setting" )
  WScript.Echo item.name
  for each propSet in item.Properties_WScript.Echo " " & propSet.Name & " = " & propSet.Valuenext
next
JScript
var e = new Enumerator(GetObject("winmgmts://MyMachine/root/MicrosoftIISv2").ExecQuery("select * from CIM_Setting"));
for(; ! e.atEnd(); e.moveNext())
{
  x = e.item();
  WScript.Echo(x.Name);
  var f = new Enumerator(x.Properties_)for(; ! f.atEnd(); f.moveNext()) {propSet = f.item();WScript.Echo(" " + propSet.Name + " = " + propSet.Value);}
}

Sometimes a server administrator wants to find an instance of an object with a property that has a specific value. For example, to determine which virtual directories have pooled applications, use the following code.

VBScript
for each item in GetObject("winmgmts://MyMachine/root/MicrosoftIISv2").ExecQuery("SELECT * FROM IIsWebVirtualDir WHERE AppIsolated = 2")
WScript.Echo item.name
next
JScript
var e = new Enumerator(GetObject("winmgmts://MyMachine/root/MicrosoftIISv2").ExecQuery("SELECT * FROM IIsWebVirtualDir WHERE AppIsolated = 2"));
for(; ! e.atEnd(); e.moveNext())
{
  x = e.item();
  WScript.Echo(x.Name);
}
Related Topics
  • To proceed to the next lesson in this module, see Lesson 6: Using Associations to Find Metabase Elements.


Lesson 6: Using Associations to Find Metabase Elements

As described in Lesson 3: Organizing Data from the IIS Metabase, there are two association classes in the IIS Windows Management Instrumentation (WMI) provider: the CIM_Component class, and the CIM_ElementSetting class. Typically, a user does not create an instance of an association class, but instead creates an instance of a regular class, such as the IIsWebServer class, and asks for instances of the associated classes. For example, server administrators can enumerate all the virtual directories that are contained in another virtual directory on their server with the following code.

VBScript
Const wbemFlagReturnImmediately = &H10 ' Causes the call to return immediately.
Const wbemFlagForwardOnly = &H20 ' Causes a forward-only enumerator to be returned (faster).

' Make connections to WMI, to the IIS namespace on MyMachine.
set locatorObj = CreateObject("WbemScripting.SWbemLocator")
set providerObj = locatorObj.ConnectServer("MyMachine", "root/MicrosoftIISv2")

' Execute the query, putting the results into a SWbemObjectSet object.
strQuery = "ASSOCIATORS OF {IIsWebVirtualDir='W3SVC/1/Root'}"
set vdirsCol = providerObj.ExecQuery(strQuery, , (wbemFlagReturnImmediately OR wbemFlagForwardOnly))

' Report the results.
For Each vdirObj in vdirsCol
  WScript.Echo "Object: " & vdirObj.Name
Next
JScript
// Make connections to WMI, to the IIS namespace on MyMachine.
var locatorObj = new ActiveXObject("WbemScripting.SWbemLocator");
var providerObj =

 locatorObj.ConnectServer("janetfi-32", "root/MicrosoftIISv2"); // Execute the query, putting the results into
a  SWbemObjectvar object. strQuery=  "ASSOCIATORS OF {IIsWebVirtualDir = 'W3SVC/1/Root'}";
var vdirsCol = providerObj.ExecQuery(strQuery);

// Report the results.
var e = new Enumerator(vdirsCol)
for(; ! e.atEnd(); e.moveNext())
{
  vdirObj = e.item();
  WScript.Echo("Object: " + vdirObj.Name);
}

Data queries that use the ASSOCIATORS OF statement return an SWbemObjectSet object, which is a collection of SWbemObjects. To print out the properties, use the Properties_ property of the SWbemObject as in the code example below.

VBScript
Const wbemFlagReturnImmediately = &H10 ' Causes the call to return immediately.
Const wbemFlagForwardOnly = &H20 ' Causes a forward-only enumerator to be returned (faster).

' Make connections to WMI, to the IIS namespace on MyMachine.
set locatorObj = CreateObject("WbemScripting.SWbemLocator")
set providerObj = locatorObj.ConnectServer("MyMachine", "root/MicrosoftIISv2")

' Execute the query, putting the results into a SWbemObjectSet object.
strQuery = "ASSOCIATORS OF {IIsWebVirtualDir='W3SVC/1/Root'}"
set vdirsCol = providerObj.ExecQuery(strQuery, , (wbemFlagReturnImmediately OR wbemFlagForwardOnly))

' Report the results.
For Each vdirObj in vdirsCol
  WScript.Echo "Object: " & vdirObj.Name
  For Each propSet in vdirObj.Properties_WScript.Echo " " & propSet.Name & " = " & propSet.ValueNext
Next
JScript
// Make connections to WMI, to the IIS namespace on MyMachine.
var locatorObj = new ActiveXObject("WbemScripting.SWbemLocator");
var providerObj = locatorObj.ConnectServer("janetfi-32", "root/MicrosoftIISv2");

// Execute the query, putting the results into a SWbemObjectvar object.
strQuery = "ASSOCIATORS OF {IIsWebVirtualDir='W3SVC/1/Root'} WHERE ResultClass = IIsWebVirtualDir ResultRole = PartComponent";
var vdirsCol = providerObj.ExecQuery(strQuery);

// Report the results.
var e = new Enumerator(vdirsCol)
for(; ! e.atEnd(); e.moveNext())
{
  vdirObj = e.item();
  WScript.Echo("Object: " + vdirObj.Name);

  var f = new Enumerator(vdirObj.Properties_)for(; ! f.atEnd(); f.moveNext()) {propvar = f.item();WScript.Echo(" " + propvar.Name + " = " + propvar.Value);}
}

The preceding code examples use the following basic query string:

"ASSOCIATORS OF {IIsWebVirtualDir='W3SVC/1/Root'}"

This query returns all of the virtual directories under W3SVC/1/Root, including W3SVC/1/Root, the parent W3SVC/1, and all possible children. Normally, a server administrator wants to limit their query by using the properties of association classes. Each element class of the CIM_Component association class has two properties: the PartComponent, which is the child member of the association, and the GroupComponent, which is the parent. For example, in the containment association of the IIsWebVirtualDir_IIsWebDirectory element class, the IIsWebVirtualDir element of the CIM_ManagedSystemElement class is the GroupComponent, and the IIsWebDirectory element of the CIM_ManagedSystemElement class is the PartComponent. This relationship is viewed best in CIM Studio by clicking the Associations tab when looking at the IIsWebVirtualDir_IIsWebDirectory element class of the CIM_Component association class.

The results of the queries used in the above code examples can be varied by using the following possible query strings.

  • To limit the results of your query to items that are IIsWebVirtualDir objects, and to those that are considered as the child of the association, use the following query string:
    "ASSOCIATORS OF {IIsWebVirtualDir='W3SVC/1/Root'} WHERE ResultClass = IIsWebVirtualDir ResultRole = PartComponent"
  • To limit the results of your query to items that are parent virtual directories, use the following query string. On a default installation of IIS 6.0, there are none.
    "ASSOCIATORS OF {IIsWebVirtualDir='W3SVC/1/Root'} WHERE ResultClass = IIsWebVirtualDir ResultRole = GroupComponent"
  • To limit the results of your query to items that are IIsDirectory objects, and those that are considered as the child of the association, use the following query string. IIsDirectory is the base class for IIsWebDirectory, IIsWebVirtualDirectory, and IIsWebFile, so any results that match these types are returned.
    "ASSOCIATORS OF {IIsWebVirtualDir='W3SVC/1/Root'} WHERE ResultClass = IIsDirectory ResultRole = PartComponent"

For more information on how to construct query strings for the ASSOCIATORS OF statement, see the WMI SDK under WMI Development Environment, WMI Query Language, Data Queries, ASSOCIATORS OF Statement. In that document is the following handy syntax:

ASSOCIATORS OF {ObjectPath} WHERE
    AssocClass = AssocClassName
    ClassDefsOnly
    RequiredAssocQualifier = QualifierName
    RequiredQualifier = QualifierName
    ResultClass = ClassName
    ResultRole = PropertyName
    Role = PropertyName


Using the IIS ADSI Provider

The Internet Information Services (IIS) ADSI objects, described in this section, are provided by IIS to make programmatic administration as straightforward as possible. The IIS ADSI objects are based on Active Directory® Service Interfaces (ADSI), are Automation-compatible, and can be easily accessed and manipulated by any language that supports Automation, such as Microsoft® Visual Basic® Scripting Edition (VBScript), Microsoft JScript®, Perl, Microsoft Active Server Pages (ASP), Visual Basic, Java, or Microsoft C++.

This section includes the following information:

  • About IIS ADSI Objects: Introduces the IIS ADSI objects, describes what they are, and how they are used. Some code samples are included to illustrate the use of ADSI objects.
  • IIS ADSI Object Hierarchy: Describes the structure of ADSI by pictorially representing instances of the IIS ADSI objects as they relate to the metabase configuration file.
  • ADSI Container Objects: Describes ADSI container objects and their functionality in IIS.
  • ADSI Objects: Discusses ADSI objects and how they can be used to configure IIS.
  • Adsutil.vbs Commands: Explains the commands that are used in a sample administrative utility script.

Related Topics
  • For reference information on each of the IIS ADSI objects, see IIS ADSI Provider Reference.
  • For reference information on administering your server programmatically, see Programmatic Administration Reference.


About IIS ADSI Objects

The IIS ADSI objects are COM Automation objects that you can use within command-line scripts, ASP pages, or custom applications to change IIS configuration values stored in the IIS Metabase. For example, instead of using IIS Manager, you can write a script to set permissions for the AppRoot, LogType, and ConnectionTimeout properties in the metabase.

This topic includes the following information:

  • Relationship Between ADSI and the Metabase
  • Properties
  • Methods
  • Inheritance
  • Security
  • Extending the IIS ADSI Schema

Relationship Between ADSI and the Metabase

Each IIS ADSI object corresponds to a key in the Metabase Schema. For example, the IIsWebServer (ADSI) ADSI object corresponds to the IIsWebServer collection key in the metabase schema file, as in the following line of code in MBSchema.xml:

<Collection InternalName="IIsWebServer"
        MetaFlagsEx="NOTABLESCHEMAHEAPENTRY | CONTAINERCLASS"
        MetaFlags="HASUNKNOWNSIZES"
        ContainerClassList="IIsObject,IIsCertMapper,IIsFilters,IIsWebVirtualDir"
        InheritsPropertiesFrom="MetabaseBaseClass">

The IIS ADSI objects and the keys in the metabase schema file describe only the structure of your IIS configuration, in the same way that the schematic for a building describes the structure of a building. IIS uses the metabase schema as a guide to build your Metabase Configuration File, add Web sites and virtual directories, and make other configuration changes as your Web server grows.

The metabase configuration file contains instances of the keys in the metabase schema file. For example, on a default installation of IIS 6.0, the metabase configuration file contains one instance of the IIsWebServer key for the default Web site, as in the following lines of code in MetaBase.xml:

<IIsWebServer  Location ="/LM/W3SVC/1"
        AppPool
        DefaultDoc="Default.htm,Default.asp,index.htm,iisstart.asp,Default.aspx"
        SecureBindings=":443:"
        ServerBindings=":80:"
        ServerComment="Default Web Site"
        ServerSize="1">

When you use an IIS ADSI object to access data currently in the metabase configuration file, you are creating an instance of that IIS ADSI object and filling the object properties with current data. For example, when using the IIsWebServer ADSI object to connect to the default Web site on the Web server, you create an instance of the IIsWebServer object whose properties, like ServerComment, contain the information seen above. The following Microsoft Visual Basic® Scripting Edition (VBScript) code creates an instance of the IIsWebServer ADSI object that is connected to the default Web site on a machine called MachineName:

Set IIsWebServerObj = GetObject("IIS://MachineName/W3SVC/1")

Because modifying an IIS ADSI Object property changes the valueof the corresponding metabase property, you can configure individual elements of IIS, such as the local machine (LM), using the IIsComputer object; the FTP server (MSFTPSVC) using the IIsFtp* objects; the Web server (W3SVC) using the IIsWeb* objects; the Network News server (NNTPSVC) using the IIsNntp* objects; and the Simple Mail server (SMTPSVC) using the IIsSmtp* objects.

Properties

Each IIS ADSI object contains two sets of properties: one read-only set that all ADSI objects must contain, and one set exclusively for IIS that corresponds to the properties in the metabase schema.

For example, the Name and AdsPath properties of the IIsWebServer object are two of the six read-only Windows ADSI object properties that all ADSI objects must contain. The LogType and ConnectionTimeout properties are two of the 51 possible properties that can be set at the IIsWebServer level. These properties are seen in the metabase schema file under the <Collection> key:

<Property InheritsPropertiesFrom="IIsConfigObject:LogType"/>
<Property InheritsPropertiesFrom="IIsConfigObject:ConnectionTimeout"/>

These properties may not show up in the metabase configuration file unless they have been specifically set at that level. If they do not show up, they may be inherited from the parent key.

Methods

Some IIS ADSI objects contain three sets of methods: one set that creates and deletes new objects, one set that changes properties of ADSI objects, and one set that exclusively relates to the purpose of the ADSI object in which the methods are found.

For example, the Create method is one of the five Windows ADSI container object methods that all ADSI objects contain. With them, you can create and delete new instances of ADSI objects, get references to child objects, and move object instances around. The following VBScript code creates a new instance of the IIsWebVirtualDir object contained within another IIsWebVirtualDir object, thereby creating a new virtual directory called NewVDir in the default Web site:

Set IIsWebVDirRootObj = GetObject("IIS://MachineName/W3SVC/1/Root")
Set IIsWebVDirObj = IIsWebVDirRootObj.Create("IIsWebVirtualDir", "NewVDir")

The Get, Put, and SetInfo methods are three of the eight Windows ADSI object methods that all ADSI objects contain. With them, you can get the value in a property, set it to something else, and then save the info to the metabase. The following VBScript code continues from the last code to set some necessary properties on the newly created virtual directory:

IIsWebVDirObj.Put "Path", "C:\NewContent"
IIsWebVDirObj.Put "AccessRead", True
IIsWebVDirObj.Put "AccessScript", True

The IIsWebDirectory.AppCreate2 (ADSI) method of the IIsWebVirtualDir (ADSI) object relates only to creating applications on virtual directories and Web directories. The following VBScript code continues from the last code example to create an application on the new virtual directory, set a property that is necessary to the application, and save the new settings in the metabase with the SetInfo Windows ADSI object method:

IIsWebVDirObj.AppCreate2 1
IIsWebVDirObj.Put "AppFriendlyName", "NewApp"
IIsWebVDirObj.SetInfo

Other examples of methods that exclusively relate to the object that contains them are the methods of the IIsComputer (ADSI) ADSI object. Methods such as IIsComputer.Backup (ADSI) and IIsComputer.Restore (ADSI) are used to protect your metabase from potentially harmful changes. It is recommended that you always back up your metabase configuration file before making any changes. The following VBScript code backs up the metabase configuration file to a file called BeforeChanges.MD0, and it backs up the metabase schema file to a file called BeforeChanges.SC0. These files are stored in the systemroot\System32\Inetsrv\MetaBack directory.

Dim IIsComputerObj, iFlags
' Create an instance of the IIsComputer object
Set IIsComputerObj = GetObject("IIS://janetfi-32")
' Set flags to save the metabase first and force a backup even if the save fails.
iFlags = (MD_BACKUP_SAVE_FIRST or MD_BACKUP_FORCE_BACKUP)
'Backup to next available version number.
IIsComputerObj.BackupWithPassword "BeforeChanges", MD_BACKUP_NEXT_VERSION, iFlags, "MyP@ssWOrd"

Inheritance

Because of the hierarchical structure of the metabase and its property inheritance feature, you can easily configure properties for a single file, a single server, all Web servers, all FTP servers, or the common properties of many other groups of objects.

Security

Only server administrators are permitted to change the values in the metabase through ADSI. If you are using ADSI in command-line scripts, note that they work only when run by an administrator. If you are using ADSI in a compiled program, set the account of the application to an administrative account. For increased security, it is recommended that you set Access Control on your scripts and compiled administrative programs to restrict access to the Administrators group.

If you are using ADSI in an ASP page to configure the metabase, you must disable anonymous access to the Web application that contains the ASP page. It is recommended that you create a server or directory for your administrative ASP files and set the authentication method to use Integrated Windows authentication for the server or directory. For security purposes, out-of-process Web applications cannot access the metabase unless WAMUserName is recognized as an administrator. However, this is not a recommended configuration. As an alternative, change the identity of the specific out-of-process package to some other account identity, and give only that account administrative access to the metabase. This method introduces less potential risk, but it must be implemented for each out-of-process package.

important Important It is recommended that you do not make IWAM_machinename an administrator, unless special circumstances require you to. Making IWAM_machinename an administrator means that anyone accessing your server through an out-of-process Web application has administrative privileges on your machine.

Extending the IIS ADSI Schema

If you find that no existing ADSI object class meets your management needs, you can extend the IIS ADSI schema. Extending the IIS ADSI schema is a complex operation. Consider your needs carefully, and assess whether an extension is really necessary.

Related Topics
  • For more information on extending the IIS ADSI schema, see "Component Development Guide", "Using IIS Interfaces for Advanced Programmatic Administration", and "ADSI Extensibility for IIS" in the IIS Software Development Kit (SDK) on MSDN® Online.


IIS ADSI Object Hierarchy

The IIS Active Directory Service Interfaces (ADSI) objects are organized in a hierarchical structure that mirrors the structures defined in the IIS metabase configuration file. Objects contain other objects to create the object structure that is illustrated in the following diagram. Most objects inherit characteristics or properties from the parent object, but child objects can contain unique characteristics that are implemented by extending the schema. You can use this object hierarchy to access configuration settings for specific IIS elements. The structure shown in the diagram can vary slightly, depending on how IIS is installed.

IIS Object Hierarchy

Related Topics
  • For information on the IIS metabase configuration file, see Metabase Configuration File.
  • For details on the IIS structure and the metabase, see Metabase Structure.


ADSI Container Objects

Any Active Directory Service Interfaces (ADSI) object that can contain other objects must also implement the IADsContainer interface, in addition to the IADs interface. Examples of IIS ADSI objects that support IADsContainer include the following:

  • IIsComputer object, which can contain IIsWebService and IIsFtpService objects, among others.
  • IIsWebVirtualDir object, which can contain IIsWebDirectory and IIsWebFile objects, as well as additional IIsWebVirtualDir objects.

The IADsContainer interface permits objects to contain other objects, and provides a way to implement the following tasks:

  • Create objects within the container.
  • Delete objects from the container.
  • Count the number of objects within the container.
  • Enumerate the contained objects.
  • Access the contained objects.

The ADSI objects that can contain other objects can also implement container object properties and methods. These objects accomplish this by supporting the IADsContainer interface; the _NewEnum and Count properties; and the GetObject, Create, and Delete methods. IIS ADSI objects also support the basic IADs interface properties and methods, and any IIS-specific or extended properties and methods.

Related Topics
  • For information on the objects, methods, and properties that are exposed by the IIS ADSI provider, see Windows ADSI Reference.


ADSI Objects

Each IIS Active Directory® Service Interfaces (ADSI) object implements the IADs interface defined by the ADSI standard. The IADs interface for the IIS ADSI objects provides the following basic functionality:

  • A simple way to set and retrieve configuration properties on a specific node in the metabase. For example, you can change permissions (AccessFlags) for a specific Web site.
  • A way to retrieve the path of the object's parent container object.
  • Binding information that uniquely identifies the object instance in a directory tree.
  • A path to the schema definition of the object.
  • Identification information that indicates the name and the type of object.
  • A way to retrieve namespace properties.
  • A simple implicit caching system.

The IIS ADSI objects implement the IADs interface, which supports the Name, ADsPath, Class, GUID, Parent, and Schema properties, in addition to IIS-specific metabase properties. The IADs GetInfo, SetInfo, Get, Put, GetEx, and PutEx methods are also supported, in addition to others that are needed for IIS configuration administration.

Related Topics
  • For more information on ADSI properties and methods that are provided by IIS ADSI objects, see Windows ADSI Reference.


Adsutil.vbs Commands

Adsutil.vbs is an IIS administration utility that uses Microsoft Visual Basic Scripting Edition (VBScript) with Active Directory Service Interfaces (ADSI) to manipulate the IIS configuration. This script should be run using CScript, which is installed with Windows Script Host.

important Important You must be a member of the Administrators group on the local computer to run scripts and executables, or you must have been delegated the appropriate authority. As a security best practice, log on to your computer using an account that is not in the Administrators group, and then use the Run as command to run your script or executable as an administrator. From the command prompt, type runas /user:administrative_accountname "script or executable command".

Usage

Cscript.exe adsutil.vbs COMMAND <path> [<param>...]

Cscript.exe adsutil.vbs COMMAND [<path> [<parameters>...]]

Commands
GET Path | Display chosen parameter.
SET Path Value | Assign a new value.
ENUM Path "/P" | Enumerate all parameters for the path. /P - Enumerate the paths only (no data).
ENUM_ALL "/P" | Enumerate all parameters. /P - Enumerate the paths only (no data).
DELETE Path | Delete the path or parameter.
CREATE Path [KeyType] | Create the path and assign it the KeyType.
APPCREATEINPROC Path | Create an in-process application.
APPCREATEOUTPROC Path | Create an out-of-process application.
APPDELETE Path | Delete the application (if present).
APPUNLOAD Path | Unload an out-of-process application.
APPGETSTATUS Path | Get status of the application.
FIND Path | Find the paths where a parameter is set.
START_SERVER Path | Start the Web site.
STOP_SERVER Path | Stop the Web site.
PAUSE_SERVER Path | Pause the Web site.
CONTINUE_SERVER Path | Unpause the Web site.
HELP | Print all available commands.

Notes

  • <Path> is the path of the node for which you are setting the property, combined with the name of the property that you are setting. For example, if you want to set the ServerComment for Web server number 1, the command would be as follows:
    adsutil SET w3svc/1/ServerComment "Web Server Number 1"
    The next time IIS Manager is opened, it will reflect the name of the Web server as "Web Server Number 1."
  • The switch "-s:server name" can be used after any command to execute the command on a remote computer. (See first example below.)

Examples

  • Cscript.exe adsutil.vbs GET W3SVC/1/ServerBindings -s:remotecomputer1
  • Cscript.exe adsutil.vbs SET W3SVC/1/ServerBindings ":81:"
  • Cscript.exe adsutil.vbs CREATE W3SVC/1/Root/MyVdir "IIsWebVirtualDir"
  • Cscript.exe adsutil.vbs START_SERVER W3SVC/1
  • Cscript.exe adsutil.vbs ENUM /P W3SVC


Using Command-Line Administration Scripts

You can extend administrative control by using scripts to perform server administration tasks. You can use scripts to automate tasks, remotely administer sites and resources, and take advantage of batch files to create and manage objects. For additional information on using command lines, see the Command-Line Reference in Windows Help and Support Center.

Internet Information Services (IIS) contains eight supported command-line scripts that use the IIS Windows Management Instrumentation (WMI) provider to configure and manage IIS metabase configurations. Microsoft supports the command-line scripts that are included in IIS, as long as the scripts are not modified. If you need to modify a supported script, you must save it under a new file name, leaving the original script unmodified.

This section includes the following information:

  • Managing Web Sites: Describes how to create and manage Web sites by using a command-line script.
  • Managing FTP Sites: Describes how to create and manage FTP sites by using a command-line script.
  • Managing Web Virtual Directories: Describes how to create and manage Web virtual directories by using a command-line script.
  • Managing FTP Virtual Directories: Describes how to create and manage FTP virtual directories by using a command-line script.
  • Managing IIS Configurations: Describes how to export and import partial or complete IIS configurations and how to back up and restore IIS configurations by using a command-line script.
  • Managing Applications and Web Service Extensions: Describes how to manage Web applications and Web service extensions by using a command-line script.
Related Topics
  • For information on the Active Directory® Service Interfaces (ADSI) utility, adsutil.vbs, see Using the IIS ADSI Provider.
  • For information on the command-line utility, convlog.exe, see Converting Log Files to NCSA Format.
  • For information on the IISReset command-line utility, see Restarting IIS.


Managing Web Sites

You can use the command-line script iisweb.vbs, which is stored in systemroot\System32, to create and manage Web sites on computers running a member of the Microsoft® Windows® Server 2003 family with Internet Information Services (IIS) 6.0.

Iisweb.vbs performs some of the same operations that are available in IIS Manager. You can use either tool to administer IIS Web sites.

This section contains the following information:

  • Creating Web Sites: Describes how to create Web site configurations on local or remote computers by using iisweb.vbs.
  • Deleting Web Sites: Describes how to delete Web site configurations on local or remote computers by using iisweb.vbs.
  • Starting Web Sites: Describes how to start Web sites on local or remote computers by using iisweb.vbs.
  • Stopping Web Sites: Describes how to stop Web sites on local or remote computers by using iisweb.vbs.
  • Pausing Web Sites: Describes how to pause Web sites on local or remote computers by using iisweb.vbs.
  • Listing Web Sites: Describes how to list Web sites on local or remote computers by using iisweb.vbs.


Creating Web Sites

You can use the command-line script iisweb.vbs, which is stored in systemroot\System32, to create Web site configurations on local or remote computers running a member of the Windows Server 2003 family with IIS 6.0. This command does not create or destroy content, but it sets up the directory structure and some IIS configuration files.

When you use iisweb.vbs to create a new Web site, you specify only the basic properties that are needed to create the site and identify its contents. Iisweb.vbs uses the same default properties that IIS Manager uses when establishing new Web sites, and it adheres to the same rules for inheriting properties. To configure the more advanced properties of the Web site, use IIS Manager.

important Important You must be a member of the Administrators group on the local computer to run scripts and executables, or you must have been delegated the appropriate authority. As a security best practice, log on to your computer using an account that is not in the Administrators group, and then use the Run as command to run your script or executable as an administrator. From the command prompt, type runas /user:administrative_accountname "script or executable command".

This topic includes the following information:

  • Syntax: The order in which you type a command and any arguments and options that follow it.
  • Parameters: The values that are given to variables in the command.
  • Examples: Sample code and an explanation of the results.

Syntax

iisweb /create Path SiteName [/b Port] [/i IPAddress] [/d HostHeader] [/dontstart] [/s Computer [/u [Domain\]User/p Password]]

Parameters

Path
Specifies the location of content files for the Web site. The path must be local, such as C:\Projects\HTML. If the specified path does not exist, then iisweb.vbs creates the path.

The Path parameter must immediately precede the SiteName parameter in the command. Otherwise, iisweb.vbs does not interpret the site information correctly.

SiteName
Required. Specifies a name for the Web site.
/b Port
Specifies a TCP port number for the Web site. The default port is 80.
/i IPAddress
Specifies an IP address for the Web site. The default is All Unassigned, which assigns to the site all of the IP addresses on the computer that are not assigned to other sites. Only one site on each IIS server can be set to All Unassigned.
/d HostHeader
Specifies the host header name for the Web site, such as www.microsoft.com. By default, the site does not have a host header name and must be identified by its IP address or port number.

Your DNS server must be configured to associate the host header name with the Internet server. Otherwise, the site will not start.

/dontstart
Indicates that the Web site should not be started automatically as soon as it is created, which is contrary to the IIS default.
/s Computer
Runs the script on the specified remote computer. Type the computer name or IP address without backslashes. By default, the script runs on the local computer.
/u [Domain\]User
Runs the script with the permissions of the specified user account. This account must be a member of the Administrators group on the remote computer. By default, the script runs with the permissions of the current user of the local computer.
/p Password
Specifies the password of the user account that is specified in the /u parameter.

note Note Iisweb.vbs does not verify the port number, IP address, or host header of a Web site, and it does not verify that these bindings are unique within the server. If you create a site with invalid or conflicting bindings, the site will not start.

Examples

Example 1:

The following example creates a single Web site configuration on a local computer. The source files for the "My Vacation" Web site are located in the C:\Rome directory. The command uses the /d parameter to specify a host header for the Web site. It also uses the dontstart parameter so that the Web site is not started automatically, providing time to add the host header name to DNS before starting the site.

iisweb /create C:\Rome "My Vacations" /d www.reskit.com /dontstart

In response, iisweb displays the following message, along with the basic properties of the new Web site. In this example, "Server" represents the machine name where drive C: is found, "Site Name" is the name you assigned to your Web site, "Metabase Path" represents the metabase key assigned by IIS and is analogous to a registry key in the system registry, "IP" is unassigned by default, "Host" is the header name you assigned, "Port" is set to 80 by default, "Root" is the directory where the Web files reside, and "Status" is set to "STOPPED" as directed.

Connecting to server ...Done.
Server        = IIS-TEST
Site Name     = My Vacations
Metabase Path = W3SVC/1211348328
IP            = ALL UNASSIGNED
Host          = www.reskit.com
Port          = 80
Root          = C:\Rome
Status        = STOPPED

Example 2:

The following example creates the Marketing Web site configuration on a remote server (SVR01). It associates the site with files stored in the D:\New Initiatives\Marketing\HTMFiles directory on SVR01. The command uses the /i parameter to specify an IP address for the site. It uses the /s parameter to specify the remote computer, and the /u and /p parameters to run the script with the permissions of the user's Administrator account.

iisweb /create C:\New Initiatives\Marketing\HTMFiles "Marketing" /i 172.30.163.244 /s SVR01 /u Admin6 /p A76QVJ32#

In response, iisweb displays the basic properties of the new Web site. In this example, "Server" represents the server machine name, "Site Name" is the name you assigned to your Web site, "Metabase Path" represents the metabase key assigned by IIS and is analogous to a registry key in the system registry, "IP" represents the assigned DNS address, "Host" is unspecified, "Port" is set to 80 by default, "Root" is the directory where the Web files reside, and "Status" is set to "STARTED" by default.

Server        = SVR01
Site Name     = Marketing
Metabase Path = W3SVC/1907510956
IP            = 172.30.163.244
Host          = NOT SPECIFIED
Port          = 80
Root          = C:\New Initiatives\Marketing\HTMFiles
Status        = STARTED
Related Topics
  • For information on deleting Web site configurations, see Deleting Web Sites.
  • For information on listing Web site configurations, see Listing Web Sites.
  • For information on starting Web sites, see Starting Web Sites.
  • For information on stopping Web sites, see Stopping Web Sites.
  • For information on pausing Web sites, see Pausing Web Sites.


Deleting Web Sites

You can use the command-line script iisweb.vbs, which is stored in systemroot\System32, to delete IIS Web site configurations on local or remote computers running a member of the Windows Server 2003 family with IIS 6.0.

This command is useful if you plan to move the site to a new URL or server, or remove it entirely. The content within the site is unaffected by this command, but the site will be inaccessible to users.

important Important You must be a member of the Administrators group on the local computer to run scripts and executables, or you must have been delegated the appropriate authority. As a security best practice, log on to your computer using an account that is not in the Administrators group, and then use the Run as command to run your script or executable as an administrator. From the command prompt, type runas /user:administrative_accountname "script or executable command".

This topic includes the following information:

  • Syntax: The order in which you type a command and any arguments and options that follow it.
  • Parameters: The values that are given to variables in the command.
  • Examples: Sample code and an explanation of the results.

Syntax

iisweb /delete WebSite [WebSite...] [/s Computer [/u [Domain\]User/p Password]]

Parameters

WebSite
Required. Specifies the site name or metabase path of the Web site. Web sites must be uniquely identified. If more than one Web site has the same descriptive name, you must use the metabase path to identify the Web site.
/s Computer
Runs the script on the specified remote computer. Type the computer name or IP address without backslashes. By default, the script runs on the local computer.
/u [Domain\]User
Runs the script with the permissions of the specified user account. This account must be a member of the Administrators group on the remote computer. By default, the script runs with the permissions of the current user of the local computer.
/p Password
Specifies the password of the user account that is specified in the /u parameter.

Examples

Example 1:

The following example deletes a single Web site configuration on a local computer. The /s parameter is omitted because the local computer is the default setting. The /u and /p parameters are omitted because the current user of the local computer must be logged on as an administrator to run the command.

iisweb /delete "My First Novel"

In response, iisweb displays the following message indicating that the site configuration has been deleted, and identifying the Web site by its metabase path:

Connecting to server ...Done.
Server W3SVC/409413479 has been DELETED.

Example 2:

The following example deletes multiple Web site configurations from a remote computer. The "Finance", "Work Group", and "Logo" Web sites reside on SRV01. The command identifies the first two sites by name and the "Logo" Web site by its metabase path, "W3SVC/79116006". In addition, the command uses the /s parameter to specify the remote computer and the /u and /p parameters to run the commands with the permissions of the user's administrator account.

iisweb /delete Finance "Work Group" W3SVC/79116006 /s SRV01 /u Alice /p p@##word

In response, iisweb displays the following message indicating that the site configurations have been deleted, and identifying each Web site by its metabase path:

Connecting to server ...Done.
Server W3SVC/1977437537 has been DELETED.
Server W3SVC/1509060625 has been DELETED.
Server W3SVC/79116006 has been DELETED.
Related Topics
  • For information on creating Web site configurations, see Creating Web Sites.
  • For information on listing Web site configurations, see Listing Web Sites.
  • For information on starting Web sites, see Starting Web Sites.
  • For information on stopping Web sites, see Stopping Web Sites.
  • For information on pausing Web sites, see Pausing Web Sites.


Starting Web Sites

IIS starts Web sites automatically when they are created, unless the administrator specifically prohibits it with the /dontstart parameter. An administrator might prohibit an automatic start, for example, to allow time for the site to be added to DNS.

An administrator might also pause or stop a Web site for troubleshooting purposes. In cases like these, you can use the command-line script iisweb.vbs, which is stored in systemroot\System32, to start or restart a Web site.

important Important You must be a member of the Administrators group on the local computer to run scripts and executables, or you must have been delegated the appropriate authority. As a security best practice, log on to your computer using an account that is not in the Administrators group, and then use the Run as command to run your script or executable as an administrator. From the command prompt, type runas /user:administrative_accountname "script or executable command".

This topic includes the following information:

  • Syntax: The order in which you type a command and any arguments and options that follow it.
  • Parameters: The values that are given to variables in the command.
  • Examples: Sample code and an explanation of the results.

Syntax

iisweb/start WebSite [WebSite...] [/s Computer [/u [Domain\]User/p Password]]

Parameters

WebSite
Required. Specifies the site name or metabase path of the Web site. Web sites must be uniquely identified. If more than one Web site has the same descriptive name, you must use the metabase path to identify the Web site.
/s Computer
Runs the script on the specified remote computer. Type the computer name or IP address without backslashes. By default, the script runs on the local computer.
/u [Domain\]User
Runs the script with the permissions of the specified user account. This account must be a member of the Administrators group on the remote computer. By default, the script runs with the permissions of the current user of the local computer.
/p Password
Specifies the password of the user account that is specified in the /u parameter.

Examples

Example 1:

The following example starts the "Products" Web site on the local computer. The command identifies the site by its name. In this example, the /s parameter is omitted because the server is local. The /u and /p parameters are omitted because the current user of the local computer must be logged on as an administrator in order to run the command.

iisweb /start Products

In response, iisweb displays the following message confirming that the site has been started, and identifying it by its metabase path:

Connecting to server ...Done.
Server W3SVC/1977437537 has been STARTED.

Example 2:

The following example starts the "Products" and "Marketing" Web sites on the SVR01 remote computer. The command identifies the "Products" site by its metabase path, "W3SVC/1509060225", and the "Marketing" site by name. In addition, the command uses the /s parameter to specify the remote computer, and the /u and /p parameters to run the commands with the permissions of the user's administrator account.

iisweb /start w3svc/1509060225 Marketing /s SVR01 /u Alice /p p@##word

In response, iisweb displays the following message confirming that the sites have been started, and identifying each by its metabase path:

Connecting to server ...Done.
Server W3SVC/1509060225 has been STARTED.
Server W3SVC/1977437537 has been STARTED.
Related Topics
  • For information on creating Web site configurations, see Creating Web Sites.
  • For information on deleting Web site configurations, see Deleting Web Sites.
  • For information on listing Web site configurations, see Listing Web Sites.
  • For information on stopping Web sites, see Stopping Web Sites.


Stopping Web Sites

If your Web site is not behaving properly, or if the site is slow or unresponsive, stopping and restarting the site may clear a temporary problem with the software—for example, a faulty worker process.

In cases like these, you can use the command-line script iisweb.vbs, which is stored in systemroot\System32, to stop a Web site from responding. The content of the site is unchanged, but it will be inaccessible to users until the site is restarted.

important Important You must be a member of the Administrators group on the local computer to run scripts and executables, or you must have been delegated the appropriate authority. As a security best practice, log on to your computer using an account that is not in the Administrators group, and then use the Run as command to run your script or executable as an administrator. From the command prompt, type runas /user:administrative_accountname "script or executable command".

This topic includes the following information:

  • Syntax: The order in which you type a command and any arguments and options that follow it.
  • Parameters: The values that are given to variables in the command.
  • Examples: Sample code and an explanation of the results.

Syntax

iisweb/stop WebSite [WebSite...] [/s Computer [/u [Domain\]User/p Password]]

Parameters

WebSite
Required. Specifies the site name or metabase path of the Web site. Web sites must be uniquely identified. If more than one Web site has the same descriptive name, you must use the metabase path to identify the Web site.
/s Computer
Runs the script on the specified remote computer. Type the computer name or IP address without backslashes. By default, the script runs on the local computer.
/u [Domain\]User
Runs the script with the permissions of the specified user account. This account must be a member of the Administrators group on the remote computer. By default, the script runs with the permissions of the current user of the local computer.
/p Password
Specifies the password of the user account that is specified in the /u parameter.

Examples

Example 1:

The following example stops the "Products" Web site on the local computer. The command identifies the site by its name. In this example, the /s parameter is unnecessary because the server is local. The /u and /p parameters are omitted because the current user of the local computer must be logged on as an administrator in order to run the command.

iisweb /stop Products

In response, iisweb displays the following message confirming that the site has been stopped, and identifying it by its metabase path:

Connecting to server ...Done.
Server W3SVC/1977437537 has been STOPPED.

Example 2:

The following example stops the "Products" and "Marketing" Web sites on the SVR01 remote computer. The command identifies the "Products" site by its metabase path, "W3SVC/1509060225", and the "Marketing" site by name. In addition, the command uses the /s parameter to specify the remote computer, and the /u and /p parameters to run the commands with the permissions of the user's administrator account.

iisweb /stop w3svc/1509060225 Marketing /s SVR01 /u Alice /p p@##word

In response, iisweb displays the following message confirming that the sites have been stopped, and identifying each by its metabase path:

Connecting to server ...Done.
Server W3SVC/1509060225 has been STOPPED.
Server W3SVC/1977437537 has been STOPPED.
Related Topics
  • For information on creating Web site configurations, see Creating Web Sites.
  • For information on deleting Web site configurations, see Deleting Web Sites.
  • For information on listing Web site configurations, see Listing Web Sites.
  • For information on starting Web sites, see Starting Web Sites.
  • For information on pausing Web sites, see Pausing Web Sites.


Pausing Web Sites

Pausing a Web site is similar to stopping it, except that pausing lets existing processes continue to their conclusion. Administrators may want to use this function to troubleshoot situations where stopping the Web site abruptly would result in severe issues for users.

You can use the command-line script iisweb.vbs, which is stored in systemroot\System32, to pause a Web site indefinitely. Pausing prevents Internet services from accepting new connections, but does not affect requests that are already being processed.

important Important You must be a member of the Administrators group on the local computer to run scripts and executables, or you must have been delegated the appropriate authority. As a security best practice, log on to your computer using an account that is not in the Administrators group, and then use the Run as command to run your script or executable as an administrator. From the command prompt, type runas /user:administrative_accountname "script or executable command".

This topic includes the following information:

  • Syntax: The order in which you must type a command and any arguments and options that follow it.
  • Parameters: The values that are given to variables in the command.
  • Examples: Sample code and an explanation of the results.

Syntax

iisweb/pause WebSite [WebSite...] [/s Computer [/u [Domain\]User/p Password]]

Parameters

WebSite
Required. Specifies the site name or metabase path of the Web site. Web sites must be uniquely identified. If more than one Web site has the same descriptive name, you must use the metabase path to identify the Web site.
/s Computer
Runs the script on the specified remote computer. Type the computer name or IP address without backslashes. By default, the script runs on the local computer.
/u [Domain\]User
Runs the script with the permissions of the specified user account. This account must be a member of the Administrators group on the remote computer. By default, the script runs with the permissions of the current user of the local computer.
/p Password
Specifies the password of the user account that is specified in the /u parameter.

Examples

Example 1:

The following example pauses the "Products" Web site on the local computer. The command identifies the site by its name. In this example, the /s parameter is omitted because the server is local. The /u and /p parameters are omitted because the current user of the local computer must be logged on as an administrator in order to run the command.

iisweb /pause Products

In response, iisweb displays the following message confirming that the site has been paused, and identifying it by its metabase path:

Connecting to server ...Done.
Server W3SVC/1977437537 has been PAUSED.

Example 2:

The following example pauses the "Products" and "Marketing" Web sites on the SVR01 remote computer. The command identifies the "Products" site by its metabase path, "W3SVC/1509060225", and the "Marketing" site by name. In addition, the command uses the /s parameter to specify the remote computer, and the /u and /p parameters to run the commands with the permissions of the user's administrator account.

iisweb /pause w3svc/1509060225 Marketing /s SVR01 /u Alice /p p@##word

In response, iisweb displays the following message confirming that the sites have been paused, and identifying each by its metabase path:

Connecting to server ...Done.
Server W3SVC/1509060225 has been PAUSED.
Server W3SVC/1977437537 has been PAUSED.
Related Topics
  • For information on creating Web site configurations, see Creating Web Sites.
  • For information on deleting Web site configurations, see Deleting Web Sites.
  • For information on listing Web site configurations, see Listing Web Sites.
  • For information on starting Web sites, see Starting Web Sites.
  • For information on stopping Web sites, see Stopping Web Sites.


Listing Web Sites

Administrators frequently need to check the status and/or properties of their Web sites. To check the status of your Web site, you can use the command-line script iisweb.vbs, which is stored in systemroot\System32, to query or list Web sites on remote or local computers.

important Important You must be a member of the Administrators group on the local computer to run scripts and executables, or you must have been delegated the appropriate authority. As a security best practice, log on to your computer using an account that is not in the Administrators group, and then use the Run as command to run your script or executable as an administrator. From the command prompt, type runas /user:administrative_accountname "script or executable command".

This topic includes the following information:

  • Syntax: The order in which you type a command and any arguments and options that follow it.
  • Parameters: The values that are given to variables in the command.
  • Examples: Sample code and an explanation of the results.

Syntax

iisweb/query [WebSite [WebSite...]] [/s Computer [/u [Domain\]User/p Password]]

Parameters

WebSite
Limits the query to the specified Web site. Type the name or metabase path of the Web site. The default displays all of the Web sites on the IIS server. Web sites must be uniquely identified. If more than one Web site has the same descriptive name, you must use the metabase path to identify the Web site.
/s Computer
Runs the script on the specified remote computer. Type the computer name or IP address without backslashes. By default, the script runs on the local computer.
/u [Domain\]User
Runs the script with the permissions of the specified user account. This account must be a member of the Administrators group on the remote computer. By default, the script runs with the permissions of the current user of the local computer.
/p Password
Specifies the password of the user account that is specified in the /u parameter.

note Note The query output includes the site name, metabase path, and the IP address, or All to indicate all unassigned addresses.

Examples

Example 1:

The following example displays the Web sites on the local computer. Omitting the WebSite parameter limits the search to the local computer, eliminating the need for the /s parameter. The /u and /p parameters are omitted because the user running the command prompt must be logged on as an administrator for the local machine.

iisweb /query

In response, iisweb displays all of the IIS Web sites that are on the local computer, including their site names, metabase paths, status, IP addresses, ports, and host names.

Site Name (Metabase Path)           Status  IP              Port  Host
=============================================================================
Default Web Site (W3SVC/1)          STARTED ALL             90    N/A
Products (W3SVC/1948497947)         STARTED 172.30.163.244  80    N/A
Finance (W3SVC/1211348328)          STARTED 172.30.152.249  80    N/A
Marketing (W3SVC/1907510956)        STARTED ALL             95    www.reskit.com

Example 2:

The following example searches for the "Marketing" Web site on the remote computer SVR01. It uses the /s parameter to specify the remote computer, and the /u and /p parameters to run the script with the permissions of the user's administrator account.

iisweb /query Marketing /s SVR01 /u Admin6 /p A76QVJ32#

In response, iisweb displays the "Marketing" Web site on SVR01.

Site Name (Metabase Path)           Status  IP              Port  Host
=============================================================================
Marketing (W3SVC/1907510956)        STOPPED ALL             80   www.reskit.com

Example 3:

The following example displays the status of the "Marketing" and "Finance" Web sites on the local computer. It uses site names to identify the Web sites, although metabase paths are also valid.

iisweb /query Marketing Finance

In response, iisweb displays the status of the "Marketing" and "Finance" Web sites.

Site Name (Metabase Path)           Status  IP              Port  Host
==============================================================================
Marketing (W3SVC/1907510956)        STARTED ALL             80    www.reskit.com
Finance (W3SVC/1509060625)          STARTED 192.168.125.225 80    www.rkfinance.com
Related Topics
  • For information on creating Web site configurations, see Creating Web Sites.
  • For information on deleting Web site configurations, see Deleting Web Sites.
  • For information on starting Web sites, see Starting Web Sites.
  • For information on stopping Web sites, see Stopping Web Sites.
  • For information on pausing Web sites, see Pausing Web Sites.


Managing FTP Sites

You can use the command-line script iisftp.vbs, which is stored in systemroot\System32, to create and manage File Transfer Protocol (FTP) sites on computers running a member of the Microsoft® Windows® Server 2003 family with Internet Information Services (IIS) 6.0.

Iisftp.vbs performs some of the same operations that are available in IIS Manager. You can use either tool to administer IIS FTP sites.

This section includes the following information:

  • Creating FTP Sites: Describes how to create and isolate FTP sites on local or remote computers by using iisftp.vbs.
  • Deleting FTP Sites: Describes how to delete FTP sites on local or remote computers by using iisftp.vbs.
  • Starting FTP Sites: Describes how to start FTP sites on local or remote computers by using iisftp.vbs.
  • Stopping FTP Sites: Describes how to stop FTP sites on local or remote computers by using iisftp.vbs.
  • Pausing FTP Sites: Describes how to pause FTP sites on local or remote computers by using iisftp.vbs.
  • Listing FTP Sites: Describes how to list FTP sites on local or remote computers by using iisftp.vbs.
  • Setting Active Directory User Isolation: Describes how to get and set user isolation on local or remote computers by using iisftp.vbs.


Creating FTP Sites

You can use the command-line script iisftp.vbs, which is stored in systemroot\System32, to create File Transfer Protocol (FTP) site configurations on local or remote computers running a member of the Windows Server 2003 family with IIS 6.0. This command does not create or destroy content, but it sets up the directory structure and IIS configuration files.

When you use iisftp.vbs to create a new FTP site, you specify only the basic properties that are needed to create the site and identify its contents. Iisftp.vbs uses the same default properties that IIS Manager uses when establishing new FTP sites, and it adheres to the same rules for inheriting properties. To configure the more advanced properties of the FTP site, use IIS Manager.

important Important You must be a member of the Administrators group on the local computer to perform the following procedure (or procedures), or you must have been delegated the appropriate authority. As a security best practice, log on to your computer using an account that is not in the Administrators group, and then use the Run as command to run IIS Manager as an administrator. From the command prompt, type runas /user:administrative_accountname "mmc %systemroot%\system32\inetsrv\iis.msc".

This topic includes the following information:

  • Syntax: The order in which you type a command and any arguments and options that follow it.
  • Parameters: The values that are given to variables in the command.
  • Examples: Sample code and an explanation of the results.

Syntax

iisftp /create Path SiteName [/b Port] [/i IPAddress] [/dontstart] [/isolation {AD|Local} [/domain DomainName /Admin [Domain\]User /AdminPwd Password]] [/s Computer [/u [Domain\]User/p Password]]

Parameters

Path
Specifies the location of content files for the FTP site. The path must be local, such as C:\Projects\HTML. If the specified path does not exist, then iisftp.vbs creates the path.

The Path parameter must immediately precede the SiteName parameter in the command. Otherwise, iisftp.vbs does not interpret the site information correctly.

SiteName
Required. Specifies a name for the FTP site.
/b Port
Specifies a TCP port number for the FTP site. Port 21 is the default.
/i IPAddress
Specifies an IP address for the FTP site. The default is All Unassigned, which assigns to the site all of the IP addresses on the computer that are not assigned to other sites. Only one site on each IIS server can be set to All Unassigned.
/dontstart
Indicates that the FTP site should not be started automatically as soon as it is created, which is contrary to the IIS default.
/isolation {AD|Local}
Provides for one of two user isolation modes, AD (Active Directory) and Local. If the /isolation switch is not present, the site will not use user isolation.
/domain DomainName
Only valid when the /isolation switch is set to AD. This value is the name of the Active Directory domain.
/Admin [Domain\]User
Only valid when the /isolation switch is set to AD. This value is the name of the administrator in the user, domain\user, or user@domain format.
/AdminPwd Password
Only valid when the /isolation switch is set to AD.This value is the administrator's password.
/s Computer
Runs the script on the specified remote computer. Type the computer name or IP address without backslashes. The default is the local computer.
/u [Domain\]User
Runs the script with the permissions of the specified user account. This account must be a member of the Administrators group on the remote computer. By default, the script runs with the permissions of the current user of the local computer.
/p Password
Specifies the password of the user account that is specified in the /u parameter.

note Note Iisftp.vbs does not verify the port number or IP address of an FTP site, and it does not verify that these bindings are unique within the server. If you create a site with invalid or conflicting bindings, the site will not start.

Example 1

The following example creates the "Archive" FTP site on the local computer, and associates it with content in the D:\Public\Archives directory. The command omits all optional parameters and accepts the default values. The "Archives" subdirectory does not exist, so iisftp.vbs will create it in the "Public" directory.

iisftp /create D:\Public\Archives Archive

In response, iisftp displays the following message along with the basic properties of the new FTP site. In this example, "Server" represents the machine name where drive D: is found, "Site Name" is the name you assigned to your FTP site, "Metabase Path" represents the metabase key assigned by IIS and is analogous to a registry key in the system registry, "IP" is unassigned by default, "Port" is set to 21 by default, "Root" is the directory where the FTP files reside, and "Status" is set to "STARTED" by default.

Connecting to server ...Done.
Server        = RESKIT
Site Name     = Archive
Metabase Path = MSFTPSVC/1452008083
IP            = ALL UNASSIGNED
Port          = 21
Root          = D:\Public\Archives
Status        = STARTED

Example 2

The following example creates the "Drivers" FTP site configuration on a remote server. It associates the site with files stored in the C:\Public\Download directory on SVR16. The command uses the /i parameter to specify an IP address for the site and the /dontstart parameter to prevent the site from starting automatically. It uses the /s parameter to specify the remote computer, and the /u and /p parameters to run the script with the permissions of the user's administrator account.

iisftp /create C:\Public\Download Drivers /i 172.31.69.150 /dontstart /s SVR16 /u Admin6 /p p@ssWor#

In response, iisftp displays the following message along with the basic properties of the new FTP site. In this example, "Server" represents the server machine, "Site Name" is the name you assigned to your FTP site name, "Metabase Path" represents the metabase key assigned by IIS and is analogous to a registry key in the system registry, "IP" represents the assigned DNS address, "Port" is set to 21 by default, "Root" is the directory where the FTP files reside, and "Status" is set to "STOPPED" as directed.

Connecting to server ...Done.
Server        = SVR16
Site Name     = Drivers
Metabase Path = MSFTPSVC/1932955329
IP            = 172.31.69.150
Port          = 21
Root          = C:\Public\Download
Status        = STOPPED
Related Topics
  • For information on deleting FTP configurations, see Deleting FTP Sites.
  • For information on starting FTP sites, see Starting FTP Sites.
  • For information on stopping FTP sites, see Stopping FTP Sites.
  • For information on pausing FTP sites, see Pausing FTP Sites.
  • For information on listing FTP sites, see Listing FTP Sites.
  • For information on setting user isolation, see Setting Active Directory User Isolation.


Deleting FTP Sites

You can use the command-line script iisftp.vbs, which is stored in systemroot\System32\, to delete IIS File Transfer Protocol (FTP) site configurations on local or remote computers running a member of the Windows Server 2003 family with IIS 6.0.

This command is useful if you plan to move the site to a new URL or server, or if you intend to remove it entirely. The content within the site is unaffected by this command, but the site will be inaccessible to users.

important Important You must be a member of the Administrators group on the local computer to run scripts and executables, or you must have been delegated the appropriate authority. As a security best practice, log on to your computer using an account that is not in the Administrators group, and then use the Run as command to run your script or executable as an administrator. From the command prompt, type runas /user:administrative_accountname "script or executable command".

This topic includes the following information:

  • Syntax: The order in which you type a command and any arguments and options that follow it.
  • Parameters: The values that are given to variables in the command.
  • Examples: Sample code and an explanation of the results.

Syntax

iisftp /delete FTPSite [FTPSite...] [/s Computer [/u [Domain\]User/p Password]]

Parameters

FTPSite
Required. Specifies the site name or metabase path of the FTP site. FTP sites must be uniquely identified. If more than one FTP site has the same descriptive name, you must use the metabase path to identify the FTP site.
/s Computer
Runs the script on the specified remote computer. Type the computer name or IP address without backslashes. By default, the script runs on the local computer.
/u [Domain\]User
Runs the script with the permissions of the specified user account. This account must be a member of the Administrators group on the remote computer. By default, the script runs with the permissions of the current user of the local computer.
/p Password
Specifies the password of the user account that is specified in the /u parameter.

Examples

Example 1:

The following example deletes a single FTP site configuration on a local computer. The content of the "Downloads" FTP site remains unchanged, but will be unavailable to users. The /s parameter is omitted because the local computer is the default setting. The /u and /p parameters are omitted because the current user of the local computer must be logged on as an administrator to run the command.

iisftp /delete Downloads

In response, iisftp displays the following message indicating that the site configuration has been deleted, and identifying the FTP site by its metabase path. The metabase path is the IIS equivalent of an entry in the system registry.

Connecting to server ...Done.
Server MSFTPSVC/2109607139 has been DELETED.

Example 2

The following example deletes multiple FTP site configurations from a remote computer. The "Downloads", "Drivers", and "Library" FTP sites reside on SVR01. The command identifies the first two sites by name and the "Logo" FTP site by its metabase path, "MSFTPSVC/1932955329". In addition, the command uses the /s parameter to specify the remote computer and the /u and /p parameters to run the commands with the permissions of the user's administrator account.

iisftp /delete Downloads Drivers MSFTPSVC/2109607139 /s Svr01 /u Tom /p p@##word

In response, iisftp displays the following message indicating that the site configurations have been deleted, and identifying each FTP site by its metabase path.

Connecting to server ...Done.
Server MSFTPSVC/2109607139 has been DELETED.
Server MSFTPSVC/1879143292 has been DELETED.
Server MSFTPSVC/1932955329 has been DELETED.
Related Topics
  • For information on creating FTP configurations, see Creating FTP Sites.
  • For information on starting FTP sites, see Starting FTP Sites.
  • For information on stopping FTP sites, see Stopping FTP Sites.
  • For information on pausing FTP sites, see Pausing FTP Sites.
  • For information on listing FTP sites, see Listing FTP Sites.
  • For information on setting user isolation, see Setting Active Directory User Isolation.


Starting FTP Sites

IIS starts File Transfer Protocol (FTP) sites automatically when they are created, unless the administrator specifically prohibits it with the /dontstart parameter. An administrator might prohibit an automatic start, for example, to allow time for the site to be added to DNS.

An administrator might also pause or stop an FTP site for troubleshooting purposes. In cases like these, you can use the command-line script iisftp.vbs, which is stored in systemroot\System32, to start or restart an FTP site.

important Important You must be a member of the Administrators group on the local computer to run scripts and executables, or you must have been delegated the appropriate authority. As a security best practice, log on to your computer using an account that is not in the Administrators group, and then use the Run as command to run your script or executable as an administrator. From the command prompt, type runas /user:administrative_accountname "script or executable command".

This topic includes the following information:

  • Syntax: The order in which you type a command and any arguments and options that follow it.
  • Parameters: The values that are given to variables in the command.
  • Examples: Sample code and an explanation of the results.

Syntax

iisftp/start FTPSite [FTPSite...] [/s Computer [/u [Domain\]User/p Password]]

Parameters

FTPSite
Required. Specifies the site name or metabase path of the FTP site. FTP sites must be uniquely identified. If more than one FTP site has the same descriptive name, you must use the metabase path to identify the FTP site.
/s Computer
Runs the script on the specified remote computer. Type the computer name or IP address without backslashes. By default, the script runs on the local computer.
/u [Domain\]User
Runs the script with the permissions of the specified user account. This account must be a member of the Administrators group on the remote computer. By default, the script runs with the permissions of the current user of the local computer.
/p Password
Specifies the password of the user account that is specified in the /u parameter.

Examples

Example 1:

The following example starts the "Products" FTP site on the local computer. The command identifies the site by its name. In this example, the /s parameter is omitted because the server is local. The /u and /p parameters are omitted because the current user of the local computer must be logged on as an administrator in order to run the command.

iisftp /start Products

In response, iisftp displays the following message confirming that the site has been started, and identifying it by its metabase path. The metabase path is the IIS equivalent of an entry in the system registry.

Connecting to server ...Done.
Server MSFTPSVC/1452008085 has been STARTED.

Example 2:

The following example starts the "Products" and "Marketing" FTP sites on the SVR01 remote computer. The command identifies the "Products" site by its metabase path, "MSFTPSVC/1452008085", and the "Marketing" site by name. In addition, the command uses the /s parameter to specify the remote computer, and the /u and /p parameters to run the commands with the permissions of the user's administrator account.

iisftp /start MSFTPSVC/1452008085 Marketing /s SVR01 /u Jim /p p@##word

In response, iisftp displays the following message, confirming that the sites have been started, and identifying each site by its metabase path:

Connecting to server ...Done.
Server MSFTPSVC/1452008085 has been STARTED.
Server MSFTPSVC/1879143292 has been STARTED.
Related Topics
  • For information on creating FTP configurations, see Creating FTP Sites.
  • For information on creating FTP configurations, see Creating FTP Sites.
  • For information on deleting FTP configurations, see Deleting FTP Sites.
  • For information on stopping FTP sites, see Stopping FTP Sites.
  • For information on listing FTP sites, see Listing FTP Sites.
  • For information on setting user isolation, see Setting Active Directory User Isolation.


Stopping FTP Sites

If your File Transfer Protocol (FTP) site is not behaving properly, or if the site is slow or unresponsive, stopping and restarting the site may clear a temporary problem with the software—for example, a faulty worker process.

In cases like these, you can use the command-line script iisftp.vbs, which is stored in systemroot\System32, to stop an FTP site from responding. The content of the site is unchanged, but it will be inaccessible to users until the site is restarted.

important Important You must be a member of the Administrators group on the local computer to run scripts and executables, or you must have been delegated the appropriate authority. As a security best practice, log on to your computer using an account that is not in the Administrators group, and then use the Run as command to run your script or executable as an administrator. From the command prompt, type runas /user:administrative_accountname "script or executable command".

This topic includes the following information:

  • Syntax: The order in which you type a command and any arguments and options that follow it.
  • Parameters: The values that are given to variables in the command.
  • Examples: Sample code and an explanation of the results.

Syntax

iisftp/stop FTPSite [FTPSite...] [/s Computer [/u [Domain\]User/p Password]]

Parameters

FTPSite
Required. Specifies the site name or metabase path of the FTP site. FTP sites must be uniquely identified. If more than one FTP site has the same descriptive name, you must use the metabase path to identify the FTP site.
/s Computer
Runs the script on the specified remote computer. Type the computer name or IP address without backslashes. By default, the script runs on the local computer.
/u [Domain\]User
Runs the script with the permissions of the specified user account. This account must be a member of the Administrators group on the remote computer. By default, the script runs with the permissions of the current user of the local computer.
/p Password
Specifies the password of the user account that is specified in the /u parameter.

Examples

Example 1:

The following example stops the "Drivers" FTP site on the local computer. The command identifies the site by its name. In this example, the /s parameter is omitted because the server is local. The /u and /p parameters are omitted because the current user of the local computer must be logged on as an administrator in order to run the command.

iisftp /stop Drivers

In response, iisftp displays the following message confirming that the site has been stopped, and identifying the site by its metabase path. The metabase path is the IIS equivalent of an entry in the system registry.

Connecting to server ...Done.
Server MSFTPSVC/1879143292 has been STOPPED.

Example 2:

The following example stops the "Downloads" and "Drivers" FTP sites on the SVR01 remote computer. The command identifies the "Downloads" site by its metabase path, "MSFTPSVC/2109607139", and the "Drivers" site by name. In addition, the command uses the /s parameter to specify the remote computer, and the /u and /p parameters to run the commands with the permissions of the user's administrator account.

iisftp /stop MSFTPSVC/2109607139 Drivers /s SVR01 /u Tom /p p###word

In response, iisftp displays the following message confirming that the sites have been stopped, and identifying each site by its metabase path:

Connecting to server ...Done.
Server MSFTPSVC/2109607139 has been STOPPED.
Server MSFTPSVC/1879143292 has been STOPPED.
Related Topics
  • For information on creating FTP configurations, see Creating FTP Sites.
  • For information on deleting FTP configurations, see Deleting FTP Sites.
  • For information on starting FTP sites, see Starting FTP Sites.
  • For information on pausing FTP sites, see Pausing FTP Sites.
  • For information on listing FTP sites, see Listing FTP Sites.
  • For information on setting user isolation, see Setting Active Directory User Isolation.


Pausing FTP Sites

Pausing a File Transfer Protocol (FTP) site is similar to stopping it, except that pausing the FTP site lets existing processes continue to their conclusion. Administrators may want to use this function to troubleshoot situations where stopping the FTP site abruptly would result in severe issues for users.

You can use the command-line script iisftp.vbs, which is stored in systemroot\System32, to pause a Web site indefinitely. Pausing prevents FTP services from accepting new connections, but it does not affect requests that are already being processed.

important Important You must be a member of the Administrators group on the local computer to run scripts and executables, or you must have been delegated the appropriate authority. As a security best practice, log on to your computer using an account that is not in the Administrators group, and then use the Run as command to run your script or executable as an administrator. From the command prompt, type runas /user:administrative_accountname "script or executable command".

This topic includes the following information:

  • Syntax: The order in which you must a command and any arguments and options that follow it.
  • Parameters: The values that are given to variables in the command.
  • Examples: Sample code and an explanation of the results.

Syntax

iisftp/pause FTPSite [FTPSite...] [/s Computer [/u [Domain\]User/p Password]]

Parameters

FTPSite
Required. Specifies the site name or metabase path of the FTP site. FTP sites must be uniquely identified. If more than one FTP site has the same descriptive name, you must use the metabase path to identify the FTP site.
/s Computer
Runs the script on the specified remote computer. Type the computer name or IP address without backslashes. By default, the script runs on the local computer.
/u [Domain\]User
Runs the script with the permissions of the specified user account. This account must be a member of the Administrators group on the remote computer. By default, the script runs with the permissions of the current user of the local computer.
/p Password
Specifies the password of the user account that is specified in the /u parameter.

Examples

Example 1:

The following example pauses the "Drivers" FTP site on the local computer. The command identifies the site by its name. In this example, the /s parameter is omitted because the server is local. The /u and /p parameters are omitted because the current user of the local computer must be logged on as an administrator in order to run the command.

iisftp /pause Drivers

In response, iisftp displays the following message confirming that the site has been paused, and identifying the site by its metabase path. The metabase path is the IIS equivalent of an entry in the system registry.

Connecting to server ...Done.
Server MSFTPSVC/1879143292 has been PAUSED.

Example 2:

The following example pauses the "Downloads" and "Drivers" FTP sites on the SVR01 remote computer. The command identifies the "Downloads" site by its metabase path, "MSFTPSVC/2109607139", and the "Drivers" site by name. In addition, the command uses the /s parameter to specify the remote computer, and it uses the /u and /p parameters to run the commands with the permissions of the user's administrator account.

iisftp /pause MSFTPSVC/2109607139 Drivers /s SVR01 /u Tom /p pa##word

In response, iisftp displays the following message confirming that the sites have been paused, and identifying each site by its metabase path:

Connecting to server ...Done.
Server MSFTPSVC/2109607139 has been PAUSED.
Server MSFTPSVC/1879143292 has been PAUSED.
Related Topics
  • For information on creating FTP configurations, see Creating FTP Sites.
  • For information on deleting FTP configurations, see Deleting FTP Sites.
  • For information on starting FTP sites, see Starting FTP Sites.
  • For information on stopping FTP sites, see Stopping FTP Sites.
  • For information on listing FTP sites, see Listing FTP Sites.
  • For information on setting user isolation, see Setting Active Directory User Isolation.


Listing FTP Sites

Administrators frequently need to check the status and/or properties of their File Transfer Protocol (FTP) sites. To check the status of your site, you can use the command-line script iisftp.vbs, which is stored in systemroot\System32, to query or list FTP sites on remote or local computers.

important Important You must be a member of the Administrators group on the local computer to run scripts and executables, or you must have been delegated the appropriate authority. As a security best practice, log on to your computer using an account that is not in the Administrators group, and then use the Run as command to run your script or executable as an administrator. From the command prompt, type runas /user:administrative_accountname "script or executable command".

This topic includes the following information:

  • Syntax: The order in which you type a command and any arguments and options that follow it.
  • Parameters: The values that are given to variables in the command.
  • Examples: Sample code and an explanation of the results.

Syntax

iisftp/query [FTPSite [FTPSite...]] [/s Computer [/u [Domain\]User/p password]]

Parameters

FTPSite
Required. Specifies the site name or metabase path of the FTP site. FTP sites must be uniquely identified. If more than one FTP site has the same descriptive name, you must use the metabase path to identify the FTP site.
/s Computer
Runs the script on the specified remote computer. Type the computer name or IP address without backslashes. By default, the script runs on the local computer.
/u [Domain\]User
Runs the script with the permissions of the specified user account. This account must be a member of the Administrators group on the remote computer. By default, the script runs with the permissions of the current user of the local computer.
/p Password
Specifies the password of the user account that is specified in the /u parameter.

note Note The query output includes the site name, metabase path, port, status, and the IP address, or All to indicate all unassigned addresses.

Examples

Example 1:

The following example displays the FTP sites that are on the local computer. Omitting the FTPSite parameter limits the search to the local computer, eliminating the need for the /s parameter. The /u and /p parameters are omitted because the user running the command prompt must be logged on as an administrator for the local machine.

iisftp /query

In response, iisftp displays all of the IIS FTP sites that are on the local computer, including site names, metabase paths, status, IP addresses, and ports.

Connecting to server ...Done.
Site Name (Metabase Path)           Status    IP              Port
==============================================================================
Default FTP Site (MSFTPSVC/1)       STARTED   ALL             21
My Site (MSFTPSVC/858812021)        STOPPED   ALL             21
Drivers (MSFTPSVC/1932955329)       STARTED   172.30.163.249  21
Downloads (MSFTPSVC/1879143292)     STARTED   ALL             25
Library (MSFTPSVC/2109607139)       STARTED   172.30.163.126  21

Example 2:

The following example searches for the "Download" FTP site on the remote computer, SVR01. It uses the /s parameter to specify the remote computer, as well as the /u and /p parameters to run the script with the permissions of the user's administrator account.

iisftp /query Download /s SVR01 /u Admin6 /p A76QVJ32#

In response, iisftp displays the "Download" FTP site on SVR01.

Site Name (Metabase Path)           Status     IP           Port
=================================================================
Downloads (MSFTPSVC/1879143292)     STARTED   ALL            25

Example 3:

The following example displays the status of the "Downloads" and "Drivers" FTP sites on the local computer. It uses site names to identify the FTP sites, although metabase paths are also valid.

iisftp /query Downloads Drivers

In response, iisftp displays the status of the "Downloads" and "Drivers" FTP sites.

Site Name (Metabase Path)           Status    IP             Port
=================================================================
Downloads (MSFTPSVC/1879143292)     STARTED   ALL             25
Drivers (MSFTPSVC/1932955329)       STARTED   172.30.163.249  21
Related Topics
  • For information on creating FTP configurations, see Creating FTP Sites.
  • For information on deleting FTP configurations, see Deleting FTP Sites.
  • For information on starting FTP sites, see Starting FTP Sites.
  • For information on stopping FTP sites, see Stopping FTP Sites.
  • For information on pausing FTP sites, see Pausing FTP Sites.
  • For information on setting user isolation, see Setting Active Directory User Isolation.


Setting Active Directory User Isolation

You can use the command-line script iisftp.vbs, which is stored in systemroot\System32, to query and set Active Directory® directory service properties for a user's File Transfer Protocol (FTP) home directory. For more information on user isolation, see Isolating FTP Users.

important Important You must be a member of the Administrators group on the local computer to run scripts and executables, or you must have been delegated the appropriate authority. As a security best practice, log on to your computer using an account that is not in the Administrators group, and then use the Run as command to run your script or executable as an administrator. From the command prompt, type runas /user:administrative_accountname "script or executable command".

This topic includes the following information:

  • Syntax: The order in which you type a command and any arguments and options that follow it.
  • Parameters: The values that are given to variables in the command.
  • Examples: Sample code and an explanation of the results.

Syntax

iisftp /GetADProp UserID [/s Computer [/u [Domain\]User /p Password]]
iisftp /SetADProp UserID {FTPDir|FTPRoot} PropertyValue [/s Computer [/u [Domain\]User/p Password]]

Parameters

/GetADProp
Returns property values for a specific Active Directory user.
/SetADProp
Sets the property values for a specific Active Directory user.
UserID
Required. Specifies the logon ID of the Active Directory user.
FTPDir|FTPRoot
Required to set the home directory properties. Specifies isolation at either the directory or root level.
PropertyValue
Required to set the home directory properties. Specifies the value of the home directory and relative path.
/s Computer
Specifies the name or IP address of a remote computer (with no backslashes). The default is the local computer.
/u [Domain\]User
Connects to the Active Directory with the permissions of the specified user account in the user or domain\user format. This account must be a member of the Administrators group on the remote computer. By default, the script runs with the permissions of the current user of the local computer.
/p Password
Specifies the password of the user account that is specified in the /u parameter.

Examples

Example 1:

The following example returns the Active Directory properties of user "BSmith" on the local computer:

iisftp /GetADProp BSmith

In response, iisftp displays the following message, which is followed by the Active Directory properties for BSmith in the default domain. In this example, "Server" represents the machine name where drive D: is found, "Site Name" is the name you assigned to the FTP site, "Metabase Path" represents the metabase key assigned by IIS, "IP" is unassigned by default, "Port" is set to 21 by default, "Root" is the directory where the FTP files reside, "IsoMode" is set to "FTPRoot", and "Status" is set to "STARTED" by default.

Connecting to server ...Done.
Server        = FTPServer
Site Name     = Smittys
Metabase Path = MSFTPSVC/1452008083
IP            = ALL UNASSIGNED
Port          = 21
Root          = D:\Public\Archives
IsoMode       = FTPRoot
Status        = STARTED

Example 2:

The following example sets the home directory properties in the Active Directory User object properties for user "Sales\MJones" on a remote computer:

iisftp /SetADProp Sales\MJones FTPDir MikesDir /s SVR16 /u Sales\Admin6 /p p@ssWor#

In response, iisftp displays the following message, which includes the Active Directory properties for MJones. In this example, "Server" represents the machine name where drive D: is found, "Site Name" is the name you assigned to the FTP site, "Metabase Path" represents the metabase key assigned by IIS, "IP" is unassigned by default, "Port" is set to 21 by default, "Root" is the directory where the FTP files reside, "IsoMode" is set to "FTPDir", and "Status" is set to "STARTED" by default.

Connecting to server ...Done.
Server        = SVR16
Site Name     = MikesDir
Metabase Path = MSFTPSVC/1452004045
IP            = ALL UNASSIGNED
Port          = 21
Root          = D:\Public\Archives
IsoMode       = FTPDir
Status        = STARTED
Related Topics
  • For information on creating FTP configurations, see Creating FTP Sites.
  • For information on deleting FTP configurations, see Deleting FTP Sites.
  • For information on starting FTP sites, see Starting FTP Sites.
  • For information on stopping FTP sites, see Stopping FTP Sites.
  • For information on pausing FTP sites, see Pausing FTP Sites.
  • For information on listing FTP sites, see Listing FTP Sites.


Managing Web Virtual Directories

You can use the command-line script iisvdir.vbs, which is stored in systemroot\System32 to create, delete, and list Web virtual directories on computers running a member of the Microsoft® Windows® Server 2003 family with Internet Information Services (IIS) 6.0.

Iisvdir.vbs performs some of the same operations that are available in IIS Manager. You can use either tool to administer IIS Web virtual directories.

This section includes the following information:

  • Creating Web Virtual Directories: Describes how to create Web virtual directories on local or remote computers by using iisvdir.vbs.
  • Deleting Web Virtual Directories: Describes how to delete Web virtual directories on local or remote computers by using iisvdir.vbs.
  • Listing Web Virtual Directories: Describes how to list Web virtual directories on local or remote computers by using iisvdir.vbs.


Creating Web Virtual Directories

You can use the command-line script iisvdir.vbs, which is stored in systemroot\System32, to create a new Web virtual directory on local or remote computers running a member of the Windows Server 2003 family with IIS 6.0. This command does not create or destroy content, but it sets up the virtual directory structure and IIS configuration files.

When you use iisvdir.vbs to create a new Web virtual directory, you specify only the basic properties that are needed to create the site and identify its contents. Iisvdir.vbs uses the same default properties that IIS Manager uses when establishing new virtual directories, and it adheres to the same rules for inheriting properties. To configure the more advanced properties of the virtual directory, use IIS Manager.

important Important You must be a member of the Administrators group on the local computer to run scripts and executables, or you must have been delegated the appropriate authority. As a security best practice, log on to your computer using an account that is not in the Administrators group, and then use the Run as command to run your script or executable as an administrator. From the command prompt, type runas /user:administrative_accountname "script or executable command".

This topic includes the following information:

  • Syntax: The order in which you type a command and any arguments and options that follow it.
  • Parameters: The values that are given to variables in the command.
  • Examples: Sample code and an explanation of the results.

Syntax

iisvdir /create WebSite[/VirtualPath] Name PhysicalPath [/s Computer [/u [Domain\]User /p Password]]

Parameters

WebSite
Required. Specifies the descriptive name, or the metabase path, of the Web site.
VirtualPath
SSpecifies a path, if necessary, to the virtual directory within the Web site. This parameter is required when the virtual directory is not located at the root of the Web site.
Name
Required. Specifies a name for the virtual directory. Virtual directory names do not have to be unique. However, when a Web site includes a virtual directory and a physical directory with the same name, the physical directory will not be visible on the Internet.
PhysicalPath
Specifies a physical directory where the content for the virtual directory resides. You must specify a path on the local computer, such as C:\Project\HTML. If the specified directory does not exist, iisvdir will create it.
/s Computer
Runs the script on the specified remote computer. Type the computer name or IP address without backslashes. The default is the local computer.
/u [Domain\]User
Runs the script with the permissions of the specified user account. This account must be a member of the Administrators group on the remote computer. By default, the script runs with the permissions of the current user of the local computer.
/p Password
Specifies the password of the user account that is specified in the /u parameter.

note Note The WebSite (or WebSite/VirtualPath), Name, and PhysicalPath parameters must always appear in the specified order on the command line. Otherwise, iisvdir.vbs does not interpret the information correctly.

Examples

Example 1:

The following example creates the "Insurance" virtual directory at the root of the "Finance" Web site on the local computer. It associates the directory with content that is currently stored in the C:\Projects\Insurance\HTML directory.

iisvdir /create Finance Insurance c:\projects\insurance\html

In response, iisvdir displays the following success message along with the basic properties of the new virtual directory. In this example, "Virtual Path" reflects the virtual directory structure, "ROOT" represents the physical directory where the content resides, and "Metabase Path" represents the metabase key that is assigned by IIS.

Connecting to server ...Done.
Virtual Path  = Finance/Insurance
ROOT          = c:\projects\insurance\html
Metabase Path = W3SVC/1509060625/ROOT/Insurance

Example 2:

The following example creates the "Updates" virtual subdirectory on the "Finance" Web site on the remote computer. The command uses the metabase path of the "Finance" Web site, "W3SVC/1509060625", to identify the Web site, and it indicates the virtual path, "Finance/Insurance", by appending it to the Web site name. In addition, the command associates the "Updates" directory with content that is stored in C:\Newstuff\Web on the remote computer.

The example also uses the /s parameter to identify the remote computer, as well as the /u and /p parameters to run iisvdir.vbs with the permissions of the user's administrator account.

iisvdir /create W3SVC/1509060625/Insurance Updates C:\Newstuff\Web /s SVR01 /u Admin01 /p p@SSw#rD2

In response, iisvdir displays the basic properties of the new Web site.

Connecting to server ...
Virtual Path  = Finance/Insurance/Updates
ROOT          = C:\Newstuff\Web
Metabase Path = W3SVC/1509060625/ROOT/Insurance/Updates
Related Topics
  • For information on deleting Web virtual directories, see Deleting Web Virtual Directories.
  • For information on Listing Web virtual directories, see Listing Web Virtual Directories.


Deleting Web Virtual Directories

You can use the command-line script iisvdir.vbs, which is stored in systemroot\System32, to delete a virtual directory on local or remote computers running a member of the Windows Server 2003 family with IIS 6.0. This command does not create or destroy content, but simply deletes the virtual directory structure.

You should not use this command to delete Web sites, as the sites may still be listed, but partially disabled. To delete a Web site, use iisweb.vbs

important Important You must be a member of the Administrators group on the local computer to run scripts and executables, or you must have been delegated the appropriate authority. As a security best practice, log on to your computer using an account that is not in the Administrators group, and then use the Run as command to run your script or executable as an administrator. From the command prompt, type runas /user:administrative_accountname "script or executable command".

This topic includes the following information:

  • Syntax: The order in which you type a command and any arguments and options that follow it.
  • Parameters: The values that are given to variables in the command.
  • Examples: Sample code and an explanation of the results.

Syntax

iisvdir /delete WebSite[/VirtualPath] Name [/s Computer [/u [Domain\]User/p Password]]

Parameters

WebSite
Required. Specifies the descriptive name, or the metabase path, of the Web site.
VirtualPath
Specifies a path, if necessary, to the virtual directory within the Web site. This parameter is required when the virtual directory is not located at the root of the Web site.
Name
Required.. Specifies a name for the virtual directory. Virtual directory names do not have to be unique. However, when a Web site includes a virtual directory and a physical directory with the same name, the physical directory will not be visible on the Internet.
/s Computer
Runs the script on the specified remote computer. Type the computer name or IP address without backslashes. The default is the local computer.
/u [Domain\]User
Runs the script with the permissions of the specified user account. This account must be a member of the Administrators group on the remote computer. By default, the script runs with the permissions of the current user of the local computer.
/p Password
Specifies the password of the user account that is specified in the /u parameter.

Examples

Example 1:

The following example deletes the "Insurance" virtual directory from the "Finance" Web site on the local computer. As a result, not only is the "Insurance" directory deleted, but all of the physical and virtual subdirectories are deleted as well.

iisvdir /delete Finance/Insurance

The /s, /u, and /p parameters are unnecessary in this instance because the default computer is local and the user running the command must be logged on as an administrator.

In response, iisvdir displays the following message:

Connecting to server ...Done.
Web directory Finance/Insurance has been DELETED.

Example 2:

The following example deletes the "Updates" virtual subdirectory called on the "Finance" Web site of the remote computer. The command uses the metabase path of the "Finance" Web site, "W3SVC/1509060625", to identify the Web site. It indicates the virtual path, "Finance/Insurance", by appending it to the Web site name.

The example also uses the /s parameter to identify the remote computer, as well as the /u and /p parameters to run iisvdir.vbs with the permissions of the user's administrator account.

iisvdir /delete W3SVC/1509060625/Insurance/Updates /s SVR01 /u Admin01 /p p@SSw#rD2

In response, iisvdir displays the following message:

Connecting to server ...Done.
Web directory Finance/Insurance/Updates has been DELETED.
Related Topics
  • For information on creating Web virtual directories, see Creating Web Virtual Directories.
  • For information on Listing Web virtual directories, see Listing Web Virtual Directories.


Listing Web Virtual Directories

You can use the command-line script iisvdir.vbs, which is stored in systemroot\System32, to list the virtual directory on local or remote computers running a member of the Windows Server 2003 family with IIS 6.0.

The /query operation only displays virtual directories at the root of the Web site, or path, and does not search recursively. Also, it does not display physical directories.

important Important You must be a member of the Administrators group on the local computer to run scripts and executables, or you must have been delegated the appropriate authority. As a security best practice, log on to your computer using an account that is not in the Administrators group, and then use the Run as command to run your script or executable as an administrator. From the command prompt, type runas /user:administrative_accountname "script or executable command".

This topic includes the following information:

  • Syntax: The order in which you type a command and any arguments and options that follow it.
  • Parameters: The values that are given to variables in the command.
  • Examples: Sample code and an explanation of the results.

Syntax

iisvdir /query WebSite[/VirtualPath][/s Computer [/u [Domain\]User/p Password]]

Parameters

WebSite
Required. Specifies the descriptive name, or the metabase path, of the Web site.
VirtualPath
Specifies a path, if necessary, to the virtual directory within the Web site. This parameter is required when the virtual directory is not located at the root of the Web site.
/s Computer
Runs the script on the specified remote computer. Type the computer name or IP address without backslashes. The default is the local computer.
/u [Domain\]User
Runs the script with the permissions of the specified user account. This account must be a member of the Administrators group on the remote computer. By default, the script runs with the permissions of the current user of the local computer.
/p Password
Specifies the password of the user account that is specified in the /u parameter.

Examples

Example 1:

The following example displays the virtual directories at the root of the "Finance" Web site on the local computer:

iisvdir /query Finance

The /s, /u, and /p parameters are unnecessary in this instance because the default computer is local and the user running the command must be logged on as an administrator.

In response, iisvdir displays the two virtual directories at the root of "Finance" Web site. These directories appear at the "Finance" root even though their physical locations are unrelated. In this example, "Alias" represents the names of the virtual directories, while "Physical Root" is their actual location.

note Note This display does not include virtual directories that are subdirectories of the site. The procedure for finding subdirectories is demonstrated below in Example 2.

Alias                    Physical Root
==============================================================================
/Personnel               D:\Corpdir\FinanceWeb\People
/Insurance               C:\Marketing\Insurance\HTMFiles

Example 2:

The following example displays the virtual directories that are subdirectories of the "Insurance" virtual directory on the "Finance" Web site. The command specifies the "Insurance" directory by using its virtual path.

The example also uses the /s parameter to identify the remote computer, as well as the /u and /p parameters to run iisvdir.vbs with the permissions of the user's administrator account.

iisvdir /query Finance\Insurance

In response, iisvdir.vbs reveals the "Current" subdirectory of the "Insurance" virtual directory, and its physical location.

Alias                    Physical Root
==============================================================================
/Current                 C:\Insurance\Monthly\200204
Related Topics
  • For information on creating Web virtual directories, see Creating Web Virtual Directories.
  • For information on deleting Web virtual directories, see Deleting Web Virtual Directories.


Managing FTP Virtual Directories

You can use the command-line script iisftpdr.vbs, which is stored in systemroot\System32, to create, delete, and list File Transfer Protocol (FTP) virtual directories on computers running a member of the Microsoft® Windows® Server 2003 family with Internet Information Services (IIS) 6.0.

Iisftpdr.vbs performs some of the same operations that are available in IIS Manager. You can use either tool to administer IIS FTP virtual directories.

This section includes the following information:

  • Creating FTP Virtual Directories: Describes how to create FTP virtual directories on local or remote computers by using iisftpdr.vbs.
  • Deleting FTP Virtual Directories: Describes how to delete FTP virtual directories that are on local or remote computers by using iisftpdr.vbs.
  • Listing FTP Virtual Directories: Describes how to list FTP virtual directories that are on local or remote computers by using iisftpdr.vbs.


Creating FTP Virtual Directories

You can use the command-line script iisftpdr.vbs, which is stored in systemroot\System32\, to create new FTP virtual directories on local or remote computers running a member of the Windows Server 2003 family with IIS 6.0. This command does not create or destroy content, but simply sets up the virtual directory structure and IIS configuration files.

When you use iisftpdr.vbs to create a new FTP virtual directory, you specify only the basic properties needed to create the site and identify its contents. Iisftpdr.vbs uses the same default properties that IIS Manager uses when establishing new virtual directories, and it adheres to the same rules for inheriting properties. To configure the more advanced properties of the directory, use IIS Manager.

important Important You must be a member of the Administrators group on the local computer to run scripts and executables, or you must have been delegated the appropriate authority. As a security best practice, log on to your computer using an account that is not in the Administrators group, and then use the Run as command to run your script or executable as an administrator. From the command prompt, type runas /user:administrative_accountname "script or executable command".

This topic includes the following information:

  • Syntax: The order in which you type a command and any arguments and options that follow it.
  • Parameters: The values that are given to variables in the command.
  • Examples: Sample code and an explanation of the results.

Syntax

iisftpdr /create FTPSite[VirtualPath] Name PhysicalPath [/s Computer [/u [Domain\]User /p Password]]

Parameters

FTPSite
Required. Specifies the descriptive name or the metabase path of the FTP site.
VirtualPath
Specifies a path, if necessary, to the virtual directory within the Web site. This parameter is required when the virtual directory is not located at the root of the Web site.
Name
Required. Specifies a name for the virtual directory. Virtual directory names do not have to be unique. However, when an FTP site includes a virtual directory and a physical directory with the same name, the physical directory will not be visible on the Internet.
PhysicalPath
Specifies a physical directory where the content for the virtual directory resides. You must specify a path on the local computer, such as C:\Project\FTP. If the specified directory does not exist, iisftpdr will create it.
/s Computer
Runs the script on the specified remote computer. Type the computer name or IP address without backslashes. The default is the local computer.
/u [Domain\]User
Runs the script with the permissions of the specified user account. This account must be a member of the Administrators group on the remote computer. By default, the script runs with the permissions of the current user of the local computer.
/p Password
Specifies the password of the user account that is specified in the /u parameter.

note Note The FTPSite (or FTPSite/VirtualPath), Name, and PhysicalPath parameters must always appear in the specified order on the command line. Otherwise, iisftpdr.vbs does not interpret the information correctly.

Examples

Example 1:

The following example creates the virtual directory "Scripts" at the root of the "Test Downloads" FTP site on the local computer. It associates the directory with content that is currently stored in the C:\Libraries\Scripts directory.

iisftpdr /create "Test Downloads" Scripts C:\Libraries\Scripts

In response, iisftpdr displays the following success message along with the basic properties of the new virtual directory. In this example, "Virtual Path" reflects the virtual directory structure, "ROOT" represents the physical directory where the content resides, and "Metabase Path" represents the metabase key assigned by IIS and is analogous to a registry key in the system registry.

Connecting to server ...Done.
Virtual Path  = Test Downloads/Scripts
ROOT          = C:\Libraries\Scripts
Metabase Path = MSFTPSVC/577648624/ROOT/Scripts

Example 2:

The following example adds the virtual directory "Updates" to the FTP site of a remote server. The command creates the new virtual directory on the "Finance" FTP site as a subdirectory of the existing virtual directory, "Documents".

The first parameter in the command, Finance\Documents, identifies the FTP site and virtual path. The second parameter, Updates, specifies the name of the virtual directory, and the third parameter specifies the physical directory on the server that stores the content of the virtual directory.

The command uses the /s parameter to identify the server computer, as well as the /u and /p parameters to run iisftpdr.vbs with the permissions of the user's administrator account.

iisftpdr /create Finance/Documents Updates C:\inetpub\ftproot\documents\updates /s SVR01 /u Admin01 /p p@SSw#rD2

In response, iisftpdr displays the basic properties of the new FTP site. In this example, the "Finance" FTP site and its "Documents" subdirectory existed on the SVR01 IIS server before the command was issued. If the FTP site or the subdirectory did not exist, the command would have failed.

Connecting to server ...Done.
Virtual Path  = Finance/Documents/Updates
ROOT          = C:\inetpub\ftproot\documents\updates
Metabase Path = MSFTPSVC/2109607139/ROOT/Documents/Updates
Related Topics
  • For information on deleting FTP virtual directories, see Deleting FTP Virtual Directories.
  • For information on listing FTP virtual directories, see Listing FTP Virtual Directories.


Deleting FTP Virtual Directories

You can use the command-line script iisftpdr.vbs, which is stored in systemroot\System32, to delete an FTP virtual directory on local or remote computers running a member of the Windows Server 2003 family with IIS 6.0. This command does not create or destroy content, but simply deletes the virtual directory structure.

You should not use this command to delete FTP sites, as the sites may still be listed, but partially disabled. To delete an FTP site, use iisftp.vbs

important Important You must be a member of the Administrators group on the local computer to run scripts and executables, or you must have been delegated the appropriate authority. As a security best practice, log on to your computer using an account that is not in the Administrators group, and then use the Run as command to run your script or executable as an administrator. From the command prompt, type runas /user:administrative_accountname "script or executable command".

This topic includes the following information:

  • Syntax: The order in which you type a command and any arguments and options that follow it.
  • Parameters: The values that are given to variables in the command.
  • Examples: Sample code and an explanation of the results.

Syntax

iisftpdr /delete FTPSite[VirtualPath]/Name [/s Computer [/u [Domain\]User /p Password]]

Parameters

FTPSite
Required. Specifies the descriptive name or the metabase path of the FTP site.
VirtualPath
Specifies a path to the virtual directory within the FTP site. This parameter is required when the virtual directory is not located at the root of the FTP site.
Name
Required. Specifies a name for the virtual directory. Virtual directory names do not have to be unique. However, when an FTP site includes a virtual directory and a physical directory with the same name, the physical directory will not be visible on the Internet.
/s Computer
Runs the script on the specified remote computer. Type the computer name or IP address without backslashes. The default is the local computer.
/u [Domain\]User
Runs the script with the permissions of the specified user account. This account must be a member of the Administrators group on the remote computer. By default, the script runs with the permissions of the current user of the local computer.
/p Password
Specifies the password of the user account that is specified in the /u parameter.

Examples

Example 1:

The following example deletes the "Insurance" virtual directory from the "Finance" FTP site on the local computer. As a result, not only is the directory deleted, but all of the physical and virtual subdirectories are deleted as well.

iisftpdr /delete Finance/Insurance

The /s, /u, and /p parameters are unnecessary in this instance because the default computer is local and the user running the command must be logged on as an administrator.

In response, iisftpdr displays the following message:

Connecting to server ...Done.
FTP directory Finance/Insurance has been DELETED.

Example 2:

The following example deletes the "Updates" virtual subdirectory on the "Finance" FTP site on the remote computer. The command uses the "Finance" FTP site metabase path, "MSFTPSVC/2109607139", to identify the FTP site. It indicates the virtual path, "Finance/Insurance", by appending it to the FTP site name.

The example also uses the /s parameter to identify the remote computer, as well as the /u and /p parameters to run iisftpdr.vbs with the permissions of the user's administrator account.

iisftpdr /delete MSFTPSVC/2109607139/Insurance/Updates /s SVR01 /u Admin01 /p p@SSw#rD2

In response, iisftpdr displays the following message:

Connecting to server ...Done.
FTP directory Finance/Insurance/Updates has been DELETED.
Related Topics
  • For information on creating FTP virtual directories, see Creating FTP Virtual Directories.
  • For information on listing FTP virtual directories, see Listing FTP Virtual Directories.


Listing FTP Virtual Directories

You can use the command-line script iisftpdr.vbs, which is stored in systemroot\system32, to list FTP virtual directories on local or remote computers running a member of the Windows Server 2003 family with IIS 6.0.

The /query operation displays only virtual directories and not physical directories. Further, it displays only virtual directories at the root of the FTP site or path and does not search recursively.

important Important You must be a member of the Administrators group on the local computer to run scripts and executables, or you must have been delegated the appropriate authority. As a security best practice, log on to your computer using an account that is not in the Administrators group, and then use the Run as command to run your script or executable as an administrator. From the command prompt, type runas /user:administrative_accountname "script or executable command".

This topic includes the following information:

  • Syntax: The order in which you must type a command and any arguments and options that follow it.
  • Parameters: The values that are given to variables in the command.
  • Examples: Sample code and an explanation of the results.

Syntax

iisftpdr /query FTPSite[/VirtualPath][/s Computer [/u [Domain\]User/p Password]]

Parameters

FTPSite
Required. Specifies the descriptive name or the metabase path of the Web site.
VirtualPath
Specifies a path, if necessary, to the virtual directory within the Web site. This parameter is required when the virtual directory is not located at the root of the Web site.
/s Computer
Runs the script on the specified remote computer. Type the computer name or IP address without backslashes. The default is the local computer.
/u [Domain\]User
Runs the script with the permissions of the specified user account. This account must be a member of the Administrators group on the remote computer. By default, the script runs with the permissions of the current user of the local computer.
/p Password
Specifies the password of the user account that is specified in the /u parameter.

Examples

Example 1:

The following example displays the virtual directories at the root of the "Test Downloads" FTP site on the local computer:

iisftpdr /query "Test Downloads"

The /s, /u, and /p parameters are unnecessary in this instance because the default computer is local and the user who is running the command must be logged on as an administrator.

In response, iisftpdr displays the "Scripts" virtual directory at the root of the "Test Downloads" FTP site. Note that the directory appears at the root even though its physical location is unrelated.

note Note This display does not include virtual directories that are subdirectories of the site. The procedure for finding subdirectories is demonstrated below in Example 2.

Alias                    Physical Root
==============================================================================
/Scripts                 C:\Libraries\Scripts
"Alias" represents the names of the virtual directories while "Physical Root" describes their actual locations.

Example 2

The following example displays the virtual directories that are subdirectories of the "Scripts" virtual directory on the "Test Downloads" FTP site. The command specifies the "Scripts" virtual directory by using its virtual path. Note that the quotation marks enclose only the path component that requires them.

iisftpdr /query "Test Download"\Scripts

In response, iisftpdr displays the VBScripts subdirectory of the "Scripts" virtual directory.

Alias                    Physical Root
==============================================================================
/VBScripts                 D:\Scripts\VBScripts
Related Topics
  • For information on creating FTP virtual directories, see Creating FTP Virtual Directories.
  • For information on deleting FTP virtual directories, see Deleting FTP Virtual Directories.


Managing IIS Configurations

You can use two command-line scripts, which are stored in systemroot\System32, to create and manage Internet Information Services (IIS) configuration files on computers running a member of the Microsoft® Windows® Server 2003 family with IIS 6.0.

Iisback.vbs creates and manages backup copies of the IIS configuration (metabase and schema) of a remote or local computer.

Iiscnfg.vbs imports and exports all, or selected, elements of an IIS metabase on a local or remote computer, or it copies the entire IIS configuration (metabase and schema) to another computer.

This section includes the following information:

  • Backing Up IIS Configurations: Describes how to back up configurations on local or remote computers by using iisback.vbs.
  • Restoring IIS Configurations: Describes how to restore configurations on local or remote computers by using iisback.vbs.
  • Deleting IIS Backup Configurations: Describes how to delete configurations on local or remote computers by using iisback.vbs.
  • Listing IIS Backup Configurations: Describes how to list configurations on local or remote computers by using iisback.vbs.
  • Copying IIS Configurations: Describes how to copy configurations on local or remote computers by using iiscnfg.vbs.
  • Importing IIS Configurations: Describes how to import configurations on local or remote computers by using iiscnfg.vbs.
  • Exporting IIS Configurations: Describes how to export configurations on local or remote computers by using iiscnfg.vbs.
  • Saving Configurations to Disk: Describes how to save configurations to disk on local or remote computers by using iiscnfg.vbs.


Backing Up IIS Configurations

You can use the command-line script iisback.vbs, which is stored in systemroot\System32, to create and manage backup copies of the IIS configuration (metabase and schema) of a remote or local computer. Administrators can use this script tool to create a backup copy of their IIS configuration, to restore an IIS configuration from a backup copy, and to list and delete backup copies.

Iisback.vbs performs the same backup and restore operations that are available in IIS Manager. You can use either tool to view and manage backup copies.

important Important You must be a member of the Administrators group on the local computer to run scripts and executables, or you must have been delegated the appropriate authority. As a security best practice, log on to your computer using an account that is not in the Administrators group, and then use the Run as command to run your script or executable as an administrator. From the command prompt, type runas /user:administrative_accountname "script or executable command".

This topic includes the following information:

  • Overview: Key concepts in understanding the backup and restore procedures.
  • Syntax: The order in which you must type a command and any arguments and options that follow it.
  • Parameters: The values that are given to variables in the command.
  • Examples: Sample code and an explanation of the results.

Overview

Each /backup operation creates two files, an .MDx file to store the metabase and an .SCx file to store the schema, where the x is the version number of the backup copy. IIS and iisback.vbs store backup copy files in the systemroot\System32\inetsrv\MetaBack directory.

The metabase and schema of an IIS configuration include system-specific and session-specific properties. Do not copy or import the metabase or schema of one IIS server to another IIS server without modification. To copy all or part of a metabase configuration from one system to another, use iiscnfg.vbs.

To prevent unauthorized use of backup copies, you can use IIS 5.1 or IIS 6.0, and iisback.vbs to encrypt the backup copy with a password. The password encrypts the session key which, in turn, encrypts all of the properties for which the secure attribute is set.

You can read an encrypted backup copy (only the session key and secure properties are encrypted) and you can delete the files. However, you cannot use the backup copy in a restore operation unless you provide the encrypting password. Also, you cannot remove the password encryption from a backup copy or change the encrypting password.

If you do not use password encryption, the session key and secure properties are encrypted with a blank password, which prevents you from reading these values but allows any member of the Administrators group to restore the metabase from the backup copy. IIS 5.1 and IIS 6.0 do not support machine key encryption of backup copies.

Syntax

iisback /backup [/b BackupName] [/v {Integer | HIGHEST_VERSION | NEXT_VERSION}] [/overwrite] [/e EncryptingPassword] [/s Computer [/u [Domain\]User/p Password]]

Parameters

/b BackupName
Specifies the name of the backup copy. The default is SampleBackup.
/v {Integer | NEXT_VERSION | HIGHEST_VERSION}
Specifies the version number of the backup copy. NEXT_VERSION is the default.
Integer | Specifies the version number of the backup copy.
NEXT_VERSION | Specifies the highest version number plus 1. NEXT_VERSION is the default value.
HIGHEST_VERSION | Reuses the highest version number. Because this option replaces a backup copy, the /overwrite parameter is required when using this value. This parameter is only valid when previous versions of the file are stored on the computer.
/overwrite
Permits iisback.vbs to replace an exiting backup copy with the newly created backup copy. Without this parameter, commands used to create a backup copy with the same name and version number as an existing backup copy fail.
/e EncryptingPassword
Encrypts the backup copy with the specified backup password. You can use any string as the password.

The /e parameter creates a secure backup by encrypting the session key and secure properties with the specified password. Administrators must provide the password to use the backup in a restore operation.

If you omit this parameter or omit the password argument, then the backup is encrypted with a blank password. As a result, only the secure properties are encrypted and any administrator can use the backup copy to restore the metabase.

/s Computer
Runs the script on the specified remote computer. Type the computer name or IP address without backslashes. The default is the local computer.
/u [Domain\]User
Runs the script with the permissions of the specified user account. This account must be a member of the Administrators group on the remote computer. By default, the script runs with the permissions of the current user of the local computer.
/p Password
Specifies the password of the user account that is specified in the /u parameter.

Examples

Example 1:

The following command creates a new backup copy of the IIS configuration on the local computer. It uses the /b parameter to assign the name ReskitBkp to the file.

iisback /backup /b ReskitBkp

In response, iisback displays the following success message indicating that the backup copy has been created, and that the default version value, NEXT_VERSION, is assigned to the file. Because this is the first backup copy named ReskitBkp, iisback assigns the version number 0 to the backup copy.

Backup ReskitBkp version NEXT_VERSION has been CREATED.

The new backup copy is displayed in the following list of backup copies on the server:

Backup Name                        Version #      Date and Time
========================================================================
ReskitBkp                          0              1/9/2001 5:00:04 AM

The ReskitBkp backup copy consists of two files, ReskitBkp.MD0, which contains the metabase and ReskitBkp.SC0, which contains the schema. Both files are stored in the systemroot\System32\inetsrv\MetaBack directory.

Example 2:

The following command creates a backup copy of the IIS configuration on the \\SVR01 remote server. It uses the /s parameter to provide the name of the remote computer, and the /u and /p parameters to run the script with the permissions of the user's Administrator account.

It also includes the /b parameter to assign the file name Svr01Bkp to the backup copy and the /v parameter to specify the version number (15) of the new backup copy. The command uses the /e parameter to encrypt the backup copy with the backup password 7W*48Hv6#.

iisback /backup /s svr01 /u admin21 /p Rrr3Qv7s /b Svr01Bkp /v 15 /e 7W*48Hv6#

In response, iisback displays the following success message:

Backup Svr01Bkp version 15 has been CREATED.

This command created the Svr01Bkp, version 15 backup copy of the \\SVR01 IIS configuration and stored the data in the Svr01Bkp.MD15 and Svr01Bkp.SC15 files in the systemroot\System32\inetsvr\MetaBack directory of the remote computer.

A list operation shows the backup copies that are stored on the remote server. The backup command created the final entry in the list.

Backup Name                        Version #      Date and Time
========================================================================
AsiaSvr                             1          1/8/2001 9:18:25 PM
Svr01Bkp                            11          1/3/2001 3:00:42 AM
Svr01Bkp                            12          1/4/2001 3:00:12 AM
Svr01Bkp                            13          1/5/2001 3:01:00 AM
Svr01Bkp                            14          1/6/2001 3:00:00 AM
Svr01Bkp                            15          1/9/2001 5:18:04 AM

Although it is not evident from the list, the new backup copy is encrypted and you must provide the backup password, 7W*48Hv6#, in order to use the backup in a restore operation.

Example 3:

The following command replaces the most recent backup copy of the local IIS configuration with a newer backup. You can use this command format to update the backup copy that you maintain for the server.

The command uses the /b parameter to specify the name of the backup copy. It uses the /v HIGHEST_VERSION parameter to direct iisback.vbs to replace the latest version of the backup copy named CurrentBackup, instead of creating a new version. It also uses the /overwrite parameter, which is required with /v HIGHEST_VERSION to permit iisback.vbs to replace an existing backup.

iisback /backup /b CurrentBackup /v HIGHEST_VERSION /overwrite

In response, iisback displays the following success message:

Backup CurrentBackup version 0 has been CREATED.

The command created new versions of the CurrentBackup.md0 and CurrentBackup.sc0 files, which replaced files with the same names.

Related Topics
  • For information on restoring IIS configurations, see Restoring IIS Configurations.
  • For information on deleting IIS configurations, see Deleting IIS Backup Configurations.
  • For information on listing IIS configurations, see Listing IIS Backup Configurations.


Restoring IIS Configurations

You can use the command-line script iisback.vbs, which is stored in systemroot\System32, to restore the IIS configuration of a server.

Iisback.vbs performs the same backup and restore operations that are available in IIS Manager. You can use either tool to view and manage backup copies.

important Important You must be a member of the Administrators group on the local computer to run scripts and executables, or you must have been delegated the appropriate authority. As a security best practice, log on to your computer using an account that is not in the Administrators group, and then use the Run as command to run your script or executable as an administrator. From the command prompt, type runas /user:administrative_accountname "script or executable command".

This topic includes the following information:

  • Overview: Key concepts in understanding the backup and restore procedures.
  • Syntax: The order in which you type a command and any arguments and options that follow it.
  • Parameters: The values that are given to variables in the command.
  • Examples: Sample code and an explanation of the results.

Overview

Each backup operation creates two files, an .MDx file to store the metabase and an .SCx file to store the schema, where the x is the version number of the backup copy. IIS and iisback.vbs store backup copy files in the systemroot\System32\inetsrv\MetaBack directory.

The metabase and schema of an IIS configuration include system-specific and session-specific properties. Do not copy or import the metabase or schema of one IIS server to another IIS server without modification. To copy all or part of a metabase configuration from one system to another, use iiscnfg.vbs.

To prevent unauthorized use of backup copies, you can use IIS 5.1 or IIS 6.0, and iisback.vbs to encrypt the backup copy with a password. The password encrypts the session key which, in turn, encrypts all of the properties for which the secure attribute is set.

You can read an encrypted backup copy (only the session key and secure properties are encrypted), and you can delete the files. However, you cannot use the backup copy in a restore operation unless you provide the encrypting password. Also, you cannot remove the password encryption from a backup copy nor can you change the encrypting password.

If you do not use password encryption, the session key and secure properties are encrypted with a blank password, which prevents you from reading these values but allows any member of the Administrators group to restore the metabase from the backup copy. IIS 5.1 and IIS 6.0. do not support machine key encryption of backup copies.

note Note The /restore operation is a complex operation that can take several minutes to complete. A brief delay is normal for this operation. During /restore, Web pages, FTP sites, and SMTP and NNTP services are temporarily stopped. Service is restored when the operation completes.

Syntax

iisback /restore/b BackupName [/v {Integer | HIGHEST_VERSION}] [/e EncryptionPassword]
[/s Computer [/u [Domain\]User/p Password]]

Parameters

/b BackupName
Specifies the name of the backup copy.
/v {Integer | HIGHEST_VERSION}
Specifies the version number of the backup copy. HIGHEST_VERSION is the default.
Integer | Specifies the version number of the backup copy.
HIGHEST_VERSION | Specifies the backup copy with the highest version number.
/e Encryption Password
Provides the password of an encrypted backup copy. When the session key in a backup copy is encrypted, you must provide its password to use the copy in the /restore operation.
/s Computer
Runs the script on the specified remote computer. Type the computer name or IP address without backslashes. The default is the local computer.
/u [Domain\]User
Runs the script with the permissions of the specified user account. This account must be a member of the Administrators group on the remote computer. By default, the script runs with the permissions of the current user of the local computer.
/p Password
Specifies the password of the user account that is specified in the /u parameter.

Examples

Example 1:

The following command restores the IIS configuration from the TestBkp, version 3 backup copy. It uses the /b parameter to specify the name of the backup copy and the /v parameter to specify the version.

iisback /restore /b TestBkp /v 3

In response, iisback displays the following success message, indicating that the IIS configuration is restored:

Backup TestBkp version 3 has been RESTORED.

To verify that the configuration is restored, compare the current configuration, which is stored in systemroot\System32\inetsrv\MetaBase.xml and MBSchema.xml, with the backup copy files, TestBkp.MD3 and TestBkp.SC3, in the systemroot\System32\inetsrv\MetaBack directory.

Example 2:

The following command restores the IIS configuration from the Svr01Bkp, version 15 backup copy. The /b parameter is required to specify the backup copy name and the /e parameter to specify the backup password, 7W*48Hv6#. This command omits the /v parameter and uses the default value, HIGHEST_VERSION.

iisback /restore /b Svr01Bkp /e 7W*48Hv6#

In response, iisback displays the following success message, indicating that the IIS configuration is restored:

Backup Svr01Bkp version HIGHEST_VERSION has been RESTORED.
Related Topics
  • For information on backing up IIS configurations, see Backing Up IIS Configurations.
  • For information on deleting IIS configurations, see Deleting IIS Backup Configurations.
  • For information on listing IIS configurations, see Listing IIS Backup Configurations.


Deleting IIS Backup Configurations

You can use the command-line script iisback.vbs, which is stored in systemroot\System32, to delete the backup IIS configuration of a local or remote computer.

Deleting backup files moves the files from the systemroot\System32\inetsrv\MetaBack directory to the Recycle Bin. It does not affect the files that are in the systemroot\System32\inetsrv\MetaBack\History directory.

Iisback.vbs performs the same delete operations that are available in IIS Manager. You can use either tool to view and manage backup copies.

important Important You must be a member of the Administrators group on the local computer to run scripts and executables, or you must have been delegated the appropriate authority. As a security best practice, log on to your computer using an account that is not in the Administrators group, and then use the Run as command to run your script or executable as an administrator. From the command prompt, type runas /user:administrative_accountname "script or executable command".

This topic includes the following information:

  • Overview: Key concepts in understanding the backup and restore procedures.
  • Syntax: The order in which you type a command and any arguments and options that follow it.
  • Parameters: The values that are given to variables in the command.
  • Examples: Sample code and an explanation of the results.

Overview

Each backup operation creates two files, an .MDx file to store the metabase and an .SCx file to store the schema, where the x is the version number of the backup copy. IIS and iisback.vbs store backup copy files in the systemroot\System32\inetsrv\MetaBack directory.

The metabase and schema of an IIS configuration include system-specific and session-specific properties. Do not copy or import the metabase or schema of one IIS server to another IIS server without modification. To copy all or part of a metabase configuration from one system to another, use iiscnfg.vbs.

To prevent unauthorized use of backup copies, you can use IIS 5.1 or IIS 6.0, and iisback.vbs to encrypt the backup copy with a password. The password encrypts the session key which, in turn, encrypts all of the properties for which the secure attribute is set.

You can read an encrypted backup copy (only the session key and secure properties are encrypted), and you can delete the files. However, you cannot use the backup copy in a restore operation unless you provide the encrypting password. Also, you cannot remove the password encryption from a backup copy or change the encrypting password.

If you do not use password encryption, the session key and secure properties are encrypted with a blank password, which prevents you from reading these values but allows any member of the Administrators group to restore the metabase from the backup copy. IIS 5.1 and IIS 6.0. do not support machine key encryption of backup copies.

Syntax

iisback /delete [/b BackupName] [/v {Integer | HIGHEST_VERSION}] [/s Computer [/u [Domain\]User/p Password]]

Parameters

/b BackupName
Required. Specifies the name of the backup copy.
/v {Integer | HIGHEST_VERSION}
Required. Specifies the version number of the backup copy.
Integer | Specifies the version number of the backup copy.
HIGHEST_VERSION | Indicates the backup copy with the highest version number.
/s Computer
Runs the script on the specified remote computer. Type the computer name or IP address without backslashes. The default is the local computer.
/u [Domain\]User
Runs the script with the permissions of the specified user account. This account must be a member of the Administrators group on the remote computer. By default, the script runs with the permissions of the current user of the local computer.
/p Password
Specifies the password of the user account that is specified in the /u parameter.

Examples

Example 1:

The following command deletes the Svr01Bkp, version 0 backup copy. It uses the /b parameter to specify the Svr01Bkp series and the /v parameter to specify the version number. Both parameters are required to identify the backup copy.

iisback /delete /b Svr01Bkp /v 0

In response, iisback displays the following message, indicating that the backup copy is deleted:

Backup Svr01Bkp version 0 has been DELETED.

Example 2

This example demonstrates the use of a simple batch file command to delete a series of backup copies of the IIS configuration. You can use this command to delete old files from your archive. You can type the command at the command line or save it in a batch file.

For /L %%i in (0, 1, 15) do iisback /delete /b Svr01Bkp /v %%i

This batch command deletes Svr01Bkp versions 1 through 15 by issuing the iisback /delete command fifteen times, once for each version.

For a more practical application, make the backup name and version numbers variable. Or, use a dir or iisback /list command to detect the backup with the lowest version number, and then append a command that deletes the oldest backup copy (lowest version number) to each command to create a new backup copy.

Related Topics
  • For information on backing up IIS configurations, see Backing Up IIS Configurations.
  • For information on restoring IIS configurations, see Restoring IIS Configurations.
  • For information on listing IIS configurations, see Listing IIS Backup Configurations.


Listing IIS Backup Configurations

You can use the command-line script iisback.vbs, which is stored in systemroot\System32, to list backup copies of the IIS configuration (metabase and schema) of a remote or local computer.

The /list operation lists only the backup copies that are stored in the default location, systemroot\System32\Inetsrv\MetaBack. If you move the backup copy files to a different directory, then the backup copy does not appear in the list.

Iisback.vbs performs the same backup and restore operations that are available in IIS Manager. You can use either tool to view and manage backup copies.

important Important You must be a member of the Administrators group on the local computer to run scripts and executables, or you must have been delegated the appropriate authority. As a security best practice, log on to your computer using an account that is not in the Administrators group, and then use the Run as command to run your script or executable as an administrator. From the command prompt, type runas /user:administrative_accountname "script or executable command".

This topic includes the following information:

  • Syntax: The order in which you type a command and any arguments and options that follow it.
  • Parameters: The values that are given to variables in the command.
  • Example: Sample code and an explanation of the results.

Syntax

iisback /list [/s Computer [/u [Domain\]User/p Password]]

Parameters

/s Computer
Runs the script on the specified remote computer. Type the computer name or IP address without backslashes. The default is the local computer.
/u [Domain\]User
Runs the script with the permissions of the specified user account. This account must be a member of the Administrators group on the remote computer. By default, the script runs with the permissions of the current user of the local computer.
/p Password
Specifies the password of the user account that is specified in the /u parameter.

Example

The following command lists the backup copies that are stored on the remote server, Svr16. It uses the /s parameter to specify the server name, the /u parameter to specify the user's Administrator account, and the /p parameter to specify the password for the Administrator account.

iisback /list /s Svr16 /u Domain06\User1 /p R34*9W@4b

In response, iisback displays all of the backup copies that are on the remote server, Svr16:

Backup Name                        Version #      Date and Time
========================================================================
AsiaSvr                              0          12/8/2001 9:18:25 PM
AsiaSvr                              1          1/14/2001 9:02:33 PM
Svr01Bkp                            11          1/3/2001 3:00:42 AM
Svr01Bkp                            12          1/4/2001 3:00:12 AM
Svr01Bkp                            13          1/5/2001 3:01:00 AM
Svr01Bkp                            14          1/6/2001 3:00:00 AM
Svr01Bkp                            15          1/9/2001 5:18:04 AM

note Note Without parameters, the iisback /list command lists all of the backup copies that are stored on the local computer.

Related Topics
  • For information on backing up IIS configurations, see Backing Up IIS Configurations.
  • For information on restoring IIS configurations, see Restoring IIS Configurations.
  • For information on deleting IIS configurations, see Deleting IIS Backup Configurations.


Copying IIS Configurations

You can use the command-line script iiscnfg.vbs, which is stored in systemroot\System32, to copy the IIS metabase and schema from one computer to another. Both computers must be running a member of the Windows Server 2003 family with IIS 6.0.

By default, iiscnfg.vbs copies the metabase of the local computer to the target computer that is specified by the /ts parameter. However, you can use the /s parameter to copy the metabase of another computer to the target computer.

important Important You must be a member of the Administrators group on the local computer to run scripts and executables, or you must have been delegated the appropriate authority. As a security best practice, log on to your computer using an account that is not in the Administrators group, and then use the Run as command to run your script or executable as an administrator. From the command prompt, type runas /user:administrative_accountname "script or executable command".

This topic includes the following information:

  • Overview: Key concepts in understanding the copy procedures.
  • Syntax: The order in which you type a command and any arguments and options that follow it.
  • Parameters: The values that are given to variables in the command.
  • Examples: Sample code and an explanation of the results.

Overview

The /copy operation uses iisback.vbs to make a backup copy of the source metabase and the schema. Afterward, it copies the backup copy files (.MDx and .SCx) to the target computer and uses iisback.vbs to replace the metabase and schema of the target computer with the backup copy.

Although you can do these operations manually, /copy provides a convenient, one-step method to replicate an IIS configuration. The /copy operation replaces the features of iissync.exe, a tool formerly included in Windows.

The /copy operation does not copy the server content, such as Web pages and FTP files, that is associated with the IIS configuration. Instead, /copy changes the computer-specific and system-specific properties in the metabase so that they are valid on the target computer. However, it does not adjust the directory or file paths. As a result, paths in the configuration might not be valid on the target computer.

Syntax

iiscnfg /copy /ts TargetComputer /tu TargetUser/tp TargetPassword [/s Computer [/u [Domain\]User [/p Password]]]

Parameters

/ts TargetComputer
Required. Copies the IIS metabase to the specified computer. Type the IP address or computer name without backslashes.
/tu TargetUser
Required (even when the current user of the local computer is an administrator of the target computer). Specifies the account used to connect to the target computer. Type a user account in [Domain]\User format. This account must be a member of the Administrators group on the target computer.
/tp TargetPassword
Required. Specifies the password for the account that is specified by the /tu parameter.
/s Computer
Copies the IIS metabase of the specified remote computer to the target computer. This parameter runs the script on the remote computer. Type the name or IP address of a remote computer without backslashes. The default is the local computer.
/u [Domain\]User
Required only when the current user is not an administrator of the remote computer. Runs the script with the permissions of the specified user account. The default is the current user of the local computer.
/p Password
Specifies the password of the user account that is specified in the /u parameter. If you omit this parameter, the script prompts you for the password and obscures the text you type.

Examples

Example 1:

The following example copies the IIS configuration of the local computer to the Svr01 server. The command uses the /ts parameter to identify the target server, and the /tu and /tp parameters to provide the user's administrator account and password on the Svr01 server.

iiscnfg /copy /ts SVR01 /tu SVR01\Admin06 /tp P@ssWord6

In response, iiscnfg displays a list of the steps it takes to copy the IIS configuration.

Microsoft (R) Windows Script Host Version 5.6
Copyright (C) Microsoft Corporation 1996-2001. All rights reserved.

Backing up server 127.0.0.1
cmd /c iisback /backup /b iisreplback /overwrite
Backup complete.
Mapping local drive D: to admin share on server 127.0.0.1
Mapping local drive E: to admin share on server Svr01
Copying backup files...
cmd /c copy /Y D:\System32\inetsrv\metaback\iisreplback.* E:\System32\inetsrv\metaback
Unmapping local drive D:
Restoring on server Svr01
cmd /c iisback /restore /s svr01 /u SVR01\Admin06 /p P@ssWord6 /b iisreplback
Restore complete.
Unmapping local drive E:

This display shows that iiscnfg issues commands to iisback.vbs, first to create a backup copy of the metabase and schema and then to restore (or paste) it to the target computer. To do so, it must copy the backup copy files (iisreplback.*) to the target computer.

The IP address, 127.0.0.1, is the loopback address and refers generically to the local computer. This address is used only when copying the configuration of the local computer.

Example 2:

The following example copies the IIS configuration of a remote computer, Svr06, to the MainBkp server. The command uses the /s parameter to identify the remote computer and the /u parameter to provide the user's administrator password on the Svr06 computer. It also uses the /ts parameter to identify the target server, and the /tu and /tp parameters to provide the user's administrator account and password on the MainBkp server.

Please note that although the /p parameter is optional, the /tp parameter is required. If you omit it, the command fails.

iiscnfg /copy /s Svr06 /u Domain01\Admin01 /ts MainBkp /tu MainBkp\Admin01 /tp P@ssWord6

In response, iiscnfg prompts you for the password for the account specified by the /u parameter, which specifies the permissions under which the script runs, and then it displays a list of the steps it takes to copy the IIS configuration. The phrase "Restore complete" indicates that the /copy operation was successful.

Microsoft (R) Windows Script Host Version 5.6
Copyright (C) Microsoft Corporation 1996-2001. All rights reserved.

Enter the Password:
Processing...
Backing up server Svr06
cmd /c iisback /backup /s Svr06 /u Domain01\Administrator /p B##jdt! /b iisreplback /overwrite
Backup complete.
Mapping local drive G: to admin share on server Svr06
Mapping local drive I: to admin share on server MainBkp
Copying backup files...
cmd /c copy /Y G:\System32\inetsrv\metaback\iisreplback.* I:\System32\inetsrv\metaback
Unmapping local drive G:
Restoring on server MainBkp
cmd /c iisback /restore /s MainBkp /u MainBkp\Admin01 /p P@ssWord6 /b iisreplback
Restore complete.
Unmapping local drive I:
Related Topics
  • For information on importing IIS configurations, see Importing IIS Configurations.
  • For information on exporting IIS configurations, see Exporting IIS Configurations.
  • For information on saving IIS configurations, see Saving Configurations to Disk.


Importing IIS Configurations

You can use the command-line script iiscnfg.vbs, which is stored in systemroot\System32, to add configuration settings from an Extensible Markup Language (XML) metabase export file to the metabase of an IIS server.

The computer issuing the command must be running Microsoft Windows XP or a member of the Windows Server 2003 family. The computer that the command affects must be running a member of the Windows Server 2003 family with IIS 6.0.

important Important You must be a member of the Administrators group on the local computer to run scripts and executables, or you must have been delegated the appropriate authority. As a security best practice, log on to your computer using an account that is not in the Administrators group, and then use the Run as command to run your script or executable as an administrator. From the command prompt, type runas /user:administrative_accountname "script or executable command".

This topic includes the following information:

  • Overview: Key concepts in understanding the copy procedures.
  • Syntax: The order in which you type a command and any arguments and options that follow it.
  • Parameters: The values that are given to variables in the command.
  • Examples: Sample code and an explanation of the results.

Overview

The metabase of an IIS server includes system-specific and computer-specific properties. Do not export the configuration of one IIS server to another IIS server without modification. Instead, use iisback.vbs or the iiscnfg.vbs /copy operation, which replaces system-specific and computer-specific properties so that the configuration is valid on the destination computer.

Changes made by using iiscnfg.vbs are effective immediately, but they aren't reflected in the MetaBase.xml file until the file is updated (every five minutes or every 50 changes). Use iiscnfg /save to review your changes immediately.

Syntax

iiscnfg /import /f [Path\]FileName.xml /sp SourcePath /dp DestiniationPath[/d EncryptingPassword] [/inherited] [/children] [/merge][/s Computer [/u [Domain\]User [/p Password]]]

Parameters

/f [Path\]FileName.xml
Required. Specifies the path and file name of the XML source file.
/sp SourcePath
Required. Specifies the location in the XML file of the keys being imported. Enter the metabase path as it appears in the XML file. To import all of the keys in the source file, enter the metabase path of the root key.
/dp DestinationPath
Required. Specifies the metabase path into which the keys are placed. Enter the metabase path as it appears in the XML file.

note Note The imported key must be of the type expected in its new position in the metabase path. If the key is not of the expected type, the configuration will not operate properly. For example, do not import the event logging configuration (/LM/Logging) to a Web site configuration path, such as /LM/W3SVC/3. If you specify a path that already exists in the metabase, the imported keys overwrite and replace the keys currently in that metabase path, without warning.

/d EncryptingPassword
Required only when the configuration file is encrypted. Specifies the password that was used to encrypt the configuration data.
/inherited
Imports the inherited properties of the keys. This parameter is only effective when the source file includes inherited properties.
/children
Recursively imports the subkeys of the specified key.
/merge
Combines keys in the XML file with the existing metabase keys. Without this parameter, the keys in the XML file replace existing keys in the same metabase path. The /merge parameter adds keys to the metabase that appear only in the XML file, retains keys in the metabase that are not in the XML file, and applies the values in the XML file when a key appears in both the XML file and the metabase.
/s Computer
Runs the script on the specified remote computer. Type the computer name or IP address without backslashes. The default is the local computer.
/u [Domain\]User
Runs the script with the permissions of the specified user account. This account must be a member of the Administrators group on the remote computer. By default, the script runs with the permissions of the current user of the local computer.
/p Password
Specifies the password of the user account that is specified in the /u parameter. If you omit this parameter, the script prompts you for the password and obscures the text you type.

Examples

Example 1:

The following command imports the NewSite Web site configuration from C:\Config.xml file to the metabase. The command uses the /f parameter to specify the name and location of the source file. Next, it uses the /sp parameter to indicate that the configuration is in the /lm/w3svc/5/Root/NewSite path in the Config.xml file. Finally, it uses the /dp parameter to specify that the keys in that path should be placed in the /lm/w3svc/1/Root/401KApp location in the metabase.

iiscnfg.vbs /import /f c:\config.xml /sp /lm/w3svc/5/Root/NewSite /dp /lm/w3svc/1/Root/401KApp

In response, iiscnfg displays the following success message:

Configuration imported from /lm/w3svc/5/Root/NewSite in c:\config.xml to /lm/w3svc/1/Root/401KApp in the Metabase.

As a result of this command, the NewSite configuration now appears in IIS as the first Web site, with metabase path W3SVC/1.

Example 2:

The following two-step example imports a custom logging configuration from C:\IISLogging.xml to the IIS metabase of a remote computer. You can use this method, or an extension of this method, to propagate a configuration to a group of servers.

The first command copies the IIsLogging.xml file to the remote server, Svr126.

copy IIsLogging.xml \\Svr126\c$

The second command imports IIsLogging.xml to the IIS configuration of Svr126. It uses the /f parameter to identify the source file, the /sp parameter to specify the /LM/Logging/Custom Logging metabase path to import, and the /dp parameter to place the imported keys in the same location in the target configuration, /LM/Logging/Custom Logging. (Use quotation marks to enclose path elements that include spaces.) Next, it uses the /children parameter to import all of the subkeys of the Logging key. Finally, to act on Svr126, it uses the /s parameter to specify the server, and the /u and /p parameters to run the script with the permissions of the user's administrator account on the remote computer.

iiscnfg /import /f C:\IISLogging.xml /sp "/lm/logging/custom logging" /dp "/lm/logging/custom logging" /children /s Svr126 /u Svr126\Administrator /p p@ssword1#

In response, iiscnfg displays the following success message:

Connecting to server ... Done.
Configuration imported from /lm/logging/custom logging in file C:\IISLogging.xml to
 /lm/logging/custom logging in the Metabase.

As a result, the /LM/Logging/Custom Logging key and its subkeys have been copied from the local metabase to the metabase of Svr126.

Example 3:

This example demonstrates how the /merge parameter works by comparing a standard import operation with an import operation that uses the /merge parameter. Both of the commands in this example update the properties of the Investments virtual directory of a Web site by using the same import file, Invest_vdir.xml.

The following sample shows the Investments metabase key before any import operations are run. (This sample is taken from a backup copy of the metabase created by using iisback.vbs).

Metabase before import

<IIsWebVirtualDir Location="/LM/W3SVC/1509060625/root/Investments"
    AccessFlags="AccessRead | AccessScript"
    AppFriendlyName="Investments"
    AppIsolated="2"
    AppRoot="/LM/W3SVC/1509060625/Root/Investments"
    DirBrowseFlags="DirBrowseShowDate | DirBrowseShowTime | DirBrowseShowSize | DirBrowseShowExtension | DirBrowseShowLongDate | EnableDefaultDoc"
    Path="E:\public\Download"
>
</IIsWebVirtualDir>

The following sample shows the content of the Invest_vdir.xml file that will be used in the /import operations. (This sample was created by exporting the Investments metabase key and then editing the export file.) Please note that the following properties of the Investments key are changed in the XML file:

  • The value of the AccessFlags property is changed.
  • The AuthFlags property is added.
  • The DirBrowseFlags property is omitted.
Import File Content
<IIsWebVirtualDir Location="/LM/W3SVC/1509060625/root/Investments"
        AccessFlags="AccessRead"
        AuthFlags="AuthAnonymous | AuthNTLM"
        AppFriendlyName="Investments"
        AppIsolated="2"
        AppRoot="/LM/W3SVC/1509060625/Root/Investments"
        Path="E:\public\Download"
>
</IIsWebVirtualDir>

Command 1: Standard Import

The following command imports the Invest_vdir.xml file to the metabase without using the /merge parameter. The command directs IIS to replace the Investments key in the metabase with the Investments key in the XML file. The command uses the /f parameter to specify the import file, and it uses the same metabase path in the source path (/sp) and destination path (/dp) parameters.

iiscnfg /import /f e:\iistest\Invest_vdir.xml /sp /LM/W3SVC/1509060625/root/Investments /dp /LM/W3SVC/1509060625/root/Investments

As a result of this command, the Investments key in the metabase is now identical to the Investments key in the Invest_vdir.xml import file.

Command 2: Import and merge

The following command merges the Investments key in the Invest_vdir.xml file to the metabase. The /merge parameter directs IIS to add new properties from the import file to the metabase, to leave the metabase properties that are not in the import file unchanged, and to apply the import file value when a property appears in both the import file and in the metabase. This command is identical to Command 1, except that the /merge parameter is added.

iiscnfg /import /f e:\iistest\Invest_vdir.xml /sp /LM/W3SVC/1509060625/root/Investments /dp /LM/W3SVC/1509060625/root/Investments /merge

As a result of this command, the content of the Investments key in the metabase is a combination of its sources, as shown in the following sample. Note that the following properties of the Investments key that are in the metabase are changed.

  • The value of the AccessFlags property, which appeared in the metabase and the XML file, is changed. The value in the XML file now appears in the metabase.
  • The AuthFlags property, which appeared only in the XML file, is added.
  • The DirBrowseFlags property, which appeared only in the metabase, is unchanged.
<IIsWebVirtualDir Location="/LM/W3SVC/1509060625/root/Investments"
        AccessFlags="AccessRead"
        AppFriendlyName="Investments"
        AppIsolated="2"
        AppRoot="/LM/W3SVC/1509060625/Root/Investments"
        AuthFlags="AuthAnonymous | AuthNTLM"
        DirBrowseFlags="DirBrowseShowDate | DirBrowseShowTime | DirBrowseShowSize | DirBrowseShowExtension | DirBrowseShowLongDate | EnableDefaultDoc"
        Path="E:\public\Download"
>
</IIsWebVirtualDir>
Related Topics
  • For information on copying IIS configurations, see Copying IIS Configurations.
  • For information on exporting IIS configurations, see Exporting IIS Configurations.
  • For information on saving IIS configurations, see Saving Configurations to Disk.


Exporting IIS Configurations

You can use the command-line script iiscnfg.vbs, which is stored in systemroot\System32, to copy all or part of an IIS metabase to an XML file, in an encrypted or unencrypted format. The XML file can be used in an /import operation to copy all or part of the metabase to another IIS configuration.

The computer issuing the command must be running Windows XP or a member of the Windows Server 2003 family. The computer that the command affects must be running a member of the Windows Server 2003 family with IIS 6.0.

important Important You must be a member of the Administrators group on the local computer to run scripts and executables, or you must have been delegated the appropriate authority. As a security best practice, log on to your computer using an account that is not in the Administrators group, and then use the Run as command to run your script or executable as an administrator. From the command prompt, type runas /user:administrative_accountname "script or executable command".

This topic includes the following information:

  • Overview: Key concepts in understanding the export procedures.
  • Syntax: The order in which you type a command and any arguments and options that follow it.
  • Parameters: The values that are given to variables in the command.
  • Examples: Sample code and an explanation of the results.

Overview

The metabase of an IIS server includes system-specific and computer-specific properties. Do not export the configuration of one IIS server to another IIS server without modification. Instead, use iisback.vbs or the iiscnfg.vbs /copy operation, both of which replace system-specific and computer-specific properties so that the configuration is valid on the destination computer.

Iiscnfg.vbs provides an option to include inherited properties in the export file.

To prevent unauthorized use of export files, iiscnfg.vbs allows you to encrypt the export file with a password. The password encrypts the session key which, in turn, encrypts all of the properties for which the secure attribute is set.

You can read an encrypted export file (only the session key and secure properties are encrypted) and you can delete the file. However, you cannot use the export file in an /import operation unless you provide the encrypting password. Also, you cannot remove the password encryption from an export file or change the encrypting password.

The /copy operation changes the computer-specific and system-specific properties in the metabase so that they are valid on the target computer. However, it does not adjust the directory or file paths. As a result, paths in the configuration might not be valid on the target computer.

Syntax

iiscnfg /export /f [Path\]FileName.xml /sp SourcePath [/d EncryptingPassword] [/inherited] [/children] [/s Computer [/u [Domain\]User [/p Password]]]

Parameters

/f [Path\]FileName.xml
Required. Specifies a unique name and location for the export file. If you specify an existing file or if the directories in the path you specify do not exist, the command fails. Also, the file path must be local. When exporting a file from a remote computer, the /f parameter refers to a path on the remote computer.
/sp SourcePath
Required. Specifies the metabase keys to export. Enter a metabase path, including /lm/ root, to indicate the selected keys.
/d EncryptingPassword
Encrypts the export file with the specified password. You can use any string as the password. The /d parameter creates a secure export file by encrypting the session key and secure properties with the specified password. You must provide the password to use the file in an /import operation.

If you omit this parameter or omit the password argument, then the export file is encrypted with a blank password. As a result, only the secure properties are encrypted and any administrator can use the export file to import a metabase configuration.

/inherited
Adds the inherited properties of the exported keys to the export file. Without this parameter, the export file does not include properties inherited from higher-level keys. If you select this option, iiscnfg.vbs adds the inherited properties of the exported keys to an IIsInheritedProperties key in the export file. When you import keys from this file, you can elect to import the inherited properties with the keys.

note Note When inherited properties are imported, the imported keys retain the properties they inherited in the exporting configuration. If inherited properties are not imported, the keys inherit the properties of the importing configuration.

/children
Recursively adds the subkeys of the specified key to the export file.
/s Computer
Runs the script on the specified remote computer. Type the computer name or IP address without backslashes. The default is the local computer.
/u [Domain\]User
Runs the script with the permissions of the specified user account. This account must be a member of the Administrators group on the remote computer. By default, the script runs with the permissions of the current user of the local computer.
/p Password
Specifies the password of the user account that is specified in the /u parameter. If you omit this parameter, the script prompts you for the password and obscures the text you type.

Examples

Example 1:

The following example exports the configuration of the Finance Web site to the C:\Finance\Finance.xml file. The command uses the /sp parameter to specify the metabase path of the Web site, which is /lm/W3SVC/2, and the /children parameter to export all of the subkeys of the configuration. It also uses the /inherited parameter to include inherited properties in the export file. This ensures that the Web site configuration retains these properties even if it is imported into a different system.

iiscnfg /export /f c:\finance\finance.xml /sp /lm/w3svc/2 /children /inherited

In response, iiscnfg displays the following success message:

Configuration exported from /lm/w3svc/2 to file c:\finance\finance.xml

The resulting file includes all of the keys and subkeys within the /lm/w3svc/2 path. It also includes an IisInheritedProperties key that contains the values of all of the inherited properties.

Example 2:

The following example exports the IIS configuration of the local computer to the D:\IIStest\Config.xml file. It uses the /f parameter to specify the file name and location and the /sp parameter to specify the root key (/)of the metabase. The /children parameter adds all of the subkeys of the root key recursively to the export file. (Without the /children parameter, only the root key is exported.) Finally, the command uses the /d parameter and a password to encrypt the export file.

iiscnfg /export /f d:\iistest\config.xml /sp / /children /d p@sswoRd61

In response, iiscnfg displays the following success message:

Configuration / has been exported to d:\iistest\config.xml

Even a complete export of the configuration is not identical to the MetaBase.xml file for the system. The session key, access control lists (ACLs), and passwords differ.

You cannot tell by looking at the export file that it is encrypted. However, if you compare an encrypted and unencrypted version of the same file, you can see that the values of the secure properties are changed in the encrypted version. Therefore, the file cannot be used in an import command without the password.

Related Topics
  • For information on copying IIS configurations, see Copying IIS Configurations.
  • For information on importing IIS configurations, see Importing IIS Configurations.
  • For information on saving IIS configurations, see Saving Configurations to Disk.


Saving Configurations to Disk

You can use the command-line script iiscnfg.vbs, which is stored in systemroot\System32, to immediately save configuration changes to disk. Administrators can use this script tool to make changes immediately visible in the metabase.xml.

Iiscnfg.vbs performs the same backup and restore operations that are available in IIS Manager. You can use either tool to view and manage backup copies.

important Important You must be a member of the Administrators group on the local computer to run scripts and executables, or you must have been delegated the appropriate authority. As a security best practice, log on to your computer using an account that is not in the Administrators group, and then use the Run as command to run your script or executable as an administrator. From the command prompt, type runas /user:administrative_accountname "script or executable command".

This topic includes the following information:

  • Overview: Key concepts in understanding the backup and restore procedures.
  • Syntax: The order in which you type a command and any arguments and options that follow it.
  • Parameters: The values that are given to variables in the command.
  • Examples: Sample code and an explanation of the results.

Overview

Any changes that are made to the metabase, by using scripts or IIS Manager, are written to memory first first and to disk at the next scheduled update, which may be several minutes later. As a result, an administrator may make metabase changes and then open metabase.xml only to find the changes aren't reflected. The /save command in iiscnfg.vbs resolves the problem by saving changes to the disk immediately.

Syntax

iiscnfg /save[/s Computer [/u [Domain\]User /p Password]]

Parameters

/s Computer
Runs the script on the specified remote computer. Type the computer name or IP address without backslashes. The default is the local computer.
/u [Domain\]User
Runs the script with the permissions of the specified user account. This account must be a member of the Administrators group on the remote computer. By default, the script runs with the permissions of the current user of the local computer.
/p Password
Specifies the password of the user account that is specified in the /u parameter.

Examples

Example 1:

The following command saves the IIS configuration to disk on the local computer:

iiscnfg /save

In response, iiscnfg displays the following message:

Configuration saved

Example 2:

The following command saves the IIS configuration to disk on the local computer:

iiscnfg /save /s SourceServer /u Administrator /p Kj30W

In response, iiscnfg displays the following message:

Configuration saved
Related Topics
  • For information on copying IIS configurations, see Copying IIS Configurations.
  • For information on importing IIS configurations, see Importing IIS Configurations.
  • For information on exporting IIS configurations, see Exporting IIS Configurations.


Managing Applications and Web Service Extensions

You can use two command-line scripts, which are stored in systemroot\system32, to configure and manage applications, Web service extensions, and individual files on computers running a member of the Microsoft® Windows® Server 2003 family with Internet Information Services (IIS) 6.0.

Iisext.vbs can enable and list applications; add and remove application dependencies; enable, disable, and list Web service extensions; and add, remove, enable, disable, and list individual files.

Iisapp.vbs can list applications that are running.

This section includes the following information:

  • Enabling Applications: Describes how to enable applications on local or remote computers using iisext.vbs.
  • Listing Applications: Describes how to list applications on local or remote computers using iisext.vbs.
  • Adding Application Dependencies: Describes how to add application dependencies on local or remote computers using iisext.vbs.
  • Removing Application Dependencies: Describes how to remove application dependencies on local or remote computers using iisext.vbs.
  • Enabling Web Service Extensions: Describes how to enable Web service extensions on local or remote computers using iisext.vbs.
  • Disabling Web Service Extensions: Describes how to disable Web service extensions on local or remote computers using iisext.vbs.
  • Listing Web Service Extensions: Describes how to list Web service extensions on local or remote computers using iisext.vbs.
  • Adding Web Service Extension Files: Describes how to add Web service extension files on local or remote computers using iisext.vbs.
  • Enabling Web Service Extension Files: Describes how to enable Web service extension files on local or remote computers using iisext.vbs.
  • Disabling Web Service Extension Files: Describes how to disable Web service extension files on local or remote computers using iisext.vbs.
  • Removing Web Service Extension Files: Describes how to remove Web service extension files on local or remote computers using iisext.vbs.
  • Listing Web Service Extension Files: Describes how to list Web service extension files on local or remote computers using iisext.vbs.
  • Listing Running Web Applications: Describes how to list applications currently running on local or remote computers using iisapp.vbs.


Enabling Applications

You can use the command-line script iisext.vbs, which is stored in systemroot\system32, to enable applications on computers running a member of the Windows Server 2003 family with IIS 6.0. The application must have at least one preexisting dependency in the ApplicationDependencies property of the metabase.

Iisext.vbs performs the same operations that are available in IIS Manager. You can use either tool to administer IIS Web sites.

important Important You must be a member of the Administrators group on the local computer to run scripts and executables, or you must have been delegated the appropriate authority. As a security best practice, log on to your computer using an account that is not in the Administrators group, and then use the Run as command to run your script or executable as an administrator. From the command prompt, type runas /user:administrative_accountname "script or executable command".

This topic includes the following information:

  • Syntax: The order in which you must type a command and any arguments and options that follow it.
  • Parameters: The values that are given to variables in the command.
  • Examples: Sample code and an explanation of the results.

Syntax

iisext /EnApp Application [/s Computer [/u [Domain\]User [/p Password]]]

Parameters

Application
Required. Specifies the name of the application to be enabled.
/s Computer
Runs the script on the specified remote computer. Type the computer name or IP address without backslashes. By default, the script runs on the local computer.
/u [Domain\]User
Runs the script with the permissions of the specified user account. This account must be a member of the Administrators group on the remote computer. By default, the script runs with the permissions of the current user of the local computer.
/p Password
Specifies the password of the user account that is specified in the /u parameter. If you omit this parameter, the script prompts you for the password and obscures the text you type.

Examples

Example 1:

The following command enables the application "Payroll" on the local computer:

iisext /EnApp Payroll

In response, iisext displays the following:

Connecting to server ...Done.
Enabling application complete.

Example 2:

The following command enables the application "TravelPlans" on a remote computer:

iisext /EnApp TravelPlans /s RemoteComputer /u Manager /p Pa$$Werd

In response, iisext displays the following:

Connecting to server ...Done.
Enabling application complete.
Related Topics
  • For information on listing applications, see Listing Applications.


Listing Applications

You can use the command-line script iisext.vbs, which is stored in systemroot\system32, to list applications that can be enabled on computers running a member of the Windows Server 2003 family with IIS 6.0. These applications are listed in the ApplicationDependencies property of the metabase.

Iisext.vbs performs the same operations that are available in IIS Manager. You can use either tool to administer IIS Web sites.

important Important You must be a member of the Administrators group on the local computer to run scripts and executables, or you must have been delegated the appropriate authority. As a security best practice, log on to your computer using an account that is not in the Administrators group, and then use the Run as command to run your script or executable as an administrator. From the command prompt, type runas /user:administrative_accountname "script or executable command".

This topic includes the following information:

  • Syntax: The order in which you must type a command and any arguments and options that follow it.
  • Parameters: The values that are given to variables in the command.
  • Example: Sample code and an explanation of the results.

Syntax

iisext /ListApp [/s Computer [/u [Domain\]User [/p Password]]]

Parameters

/s Computer
Runs the script on the specified remote computer. Type the computer name or IP address without backslashes. By default, the script runs on the local computer.
/u [Domain\]User
Runs the script with the permissions of the specified user account. This account must be a member of the Administrators group on the remote computer. By default, the script runs with the permissions of the current user of the local computer.
/p Password
Specifies the password of the user account that is specified in the /u parameter. If you omit this parameter, the script prompts you for the password and obscures the text you type.

Example

The following command lists all of the applications that are in the ApplicationDependencies property of the metabase on the local computer:

iisext /ListApp

In response, iisext displays all of the applications that are on the local computer.

Connecting to server ...Done
Active Server Pages
Internet Data Connector
Server Side Includes
WebDAV
Payroll
TravelPlans


Adding Application Dependencies

You can use the command-line script iisext.vbs, which is stored in systemroot\system32, to add dependencies between applications and one or more Web service extensions on computers running a member of the Windows Server 2003 family with IIS 6.0. If the application does not exist in the ApplicationDependencies property, iisext will create it.

Iisext.vbs performs the same operations that are available in IIS Manager. You can use either tool to administer IIS Web sites.

important Important You must be a member of the Administrators group on the local computer to run scripts and executables, or you must have been delegated the appropriate authority. As a security best practice, log on to your computer using an account that is not in the Administrators group, and then use the Run as command to run your script or executable as an administrator. From the command prompt, type runas /user:administrative_accountname "script or executable command".

This topic includes the following information:

  • Syntax: The order in which you must type a command and any arguments and options that follow it.
  • Parameters: The values that are given to variables in the command.
  • Examples: Sample code and an explanation of the results.

Syntax

iisext /AddDep Application ID [ID] [/s Computer [/u [Domain\]User [/p Password]]]

Parameters

Application
Required. Specifies the name of the application that is dependent on a Web service extension.
ID
Required. Specifies the ID of the Web service extension upon which the application is dependent. Additional dependencies are optional.
/s Computer
Runs the script on the specified remote computer. Type the computer name or IP address without backslashes. By default, the script runs on the local computer.
/u [Domain\]User
Runs the script with the permissions of the specified user account. This account must be a member of the Administrators group on the remote computer. By default, the script runs with the permissions of the current user of the local computer.
/p Password
Specifies the password of the user account that is specified in the /u parameter. If you omit this parameter, the script prompts you for the password and obscures the text you type.

Examples

Example 1:

The following command makes the application "Payroll" dependent on the Web service extension "timesheet" on the local computer. In this example, the files that are required for the Web service extension "timesheet" were previously added to and enabled on the local computer.

iisext /AddDep Payroll timesheet

In response, iisext displays the following:

Connecting to server ...Done.
Adding dependency complete.

Example 2:

The following command makes the application "TravelPlans" dependent on the Web service extensions "FlightSchedules" and "HotelRooms" on a remote computer. In this example, the files that are required for the Web service extensions "FlightSchedules" and "HotelRooms" were previously added to and enabled on the remote computer.

iisext /AddDep TravelPlans FlightSchedules HotelRooms /s RemoteComputer /u Manager /p Pa$$Werd

In response, iisext displays the following:

Connecting to server ...Done.
Adding dependency complete.
Related Topics
  • For information on removing application dependencies, see Removing Application Dependencies.


Removing Application Dependencies

You can use the command-line script iisext.vbs, which is stored in systemroot\system32, to remove dependencies between applications and one or more Web service extensions on computers running a member of the Windows Server 2003 family with IIS 6.0.

Iisext.vbs performs the same operations that are available in IIS Manager. You can use either tool to administer IIS Web sites.

important Important You must be a member of the Administrators group on the local computer to run scripts and executables, or you must have been delegated the appropriate authority. As a security best practice, log on to your computer using an account that is not in the Administrators group, and then use the Run as command to run your script or executable as an administrator. From the command prompt, type runas /user:administrative_accountname "script or executable command".

This topic includes the following information:

  • Syntax: The order in which you must type a command and any arguments and options that follow it.
  • Parameters: The values that are given to variables in the command.
  • Examples: Sample code and an explanation of the results.

Syntax

iisext /RmDep Application ID [ID] [/s Computer [/u [Domain\]User [/p Password]]]

Parameters

Application
Required. Specifies the name of the application that is dependent on a Web service extension.
ID
Required. Specifies the ID of the Web service extension upon which the application is dependent. Additional dependencies are optional.
/s Computer
Runs the script on the specified remote computer. Type the computer name or IP address without backslashes. By default, the script runs on the local computer.
/u [Domain\]User
Runs the script with the permissions of the specified user account. This account must be a member of the Administrators group on the remote computer. By default, the script runs with the permissions of the current user of the local computer.
/p Password
Specifies the password of the user account that is specified in the /u parameter. If you omit this parameter, the script prompts you for the password and obscures the text you type.

Examples

Example 1:

The following command removes the dependency of the application "Payroll" on the Web service extension "timesheet" on the local computer:

iisext /RmDep Payroll timesheet

In response, iisext displays the following:

Connecting to server ...Done.
Removing dependency complete.

Example 2:

The following command removes the dependency of the application "TravelPlans" on the Web service extensions "FlightSchedules" and "HotelRooms" on a remote computer:

iisext /RmDep TravelPlans FlightSchedules HotelRooms /s RemoteComputer /u Manager /p Pa$$Werd

In response, iisext displays the following:

Connecting to server ...Done.
Removing dependency complete.
Related Topics
  • For information on adding application dependencies, see Adding Application Dependencies.


Enabling Web Service Extensions

You can use the command-line script iisext.vbs, which is stored in systemroot\system32, to enable a Web service extension. The Web service extension must have at least one file associated with it in the WebSvcExtRestrictionList property of the metabase. The command can be executed on local or remote computers running a member of the Windows Server 2003 family with IIS 6.0.

Iisext.vbs performs the same operations that are available in IIS Manager. You can use either tool to administer IIS Web sites.

important Important You must be a member of the Administrators group on the local computer to run scripts and executables, or you must have been delegated the appropriate authority. As a security best practice, log on to your computer using an account that is not in the Administrators group, and then use the Run as command to run your script or executable as an administrator. From the command prompt, type runas /user:administrative_accountname "script or executable command".

This topic includes the following information:

  • Syntax: The order in which you must type a command and any arguments and options that follow it.
  • Parameters: The values that are given to variables in the command.
  • Examples: Sample code and an explanation of the results.

Syntax

iisext /EnExt ID [/s Computer [/u [Domain\]User [/p Password]]]

Parameters

ID
Required. Specifies the ID of the Web service extension that is going to be enabled.
/s Computer
Runs the script on the specified remote computer. Type the computer name or IP address without backslashes. By default, the script runs on the local computer.
/u [Domain\]User
Runs the script with the permissions of the specified user account. This account must be a member of the Administrators group on the remote computer. By default, the script runs with the permissions of the current user of the local computer.
/p Password
Specifies the password of the user account that is specified in the /u parameter. If you omit this parameter, the script prompts you for the password and obscures the text you type.

Examples

Example 1:

The following command enables the Web service extension "Payroll" on the local computer:

iisext /EnExt Payroll

In response, iisext displays the following:

Connecting to server ...Done.
Enabling extension complete.

Example 2:

The following command enables the Web service extension "Inventory" on a remote computer:

iisext /EnExt Inventory /s RemoteComputer /u Manager /p Pa$$Werd

In response, iisext displays the following:

Connecting to server ...Done.
Enabling extension complete.
Related Topics
  • For information on disabling Web service extensions, see Disabling Web Service Extensions.
  • For information on listing Web service extensions, see Listing Web Service Extensions.


Disabling Web Service Extensions

You can use the command-line script iisext.vbs, which is stored in systemroot\system32, to disable a Web service extension by disabling all of the files with a specific Web service extension ID. The command can be executed on local or remote computers running a member of the Windows Server 2003 family with IIS 6.0.

Iisext.vbs performs the same operations that are available in IIS Manager. You can use either tool to administer IIS Web sites.

important Important You must be a member of the Administrators group on the local computer to run scripts and executables, or you must have been delegated the appropriate authority. As a security best practice, log on to your computer using an account that is not in the Administrators group, and then use the Run as command to run your script or executable as an administrator. From the command prompt, type runas /user:administrative_accountname "script or executable command".

This topic includes the following information:

  • Syntax: The order in which you must type a command and any arguments and options that follow it.
  • Parameters: The values that are given to variables in the command.
  • Examples: Sample code and an explanation of the results.

Syntax

iisext /DisExt ID [/s Computer [/u [Domain\]User [/p Password]]]

Parameters

ID
Required. Specifies the ID of the Web service extension that is going to be disabled.
/s Computer
Runs the script on the specified remote computer. Type the computer name or IP address without backslashes. By default, the script runs on the local computer.
/u [Domain\]User
Runs the script with the permissions of the specified user account. This account must be a member of the Administrators group on the remote computer. By default, the script runs with the permissions of the current user of the local computer.
/p Password
Specifies the password of the user account that is specified in the /u parameter. If you omit this parameter, the script prompts you for the password and obscures the text you type.

Examples

Example 1:

The following command disables the Web service extension "FlightTimes" on the local computer:

iisext /DisExt FlightTimes

In response, iisext displays the following:

Connecting to server ...Done.
Disabling extension complete.

Example 2:

The following command disables the Web service extension "PassengerList" on a remote computer:

iisext /DisExt PassengerList /s RemoteComputer /u Manager /p Pa$$Werd

In response, iisext displays the following:

Connecting to server ...Done.
Disabling extension complete.
Related Topics
  • For information on enabling Web service extensions, see Enabling Web Service Extensions.
  • For information on listing Web service extensions, see Listing Web Service Extensions.


Listing Web Service Extensions

You can use the command-line script iisext.vbs, which is stored in systemroot\system32, to list Web service extension IDs for all of the defined Web service extensions. The extensions must reside on a computer running a member of the Windows Server 2003 family with IIS 6.0.

Iisext.vbs performs the same operations that are available in IIS Manager. You can use either tool to administer IIS Web sites.

important Important You must be a member of the Administrators group on the local computer to run scripts and executables, or you must have been delegated the appropriate authority. As a security best practice, log on to your computer using an account that is not in the Administrators group, and then use the Run as command to run your script or executable as an administrator. From the command prompt, type runas /user:administrative_accountname "script or executable command".

This topic includes the following information:

  • Syntax: The order in which you must type a command and any arguments and options that follow it.
  • Parameters: The values that are given to variables in the command.
  • Example: Sample code and an explanation of the results.

Syntax

iisext /ListExt [/s Computer [/u [Domain\]User [/p Password]]]

Parameters

/s Computer
Runs the script on the specified remote computer. Type the computer name or IP address without backslashes. By default, the script runs on the local computer.
/u [Domain\]User
Runs the script with the permissions of the specified user account. This account must be a member of the Administrators group on the remote computer. By default, the script runs with the permissions of the current user of the local computer.
/p Password
Specifies the password of the user account that is specified in the /u parameter. If you omit this parameter, the script prompts you for the password and obscures the text you type.

Example

The following command lists all of the Web service extension IDs that are in the WebSvcExtRestrictionList property of the metabase on the local computer:

iisext /ListExt

In response, iisext displays all of the Web service extension IDs that are on the local computer.

Connecting to server ...Done
SSINC
Payroll
ASP
Inventory
ASP.NET
WEBDAV
HTTPODBC
Related Topics
  • For information on enabling Web service extensions, see Enabling Web Service Extensions.
  • For information on disabling Web service extensions, see Disabling Web Service Extensions.


Adding Web Service Extension Files

You can use the command-line script iisext.vbs, which is stored in systemroot\system32, to add a single file to the WebSvcExtRestrictionList property of the metabase. The command can be executed on local or remote computers running a member of the Windows Server 2003 family with IIS 6.0. Web service extension files can be either ISAPI extensions or CGI files.

Iisext.vbs performs the same operations that are available in IIS Manager. You can use either tool to administer IIS Web sites.

important Important You must be a member of the Administrators group on the local computer to run scripts and executables, or you must have been delegated the appropriate authority. As a security best practice, log on to your computer using an account that is not in the Administrators group, and then use the Run as command to run your script or executable as an administrator. From the command prompt, type runas /user:administrative_accountname "script or executable command".

This topic includes the following information:

  • Syntax: The order in which you must type a command and any arguments and options that follow it.
  • Parameters: The values that are given to variables in the command.
  • Examples: Sample code and an explanation of the results.

Syntax

iisext /AddFile Drive:\Path\FileName Access {0|1} ID Deletable {0|1} ShortDesc [/s computer [/u [domain\]user/p password]]

Parameters

Drive:\Path\FileName
Required. Specifies the file name and the path of the Web service extension file that is going to be added.
Access
Required. Numerically designates whether the file is disabled (set to 0) or enabled (set to 1) after it is added.
ID
Required. Specifies the ID of the Web service extension that is associated with the file.
Deletable
Required. Numerically designates whether the file can be deleted from the Web service extension restriction list by using iisext or IIS Manager. Set to 0 to prevent the file from being deleted, or set to 1 to allow the file to be deleted.
ShortDesc
Required. A short description of the Web service extension that is associated with the file. This text can be localized, and it should be the same for all of the files that are associated with the same Web service extension.
/s Computer
Runs the script on the specified remote computer. Type the computer name or IP address without backslashes. By default, the script runs on the local computer.
/u [Domain\]User
Runs the script with the permissions of the specified user account. This account must be a member of the Administrators group on the remote computer. By default, the script runs with the permissions of the current user of the local computer.
/p Password
Specifies the password of the user account that is specified in the /u parameter. If you omit this parameter, the script prompts you for the password and obscures the text you type.
/?
Displays Help at the command prompt.

Examples

Example 1:

The following command adds the file "Timesheet.exe" to the WebSvcExtRestrictionList property of the metabase on the local computer. The Access flag is set to "0" to disable the file on startup, the ID flag identifies the associated Web service extension as "Payroll", and the Deletable flag is set to "1" to allow the file to be deleted from the list of Web service extensions.

iisext /AddFile c:\Source\Timesheet.exe 0 Payroll 1 Payroll

In response, iisext displays the following:

Connecting to server ...Done.
Adding extension file complete.

Example 2:

The following command adds the file "Payscale.dll" to the WebSvcExtRestrictionList property of the metabase on a remote computer. The Access flag is set to "1" to enable the file on startup, the ID flag identifies the associated Web service extension as "Payroll", and the Deletable flag is set to "0" to prevent the file from being deleted from the list of Web service extensions.

iisext /AddFile c:\Source\Payscale.dll 1 Payroll 0 Payroll /s RemoteComputer /u Manager /p Pa$$Werd

In response, iisext displays the following:

Connecting to server ...Done.
Adding extension file complete.
Related Topics
  • For information on enabling Web service extension files, see Enabling Web Service Extension Files.
  • For information on disabling Web service extension files, see Disabling Web Service Extension Files.
  • For information on removing Web service extension files, see Removing Web Service Extension Files.
  • For information on listing Web service extension files, see Listing Web Service Extension Files.


Enabling Web Service Extension Files

You can use the command-line script iisext.vbs, which is stored in systemroot\system32, to enable a single file that is in the WebSvcExtRestrictionList property of the metabase. The command can be executed on local or remote computers running a member of the Windows Server 2003 family with IIS 6.0. Web service extension files can be either ISAPI extensions or CGI files.

Iisext.vbs performs the same operations that are available in IIS Manager. You can use either tool to administer IIS Web sites.

important Important You must be a member of the Administrators group on the local computer to run scripts and executables, or you must have been delegated the appropriate authority. As a security best practice, log on to your computer using an account that is not in the Administrators group, and then use the Run as command to run your script or executable as an administrator. From the command prompt, type runas /user:administrative_accountname "script or executable command".

This topic includes the following information:

  • Syntax: The order in which you must type a command and any arguments and options that follow it.
  • Parameters: The values that are given to variables in the command.
  • Examples: Sample code and an explanation of the results.

Syntax

iisext /EnFile Drive:\Path\FileName [/s computer [/u [domain\]user/p password]]

Parameters

Drive:\Path\FileName
Required. Specifies the file name and the path of the Web service extension file that is going to be enabled.
/s Computer
Runs the script on the specified remote computer. Type the computer name or IP address without backslashes. By default, the script runs on the local computer.
/u [Domain\]User
Runs the script with the permissions of the specified user account. This account must be a member of the Administrators group on the remote computer. By default, the script runs with the permissions of the current user of the local computer.
/p Password
Specifies the password of the user account that is specified in the /u parameter. If you omit this parameter, the script prompts you for the password and obscures the text you type.

Examples

Example 1:

The following command enables the file "Timesheet.exe" in the WebSvcExtRestrictionList property of the metabase on the local computer:

iisext /EnFile c:\Source\Timesheet.exe

In response, iisext displays the following:

Connecting to server ...Done.
Enabling extension file complete.

Example 2:

The following command enables the file "Taxes.dll" in the WebSvcExtRestrictionList property of the metabase on a remote computer:

iisext /EnFile c:\Source\Taxes.dll /s RemoteComputer /u Manager /p Pa$$Werd

In response, iisext displays the following:

Connecting to server ...Done.
Enabling extension file complete.
Related Topics
  • For information on adding Web service extension files, see Adding Web Service Extension Files.
  • For information on disabling Web service extension files, see Disabling Web Service Extension Files.
  • For information on removing Web service extension files, see Removing Web Service Extension Files.
  • For information on listing Web service extension files, see Listing Web Service Extension Files.


Disabling Web Service Extension Files

You can use the command-line script iisext.vbs, which is stored in systemroot\system32, to disable a single file in the WebSvcExtRestrictionList property of the metabase. The command can be executed on local or remote computers running a member of the Windows Server 2003 family with IIS 6.0. Web service extension files can be either ISAPI extensions or CGI files.

Iisext.vbs performs the same operations that are available in IIS Manager. You can use either tool to administer IIS Web sites.

important Important You must be a member of the Administrators group on the local computer to run scripts and executables, or you must have been delegated the appropriate authority. As a security best practice, log on to your computer using an account that is not in the Administrators group, and then use the Run as command to run your script or executable as an administrator. From the command prompt, type runas /user:administrative_accountname "script or executable command".

This topic includes the following information:

  • Syntax: The order in which you must type a command and any arguments and options that follow it.
  • Parameters: The values that are given to variables in the command.
  • Examples: Sample code and an explanation of the results.

Syntax

iisext /DisFile Drive:\Path\FileName [/s computer [/u [domain\]user/p password]]

Parameters

Drive:\Path\FileName
Required. Specifies the file name and the path of the Web service extension file that is going to be disabled.
/s Computer
Runs the script on the specified remote computer. Type the computer name or IP address without backslashes. By default, the script runs on the local computer.
/u [Domain\]User
Runs the script with the permissions of the specified user account. This account must be a member of the Administrators group on the remote computer. By default, the script runs with the permissions of the current user of the local computer.
/p Password
Specifies the password of the user account that is specified in the /u parameter. If you omit this parameter, the script prompts you for the password and obscures the text you type.

Examples

Example 1:

The following command disables the file "Timesheet.exe" in the WebSvcExtRestrictionList property of the metabase on the local computer:

iisext /DisFile c:\Source\Timesheet.exe

In response, iisext displays the following:

Connecting to server ...Done.
Disabling extension file complete.

Example 2:

The following command disables the file "Taxes.dll" in the WebSvcExtRestrictionList property of the metabase on a remote computer:

iisext /DisFile c:\Source\Taxes.dll /s RemoteComputer /u Manager /p Pa$$Werd

In response, iisext displays the following:

Connecting to server ...Done.
Disabling extension file complete.
Related Topics
  • For information on adding Web service extension files, see Adding Web Service Extension Files.
  • For information on enabling Web service extension files, see Enabling Web Service Extension Files.
  • For information on removing Web service extension files, see Removing Web Service Extension Files.
  • For information on listing Web service extension files, see Listing Web Service Extension Files.


Removing Web Service Extension Files

You can use the command-line script iisext.vbs, which is stored in systemroot\system32, to remove a single deleteable file from the WebSvcExtRestrictionList property of the metabase. The command can be executed on local or remote computers running a member of the Windows Server 2003 family with IIS 6.0. Web service extension files can be either ISAPI extensions or CGI files.

Iisext.vbs performs the same operations that are available in IIS Manager. You can use either tool to administer IIS Web sites.

important Important You must be a member of the Administrators group on the local computer to run scripts and executables, or you must have been delegated the appropriate authority. As a security best practice, log on to your computer using an account that is not in the Administrators group, and then use the Run as command to run your script or executable as an administrator. From the command prompt, type runas /user:administrative_accountname "script or executable command".

This topic includes the following information:

  • Syntax: The order in which you must type a command and any arguments and options that follow it.
  • Parameters: The values that are given to variables in the command.
  • Examples: Sample code and an explanation of the results.

Syntax

iisext /RmFile Drive:\Path\FileName [/s Computer [/u [Domain\]User [/p Password]]]

Parameters

Drive\Path\FileName
Required. Specifies the file name and the path of the Web service extension file that is going to be removed from the Web service extension restriction list (WebSvcExtRestrictionList).

note Note If the file has been flagged as undeletable, iisext returns the error message, "Error trying to delete extension. Make sure it exists and is deletable."

/s Computer
Runs the script on the specified remote computer. Type the computer name or IP address without backslashes. By default, the script runs on the local computer.
/u [Domain\]User
Runs the script with the permissions of the specified user account. This account must be a member of the Administrators group on the remote computer. By default, the script runs with the permissions of the current user of the local computer.
/p Password
Specifies the password of the user account that is specified in the /u parameter. If you omit this parameter, the script prompts you for the password and obscures the text you type.

Examples

Example 1:

The following command removes the file "Accounting.dll" from the WebSvcExtRestrictionList property of the metabase on the local computer:

iisext /RmFile c:\Source\Accounting.dll

In response, iisext displays the following:

Connecting to server ...Done.
Removing extension file complete.

Example 2:

The following command removes the file "Taxes.exe" from the WebSvcExtRestrictionList property of the metabase on a remote computer:

iisext /RmFile c:\Source\Taxes.exe /s RemoteComputer /u Manager /p Pa$$Werd

In response, iisext displays the following:

Connecting to server ...Done.
Removing extension file complete.
Related Topics
  • For information on adding Web service extension files, see Adding Web Service Extension Files.
  • For information on enabling Web service extension files, see Enabling Web Service Extension Files.
  • For information on disabling Web service extension files, see Disabling Web Service Extension Files.
  • For information on listing Web service extension files, see Listing Web Service Extension Files.


Listing Web Service Extension Files

You can use the command-line script iisext.vbs, which is stored in systemroot\system32, to list the Web service extension files that are in the WebSvcExtRestrictionList property of the metabase. The command can be executed on local or remote computers running a member of the Windows Server 2003 family with IIS 6.0. Web service extension files can be either ISAPI extensions or CGI files.

Iisext.vbs performs the same operations that are available in IIS Manager. You can use either tool to administer IIS Web sites.

important Important You must be a member of the Administrators group on the local computer to run scripts and executables, or you must have been delegated the appropriate authority. As a security best practice, log on to your computer using an account that is not in the Administrators group, and then use the Run as command to run your script or executable as an administrator. From the command prompt, type runas /user:administrative_accountname "script or executable command".

This topic includes the following information:

  • Syntax: The order in which you must type a command and any arguments and options that follow it.
  • Parameters: The values that are given to variables in the command.
  • Example: Sample code and an explanation of the results.

Syntax

iisext /ListFile [/s Computer [/u [Domain\]User [/p Password]]]

Parameters

/s Computer
Runs the script on the specified remote computer. Type the computer name or IP address without backslashes. By default, the script runs on the local computer.
/u [Domain\]User
Runs the script with the permissions of the specified user account. This account must be a member of the Administrators group on the remote computer. By default, the script runs with the permissions of the current user of the local computer.
/p Password
Specifies the password of the user account that is pecified in the /u parameter. If you omit this parameter, the script prompts you for the password and obscures the text you type.

Example

The following command lists all of the Web service extension files that are in the WebSvcExtRestrictionList property of the metabase on the local computer:

iisext /ListFile

In response, iisext displays all of the Web service extension files that are on the local computer.

Connecting to server ...Done
E:\Windows\system32\inetsrv\asp.dll
E:\Windows\system32\inetsrv\httpodbc.dll
E:\Windows\system32\inetsrv\ssinc.dll
E:\Windows\system32\inetsrv\httpext.dll
E:\Windows\system32\Microsoft.NET\Framework\v1.0.3705\aspnet_isapi.dll
c:\Source\Taxes.dll
c:\Source\Accounting.dll
c:\Source\Taxes.exe
c:\Source\Timesheet.exe
c:\Source\Payscale.dll
Related Topics
  • For information on adding Web service extension files, see Adding Web Service Extension Files.
  • For information on enabling Web service extension files, see Enabling Web Service Extension Files.
  • For information on disabling Web service extension files, see Disabling Web Service Extension Files.
  • For information on removing Web service extension files, see Removing Web Service Extension Files.


Listing Running Web Applications

You can use the command-line script iisapp.vbs, which is stored in systemroot\system32, to view any worker processes that are currently running. This command is often used for troubleshooting.

The computer issuing the command must be running Windows XP or a member of the Windows Server 2003 family. The computer that the command affects must be running a member of the Windows Server 2003 family with IIS 6.0.

important Important You must be a member of the Administrators group on the local computer to run scripts and executables, or you must have been delegated the appropriate authority. As a security best practice, log on to your computer using an account that is not in the Administrators group, and then use the Run as command to run your script or executable as an administrator. From the command prompt, type runas /user:administrative_accountname "script or executable command".

This topic includes the following information:

  • Syntax: The order in which you must type a command and any arguments and options that follow it.
  • Parameters: The values that are given to variables in the command.
  • Examples: Sample code and an explanation of the results.

Syntax

iisapp [a/ AppPoolName | /p AppPoolID]

Parameters

/a AppPoolName
Optional. Specifies the name of a particular application pool.
/p AppPoolID
Optional. Specifies an application pool by its ID number.

Examples

Example 1:

The following command displays all of the application pools that are running on the local computer:

iisapp

In response, iisapp displays all of the currently running applications, identifying each application pool by its process ID (PID) and application pool ID (AppPoolID). Iisapp omits all of the optional parameters and accepts the default values.

W3wp.exe PID: 2232   AppPoolID: DefaultAppPool
W3wp.exe PID: 2608   AppPoolID: MyAppPool

Example 2:

Use the following command to view a specific application by entering its PID:

iisapp /p 2608

In response, iisapp displays the specified application.

W3wp.exe PID: 2608   AppPoolID: MyAppPool


Web Application Guide

This section includes information about configuring Web applications using Microsoft® ASP.NET. In this section you will find information about configuration, security, and deployment.

This section includes the following information:

  • .NET Framework: Provides an introduction to the Microsoft .NET Framework.
  • ASP.NET: Provides information on ASP.NET configuration, deployment, and security.
  • ASP: Provides an overview of what is new in Microsoft Active Server Pages (ASP).
Related Topics
  • For information on writing server-side scripts with ASP and creating ASP applications, see the Active Server Pages Guide on MSDN® Online or in the Internet Information Services (IIS) Software Development Kit (SDK).
  • For reference topics related to ASP, see the ASP references on MSDN Online or in the IIS SDK.


.NET Framework

important Important This feature is not available on Windows XP 64-Bit Edition and the 64-bit versions of the Windows Server 2003 family. For more information, see Features unavailable on 64-bit versions of the Windows Server family.

The Microsoft .NET Framework is a new computing platform that simplifies application development in the distributed environment of the Internet. The .NET Framework is designed to provide an object-oriented programming environment that guarantees the safe execution of code, and to eliminate the performance problems of scripted environments.

The .NET Framework has two main components: the common language runtime and the .NET Framework class library. Microsoft ASP.NET hosts the runtime to provide core services such as memory management, thread management, and remoting while enforcing strict type safety and other forms of code accuracy that ensure security and robustness. Code management is a fundamental principle of the runtime; code that targets the runtime is called managed code, while code that does not target the runtime is called unmanaged code.

The .NET Framework class library is a comprehensive, object-oriented collection of reusable types that developers can use to create ASP.NET applications.

Common Language Runtime Features

The common language runtime manages memory, thread execution, code execution, code safety verification, compilation, and other system services. These features are intrinsic to the managed code that runs on the common language runtime hosted by ASP.NET. Managed components are granted varying degrees of trust, depending on a number of factors including their origin (such as the Internet, enterprise network, or local computer). This means that a managed component might or might not be able to perform sensitive functions, even if it is being used in the same active application.

The runtime enforces code access security. Applications can be granted access to specific resources but cannot access any resources outside of those limits.

The runtime also enforces code robustness by implementing a strict type- and code-verification structure called the common type system (CTS). The CTS ensures that all managed code is self-describing, which means that managed code can consume other types and instances regardless of which language compiler was used to develop the software.

In addition, the managed environment of the runtime eliminates many common software issues. For example, the runtime automatically handles object layout and manages references to objects, releasing them when they are no longer in use. This automatic memory management resolves the two most common application errors: memory leaks and invalid memory references. The runtime is designed to enhance performance. Although the common language runtime provides many standard runtime services, managed code is never interpreted. Just-in-time (JIT) compiling enables all managed code to run in the native machine language of the system on which it is executing. Meanwhile, the memory manager further improves performance.

.NET Framework Class Library Features

The .NET Framework class library is a collection of reusable types that tightly integrate with the common language runtime. The class library is object-oriented, providing types from which applications can derive additional functionality. This makes the .NET Framework types easy to use and it reduces the time associated with learning new features of the .NET Framework. In addition, third-party components can integrate seamlessly with classes in the .NET Framework.

The .NET Framework types enable you to accomplish a range of common programming tasks such as string management, data collection, database connectivity, and file access. In addition, the class library includes types that support a variety of specialized development scenarios.

Related Topics
  • For information on writing, building, testing, and deploying .NET Framework applications, see the Microsoft .NET Framework Software Development Kit.


ASP.NET

important Important This feature is not available on Windows XP 64-Bit Edition and the 64-bit versions of the Windows Server 2003 family. For more information, see Features unavailable on 64-bit versions of the Windows Server family.

Microsoft® ASP.NET is more than just the next generation of Active Server Pages (ASP). It provides an entirely new programming model for creating network applications that take advantage of the Internet. This section includes information on configuration, security, and deployment of ASP.NET applications.

FPSE does not support unicode content directory names or WebDAV. New FPSE virtual servers should be assigned to the MSSharePointPool application pool. Also, do not make changes to the Microsoft SharePoint™ application pool configuration.

note Note If you have a Sharepoint™ Team Services (STS) Web site, the following types of pages do not work without excluding the virtual directory containing the pages from the STS ISAPI filter:

  • ASP pages.
  • ASP.NET pages.
  • PHP pages.
  • PerlScript pages.
To enable these types of pages to work on your STS Web site
  1. In the Central Administration Web site for STS, choose to Manage your virtual directory or Web site.
  2. Under Defined Managed Paths, type the path to the virtual directory that contains your excluded pages (such as <code>\MyASPPages</code>) and select Exclude.

This section includes the following information:

  • Introduction to ASP.NET: Describes the ASP.NET programming model and infrastructure.
  • Why Use ASP.NET?: Describes the differences between ASP.NET and ASP.
  • Introduction to XML Web Services Created with ASP.NET: Defines XML Web services and describes how to use them.
  • ASP.NET Administration: Describes installing, configuring, and deploying ASP.NET applications on a computer running Microsoft Windows® Server 2003.
Related Topics
  • For complete ASP.NET development information, see Creating ASP.NET Web Applications.
  • For information on developing secure ASP.NET applications, see ASP.NET Web Application Security.


Introduction to ASP.NET

ASP.NET is a unified Web application platform that provides the services necessary to build and deploy enterprise-class Web applications. ASP.NET offers a new programming model and infrastructure for more secure, scalable, and stable applications that can target any browser or device.

ASP.NET is part of the Microsoft .NET Framework, a computing environment that simplifies application development in the highly distributed environment of the Internet. The .NET Framework includes the common language runtime, which provides core services such as memory management, thread management, and code security.It also includes the .NET Framework class library, which is a comprehensive, object-oriented collection of types that developers can use to create applications.

ASP.NET offers the following benefits:

  • Manageability: ASP.NET uses a text-based, hierarchical configuration system that simplifies applying settings to your server environment and Web applications. Because configuration information is stored as plain text, new settings can be applied without the aid of local administration tools. Any changes to the configuration files are automatically detected and applied to the application. For more information, see ASP.NET Configuration.
  • Security: ASP.NET provides default authorization and authentication schemes for Web applications. Developers can easily add to, remove, or replace these schemes depending on the needs of the application. For more information, see ASP.NET Security.
  • Easy Deployment: An ASP.NET application is deployed to a server by simply copying the necessary files to the server. No server restart is required, even to deploy or replace running compiled code. For more information, see ASP.NET Deployment.
  • Enhanced Performance: ASP.NET is compiled code running on the server. Unlike traditional Active Server Pages (ASP), ASP.NET can take advantage of early binding, just-in-time (JIT) compilation, native optimization, and caching services right out of the box for improved performance. For more information, see ASP.NET Performance Monitoring.
  • Flexible Output Caching: ASP.NET can cache page data, portions of a page, or whole pages, depending on the needs of the application. Cached items can be dependent on files or other items in the cache, or they can be refreshed based on an expiration policy.
  • Internationalization: ASP.NET uses Unicode internally to represent request and response data. Internationalization settings can be configured for each computer, each directory, and each page.
  • Mobile Device Support: ASP.NET supports any browser on any device. Developers use the same programming techniques to target new mobile devices that they use for traditional desktop browsers.
  • Scalability and Availability: ASP.NET was designed to be scalable, with features specifically tailored to improve performance in clustered and multiprocessor environments. Moreover, processes are closely monitored and managed by Internet Information Services (IIS) and the ASP.NET runtime so that if one misbehaves, a new process can be created in its place, which helps keep your application available to handle requests. For more information, see ASP.NET Process Isolation.
  • Tracing and Debugging: ASP.NET provides tracing services that can be enabled during debugging at both the application and the page level. You can choose to view the information either in a page or using the application-level trace viewing tool. ASP.NET supports local and remote debugging with .NET Framework debugging tools, both during development and when the application is in production. When an application is put into production, tracing statements can be left in the production code with no impact on performance.
  • Integration with the .NET Framework: Because ASP.NET is part of the .NET Framework, the power and flexibility of the entire platform is available to Web applications. The .NET class library, as well as messaging and data access solutions, are all seamlessly accessible from the Web. ASP.NET is language-independent, so developers can choose the language that best applies to the application. In addition, common language runtime interoperability preserves existing investments in COM-based development.
  • Compatibility with Existing ASP Applications: ASP and ASP.NET can run side by side on an IIS Web server without interference; there is no chance of corrupting an existing ASP application by installing ASP.NET. Only files with a .aspx file name extension are processed by ASP.NET. Files with a .asp file name extension will continue to be processed by the ASP engine. You should note, however, that session state and application state are not shared between ASP and ASP.NET pages.

ASP.NET enables two features for distributed applications: Web Forms and XML Web services. These two features are supported by the same configuration and debugging infrastructure.

  • Web Forms technology enables you to build powerful form-based Web pages. Web Forms pages use reusable built-in or custom components to simplify the code of a page.
  • XML Web services that are created using ASP.NET enable you to access servers remotely. Using XML Web services, businesses can provide programmatic interfaces to their data or business logic, which in turn can be obtained and manipulated by client and server applications. XML Web services enable the exchange of data using standards such as XML messaging and HTTP across firewalls in client/server and server/server scenarios. Programs written in any language and running on any operating system can call XML Web services.
Related Topics
  • For more information on how IIS 6.0 handles the configuration of ASP.NET differently for each of the two application isolation modes, see ASP.NET and IIS 6.0.


Why Use ASP.NET?

Microsoft ASP.NET is more than just the next generation of Active Server Pages (ASP). It provides an entirely new programming model for creating network applications that take advantage of the Internet.

  • Improved Performance and Scalability
    • Compiled Execution: ASP.NET is much faster than classic ASP, while preserving the "just hit save" update model of ASP. No explicit compile step is required. ASP.NET automatically detects any change, dynamically compiles files if needed, and stores the compiled results to reuse for subsequent requests. Dynamic compilation ensures that your application is always up to date, and compiled execution makes it fast. Most applications migrated from classic ASP to ASP.NET see a 3x to 5x increase in pages served.
    • Rich Output Caching: ASP.NET output caching can dramatically improve the performance and scalability of your application. When output caching is enabled on a page, ASP.NET executes the page once and saves the result in memory before sending it to the user. When another user requests the same page, ASP.NET serves the cached result from memory without re-executing the page. Output caching is configurable, and it can be used to cache individual regions or an entire page.
    • Web Farm Session State: ASP.NET session state lets you share session data across all machines in a Web farm. Now a user can hit different servers in the Web farm over multiple requests and still have full access to session data.
  • Enhanced Reliability
    • Memory Leak, Dead Lock, and Crash Protection: ASP.NET automatically detects and recovers from errors such as dead locks and memory leaks to ensure that your application is always available. For example, when a memory leak is detected, ASP.NET automatically starts up a new copy of the ASP.NET worker process and directs all new requests to the new process. After the old process has finished processing pending requests, it is gracefully disposed of and the leaked memory is released.
  • Easy Deployment
    • "No Touch" Application Deployment: With ASP.NET you can deploy an entire application by copying it to the server. Configuration settings are stored in an XML file within the application.
    • Dynamic Update of Running Application: ASP.NET lets you update compiled components without restarting the Web server. Unlike classic COM components that required the Web server to be manually restarted when an update was deployed, ASP.NET automatically detects the change and starts using the new code.
    • Easy Migration Path: ASP.NET runs side by side on IIS with classic ASP applications on Microsoft Windows® 2000 and Windows XP, and on members of the Windows Server 2003 family. You can migrate one application at a time, or even single pages. ASP.NET even lets you continue to use your existing classic COM business components.
  • New Application Models
    • XML Web Services: XML Web services allow applications to communicate and share data over the Internet, regardless of operating system or programming language. ASP.NET makes exposing and calling XML Web services simple.
    • Mobile Web Device Support: ASP.NET mobile controls let you target over 80 mobile Web devices using ASP.NET. You write the application once, and the mobile controls automatically generate pages for the requesting device.
  • Developer Productivity
    • Easy Programming Model: ASP.NET makes building real-world Web applications dramatically easier with server controls that let you build great pages with far less code than classic ASP.
    • Flexible Language Options. ASP.NET supports not only Microsoft Visual Basic® Scripting Edition (VBScript) and Microsoft JScript® but also more than 25 .NET languages, including built-in support for Visual Basic .NET, Microsoft C#, and JScript .NET.
    • Rich Class Framework: The .NET Framework class library offers over 4,500 classes that encapsulate rich functionality such as XML, data access, file upload, regular expressions, image generation, performance monitoring and logging, transactions, message queuing, and SMTP mail.


Introduction to XML Web Services Created with ASP.NET

An XML Web service is a programmable entity that provides a particular function, such as application logic, and is accessible to systems using Internet standards such as XML, HTTP, and SOAP. Applications written in any language and running on any operating system can call XML Web services.

An XML Web service can be used internally by a single application or exposed externally over the Internet for use by any number of applications. Because it is accessible through a standard interface, an XML Web service allows heterogeneous systems to work together as a single web of computation. One of the core characteristics of an XML Web service is the high degree of abstraction that exists between the implementation and consumption of a service. Because an XML Web service is created and accessed using XML-based messaging, the XML Web service provider and the client need no knowledge of each other beyond inputs, outputs, and location.

The XML Web services infrastructure provides a discovery mechanism to locate XML Web services, a service description for defining how to use those services, and standard wire formats for communication.

Discovery is the process of locating one or more documents that describe a particular XML Web service using the Web Services Description Language (WSDL). Once a service is found, the WSDL document provides a description of the interactions that the service supports. XML Web services communicate using open wire formats, which are protocols that can be understood by any system capable of supporting the most common Web standards. SOAP is the key protocol for XML Web service communication.

ASP.NET enables you to build and publish XML Web services using the same programming constructs that are used to build and publish ASP.NET Web pages. XML Web services created with ASP.NET use the industry standards shown in the following table.

Industry standard | Use in XML Web services created with ASP.NET
XML | The text format used when communicating with XML Web services using SOAP. When communicating with XML Web services using the HTTP-GET and HTTP-POST protocols, XML is used to encode the response.
SOAP | An XML-based message exchange protocol used for communication between XML Web services and their clients.
Web Services Description Language (WSDL) | Describes the contract of messages that an XML Web service can interpret when communicating with an XML Web service client.
XML Schema Definition language (XSD) | Provides a universal type system, allowing data types to be defined and passed across platforms. For an XML Web service, XSD defines the structure and data types for the XML encapsulated within a SOAP message sent to and from an XML Web service.
application/x-www-form-urlencoded | A MIME type used for encoding parameters on a URL. This encoding is used for encoding request parameters to XML Web services using the HTTP-GET and HTTP-POST protocols.


ASP.NET Administration

Text inserted here from common.xml - iis_aspnet_64bit

This document is for administrators responsible for establishing and maintaining Microsoft® ASP.NET applications on production servers. It covers common concepts and tasks that administrators need to be familiar with, from setting up ASP.NET on server computers to monitoring ASP.NET applications once they are deployed.

This section includes the following information:

  • ASP.NET Setup: Describes how to install and uninstall ASP.NET on the platforms that support it and how to identify and solve common problems with a new ASP.NET installation.
  • ASP.NET Web Application Overview: Defines ASP.NET applications and the file types and directories they contain.
  • ASP.NET Configuration: Describes how to configure ASP.NET applications and includes reference information on each of the ASP.NET configuration elements.
  • ASP.NET Security: Describes how to work with authorization and authentication in ASP.NET applications.
  • ASP.NET Deployment: Describes how to distribute ASP.NET applications and components from development and test servers to production servers.
  • ASP.NET Process Isolation: Describes the process models that Internet Information Services (IIS) 6.0 and ASP.NET use.
  • ASP.NET Performance Monitoring: Describes the tools available to monitor the performance of your ASP.NET applications and includes a list of performance counters that are exposed by ASP.NET.
  • Additional Resources: Contains a list of other sources of information on administering ASP.NET applications.


ASP.NET Setup

Microsoft® ASP.NET is installed with the Microsoft .NET Framework through Web downloads, Microsoft Visual Studio® .NET installations, and as a service on all products in the Microsoft Windows® Server 2003 family.

note Note ASP.NET is a part of the .NET Framework. You must install the .NET Framework to install ASP.NET.

This section describes the necessary steps to install and enable ASP.NET on all platforms that support it. It also explains how to uninstall ASP.NET and includes a troubleshooting section that addresses common problems encountered once ASP.NET is installed.

This section includes the following information:

  • Installing ASP.NET: Describes the software requirements for ASP.NET and how to install it on servers running a product in the Windows Server 2003 family.
  • Uninstalling ASP.NET: Describes how to remove an ASP.NET installation from a server.
  • Troubleshooting an ASP.NET Installation: Explains how to solve common problems encountered once ASP.NET is installed on a server.
  • ASP.NET IIS Registration Tool (Aspnet_regiis.exe): Explains how to use the ASP.NET IIS Registration tool to create script maps that point from your application to a particular version of ASP.NET and the .NET Framework.
Related Topics
  • For introductory information on the ASP.NET administration guide, see ASP.NET Administration.


Installing ASP.NET

ASP.NET is supported on the Windows Server 2003 family, Windows 2000 (Professional, Server, and Advanced Server), and Windows XP Professional for both client and server applications.

A server running a member of the Microsoft Windows Server 2003 family can be configured as an application server, with ASP.NET as an option that you can enable while configuring the application server role. To deploy ASP.NET Web applications to a production server, you must be sure to enable the ASP.NET and IIS roles on the production server before you distribute the application.

note Note If you want to install ASP.NET on a domain controller, there are special steps you must take to make the installation work properly. For more information, see article Q315158, "ASP.NET Does Not Work with the Default ASPNET Account on a Domain Controller," in the Microsoft Knowledge Base at http://support.microsoft.com.

ASP.NET, along with the .NET Framework version 1.1, is installed as a part of Windows Server 2003. You simply need to add it as a new program from Control Panel or enable it by using the Configure Your Server wizard.

note Note When you use the Configure Your Server wizard or the Add or Remove Programs dialog box to install ASP.NET on a server running Windows Server 2003, ASP.NET is automatically enabled in IIS Manager. However, if you install ASP.NET from a Web download or as part of an application such as Visual Studio .NET, you must enable ASP.NET manually. For instructions, see the To enable ASP.NET in IIS Manager on a server running Windows Server 2003 procedure, later in this topic.

To install ASP.NET on a server running Windows Server 2003 using the Configure Your Server wizard

  1. From the Start menu, click Manage Your Server; in the Manage Your Server window, click Add or remove a role.
  2. In the Configure Your Server wizard, click Next, and in the Server Role dialog box, check Application Server (IIS, ASP.NET) and then click Next.
  3. In the Application Server Options dialog box, select the Enable ASP.NET check box, click Next, and then click Next again.
  4. If necessary, insert your Windows Server 2003 installation CD in the CD-ROM drive and then click Next.
  5. When the installation is complete, click Finish.

To install ASP.NET on a server running Windows Server 2003 using the Add or Remove Programs dialog box

  1. From the Start menu, point to Control Panel, and then click Add or Remove Programs.
  2. In the Add or Remove Programs dialog box, click Add/Remove Windows Components.
  3. In the Components box in the Windows Components wizard, select the Application Server check box, and then click Next.
  4. When the Windows Components wizard has finished configuring Windows Server 2003, click Finish.

To enable ASP.NET in IIS Manager on a server running Windows Server 2003

  1. From the Start menu, click Run.
  2. In the Open box in the Run dialog box, type inetmgr, and then click OK.
  3. In IIS Manager, expand the local computer and then click Web Service Extensions.
  4. In the right pane, right-click ASP.NET and then click Allow. The status of ASP.NET changes to Allowed.

Related Topics
  • ASP.NET Setup
  • Uninstalling ASP.NET
  • Troubleshooting an ASP.NET Installation


Uninstalling ASP.NET

On Windows Server 2003, you can use the Configure Your Server wizard or use the Add or Remove Programs dialog box in Control Panel to disable or uninstall ASP.NET.

note Note There are specific issues that you need to understand if you are uninstalling a version of ASP.NET from a server with multiple versions. For more information, see Managing Multiple Versions of ASP.NET.

The following procedures describe how to remove ASP.NET and the .NET Framework from all server platforms that support them. You might also need to uninstall to troubleshoot an installation of ASP.NET.

To uninstall ASP.NET from a computer running Windows Server 2003 using the Configure Your Server wizard

  1. From the Start menu, click Manage Your Server; in the Manage Your Server window, click Add or remove a role.
  2. In the Configure Your Server wizard, click Next, and in the Server Role dialog box, uncheck Application Server (IIS, ASP.NET), and then click Next.
  3. When the setup program is complete, click Finish.

To uninstall ASP.NET and the .NET Framework from a computer running Windows Server 2003

  1. From the Start menu, point to Control Panel, and then click Add or Remove Programs.
  2. In the Currently installed programs box, click Microsoft .NET Framework (language) version, and then click the Change/Remove button.

    note Note In the program name, language is a placeholder that represents the language of the version of the .NET Framework that you want to remove from your server, and version represents the version number of the installation you want to remove from your server.

  3. In the Add or Remove Programs dialog box, click Yes.
  4. Answer any questions from the setup program.

Related Topics
  • ASP.NET Setup
  • Installing ASP.NET
  • Troubleshooting an ASP.NET Installation


Troubleshooting an ASP.NET Installation

There are a few problems that commonly occur with new ASP.NET installations:

  • You have installed ASP.NET and the .NET Framework on the server, but when you request a page from your application, nothing happens and the request does not resolve.

    You need to install and enable IIS on the server before you install the .NET Framework. Either you can uninstall the .NET Framework from the server, install IIS, then reinstall the .NET Framework, or you can install IIS, then use the ASP.NET IIS Registration tool (Aspnet_regiis.exe) to configure the script maps that IIS uses for ASP.NET file name extensions. For more information, see Uninstalling ASP.NET, Setting Application Mappings, and the To repair IIS mappings for ASP.NET using Aspnet_regiis.exe procedure, later in this topic.

  • You have installed ASP.NET and the .NET Framework with IIS installed and enabled, then uninstalled and reinstalled IIS. When you request a page from your application, nothing happens and the request does not resolve.

    When you uninstalled and reinstalled IIS, the script maps that IIS uses for ASP.NET were broken. Use Aspnet_regiis.exe to configure the script maps that IIS uses for ASP.NET file name extensions. For more information, see the To repair IIS mappings for ASP.NET using Aspnet_regiis.exe procedure, later in this topic.

  • You have installed and enabled IIS, installed ASP.NET and the .NET Framework, deployed your application, and requested a page, but you receive one of the following error messages:
    • Access denied to 'C:\Inetpub\Wwwroot' directory. Failed to start monitoring directory changes.
    • Server cannot access application directory 'C:\Inetpub\Wwwroot\ Virtual Directory Name \'. The directory does not exist or is not accessible because of security settings.

    The proper permissions have not been set for the Web site or virtual directory. ASP.NET requires read, execute, and list access for the ASPNET account (the Aspnet_wp.exe process account) on the root Web site or on any virtual directory. These settings are necessary so that ASP.NET can access the content files and can monitor file changes. To correct this problem, follow the steps in the following procedure.

To add read, execute, and list permissions for the ASPNET account on the root Web site or on a virtual directory

  1. In Windows Explorer, browse to the folder that contains the root Web site (which is C:\Inetpub\Wwwroot by default) or the virtual directory.
  2. Right-click the folder and then click Properties.
  3. On the Security tab, click Add.
  4. Type ComputerName\ASPNET (for example, on a computer named Webdev, type Webdev\ASPNET) and then click OK.
  5. Allow the following permissions for the ASPNET account: Read & Execute, List Folder Contents, and Read.
  6. Click OK to close the Properties dialog box and to save the changes.

    note Note You do not need to perform these steps if the Everyone group or the Users group has read access to the root Web site or virtual directory.

To repair IIS mappings for ASP.NET using Aspnet_regiis.exe

  1. From the Start menu, click Run.
  2. In the Open box in the Run dialog box, type cmd, and then click OK.
  3. At the command prompt in the new window, type the following line:

    "%systemroot%\Microsoft.NET\Framework\version\aspnet_regiis.exe" –i.

    In this path, version represents the version number of the .NET Framework installed on your server. You must replace this placeholder with the actual version number when you type the command.

    note Note You must include the quotation marks in the command.

    For more information on Aspnet_regiis.exe, use repeat step 3 with -? as an argument, or see ASP.NET IIS Registration Tool (Aspnet_regiis.exe).

Also, on Windows Server 2003, if you have installed the .NET Framework and ASP.NET from a Web download or through Visual Studio .NET, you must enable ASP.NET manually from IIS Manager. For more information, see Installing ASP.NET.

note Note If you want to install ASP.NET on a domain controller, there are special steps you must take to make the installation work properly. For more information, see article Q315158, "ASP.NET Does Not Work with the Default ASPNET Account on a Domain Controller," in the Microsoft Knowledge Base at http://support.microsoft.com.

Related Topics
  • ASP.NET Setup
  • Installing ASP.NET
  • Uninstalling ASP.NET


ASP.NET IIS Registration Tool (Aspnet_regiis.exe)

When multiple versions of the .NET Framework are executing side by side on a single computer, the ASP.NET ISAPI version scriptmapped to an ASP.NET application determines which version of the common language runtime is used for the application. The ASP.NET IIS Registration tool (Aspnet_regiis.exe) allows an administrator or installation program to easily update the scriptmaps for an ASP.NET application to point to the ASP.NET ISAPI version associated with the tool. The tool can also be used to display the status of all installed versions of ASP. NET, register the ASP.NET version coupled with the tool, create client-script directories, and perform other configuration operations.

Aspnet_regiis [options]

You can specify one or more of the following options.

Option | Description
-c | Installs the client-side scripts for ASP.NET, such as client-side validation scripts, to the aspnet_client subdirectory of each IIS site directory. note Note Only the client-side scripts for the ASP.NET version associated with Aspnet_regiis.exe are installed.
-e | Removes the client-side scripts for ASP.NET from the aspnet_client subdirectory of each IIS site directory. note Note Only the client-side scripts for the ASP.NET version associated with Aspnet_regiis.exe are removed.
-ea | Removes the client-side scripts for all versions of ASP.NET from the Aspnet_client subdirectory of each IIS site directory.
-i | Installs the version of ASP.NET associated with Aspnet_regiis.exe and updates the scriptmaps at the IIS metabase root and below. note Note Only the scriptmaps for applications that use an earlier version of the ASP.NET are updated. Applications that use a later version are not affected.
-ir | Installs the version of ASP.NET associated with Aspnet_regiis.exe and only registers ASP.NET in IIS. note Note This option does not update the scriptmaps. To install ASP.NET and update the scriptmaps, use the -i option.
-k path | Removes the scriptmaps to all versions of ASP.NET from all ASP.NET applications at the specified application root path and its subdirectories.
-kn path | Removes the scriptmaps to all versions of ASP.NET from the ASP.NET application only at the specified application root path. note Note This option does not affect applications in subdirectories of path.
-lk | Lists the path and version of all IIS metabase keys where ASP.NET is scriptmapped. note Note The keys that inherit ASP.NET scriptmaps from a parent key are not displayed.
-lv | Lists the status and installation path of all versions of ASP.NET installed on the computer.
-r | Updates all scriptmaps in the IIS metabase and below to point to the ASP.NET ISAPI version associated with Aspnet_regiis.exe. note Note All existing scriptmaps are updated to point to the ASP.NET ISAPI version associated with Aspnet_regiis.exe, regardless of the current version.
-s path | Installs the scriptmap pointing to the ASP.NET ISAPI version associated with Aspnet_regiis.exe to all ASP.NET application at the specified application root path and its subdirectories. All existing scriptmaps in the specified path and below that use an earlier version of the ASP.NET ISAPI are updated.
-sn path | Installs the scriptmap pointing to the ASP.NET ISAPI version associated with Aspnet_regiis.exe to the ASP.NET application at the specified application root path. All existing scriptmaps in the specified path that use an earlier version of the ASP.NET ISAPI are updated. note Note This option does not affect applications in subdirectories of path.
-u | Uninstalls the version of ASP.NET associated with Aspnet_regiis.exe from the computer. Existing scriptmaps to this version of the ASP.NET ISAPI are automatically remapped to the highest remaining ASP.NET ISAPI version installed.
-ua | Uninstalls all versions of ASP.NET from the computer.
-? | Displays the command syntax and options for the tool.

Remarks

When multiple versions of ASP.NET are installed on a computer, ASP.NET is said to be running side-by-side. In this setup, Internet Information Services (IIS) needs to know which version of the ASP.NET ISAPI (aspnet_isapi.dll) should process a page in an ASP.NET application. The ASP.NET ISAPI version associated with an ASP.NET application determines which version of the common language runtime is used for the application. An ASP.NET application is associated with an ASP.NET ISAPI version through a scriptmap in IIS. To simplify the configuration process for an ASP.NET application, each version of ASP.NET comes with a linked version of Aspnet_regiis.exe.

note Note A unique version of Aspnet_regiis.exe is included with each version of the .NET Framework. Since each version of the tool is applicable only to its associated version of the .NET Framework, be sure to use the appropriate version of the tool to configure an ASP.NET application.

Aspnet_regiis.exe is commonly used with the -s or -sn option to remap an ASP.NET application to the version of the .NET Framework that is associated with the tool. Use the -s option to update the applications at the specified root path and in all its subdirectories. If you don't want applications in subdirectories to be updated, use the -sn option. To update the scriptmaps of all existing ASP.NET applications on the computer at once, use the -r option.

note Note The path parameter refers to the root path of the application, not the physical path. For example, W3SVC/1/ROOT/SampleApp1.

Conversely, you can use the tool to remove the scriptmaps to any version of ASP.NET from an application using the -k or -kn option and specifying the root path of the application.

note Note If the root path specified inherits its scriptmap from a parent root path, the -k and -kn options will have no effect.

The tool can also be used to install and uninstall the linked version of ASP.NET. Use the -i option to install ASP.NET and to update the scriptmaps of all existing ASP.NET applications. Use the -ir option to install ASP.NET without updating the scriptmaps. To uninstall the ASP.NET version associated with the tool, use the -u option. If you want to uninstall all versions of ASP.NET from the computer, use the -ua option.

You can use Aspnet_regiis.exe to view information about ASP.NET. To list the status and installation path of all installed versions of ASP.NET, use the -lv option. If you would like to see the paths to all IIS metabase keys where ASP.NET is scriptmapped, use the -lk option.

Client-side script, such as client-side validation, can be installed and removed using Aspnet_regiis.exe. To install the client-side script for the version of ASP.NET associated with the tool to the aspnet_client subdirectory of each IIS site directory, use the -c option. To remove the client-side script for just the ASP.NET version associated with the tool, use the -e option. To remove the client-side script for all installed versions of ASP.NET, use the -ea option.

For more information on side-by-side execution in ASP.NET, see Side-by-Side Support in ASP.NET. For more information on script maps and application root path, see Setting Application Mappings.

Examples

The following command installs the scriptmaps pointing to the ASP.NET version associated with Aspnet_regiis.exe to the SampleApp1 application and all its sub-applications.

Aspnet_regiis -s W3SVC/1/ROOT/SampleApp1

The following command only updates the scriptmaps for the SampleApp1 application, without affecting applications in subdirectories.

Aspnet_regiis -sn W3SVC/1/ROOT/SampleApp1

The following command installs the ASP.NET version associated with the tool and updates the scriptmaps of all existing ASP.NET applications. Note that only applications that are currently scriptmapped to an earlier version of ASP.NET are affected.

Aspnet_regiis -i

The following command installs the ASP.NET version associated with the tool, but does not update the scriptmaps of existing ASP.NET applications

Aspnet_regiis -ir

The following command displays the status and installation path of all versions of ASP.NET installed on the computer.

Aspnet_regiis -lv

Related Topics
  • ASP.NET Setup
  • Installing ASP.NET
  • Uninstalling ASP.NET
  • Side-by-Side Support in ASP.NET
  • Troubleshooting an ASP.NET Installation


ASP.NET Web Application Overview

A Microsoft® ASP.NET application is defined as all the files and executable code that can be invoked from a virtual directory and its subdirectories on a Web server. These can include Web pages (.html files), Web Forms pages (.aspx files), Web Forms user controls (.ascx files), XML Web Services (.asmx files), HTTP handlers, HTTP modules, and other files (such as image and configuration files). Any script maps that are associated with the version of the Microsoft .NET Framework that you are using are also a part of an ASP.NET application.

If an ASP.NET application has been developed using Microsoft Visual Studio® .NET, a project DLL is stored in the \Bin directory under the application's root directory. Any other DLLs that provide functionality that the application uses, whether it has been developed using Visual Studio or not, must reside in the \Bin directory as well. These can include compiled ASP.NET custom server controls, business logic, and database access logic.

The relationship between an ASP.NET application and Internet Information Services (IIS) is this: IIS serves all requests for publishable ASP.NET files through aspnet_isapi.dll (the process model for ASP.NET). IIS does not process the server-side code; the ASP.NET engine does that and then returns the output to IIS (or another Web server, possibly) to be served from that software.

This section includes the following information

  • Layout of ASP.NET Web Applications: Describes the guidelines for creating a file structure for an ASP.NET application.
  • Viewing the ASP.NET Version: Describes how to determine which version of the .NET Framework, and ASP.NET, an application is using.
Related Topics
  • For introductory information on the ASP.NET administration guide, see ASP.NET Administration.
  • For information on how to deploy an ASP.NET application from a development or test server to a production server, see ASP.NET Deployment.
  • For information on how to use Web.config files to create configuration settings for an ASP.NET application, see ASP.NET Configuration.


Layout of ASP.NET Web Applications

An ASP.NET application must reside in an IIS virtual directory, known as the application root. ASP.NET applications can contain compiled assemblies (usually DLL files that contain business logic); a well-known directory, always named \Bin, where precompiled code is stored; configuration settings stored in a text-based, human-readable Web.config file; pages; server controls; and XML Web services.

Any precompiled code that is not shared with other applications on the server must be stored in the application's \Bin directory. This is the local assembly cache for the application.

note Note If you intend to use the same assembly in multiple applications on your Web server, you should deploy that assembly to the global assembly cache. For more information, see Deploying Shared Components to the Global Assembly Cache.

Web.config files store application-wide configuration settings in an XML-based text file. This means that you can use any standard text editor or XML parser to create them, and that they are readable. If you do not include a Web.config file in the application root, configuration settings are determined by those set in the Machine.config file, the configuration file for the entire server. A version of the Machine.config file is installed when you install the .NET Framework. For more information about configuration files, see ASP.NET Configuration.

The following illustration shows a sample file system layout for an ASP.NET application.

A Sample ASP.NET Application Virtual Structure

The application in this illustration includes two DLL files in the \Bin directory, a Default.aspx page, a user control named Menu.ascx, an XML Web service named MyWebService.asmx, and a Global.asax file. In addition, the application is configured using three configuration files: the machine-level Machine.config file in the system root directory, the site-level Web.config file in the C:\Inetpub\Wwwroot directory, and the application-level Web.config file in the application root directory. Configuration settings stored in the application root override the settings in the site's Web.config file and the Machine.config file, while the site's Web.config file overrides settings in the Machine.config file.

note Note ASP.NET applications are composed of virtual directory structures, not physical directory structures. Configuration settings are applied to virtual paths.

Related Topics
  • ASP.NET Web Application Overview
  • ASP.NET Deployment
  • ASP.NET Configuration
  • Viewing the ASP.NET Version


Viewing the ASP.NET Version

The version of the Framework used by an ASP.NET application is determined by the version of the aspnet_isapi.dll file that is registered under the IIS script maps for that application. A script map is a three-way association of a file name extension, such as .aspx; an HTTP verb associated with a request, such as GET; and the DLL that contains instructions for what the Web server should do when it receives an HTTP request for a file with the specified file name extension. You can set these script maps to the application root directory itself, which is an IIS virtual directory, or allow them to be inherited from a parent application or site.

To view script maps for file name extensions in your application

  1. From the Start menu, click Run, type inetmgr in the Open box, and then click OK.
  2. In IIS Manager, expand the local computer, expand Web Sites, expand Default Web Site, and then click the name of your application.
  3. Right-click the application name, and then click Properties.
  4. On the Directory tab, click Configuration. All the script maps associated with your application appear alphabetically by file name extension in the Application Mappings box.

Configuring Script Maps

ASP.NET provides a command-line tool, called the ASP.NET IIS Registration tool (Aspnet_regiis.exe), to make it easy to configure script maps for your applications. If you have multiple versions of ASP.NET installed on your Web server, a version of this tool is provided with each. You can use the tool associated with a particular version of ASP.NET to register your application with that version.

The –s and –sn commands included in Aspnet_regiis.exe install the current version to the specified path, included as an argument on the command line. The –s command installs the specified version of ASP.NET to the specified application root and all its virtual subdirectories. This command updates all existing script maps in the specified path and below that use an earlier version of the ASP.NET ISAPI. The –sn command installs the specified version of ASP.NET to the directory specified in the path argument only; it does not install the version to subdirectories. For example, the following entry on the command line creates a script map between the version of ASP.NET associated with the tool version and the SampleApp1 directory, along with all its subdirectories:

aspnet_regiis.exe -s W3SVC/1/ROOT/SampleApp1

Aspnet_regiis.exe has other utility purposes as well, such as registering a version of ASP.NET (which includes registering the Aspnet_isapi.dll, setting up the state server, setting up the worker process account, and so on) and creating client script directories for that version of ASP.NET. It can also list all installed versions of ASP.NET and which applications use each version. For more information about this tool, see ASP.NET IIS Registration Tool (Aspnet_regiis.exe).

For more information about running multiple ASP.NET applications on a server using different versions of the .NET Framework, see Side-By-Side Support in ASP.NET.

Related Topics
  • ASP.NET Web Application Overview
  • ASP.NET Deployment
  • Side-By-Side Support in ASP.NET
  • Layout of ASP.NET Web Applications


ASP.NET Configuration

The Microsoft® ASP.NET configuration system features an extensible infrastructure that enables you to define configuration settings when your ASP.NET applications are first deployed so that you can add or revise configuration settings at any time with minimal impact on operational Web applications and servers.

The ASP.NET configuration system provides the following benefits:

  • Configuration information is stored in XML-based text files. You can use any standard text editor or XML parser to create and edit ASP.NET configuration files.
  • Multiple configuration files, all named Web.config, can appear in multiple directories on an ASP.NET Application server. Each Web.config file applies configuration settings to its own directory and all child directories below it. Configuration files in child directories can supply configuration information in addition to that inherited from parent directories, and the child directory configuration settings can override or modify settings defined in parent directories. The root configuration file named systemroot\Microsoft.NET\Framework\versionNumber\CONFIG\Machine.config provides ASP.NET configuration settings for the entire Web server.
  • At run time, ASP.NET uses the configuration information provided by the Web.config files in a hierarchical virtual directory structure to compute a collection of configuration settings for each unique URL resource. The resulting configuration settings are then cached for all subsequent requests to a resource. Note that inheritance is defined by the incoming request path (the URL), not the file system paths to the resources on disk (the physical paths).
  • ASP.NET detects changes to configuration files and automatically applies new configuration settings to Web resources affected by the changes. The server does not have to be rebooted for the changes to take effect. Hierarchical configuration settings are automatically recalculated and recached whenever a configuration file in the hierarchy is changed. The <processModel> section is an exception.
  • The ASP.NET configuration system is extensible. You can define new configuration parameters and write configuration section handlers to process them.
  • ASP.NET helps protect configuration files from outside access by configuring Internet Information Services (IIS) to help prevent direct browser access to configuration files. HTTP access error 403 (forbidden) is returned to any browser attempting to request a configuration file directly.

This section includes the following information:

  • Format of ASP.NET Configuration Files: Explains how ASP.NET configuration files are organized.
  • Hierarchical Configuration Architecture: Explains configuration setting inheritance.
Related Topics
  • For introductory information on the ASP.NET administration guide, see ASP.NET Administration.


Format of ASP.NET Configuration Files

Configuration information for ASP.NET resources is contained in a collection of configuration files, each named Web.config. Each configuration file contains a nested hierarchy of XML tags and subtags with attributes that specify the configuration settings. Because the tags must be well-formed XML, the tags, subtags, and attributes are case-sensitive. Tag names and attribute names are camel-cased, which means that the first character of a tag name is lowercase and the first letter of any subsequent concatenated words is uppercase. Attribute values are Pascal-case, which means that the first character is uppercase and the first letter of any subsequent concatenated words is uppercase. Exceptions are true and false, which are always lowercase.

All configuration information resides between the <configuration> and </configuration> root XML tags. Configuration information between the tags is grouped into two main areas: the configuration section handler declaration area and the configuration section settings area.

Configuration section handler declarations appear at the top of the configuration file between <configSections> and </configSections> tags. Each declaration contained in a <section> tag specifies the name of a section that provides a specific set of configuration data and the name of the .NET Framework class that processes configuration data in that section.

The configuration section settings area follows the <configSections> area and contains the actual configuration settings. There is one configuration section for each declaration in the <configSections> area. Each configuration section contains subtags with attributes that contain the settings for that section.

The following Web.config file example declares two configuration <section> handlers. One manages application settings and the other manages session state.

<configuration>
   <configSections>
      <section name="appSettings"
         type="System.Configuration.NameValueFileSectionHandler,
         System, Version=1.0.3300.0,
         Culture=neutral, PublicKeyToken=b77a5c561934e089"/>
      <section name="sessionState"
         type="System.Web.SessionState.SessionStateSectionHandler,
         System.Web, Version=1.0.3300.0, Culture=neutral,
         PublicKeyToken=b03f5f7f11d50a3a"
         allowDefinition="MachineToApplication"/>
   </configSections>

   <appSettings>
      <add key="dsn" value="localhost;uid=MyUserName;pwd=;"/>
      <add key="msmqserver" value="server\myqueue"/>
   </appSettings>

   <sessionState cookieless="true" timeout="10"/>
</configuration>

You need to declare a configuration section handler only once. You can place it in the server's root Machine.config file or in a Web.config file in the virtual directory containing the Web application files. Configuration files in subdirectories automatically inherit configuration handlers declared in parent directories. For more information, see Configuration Inheritance.

Configuration settings are often nested together under section grouping tags. These top-level section tags typically represent the namespace to which the configuration settings apply. For example, the top-level <system.net> tag represents the settings for network classes, and the <system.web> tag represents the settings for the ASP.NET classes.

The following example shows tag nesting.

<configuration>
   <configSections>
      <sectionGroup name="system.net">
         <section name="authenticationModules"
            type="System.Net.Configuration.NetAuthenticationModuleHandler,
            System, Version=1.0.3300.0, Culture=neutral,
            PublicKeyToken=b77a5c561934e089"/>
         <section name="webRequestModules"
            type="System.Net.Configuration.WebRequestModuleHandler,
            System, Version=1.0.3300.0, Culture=neutral,
            PublicKeyToken=b77a5c561934e089"/>
       </sectionGroup>

       <sectionGroup name="system.web">
          <section name="authorization"
             type="System.Web.Configuration.AuthorizationConfigHandler,
             System.Web, Version=1.0.3300.0, Culture=neutral,
             PublicKeyToken=b03f5f7f11d50a3a"/>
          <section name="sessionState"
             type="System.Web.SessionState.SessionStateSectionHandler,
             System.Web, Version=1.0.3300.0, Culture=neutral,
             PublicKeyToken=b03f5f7f11d50a3a"
             allowDefinition="MachineToApplication"/>
       </sectionGroup>
    </configSections>

   <system.net>
      <! — Net Class Settings would go here. -->
   </system.net>
   <system.web>
        <authorization>
            <allow users="*"/> <!-- Allow all users -->
            <!-- Allow or deny specific users.
            allow users="[comma separated list of users]"
                  roles="[comma separated list of roles]"/>
            <deny users="[comma separated list of users]"
                  roles="[comma separated list of roles]"/>
            -->
        </authorization>
        <sessionState
            sqlConnectionString="data source=localhost;
               Integrated Security=SSPI;
               Initial Catalog=northwind"
            cookieless="false"
            timeout="10"/>
   </system.web>
</configuration>

The ASP.NET configuration infrastructure makes no assumptions about the types of configuration data that the infrastructure supports. Configuration section handler classes process all Web.config data. You can use the predefined configuration section handlers that are supplied with the .NET Framework or you can create your own handlers to process your own custom configuration data.

Related Topics
  • ASP.NET Configuration


Hierarchical Configuration Architecture

ASP.NET applies configuration settings to resources in a hierarchical manner. Site-wide Web.config configuration files supply configuration information to the directories in which they are located and to all child directories. The configuration settings for a Web resource are supplied by the configuration file located in the same directory as the resource and by all configuration files in all parent directories.

Configurations settings are inherited from file to file in a virtual path, with the Machine.config file, which helps control configuration settings for the entire server, at the root. Web.config files that are stored in the virtual path help control their sites and virtual roots.

In This Section

Configuration Inheritance
Describes how to design virtual paths so that configuration problems will not arise in your ASP.NET applications.
Configuration <location> Settings
Describes how to customize configurations settings to apply to a specific directory or resource in that directory.
Locking Configuration Settings
Describes how to make configuration settings on a site unchangeable, particularly for administrators who host Web applications.

Related Sections

ASP.NET Configuration
Describes how to configure ASP.NET applications
Layout of ASP.NET Web Applications
Describes the guidelines for creating a file structure for an ASP.NET application.


Configuration Inheritance

When the server receives a request for a particular Web resource, ASP.NET computes the configuration settings for that resource hierarchically, using all the configuration files located in the virtual directory path for the requested URL. For example, you could have a Web site with the following file structure, where the application root directory is the application virtual directory (Vdir).

Normally, the last configuration setting overwrites settings for the same section provided in parent directories, but the section handler might implement a different inheritance scheme.

For example, as the administrator, you could configure the application settings to allow all users access to the ASP.NET resources in the application root directory (the physical directory mapped by the application virtual directory) but allow only selected users access to the ASP.NET resources in the two subdirectories.

Assume that there is a Web.config file in the SubDir1 directory and none in the application root or SubDir2 directories. In this case, ASP.NET is using two configuration files. The highest-level file is the one located in the systemroot\Microsoft .NET \Framework\versionNumber\CONFIG directory. This file, named Machine.config, is at the machine level, and all ASP.NET directories and subdirectories inherit its settings. Machine.config is shipped with the.NET Framework and contains many default ASP.NET settings. The default setting for the security configuration section of this file allows all users to access all URL resources. There is no configuration file in the example's application root directory that modifies security, so all users have access to the ASP.NET resources in it (because that directory inherits from the machine-level configuration file). If the Web.config file in the SubDir1 directory contains a security configuration section that allows access only to certain users, then SubDir2 inherits that setting. So, all users have access to the ASP.NET resources in the application root directory, but only certain users have access to the ASP.NET resources in SubDir1 and SubDir2.

Configuration settings for virtual directories are independent of physical directory structure, and virtual directories must be organized carefully to avoid configuration problems. For example, you could have an application named MyResource.aspx with the following physical directory structure.

C:\Subdir1\Subdir2\MyResource.aspx

Assume a configuration file is located in Subdir1 and a virtual directory named Vdir1 is mapped to c:\Subdir1 and a virtual directory named Vdir2 is mapped to c:\Subdir1\Subdir2. If a client accesses the resource physically located at c:\Subdir1\Subdir2\MyResource.aspx using the URL http://localhost/vdir1/subdir2/MyResource.aspx, the resource inherits configuration settings from Vdir1. However, if the client accesses the same resource using the URL http://localhost/vdir2/MyResource.aspx, it does not inherit settings from Vdir1. Therefore, creating virtual directories in this manner could cause unexpected results or even an application failure and is not recommended.

note Note The ASP.NET configuration system applies only to ASP.NET resources (those registered to be handled by ASP.NET using the Aspnet_isapi.dll). The configuration system does not provide authorization for non-ASP.NET resources by default. ASP, HTML, TXT, GIF, and JPEG files, for example, are accessible by all users. In the preceding example, if directory browsing is enabled and no other restrictions are in place, all users can view non-ASP.NET files located in the application root directory, SubDir1, and SubDir2. For more information about ASP.NET security, see ASP.NET Security.

Related Topics
  • Hierarchical Configuration Architecture


Configuration <location> Settings

Configuration settings can be applied to specific resources by using a <location> tag with an appropriate path attribute. The path attribute can be used to identify a specific file or child directory to which unique configuration settings apply.

For example, the following configuration file specifies settings at three levels:

  • Settings that apply to the current directory and all child directories (everything contained within the top <configuration> tag).
  • Settings that apply to the Sub1 child directory (everything contained within the <location> tag with a path attribute set to Sub1).
  • Settings that apply to the Sub2 child directory (everything contained within the <location> tag with a path attribute set to Sub2).
<configuration>
   <system.web>
      <sessionState cookieless="true" timeout="10"/>
   </system.web>

   <!— Configuration for the "Sub1" subdirectory. -->
   <location path="sub1">
      <system.web>
         <httpHandlers>
            <add verb="*" path="Sub1.Scott" type="Sub1.Scott"/>
            <add verb="*" path="Sub1.David" type="Sub1.David"/>
         </httpHandlers>
      </system.web>
   </location>

   <!— Configuration for the "Sub2" subdirectory. -->
   <location path="sub2">
      <system.web>
         <httpHandlers>
            <add verb="*" path="Sub2.Scott" type="Sub2.Scott"/>
            <add verb="*" path="Sub2.David" type="Sub2.David"/>
         </httpHandlers>
      </system.web>
   </location>
</configuration>

Related Topics
  • Hierarchical Configuration Architecture


Locking Configuration Settings

By default, configuration files located in subdirectories override and extend all configuration settings defined in parent configuration files. In application hosting scenarios, administrators often want to lock or make some settings on a site unchangeable to prevent modification. For example, an administrator might want to lock the sandbox security settings for hosted applications to help prevent Web users from attacking the system.

Administrators can lock configuration settings by adding an allowOverride="false" attribute to a <location> directive. This tells the configuration system to throw an error if a lower-level configuration file attempts to override any configuration section defined within this locked <location> directive.

The following configuration file example (which could be stored at either the main system level or at the site level) locks the trust level of two different ASP.NET applications (application1 and application2).

<configuration>
   <location path="application1" allowOverride="false">
      <system.web>
         <trust level="High"/>
      </system.web>
   </location>

   <location path="application2" allowOverride="false">
      <system.web>
         <trust level="Medium"/>
      </system.web>
   </location>
</configuration>

Any attempt to override the configuration settings in the preceding example by the configuration settings in the following example would generate a configuration system error.

<configuration>
   <system.web>
      <trust level="Full"/>
   </system.web>
</configuration>

Related Topics
  • Hierarchical Configuration Architecture


ASP.NET Settings Schema Reference

The ASP.NET configuration section schema contains elements that help control how ASP.NET Web applications behave. Where a default value is specified for an attribute, the default value is set in the Machine.config file that is located at systemroot\Microsoft.NET\Framework\versionNumber\Config\Machine.config.

The following list shows all elements that can be included in a Web.config file, the order in which they should appear, and the nesting of elements within one another.

Example Configuration Structure:

<configuration>
<location>
<system.web>
<authentication>
<forms>
<credentials>
<passport>
<authorization>
<allow>
<deny>
<browserCaps>
<result>
<use>
<filter>
<case>
<clientTarget>
<add>
<remove>
<clear>
<compilation>
<compilers>
<compiler>
<assemblies>
<add>
<remove>
<clear>
<customErrors>
<error>
<globalization>
<httpHandlers>
<add>
<remove>
<clear>
<httpModules>
<add>
<remove>
<clear>
<httpRuntime>
<identity>
<machineKey>
<pages>
<processModel>
<securityPolicy>
<trustLevel>
<sessionState>
<trace>
<trust>
<webServices>
<protocols>
<add>
<remove>
<clear>
<serviceDescriptionFormatExtensionTypes>
<add>
<remove>
<clear>
<soapExtensionTypes>
<add>
<clear>
<soapExtensionReflectorTypes>
<add>
<clear>
<soapExtensionImporterTypes>
<add>
<clear> Element
<WsdlHelpGenerator>
</webServices>
</system.web>
</location>
</configuration>

The following table provides a brief description of all elements that can be included in a Web.config file.

Element | Description
<system.web> | Specifies the root element for the ASP.NET configuration section.
<add> for <assemblies> | Adds an assembly reference to use during compilation of a dynamic resource.
<add> for <clientTarget> | Adds an alias for a specific user agent to an internal collection of user agent aliases.
<add> for <httpHandlers> | Adds a reference to an assembly to use during compilation of a dynamic resource.
<add> for <httpModules> | Adds a reference to an assembly to use during compilation of a dynamic resource.
<add> for <protocols> | Adds a transmission protocol that the .NET Framework can use to decrypt data sent from a client browser in the HTTP request.
<add> for <serviceDescriptionFormatExtensionTypes> | Adds a service description format extension to run within the scope of the configuration file.
<add> for <soapExtensionTypes>, <soapExtensionImporterTypes>, and <soapExtensionReflectorTypes> | Adds a SOAP extension to run with all XML Web services within the scope of the configuration file.
<allow> | Allows access to a resource.
<assemblies> | Specifies ASP.NET compilation processing directives.
<authentication> | Configures ASP.NET authentication support.
<authorization> | Configures ASP.NET authorization support.
<browserCaps> | Configures the settings for the browser capabilities component.
<case> | Allows pattern matching to stop after processing the first successful match out of a number of alternatives.
<clear> | Removes all references to items appropriate to the parent tag.
<clientTarget> | Adds aliases for specific user agents to an internal collection of user agent aliases.
<compilation> | Contains all the compilation settings used by ASP.NET.
<compiler> | Defines a new compiler option.
<compilers> | Specifies the compilers that the ASP.NET application supports.
<credentials> | Allows optional definition of name and password credentials within the configuration file.
<customErrors> | Defines custom error messages for an ASP.NET application and the pages that a browser is redirected to when errors occur.
<deny> | Specifies that access to a resource is denied.
<error> | Defines one custom error condition that will be handled by a custom error page.
<filter> | Allows multiple rules to be applied in sequence.
<forms> | Configures an ASP.NET application for custom forms-based authentication.
<globalization> | Configures the globalization settings of an application.
<httpHandlers> | Maps incoming URL requests to IHttpHandler classes.
<httpModules> | Adds, removes, or clears HTTP modules within an application.
<httpRuntime> | Configures ASP.NET HTTP runtime settings. This section can be declared at the machine, site, application, or subdirectory level.
<identity> | Helps control the application identity of the Web application.
<location> | Specifies the resource that configuration settings apply to.
<machineKey> | Configures keys to use for encryption and decryption of forms authentication cookie data. This section allows developers to configure a validation key that performs message authentication checks on view state data and forms authentication tickets. It can be declared at the machine, site, or application levels, but not at the subdirectory level.
<pages> | Identifies page-specific configuration settings.
<passport> | Specifies the page to redirect to if the page requires authentication and the user has not signed on with Microsoft Passport authentication.
<processModel> | Configures the ASP.NET process model settings on Internet Information Services (IIS) Web server systems.
<protocols> | Specifies the transmission protocols that ASP.NET can use to decrypt data sent from a client browser in the HTTP request.
<remove> for <assemblies> | Removes a reference to an assembly.
<remove> for <clientTarget> | Removes an alias for a specific user agent from an internal collection of user agent aliases.
<remove> for <httpHandlers> | Removes a verb/path mapping to an HttpHandler class.
<remove> for <httpModules> | Removes a reference to an HttpModule class. The value of <remove> must exactly match that of a previous <add> directive.
<remove> for <protocols> | Removes a single protocol from a specific application's list of supported HTML encoding protocols.
<remove> for <serviceDescriptionFormatExtensionTypes> | Removes a single service description format extension type from within the scope of the configuration file.
<result> | The HttpCapabilitiesBase-derived class used to hold the results (key-value string pairs) from parsing this section. This string is used at run time to create the return type.
<securityPolicy> | Defines valid mappings of named security levels to policy files. This section can be declared at the machine, site, or application levels.
<serviceDescriptionFormatExtensionTypes> | Specifies the service description format extensions to run within the scope of the configuration file.
<sessionState> | Configures some session-state settings for the current application.
<soapExtensionImporterTypes> | Specifies the SOAP extensions to run when a service description for an XML Web service within the scope of the configuration file is accessed.
<soapExtensionReflectorTypes> | Specifies the SOAP extensions to run when a service description is generated for all XML Web services within the scope of the configuration file.
<soapExtensionTypes> | Specifies the SOAP extensions to run with all XML Web services within the scope of the configuration file.
<trace> | Configures the ASP.NET trace service.
<trust> | Configures the code access security permission set used to run a particular application. This section can be declared at the machine, site, and application levels.
<trustLevel> | Defines the mapping of specific security levels to named policy files.
<use> | Specifies the HTTP request strings sent to this parser.
<user> | Allows definition of user name and password credentials within the configuration file.
<webServices> | Helps control the settings of XML Web services created using ASP.NET.
<WsdlHelpGenerator> | Specifies the .aspx Help page for an XML Web service.

Related Topics
  • ASP.NET Configuration


<configuration> Element

The root element in every configuration file used by the common language runtime and .NET Framework applications.

note Note For a complete list of elements that the <configuration> element can contain, see the Configuration File Schema topic in the Reference section of .NET Framework Help .

<configuration>

<configuration>
   <!-- configuration settings -->
</configuration>

Child Elements

Element | Description
<system.web> Element | Specifies the root element for the ASP.NET configuration section. Contains configuration elements that configure ASP.NET Web applications and help control how the applications behave.
<location> Element | Specifies the resource that specified configuration settings apply to.

Remarks

Each configuration file must contain exactly one <configuration> element.

Related Topics
  • ASP.NET Settings Schema Reference


<system.web> Element

Specifies the root element for the ASP.NET configuration section. Contains configuration elements that configure ASP.NET Web applications and help control how the applications behave.

Example Configuration Structure:

<configuration>
<system.web>

<system.web>
   <authentication>
   <authorization>
   <browserCaps>
   <clientTarget>
   <compilation>
   <customErrors>
   <globalization>
   <httpHandlers>
   <httpModules>
   <httpRuntime>
   <identity>
   <machineKey>
   <pages>
   <processModel>
   <securityPolicy>
   <serviceDescriptionFormatExtensionTypes>
   <sessionState>
   <trace>
   <trust>
   <webServices>
</system.web>

Child Elements

Element | Description
<authentication> | Configures ASP.NET authentication support.
<authorization> | Configures ASP.NET authorization support.
<browserCaps> | Configures the settings for the browser capabilities component.
<clientTarget> | Adds aliases for specific user agents to an internal collection of user agent aliases.
<compilation> | Contains all the compilation settings used by ASP.NET.
<customErrors> | Defines custom error messages for an ASP.NET application.
<globalization> | Configures the globalization settings of an application.
<httpHandlers> | Maps incoming URL requests to IHttpHandler classes.
<httpModules> | Adds, removes, or clears HTTP modules within an application.
<httpRuntime> | Configures ASP.NET HTTP runtime settings. This section can be declared at the machine, site, application, or subdirectory level.
<identity> | Helps control the application identity of the Web application.
<machineKey> | Configures keys to use for encryption and decryption of forms authentication cookie data. This section allows developers to configure a validation key that performs message authentication checks on view state data and forms authentication tickets. It can be declared at the machine, site, or application levels, but not at the subdirectory level.
<pages> | Identifies page-specific configuration settings.
<processModel> | Configures the ASP.NET process model settings on Internet Information Services (IIS) Web server systems.
<securityPolicy> | Defines valid mappings of named security levels to policy files. This section can be declared at the machine, site, or application levels.
<sessionState> | Configures the session-state module.
<trace> | Configures the ASP.NET trace service.
<trust> | Configures the code access security permission set used to run a particular application. This section can be declared at the machine, site, and application levels.
<webServices> | Helps control the settings of XML Web services created using ASP.NET.

Related Topics
  • ASP.NET Configuration
  • ASP.NET Settings Schema


<add> Element for <assemblies>

Adds an assembly reference to use during compilation of a dynamic resource. ASP.NET automatically links this assembly to the resource when compiling each code module.

Example Configuration Structure:

<configuration>
<system.web>
<assemblies>
<add>

Syntax

<add assembly="Assembly [,Version=version number]
    [,Culture=culture] [,PublicKeyToken=token]"/>

Required Attribute

Attribute | Description
assembly | Specifies a comma-separated assembly combination consisting of version, culture, and public key tokens. ASP.NET searches for the assembly DLL first in the application's private \Bin directory and then in the system assembly cache.

Remarks

The value of <add> is an assembly name, not a DLL path. ASP.NET looks up the assembly name to find its physical DLL location. You can optionally specify the wildcard character * (an asterisk) to add every assembly within an application's private assembly cache. For details, see Assembly.Load in Microsoft .NET Framework Help.

Example

The following example adds an assembly reference to an application.

<configuration>
   <system.web>
      <compilation>
         <assemblies>
            <add assembly="System.Data, Version=1.0.2411.0,
                           Culture=neutral,
                           PublicKeyToken=b77a5c561934e089"/>
         </assemblies>
      </compilation>
   </system.web>
</configuration>

Requirements

  • Contained Within: <system.web>
  • Web Platform: Internet Information Services (IIS) 5.0
  • Configuration File: Machine.config, Web.config
  • Configuration Section Handler: System.Web.UI.CompilationConfigurationHandler

Related Topics
  • <assemblies> Element
  • ASP.NET Configuration
  • ASP.NET Settings Schema


<add> Element for <clientTarget>

Adds an alias for a specific user agent to an internal collection of user agent aliases.

Example Configuration Structure:

<configuration>
<system.web>
<clientTarget>
<add>

Syntax

<add alias="alias for user agent"
    userAgent="user agent identification"/>

Required Attributes

Attribute | Description
alias | The name used to refer to a specific user agent.
userAgent | The user agent's identification.

Remarks

The collection of user agent aliases indicates the target user agents that ASP.NET server controls should render content for.

Example

The following example adds four user agent aliases to the internal user agent alias collection.

<configuration>
   <system.web>
      <clientTarget>
         <add alias="ie5" userAgent="Mozilla/4.0 (compatible;
                     MSIE 5.5; Windows NT 4.0)"/>
         <add alias="ie4" userAgent="Mozilla/4.0 (compatible;
                     MSIE 4.0; Windows NT 4.0)"/>
         <add alias="uplevel" userAgent="Mozilla/4.0 (compatible;
                     MSIE 4.0; Windows NT 4.0)"/>
         <add alias="downlevel" userAgent="Unknown"/>
      </clientTarget>
   </system.web>
</configuration>

Requirements

  • Contained Within: <system.web>
  • Web Platform: Internet Information Services (IIS) 5.0
  • Configuration File: Machine.config, Web.config
  • Configuration Section Handler: System.Web.Configuration.ClientTargetSectionHandler

Related Topics
  • <clientTarget> Element
  • ASP.NET Configuration
  • ASP.NET Settings Schema


<add> Element for <httpHandlers>

Adds a handler to an application. A handler is an IHttpHandler or IHttpHandlerFactory class that processes requests for specific URLs.

Example Configuration Structure:

<configuration>
<system.web>
<httpHandlers>
<add>

Syntax

<add verb="verb list"
    path="path/wildcard"
    type="type,assemblyname"
    validate="true|false"/>

Required Attributes

Attribute | Description
verb | The verb list can be either a comma-separated list of HTTP verbs (for example, "GET, PUT, POST") or a start-script mapping (for example, the wildcard character * [an asterisk]).
path | The path attribute can contain either a single URL path or a simple wildcard string (for example, *.aspx).
type | Specifies a comma-separated class/assembly combination. ASP.NET searches for the assembly DLL first in the application's private \Bin directory and then in the system assembly cache.

Optional Attribute

Attribute | Description
validate | If validate is set to false, ASP.NET will not attempt to load the class until the actual matching request comes, potentially delaying the error but improving start-up time.

Remarks

The <add> directives are processed in top-down sequential order. If two or more <add> subtags specify the same verb/path combination, the final <add> overrides all others.

Example

The following example maps all HTTP requests to the classes MyHandler.New and MyHandler.Fin in the assembly MyHandler that is in the file MyHandler.dll.

<configuration>
   <system.web>
      <httpHandlers>
         <add verb="*" path="MyHandler.New"
              type="MyHandler.New, MyHandlerAssembly"/>
         <add verb="*" path="*.myNewFileExtension"
              type="MyHandler.Fin, MyHandlerAssembly"/>
      </httpHandlers>
   <system.web>
</configuration>

Requirements

  • Contained Within: <system.web>
  • Web Platform: Internet Information Services (IIS) 5.0
  • Configuration File: Machine.config, Web.config
  • Configuration Section Handler: System.Web.Configuration.HttpHandlersSectionHandler

Related Topics
  • <httpHandlers> Element
  • ASP.NET Configuration
  • ASP.NET Settings Schema


<add> Element for <httpModules>

Adds a module to a Web application.

Example Configuration Structure:

<configuration>
<system.web>
<httpModules>
<add>

Syntax

<add name="ModuleName"
    type=".NET Class, Assembly [,Version=version number]
    [,Culture=culture] [,PublicKeyToken=token]"/>

Required Attributes

Attribute | Description
name | Provides a friendly name for the module. This enables you to associate an event handler for module events within the Global.asax file.
type | Specifies a comma-separated class/assembly combination consisting of version, culture, and public key tokens. ASP.NET searches for the assembly DLL first in the application's private \Bin directory and then in the system assembly cache.

Remarks

The <add> directives are processed in top-down sequential order. If two or more <add> subtags specify the same verb/path combination, the final <add> overrides all others.

Example

The following example adds a module to an application.

<configuration>
   <system.web>
      <httpModules>
         <add name="OutputCache"
              type="System.Web.Caching.OutputCacheModule, System.Web,
                    Version=1.0.2800.0, Culture=neutral,
                    PublicKeyToken=b03f5f7f11d50a3a"/>
      </httpModules>
   <system.web>
</configuration>

Requirements

  • Contained Within: <system.web>
  • Web Platform: Internet Information Services (IIS) 5.0
  • Configuration File: Machine.config, Web.config
  • Configuration Section Handler: System.Web.Configuration.HttpModulesConfigurationHandler

Related Topics
  • <HttpModules> Element
  • ASP.NET Configuration
  • ASP.NET Settings Schema


<add> Element for <protocols>

Adds a transmission protocol that the .NET Framework can use to decrypt data sent from a client browser in the HTTP request. The data sent in an HTTP request to an XML Web service contains method invocation calls and method parameter lists.

Example Configuration Structure:

<configuration>
<system.web>
<webServices>
<protocols>
<add>

Syntax

<add name="protocol name"/>

Required Attribute

Attribute | Value | Description
name |  | The name of the protocol to add that can be used to decrypt or deserialize XML Web service method calls and associated parameters.
 | HttpGet | Adds the HTTP GET protocol. Method names and parameters are passed in the query string that is appended to the request URL after the question mark (?).
 | HttpPost | Adds the HTTP POST protocol. Method names and parameters are passed in the free format area of the HTTP request.
 | HttpSoap | Adds the HTTP SOAP protocol.
 | Documentation | Adds the special Documentation protocol. When this protocol is enabled and the .asmx page is requested directly, ASP.NET runs a helper page to create a documentation page that is delivered to the requesting client.

Example

The following example enables all four currently supported protocols.

<configuration>
   <system.web>
      <webServices>
         <protocols>
            <add name="HttpSoap"/>
            <add name="HttpPost"/>
            <add name="HttpGet"/>
            <add name="Documentation"/>
         </protocols>
      </webServices>
   </system.web>
</configuration>

Requirements

  • Contained Within: <system.web>
  • Web Platform: Internet Information Services (IIS) 5.0
  • Configuration File: Machine.config, Web.config
  • Configuration Section Handler: System.Web.Services.Configuration.WebServicesConfigurationSectionHandler

Related Topics
  • <protocols> Element
  • ASP.NET Configuration
  • ASP.NET Settings Schema


<add> Element for <serviceDescriptionFormatExtensionTypes>

Adds a service description format extension to run within the scope of the configuration file.

Example Configuration Structure:

<configuration>
<system.web>
<webServices>
<serviceDescriptionFormatExtensionTypes>
<add>

Syntax

<add type="service description format extension type"/>

Required Attribute

Attribute | Description
type | Specifies the service description format extension class to add.

Example

The following example adds a service description format extension class.

<configuration>
   <system.web>
      <webServices>
         <serviceDescriptionFormatExtensionType>
            <add name="NameOfClass"/>
         </serviceDescriptionFormatExtensionType>
      </webServices>
   </system.web>
</configuration>

Requirements

  • Contained Within: <system.web>
  • Web Platform: Internet Information Services (IIS) 5.0
  • Configuration File: Machine.config, Web.config
  • Configuration Section Handler: System.Web.Services.Configuration.WebServicesConfigurationSectionHandler

Related Topics
  • <serviceDescriptionFormatExtensionTypes> Element
  • <webServices>
  • ASP.NET Configuration
  • ASP.NET Settings Schema


<add> Element for <soapExtensionTypes>, <soapExtensionImporterTypes>, and <soapExtensionReflectorTypes>

Adds a SOAP extension to run with all XML Web services within the scope of the configuration file.

Example Configuration Structure:

<configuration>
 <system.web>
  <webServices>
   <soapExtensionTypes>
     <add>

      <soapExtensionImporterTypes>
        <add>

         <soapExtensionReflectorTypes>
           <add>
Syntax
<add type="soap extension class"
    priority="number"
    group="0|1"/>

Required Attributes

Attribute | Value | Description
type |  | Specifies the SOAP extension class to add.
priority |  | Indicates the relative order in which a SOAP extension runs when multiple SOAP extensions are specified. Within each group, the priority attribute distinguishes the overall relative priority of the SOAP extension. A lower priority number indicates a higher priority for the SOAP extension. The lowest possible value for the priority attribute is 1.
group |  | Along with priority, specifies the relative order in which a SOAP extension runs when multiple SOAP extensions are configured to run.
 | 0 | Indicates that the SOAP extension executes in the group of SOAP extensions with the highest priority.
 | 1 | Indicates that the SOAP extension executes in the group of SOAP extensions with the lowest priority.

Example

The following example adds a SOAP extension type.

<configuration>
   <system.web>
      <webServices>
         <soapExtensionType>
            <add name="TypeName" priority="2" group="0"/>
         </soapExtensionType>
      </webServices>
   </system.web>
</configuration>

Requirements

  • Contained Within: <system.web>
  • Web Platform: Internet Information Services (IIS) 5.0
  • Configuration File: Machine.config, Web.config
  • Configuration Section Handler: System.Web.Services.Configuration.WebServicesConfigurationSectionHandler

Related Topics
  • <soapExtensionTypes> Element
  • <soapExtensionImporterTypes> Element
  • <soapExtensionReflectorTypes> Element
  • <webServices>
  • ASP.NET Configuration
  • ASP.NET Settings Schema


<allow> Element

Allows access to a resource.

Example Configuration Structure:

<configuration>
<system.web>
<authorization>
<allow>

Syntax

<allow users="comma-separated list of users"
    roles="comma-separated list of roles"
    verbs="comma-separated list of verbs/>"

Optional Attributes

Attribute | Description
users | A comma-separated list of users that are granted access to the resource. A question mark (?) allows anonymous users; an asterisk (*) allows all users.
roles | A comma-separated list of roles that are granted access to the resource.
verbs | A comma-separated list of HTTP transmission methods that are granted access to the resource. Verbs registered to ASP.NET are GET, HEAD, POST, and DEBUG.

Example

The following example denies access to all users and allows access to all members of the Admins role.

<configuration>
   <system.web>
      <authorization>
         <deny users="*"/>
         <allow roles="Admins"/>
      </authorization>
   </system.web>
</configuration>

Requirements

  • Contained Within: <system.web>
  • Web Platform: Internet Information Services (IIS) 5.0
  • Configuration File: Machine.config, Web.config
  • Configuration Section Handler: System.Web.Configuration.AuthorizationConfigHandler

Related Topics
  • <authorization> Element
  • ASP.NET Configuration
  • ASP.NET Settings Schema


<assemblies> Element

Specifies the assemblies that are used during compilation of an ASP.NET resource.

Example Configuration Structure:

<configuration>
<system.web>
<compilation>
<assemblies>

<assemblies>
   <add assembly="assembly"/>
   <remove assembly="assembly"/>
   <clear/>
</assemblies>

Subtags

Subtag | Description
<add> | Adds an assembly reference to use during compilation of a dynamic resource. ASP.NET automatically links this assembly to the resource when compiling each code module. The value of <add> is an assembly name, not a DLL path. ASP.NET looks up the assembly name to find its physical DLL location. You can optionally specify the wildcard character * (an asterisk) to add every assembly within an application's private assembly cache, which is located either in the \Bin subdirectory of an application or in the.NET Framework install directory (systemroot\Microsoft.NET\Framework\version\).
<remove> | Removes the specified assembly reference from the compile settings. The value of <remove> must exactly match that of a previous <add> directive. Wildcard selections are not supported.
<clear> | Removes all assembly references currently contained in or inherited by the specified Web.config file.

Example

The following example adds an assembly reference to an application.

<configuration>
   <compilation>
      <assemblies>
         <add assembly="System.Data, Version=1.0.2411.0,
                        Culture=neutral,
                        PublicKeyToken=b77a5c561934e089"/>
      </assemblies>
   </compilation>
</configuration>

Requirements

  • Contained Within: <system.web>
  • Web Platform: Internet Information Services (IIS) 5.0
  • Configuration File: Machine.config, Web.config
  • Configuration Section Handler: System.Web.UI.CompilationConfigurationHandler

Related Topics
  • <compilation> Element
  • ASP.NET Configuration
  • ASP.NET Settings Schema


<authentication> Element

Configures ASP.NET authentication support. This element can be declared only at the machine, site, or application level. Any attempt to declare it in a configuration file at the subdirectory or page level will result in a parser error message.

Example Configuration Structure:

<configuration>
<system.web>
<authentication>

<authentication mode="Windows|Forms|Passport|None">
   <forms name="name"
          loginUrl="url"
          protection="All|None|Encryption|Validation"
          timeout="30" path="/" >
      <credentials passwordFormat="Clear|SHA1|MD5">
         <user name="username" password="password"/>
      </credentials>
   </forms>
   <passport redirectUrl="internal"/>
</authentication>

Required Attribute

Attribute | Option | Description
mode |  | Controls the default authentication mode for an application.
 | Windows | Specifies Windows authentication as the default authentication mode. Use this mode when using any form of Internet Information Services (IIS) authentication: Basic, Digest, Integrated Windows authentication (NTLM/Kerberos), or certificates.
 | Forms | Specifies ASP.NET forms-based authentication as the default authentication mode.
 | Passport | Specifies Microsoft Passport authentication as the default authentication mode.
 | None | Specifies no authentication. Only anonymous users are expected or applications can handle events to provide their own authentication.

Subtags

Subtag | Description
<forms> | Configures an ASP.NET application for custom forms-based authentication.
<passport> | Specifies the page to redirect to if the page requires authentication and the user has not signed on with Passport.

Example

The following example configures a site for forms-based authentication, specifies the name of the cookie that transmits logon information from the client, and specifies the name of the logon page to use if initial authentication fails. You need to include an <authorization> section to require forms authentication by all users and to deny anonymous users access to the site.

<configuration>
   <system.web>
      <authentication mode="Forms">
         <forms name="401kApp" loginUrl="/login.aspx"/>
      </authentication>
      <authorization>
         <deny users="?"/>
      </authorization>
   </system.web>
</configuration>

Requirements

  • Contained Within: <system.web>
  • Web Platform: Internet Information Services (IIS) 5.0
  • Configuration File: Machine.config, Web.config
  • Configuration Section Handler: System.Web.Configuration.AuthenticationConfigHandler

Related Topics
  • ASP.NET Configuration
  • ASP.NET Settings Schema


<authorization> Element

Configures ASP.NET authorization support. The <authorization> tag helps control client access to URL resources. This element can be declared at any level (machine, site, application, subdirectory, or page).

<configuration>
<system.web>
<authorization>

<authorization>
   <allow users="comma-separated list of users"
          roles="comma-separated list of roles"
          verbs="comma-separated list of verbs"/>

   <deny users="comma-separated list of users"
         roles="comma-separated list of roles"
         verbs="comma-separated list of verbs"/>
</authorization>

Subtags

Subtag Description
<allow> Allows access to a resource based on the following:

users: A comma-separated list of user names that are granted access to the resource. A question mark (?) allows anonymous users; an asterisk (*) allows all users.

roles: A comma-separated list of roles that are granted access to the resource.

verbs: A comma-separated list of HTTP transmission methods that are granted access to the resource. Verbs registered to ASP.NET are GET, HEAD, POST, and DEBUG.
<deny> Denies access to a resource based on the following:

users: A comma-separated list of user names that are denied access to the resource. A question mark (?) indicates that anonymous users are denied access; an asterisk (*) indicates that all users are denied access.

roles: A comma-separated list of roles that are denied access to the resource.

verbs: A comma-separated list of HTTP transmission methods that are denied access to the resource. Verbs registered to ASP.NET are GET, HEAD, POST, and DEBUG.

Remarks

At run time, the authorization module iterates through the <allow> and <deny> tags until it finds the first access rule that fits a particular user. It then grants or denies access to a URL resource depending on whether the first access rule found is an <allow> or a <deny> rule. The default authorization rule in the Machine.config file is <allow users="*"/> so, by default, access is allowed unless configured otherwise.

Example

The following example allows access to all members of the Admins role and denies access to all users.

<configuration>
   <system.web>
      <authorization>
         <allow roles="Admins"/>
         <deny users="*"/>
      </authorization>
   </system.web>
</configuration>

Requirements

  • Contained Within: <system.web>
  • Web Platform: Internet Information Services (IIS) 5.0
  • Configuration File: Machine.config, Web.config
  • Configuration Section Handler: System.Web.Configuration.AuthorizationConfigHandler

Related Topics
  • ASP.NET Configuration
  • ASP.NET Settings Schema


<browserCaps> Element

Helps control the settings of the browser capabilities component. The <browserCaps> element can be declared at the machine, site, application, and subdirectory level. The <browserCaps> element can be updated as required to detect future browsers and browser capabilities.

For a list of valid browser properties, see the HttpBrowserCapabilities class in .NET Framework Help .

Example Configuration Structure:

<configuration>
<system.web>
<browserCaps>

<browserCaps>
   <result type="class"/>
   <use var="HTTP_USER_AGENT"/>
        browser=Unknown
        version=0.0
        majorver=0
        minorver=0
        frames=false
        tables=false
      <filter>
         <case match="Windows 98|Win98">
            platform=Win98
         </case>
      <case match="Windows NT|WinNT">
         platform=WinNT
      </case>
   </filter>
   <filter match="Unknown" with="%(browser)">
      <filter match="Win95" with="%(platform)">
      </filter>
   </filter>
</browserCaps>

Subtags

Subtag | Description
<use> | Specifies the server variables used while evaluating <filter>, <case>, and assignments in the section.
<filter> | Evaluates the first child <case> element that matches; the rest are ignored.
<result> | Specifies the HttpCapabilitiesBase-derived class used to hold the resulting key/value string pairs from parsing this section (for example, browser, version, and majorver in the syntax block above). This string is used at run time to create the return type.

Remarks

Lines of the form capsVariableName=regular expression are assignments. Use the syntax %{capsVariableName} or ${captureGroupName} in match attributes and on the right-hand side of assignments. For more information on using regular expressions, see the .NET Framework Regular Expressions topic in .NET Framework Help . For the full <browserCaps> section, with a more complete example of this syntax, see the Machine.config file that is installed with the .NET Framework.

The name/value pairs that are captured with capsVariableName are accessible through the Item property of the HttpBrowserCapabilities that is inherited from HttpCapabilitiesBase. The Item property is the default indexer property in C#.

Example

The following example demonstrates parsing the User-Agent HTTP header for any version of Internet Explorer (as long as the format of the User-Agent string remains approximately unchanged).

The example makes use of regular expressions and uses the ability of regular expressions to capture subexpressions in order to move version numbers directly from the User-Agent string to the browser caps object.

The file specifies name/value pairs in the form of assignment statements, similar to Internet Information Services (IIS) browscap.ini files. For example, the line "browser=IE" sets the value of the browser field to the string "IE".

<configuration>
   <browserCaps>
      <result type="System.Web.HttpBrowserCapabilities, System.Web"/>
      <use var="HTTP_USER_AGENT"/>
      browser=Unknown
      version=0.0
      majorversion=0
      minorversion=0
      frames=false
      tables=false
      cookies=false
      backgroundsounds=false
      <filter>
         <case match="^Mozilla[^(]*\(compatible; MSIE
            (?'ver'(?'major'\d+)(?'minor'\.\d+)(?'letters'\w*))
            (?'extra'.*)">
            browser=IE
            version=${ver}
            majorver=${major}
            minorver=${minor}
            <case match="^2\." with="%{version}">
               tables=true
               cookies=true
               backgroundsounds=true
               <case match="2\.5b" with="%{version}">
                  beta=true
               </case>
            </case>
         </case>
      </filter>
   </browsercaps>
</configuration>

Requirements

  • Contained Within: <system.web>
  • Web Platform: Internet Information Services (IIS) 5.0
  • Configuration File: Machine.config, Web.config
  • Configuration Section Handler: System.Web.Configuration.HttpCapabilitiesSectionHandler

Related Topics
  • ASP.NET Configuration
  • ASP.NET Settings Schema


<case> Element

Allows pattern matching to stop after processing the first successful match out of a number of alternatives.

Example Configuration Structure:

<configuration>
<system.web>
<browserCaps>
<filter>
<case>

<case match="[regex expression]" with="[regex expression]">
   [assignments, filter elements and case elements]
</case>

Required Attributes

Attribute | Description
match | A .NET Framework regular expression tested against the with attribute. If omitted, the match is assumed successful.
with | A .NET Framework regular expression or string to be searched. If omitted, the string specified by the <use> element is used.

Example

The following example demonstrates parsing the User-Agent HTTP header for any version of Internet Explorer (as long as the format of the User-Agent string remains approximately unchanged).

The example makes use of regular expressions and uses the ability of regular expressions to capture subexpressions in order to move version numbers directly from the User-Agent string to the browser caps object.

The file specifies name/value pairs in the form of assignment statements, similar to Internet Information Services (IIS) browscap.ini files. For example, the line "browser=IE" sets the value of the browser field to the string "IE".

<configuration>
   <browserCaps>
      <result type="System.Web.HttpBrowserCapabilities, System.Web"/>
      <use var="HTTP_USER_AGENT"/>
      browser=Unknown
      version=0.0
      majorversion=0
      minorversion=0
      frames=false
      tables=false
      cookies=false
      backgroundsounds=false
      <filter>
         <case match="^Mozilla[^(]*\(compatible; MSIE
            (?'ver'(?'major'\d+)(?'minor'\.\d+)(?'letters'\w*))
            (?'extra'.*)">
            browser=IE
            version=${ver}
            majorver=${major}
            minorver=${minor}
            <case match="^2\." with="%{version}">
               tables=true
               cookies=true
               backgroundsounds=true
               <case match="2\.5b" with="%{version}">
                  beta=true
               </case>
            </case>
         </case>
      </filter>
   </browsercaps>
</configuration>

Remarks

All <filter> and <case> elements can contain assignments and other <filter> and <case> elements. The difference between <case> and <filter> groups is this: after a <filter> group is evaluated, execution continues with the statement after the group, but after a <case> group is successfully matched and evaluated, execution skips to the end of the enclosing group.

Requirements

  • Contained Within: <system.web>
  • Web Platform: Internet Information Services (IIS) 5.0
  • Configuration File: Machine.config, Web.config
  • Configuration Section Handler: System.Web.Configuration.HttpCapabilitiesSectionHandler

Related Topics
  • <browserCaps> Element
  • <filter> Element
  • ASP.NET Configuration
  • ASP.NET Settings Schema


<clear> Element

Removes all references to items appropriate to the parent tag. The <clear> element is a subtag of the <assemblies>, <clientTarget>, <compilers>, <httpHandlers>, <httpModules>, and <serviceDescriptionFormatExtensionTypes> parent tags under <system.web>.

Example Configuration Structure:

<configuration>
   <system.web>
      <assemblies>
         <clear>

      <clientTarget>
         <clear>
      <compilation>
         <compilers>
            <clear>

      <httpHandlers>
         <clear>

      <httpModules>
         <clear>

      <serviceDescriptionFormatExtensionTypes>
         <clear>

      <webServices>
        <protocols>
              <clear>

      <soapExtensionTypes>
         <clear>

      <soapExtensionReflectorTypes>
         <clear>

      <soapExtensionImporterTypes>
         <clear>
<clear>

Example

The following example clears all assembly references for an application.

<configuration>
   <system.web>
      <assemblies>
         <clear/>
      </assemblies>
   </system.web>
</configuration>

Requirements

  • Contained Within: <system.web>
  • Web Platform: Internet Information Services (IIS) 5.0
  • Configuration File: Machine.config, Web.config
  • Configuration Section Handler: System.Web.UI.CompilationConfigurationHandler
    - or -
    System.Web.Configuration.HttpHandlersSectionHandler
    – or -
    System.Web.Configuration.HttpModulesConfigurationHandler

Related Topics
  • <assemblies> Element
  • <compilers> Element
  • <httpHandlers> Element
  • <httpModules> Element
  • <serviceDescriptionFormatExtensionTypes> Element
  • ASP.NET Configuration
  • ASP.NET Settings Schem Reference


<clientTarget> Element

Adds aliases for specific user agents to an internal collection of user agent aliases.

Example Configuration Structure:

<configuration>
<system.web>
<clientTarget>

<clientTarget>
   <add alias="alias name to use"
        userAgent="identification of user agent"/>
   <remove alias="alias name to remove"/>
   <clear/>
</clientTarget>

Subtags

Subtag | Description
<add> | Adds an alias for a specific user agent to an internal collection of user agent aliases.
<clear> | Removes all aliases currently contained in or inherited by the specified Web.config file.
<remove> | Removes the specified alias from the list of aliases. The value of <remove> must exactly match that of a previous <add> directive. Wildcard selections are not supported.

Example

The following example adds four user agent aliases.

<configuration>
   <system.web>
      <clientTarget>
         <add alias="ie5" userAgent="Mozilla/4.0 (compatible;MSIE 5.5;Windows NT 4.0)"/>
         <add alias="ie4" userAgent="Mozilla/4.0 (compatible;MSIE 4.0;Windows NT 4.0)"/>
         <add alias="uplevel" userAgent="Mozilla/4.0 (compatible;MSIE 4.0;Windows NT 4.0)"/>
         <add alias="downlevel" userAgent="Unknown"/>
      </clientTarget>
   </system.web>
</configuration>

Remarks

The collection of user agent aliases indicates the target user agents that ASP.NET server controls should render content for.

Requirements

  • Contained Within: <system.web>
  • Web Platform: IIS 5.0, IIS 5.1, IIS 6.0
  • Configuration File: Machine.config, Web.config
  • Configuration Section Handler: System.Web.Configuration.ClientTargetSectionHandler

Related Topics
  • ASP.NET Configuration
  • ASP.NET Settings Schema


<compilation> Element

Configures all the compilation settings that ASP.NET uses.

Example Configuration Structure:

<configuration>
<system.web>
<compilation>

<compilation debug="true|false"
             batch="true|false"
             batchTimeout="number of seconds"
             defaultLanguage="language"
             explicit="true|false"
             maxBatchSize="maximim number of pages per
                           batched compilation"
             maxBatchGeneratedFileSize="maximum combined size (in KB)
                                        of the generated source file per
                                        batched compilation"
             numRecompilesBeforeAppRestart="number"
             strict="true|false"
             tempDirectory="directory under which the ASP.NET temporary
                            files are created">
   <compilers>
      <compiler language="language"
                extension="ext"
                type=".NET Type"
                warningLevel="number"
                compilerOptions="options"/>
   </compilers>

   <assemblies>
      <add assembly="assembly"/>
      <remove assembly="assembly"/>
      <clear/>
   </assemblies>
</compilation>

Optional Attributes

Attribute | Option | Description
debug |  | Specifies whether to compile retail binaries or debug binaries. The default is false.
 | true | Specifies compilation of debug binaries.
 | false | Specifies compilation of retail binaries.
defaultLanguage |  | Specifies the default programming language, such as "C#" or "PERL", to use in dynamic compilation files. Language names are defined using the <compiler> subtag. The default is vb.
explicit |  | Indicates the setting of the Microsoft Visual Basic explicit compile option. The default is true.
 | true | Indicates that the Visual Basic explicit compile option is enabled and that all variables must be declared using a Dim, Private, Public, or ReDim statement.
 | false | Indicates that the Visual Basic explicit compile option is disabled.
batch |  | Indicates whether batching is supported.
 | true | Indicates that batching is supported.
 | false | Indicates that batching is not supported.
batchTimeout |  | Indicates the time-out period, in seconds, for batch compilation. If compilation cannot be completed within the time-out period, the compiler reverts to single compilation mode for the current page.
maxBatchGeneratedFileSize |  | Specifies the maximum size (in KB) of the generated source files per batched compilation.
maxBatchFileSize |  | Specifies the maximum number of pages per batched compilation.
numRecompilesBeforeApprestart |  | Indicates the number of dynamic recompiles of resources that can occur before the application restarts. This attribute is supported at the global and application level but not at the directory level.
strict |  | Indicates the setting of the Visual Basic strict compile option.
 | true | Indicates that the Visual Basic strict compile option is enabled.
 | false | Indicates that the Visual Basic strict compile option is disabled.
tempDirectory |  | Specifies the directory to use for temporary file storage during compilation.

Subtags

Subtag | Description
<compilers> | Defines a new compiler option.
<assemblies> | Specifies ASP.NET compilation processing directives.

Example

The following example configures compilation settings for an application.

<configuration>
   <system.web>
      <compilation defaultLanguage="VB"
         debug="true"
         numRecompilesBeforeAppRestart="15">
         <compilers>
            <compiler language="VB;VBScript"
               extension=".cls"
               type="Microsoft.VisualBasic.VBCodeProvider,system,
                     Version=1.0.5000.0, Culture=neutral,
                     PublicKeyToken=b77a5c561934e089"/>
            <compiler language="C#;Csharp"
               extension=".cs"
               type="Microsoft.CSharp.CSharpCodeProvider,system,
                     Version=1.0.5000.0,  Culture=neutral,
                     PublicKeyToken=b77a5c561934e089"/>
         </compilers>

         <assemblies>
            <add assembly="ADODB"/>
            <add assembly="*"/>
         </assemblies>
      </compilation>
   </system.web>
</configuration>

Requirements

  • Contained Within: <system.web>
  • Web Platform: IIS 5.0, IIS 5.1, IIS 6.0
  • Configuration File: Machine.config, Web.config
  • Configuration Section Handler: System.Web.Configuration.CompilationConfigHandler

Related Topics
  • ASP.NET Configuration
  • ASP.NET Settings Schema


<compiler> Element

Defines a new compiler. Any number of <compiler> tags can be used in the <compilers> section.

Example Configuration Structure:

<configuration>
<system.web>
<compilation>
<compilers>
<compiler>

<compiler language="language"
          extension="ext"
          type=".NET Type"
          warningLevel="number"
          compilerOptions="options"/>

Required Attributes

Attribute | Description
language | Provides a semicolon-separated list of languages used in dynamic compilation files. For example, "c#;cs;csharp".
extension | Provides a semicolon-separated list of file name extensions used for dynamic code-behind files. For example, ".cs".
type | Specifies a comma-separated class/assembly combination that indicates the .NET Framework class that is used to compile all resources that use the specified language or file name extension.

Optional Attributes

Attribute | Description
warningLevel | Specifies compiler warning levels.
compilerOptions | Lists additional compiler-specific options to pass during compilation.

Example

The following example configures compilation settings for an application.

<configuration>
   <system.web>
      <compilation defaultLanguage="VB"
         debug="true"
         numRecompilesBeforeAppRestart="15">
         <compilers>
            <compiler language="VB;VBScript"
               extension=".cls"
               type="Microsoft.VisualBasic.VBCodeProvider,system,
                     Version=1.0.5000.0, Culture=neutral,
                     PublicKeyToken=b77a5c561934e089"/>
            <compiler language="C#;Csharp"
               extension=".cs"
               type="Microsoft.CSharp.CSharpCodeProvider,system,
                     Version=1.0.5000.0,  Culture=neutral,
                     PublicKeyToken=b77a5c561934e089"/>
         </compilers>
      </compilation>
   </system.web>
</configuration>

Requirements

  • Contained Within: <system.web>
  • Web Platform: IIS 5.0, IIS 5.1, IIS 6.0
  • Configuration File: Machine.config, Web.config
  • Configuration Section Handler: System.Web.Configuration.CompilationConfigHandler

Related Topics
  • <compilation> Element
  • <compilers> Element
  • ASP.NET Configuration
  • ASP.NET Settings Schema


<compilers> Element

Specifies the compilers that the ASP.NET application supports.

Example Configuration Structure:

<configuration>
<system.web>
<compilation>
<compilers>

<compilers>
   <compiler language="language"
             extension="ext"
             type=".NET Type"
             warningLevel="number"
             compilerOptions="options"/>
</compilers>

Subtag

Subtag | Description
<compiler> | Defines a new compiler option. Any number of <compiler> tags can be used in the <compilers> section.

Example

The following example configures compilation settings for an application.

<configuration>
   <system.web>
      <compilation defaultLanguage="VB"
         debug="true"
         numRecompilesBeforeAppRestart="15">

         <compilers>
            <compiler language="VB;VBScript"
               extension=".cls"
               type="Microsoft.VisualBasic.VBCodeProvider,system,
                     Version=1.0.5000.0, Culture=neutral,
                     PublicKeyToken=b77a5c561934e089"/>
            <compiler language="C#;Csharp"
               extension=".cs"
               type="Microsoft.CSharp.CSharpCodeProvider,system,
                     Version=1.0.5000.0,  Culture=neutral,
                     PublicKeyToken=b77a5c561934e089"/>
         </compilers>

         <assemblies>
            <add assembly="ADODB"/>
            <add assembly="*"/>
         </assemblies>

      </compilation>
   </system.web>
</configuration>

Requirements

  • Contained Within: <system.web>
  • Web Platform: IIS 5.0, IIS 5.1, IIS 6.0
  • Configuration File: Machine.config, Web.config
  • Configuration Section Handler: System.Web.Configuration.CompilationConfigHandler

Related Topics
  • <compilation> Element
  • ASP.NET Configuration
  • ASP.NET Settings Schema


<credentials> Element

Allows optional definition of name and password credentials within the configuration file. You also can implement a custom password scheme to use an external source, such as a database, to help control validation.

Example Configuration Structure:

<configuration>
<system.web>
<authentication>
<forms>
<credentials>

<credentials
   passwordFormat="Clear|SHA1|MD5"
</credentials>

Required Attribute

Attribute | Option | Description
passwordFormat |  | Specifies the encryption format for storing passwords.
 | Clear | Specifies that passwords are not encrypted.
 | MD5 | Specifies that passwords are encrypted using the MD5 hash algorithm.
 | SHA1 | Specifies that passwords are encrypted using the SHA1 hash algorithm.

Subtag

Subtag | Description
<user> | Allows definition of user name and password credentials within the configuration file. This method of storing credentials should be used only in applications that don't require a high level of security.

Example

The following example specifies the authentication mode, logon page, and logon credentials encryption format. Credentials for three users are stored in the configuration file.

<configuration>
   <system.web>
      <authentication mode="Forms">
         <forms name="401kApp" loginUrl="/login.aspx">
            <credentials passwordFormat = "SHA1"
               <user name="UserName1" password="SHA1EncryptedPassword1"/>
               <user name="UserName2" password="SHA1EncryptedPassword2"/>
               <user name="UserName3" password="SHA1EncryptedPassword3"/>
            </credentials>
         </forms>
      </authentication>
   </system.web>
</configuration>

Requirements

  • Contained Within: <system.web>
  • Web Platform: IIS 5.0, IIS 5.1, IIS 6.0
  • Configuration File: Machine.config, Web.config
  • Configuration Section Handler: System.Web.Configuration.CompilationConfigHandler

Related Topics
  • <authentication> Element
  • <forms> Element
  • ASP.NET Configuration
  • ASP.NET Settings Schema


<customErrors> Element

Provides information about custom error messages for an ASP.NET application.

Example Configuration Structure:

<configuration>
<system.web>
<customErrors>

<customErrors defaultRedirect="url"
              mode="On|Off|RemoteOnly">
   <error statusCode="statuscode"
          redirect="url"/>
</customErrors>

Required Attribute

Attribute | Option | Description
Mode |  | Specifies whether custom errors are enabled, disabled, or shown only to remote clients.
 | On | Specifies that custom errors are enabled. If no defaultRedirect is specified, users see a generic error.
 | Off | Specifies that custom errors are disabled. This allows display of detailed errors.
 | RemoteOnly | Specifies that custom errors are shown only to remote clients and ASP.NET errors are shown to the local host. This is the default.

Optional Attribute

Attribute | Description
defaultRedirect | Specifies the default URL to direct a browser to if an error occurs. When defaultRedirect is not specified, a generic error is displayed instead. The URL can be absolute (for instance, http://www.contoso.com/ErrorPage.htm) or it can be relative. A relative URL such as /ErrorPage.htm is relative to the Web.config file that specified the defaultRedirect URL, not to the Web page in which the error occurred. A URL starting with a tilde (~),such as ~/ErrorPage.htm, means that the specified URL is relative to the root path of the application.

Subtag

Subtag | Description
<error> | The error subtag can appear multiple times. Each appearance defines one custom error condition.

Remarks

The <customErrors> element does not apply to errors that occur in XML Web services.

Example

The following example specifies the error handling pages to use for an ASP.NET application.

<configuration>
   <system.web>
      <customErrors defaultRedirect="GenericError.htm"
                    mode="RemoteOnly">
         <error statusCode="500"
                redirect="InternalError.htm"/>
      </customErrors>
   </system.web>
</configuration>

Requirements

  • Contained Within: <system.web>
  • Web Platform: IIS 5.0, IIS 5.1, IIS 6.0
  • Configuration File: Machine.config, Web.config
  • Configuration Section Handler: System.Web.Configuration.CustomErrorsConfigHandler

Related Topics
  • ASP.NET Configuration
  • ASP.NET Settings Schema


<deny> Element

Specifies that access to a resource is denied.

Example Configuration Structure:

<configuration>
<system.web>
<authorization>
<deny>

<deny users="comma-separated list of users"
      roles="comma-separated list of roles"/>

Optional Attributes

Attribute | Description
Users | A comma-separated list of user names that are denied access to the resource. A question mark (?) denies anonymous users and an asterisk (*) indicates that all users are denied access.
Roles | A comma-separated list of roles that are denied access.

Remarks

At run time, the authorization module iterates through the <allow> and <deny> tags until it finds the first access rule that fits a particular user. It then grants or denies access to a URL resource depending on whether the first access rule found is an <allow> or a <deny> rule. The default authorization rule in the Machine.config file is <allow users="*"/> so, by default, access is allowed unless configured otherwise.

Example

The following example allows access to all members of the Admins role and denies access to all users.

<configuration>
   <system.web>
      <authorization>
         <allow roles="Admins"/>
         <deny users="*"/>
      </authorization>
   </system.web>
</configuration>

Requirements

  • Contained Within: <system.web>
  • Web Platform: IIS 5.0, IIS 5.1, IIS 6.0
  • Configuration File: Machine.config, Web.config
  • Configuration Section Handler: System.Web.Configuration.CustomErrorsConfigHandler

Related Topics
  • <authorization> Element
  • ASP.NET Configuration
  • ASP.NET Settings Schema


<error> Element

Defines one custom error redirect associated with an HTTP status code.

Example Configuration Structure:

<configuration>
<system.web>
<customErrors>
<error>

<error statusCode="statuscode"
       redirect="url"/>

Optional Attributes

Attribute | Description
StatusCode | Specifies the HTTP status code that will result in redirection to the error page.
Redirect | The error page that will present information to the client about the error.

Example

The following example specifies the error handling pages to use for an ASP.NET application.

<configuration>
   <system.web>
      <customErrors defaultRedirect="GenericError.htm"
                    mode="RemoteOnly">
         <error statusCode="500"
                redirect="InternalError.htm"/>
      </customErrors>
   </system.web>
</configuration>

Requirements

  • Contained Within: <system.web>
  • Web Platform: IIS 5.0, IIS 5.1, IIS 6.0
  • Configuration File: Machine.config, Web.config
  • Configuration Section Handler: System.Web.Configuration.CustomErrorsConfigHandler

Related Topics
  • <customErrors> Element
  • ASP.NET Configuration
  • ASP.NET Settings Schema


<filter> Element

Allows multiple rules to be applied in sequence.

Example Configuration Structure:

<configuration>
<system.web>
<browserCaps>
<filter>

<filter>
   [assignments, filter elements and case elements]
<filter>
<filter match="[regular expression]" with="[regular expression]" >
   [assignments, filter elements and case elements]
</filter>
<filter>
   <case match="[regular expression]" with="[regular expression]" >
      [assignments, filter elements and case elements]
   </case>
</filter>

Optional Attributes

Attribute | Description
match | A .NET Framework regular expression tested against the with attribute. If omitted, the match is assumed successful.
with | A .NET Framework regular expression or string to be searched. If omitted, the string specified by the <use> element is used.

Subtag

Subtag | Description
<case> | Allows pattern matching to stop after processing the first successful match out of a number of alternatives.

Example

The following example demonstrates parsing the User-Agent HTTP header for any version of Internet Explorer (as long as the format of the User-Agent string remains approximately unchanged).

The example makes use of .NET Framework regular expressions and uses the ability of regular expressions to capture subexpressions in order to move version numbers directly from the User-Agent string to the browser caps object.

The file specifies name/value pairs in the form of assignment statements, similar to Internet Information Services (IIS) browscap.ini files. For example, the line "browser=IE" sets the value of the browser field to the string "IE".

<configuration>
   <browserCaps>
      <result type="System.Web.HttpBrowserCapabilities, System.Web"/>
      <use var="HTTP_USER_AGENT"/>
      browser=Unknown
      version=0.0
      majorversion=0
      minorversion=0
      frames=false
      tables=false
      cookies=false
      backgroundsounds=false
      <filter>
         <case match="^Mozilla[^(]*\(compatible; MSIE
            (?'ver'(?'major'\d+)(?'minor'\.\d+)(?'letters'\w*))
            (?'extra'.*)">
            browser=IE
            version=${ver}
            majorver=${major}
            minorver=${minor}
            <case match="^2\." with="%{version}">
               tables=true
               cookies=true
               backgroundsounds=true
               <case match="2\.5b" with="%{version}">
                  beta=true
               </case>
            </case>
         </case>
      </filter>
   </browsercaps>
</configuration>

Requirements

  • Contained Within: <system.web>
  • Web Platform: IIS 5.0, IIS 5.1, IIS 6.0
  • Configuration File: Machine.config, Web.config
  • Configuration Section Handler: System.Web.Configuration.HttpCapabilitiesSectionHandler

Related Topics
  • <browserCaps> Element
  • ASP.NET Configuration
  • ASP.NET Settings Schema


<forms> Element

Configures an ASP.NET application for custom forms-based authentication.

Example Configuration Structure:

<configuration>
<system.web>
<authentication>
<forms>

<forms name="name"
       loginUrl="url"
           protection="All|None|Encryption|Validation"
                timeout="30"
       path="/"
       requireSSL="true|false"
       slidingExpiration="true|false">
   <credentials passwordFormat="format"/>
</forms>

Optional Attributes

Attribute | Option | Description
name |  | Specifies the HTTP cookie to use for authentication. By default, the value of name is .ASPXAUTH. If multiple applications are running on a single server and each application requires a unique cookie, you must configure the cookie name in each application's Web.config file.
loginUrl |  | Specifies the URL to which the request is redirected for logon if no valid authentication cookie is found. The default value is default.aspx.
protection |  | Specifies the type of encryption, if any, to use for cookies.
 | All | Specifies that the application uses both data validation and encryption to help protect the cookie. This option uses the configured data validation algorithm (based on the <machineKey> element). Triple-DES (3DES) is used for encryption, if available and if the key is long enough (48 bytes or more). All is the default (and recommended) value.
 | None | Specifies that both encryption and validation are disabled for sites that are using cookies only for personalization and have weaker security requirements. Using cookies in this manner is not recommended; however, it is the least resource-intensive way to enable personalization using the .NET Framework.
 | Encryption | Specifies that the cookie is encrypted using Triple-DES or DES, but data validation is not performed on the cookie. Cookies used in this way might be subject to chosen plaintext attacks.
 | Validation | Specifies that a validation scheme verifies that the contents of an encrypted cookie have not been altered in transit. The cookie is created using cookie validation by concatenating a validation key with the cookie data, computing a message authentication code (MAC), and appending the MAC to the outgoing cookie.
timeout |  | Specifies the amount of time, in integer minutes, after which the cookie expires. The default value is 30. If the SlidingExpiration attribute is true, the timeout attribute is a sliding value, expiring at the specified number of minutes after the time the last request was received. To prevent compromised performance, and to avoid multiple browser warnings for users that have cookie warnings turned on, the cookie is updated when more than half the specified time has elapsed. This might result in a loss of precision. Persistent cookies do not time out.
path |  | Specifies the path for cookies issued by the application. The default value is a slash (/), because most browsers are case-sensitive and will not send cookies back if there is a path case mismatch.
requireSSL |  | Specifies whether an encrypted connection is required to transmit the authentication cookie.
 | true | Specifies that an encrypted connection is required to help protect the user's credentials. If true, ASP.NET sets HttpCookie.Secure for the authentication cookie and a compliant browser does not return the cookie unless the connection is using Secure Sockets Layer (SSL).
 | false | Specifies that an encrypted connection is not required to transmit the cookie. The default is false.
slidingExpiration |  | Specifies whether sliding expiration is enabled. Sliding expiration resets an active authentication cookie's time to expiration upon each request during a single session.
 | true | Specifies that sliding expiration is enabled. The authentication cookie is refreshed and the time to expiration is reset on subsequent requests during a single session. The default for version 1.0 of ASP.NET was true.
 | false | Specifies that sliding expiration is not enabled and the cookie expires at a set interval from the time it was originally issued. The default is false.

Subtag

Subtag | Description
<credentials> | Allows definition of name and password credentials within the configuration file. You also can implement a custom password scheme to use an external source, such as a database, to help control validation.

Remarks

If multiple applications are running on a single server, the <forms> attributes must be configured in the Web.config file for each application.

Example

The following example configures a site for forms-based authentication, specifies the name of the cookie that transmits logon information from the client, and specifies the name of the logon page to use if initial authentication fails.

<configuration>
   <system.web>
      <authentication mode="Forms">
         <forms name="401kApp" loginUrl="/login.aspx">
            <credentials passwordFormat = "SHA1"
               <user name="UserName"
                     password="07B7F3EE06F278DB966BE960E7CBBD103DF30CA6"/>
            </credentials>
         </forms>
      </authentication>
   </system.web>
</configuration>

Requirements

  • Contained Within: <system.web>
  • Web Platform: IIS 5.0, IIS 5.1, IIS 6.0
  • Configuration File: Machine.config, Web.config
  • Configuration Section Handler: System.Web.Configuration.AuthenticationConfigHandler

Related Topics
  • <authentication> Element
  • ASP.NET Configuration
  • ASP.NET Settings Schema


<globalization> Element

Configures the globalization settings of an application.

Example Configuration Structure:

<configuration>
<system.web>
<globalization>

<globalization requestEncoding="any valid encoding string"
               responseEncoding="any valid encoding string"
               fileEncoding="any valid encoding string"
               culture="any valid culture string"
               uiCulture="any valid culture string"/>

Optional Attributes

Attribute | Description
requestEncoding | Specifies the assumed encoding of each incoming request, including posted data and the query string. If the request comes with a request header containing an Accept-Charset attribute, it overrides the requestEncoding in configuration. The default encoding is UTF-8, specified in the <globalization> tag included in the Machine.config file created when the .NET Framework is installed. If request encoding is not specified in a Machine.config or Web.config file, encoding defaults to the computer's Regional and Language Options locale setting. In single-server applications, requestEncoding and responseEncoding should be the same. For the less common case (multiple-server applications where the default server encodings are different), you can vary the request and response encoding using local Web.config files.
responseEncoding | Specifies the content encoding of responses. The default encoding is UTF-8, specified in the <globalization> tag included in the Machine.config file created when the .NET Framework is installed. If response encoding is not specified in a Machine.config or Web.config file, encoding defaults to the computer's Regional and Language Options locale setting. In single-server applications, requestEncoding and responseEncoding should be the same. For the less common case (multiple-server applications where the default server encodings are different), you can vary the request and response encoding using local Web.config files.
fileEncoding | Specifies the default encoding for .aspx, .asmx, and .asax file parsing. Unicode and UTF-8 files saved with the byte order mark prefix will be automatically recognized regardless of the value of fileEncoding.
culture | Specifies the default culture for processing incoming Web requests. For valid culture strings, see the System.Globalization.CultureInfo class.
uiCulture | Specifies the default culture for processing locale-dependent resource searches. For valid culture strings, see System.Globalization.CultureInfo class.

Example

The following example specifies the default request and response encoding for an ASP.NET application.

<configuration>
   <system.web>
      <globalization
         requestEncoding="iso-8859-1"
         responseEncoding="iso-8859-1"/>
   </system.web>
</configuration>

Requirements

  • Contained Within: <system.web>
  • Web Platform: IIS 5.0, IIS 5.1, IIS 6.0
  • Configuration File: Machine.config, Web.config
  • Configuration Section Handler: System.Web.Configuration.GlobalizationConfigHandler

Related Topics
  • ASP.NET Configuration
  • ASP.NET Settings Schema


<httpHandlers> Element

Maps incoming requests to the appropriate IHttpHandler or IHttpHandlerFactory class, according to the URL and the HTTP verb specified in the request.

Example Configuration Structure:

<configuration>
<system.web>
<httpHandlers>

<httpHandlers>
   <add verb="verb list"
        path="path/wildcard"
        type="type,assemblyname"
        validate="true|false"/>
   <remove verb="verb list"
           path="path/wildcard"/>
   <clear/>
</httpHandlers>

Subtags

Subtag | Description
<add> | Specifies verb/path mapping to an IHttpHandler or IHttpHandlerFactory class.
<remove> | Removes a verb/path mapping to an IHttpHandler class. The <remove> directive must exactly match the verb/path combination of a previous <add> directive. Wildcard characters are not supported.
<clear> | Removes all IHttpHandler mappings currently configured or inherited by the specified Web.config file.

Remarks

The <httpHandlers> settings are inherited by subdirectories.

The <add> directives are processed in top-down sequential order. If two or more <add> subelements specify the same verb/path combination, the final <add> overrides all others.

Please note that Internet Information Services (IIS) has its own concept of mapping extensions to ISAPIs. For the settings for a given extension in this section to take effect, the extension must be mapped in IIS to ASP.NET ISAPI. For nonstandard extensions (something other than .aspx, .asmx, .asax, and so on), the user must configure IIS.

Example

The following example maps all HTTP requests for files with file name extension .New to the class MyHandler.New and for HTTP GET and HTTP HEAD requests for files with file name extension .MyNewFileExtension to the class MyHandler.MNFEHandler. Both classes are in the assembly MyHandler that is in the file MyHandler.dll.

<configuration>
   <system.web>
      <httpHandlers>
         <add verb="*"
              path="*.New"
              type="MyHandler.New,MyHandler"/>
         <add verb="GET,HEAD"
              path="*.MyNewFileExtension"
              type="MyHandler.MNFEHandler,MyHandler.dll"/>
     </httpHandlers>
   <system.web>
</configuration>

Requirements

  • Contained Within: <system.web>
  • Web Platform: IIS 5.0, IIS 5.1, IIS 6.0
  • Configuration File: Machine.config, Web.config
  • Configuration Section Handler: System.Web.Configuration.HttpHandlersConfigHandler

Related Topics
  • ASP.NET Configuration
  • ASP.NET Settings Schema


<httpModules> Element

Configures the HTTP modules within an application.

Example Configuration Structure:

<configuration>
<system.web>
<httpModules>

<httpModules>
   <add type="classname,assemblyname" name="modulename"/>
   <remove name="modulename"/>
   <clear/>
</httpModules>

Subtags

Subtag | Description
<add> | Adds an HttpModule class to an application. Note that if an identical verb/path combination has been specified earlier (for example in a Web.config file in a parent directory), the second call to <add> overrides the previous setting.
<remove> | Removes an HttpModule class from an application.
<clear> | Removes all HttpModule mappings from an application.

Example

The following example adds three HttpModule references to the ASP.NET application.

<configuration>
   <system.web>
      <httpModules>
         <add type="System.Web.Caching.OutputCacheModule"
              name="OutputCache"/>
         <add type="System.Web.SessionState.SessionStateModule"
              name="Session"/>
         <add type=Selector, selector.dll"
              name="Selector"/>
      </httpModules>
   </system.web>
</configuration>

Requirements

  • Contained Within: <system.web>
  • Web Platform: IIS 5.0, IIS 5.1, IIS 6.0
  • Configuration File: Machine.config, Web.config
  • Configuration Section Handler: System.Web.Configuration.HttpModulesConfigHandler

Related Topics
  • ASP.NET Configuration
  • ASP.NET Settings Schema


<httpRuntime> Element

Configures ASP.NET HTTP runtime settings. This section can be declared at the machine, site, application, and subdirectory levels.

Example Configuration Structure:

<configuration>
<system.web>
<httpRuntime>

<httpRuntime useFullyQualifiedRedirectUrl="true|false"
             maxRequestLength="size in kbytes"
             executionTimeout="seconds"
             minFreeThreads="number of threads"
             minFreeLocalRequestFreeThreads="number of threads"
             appRequestQueueLimit="number of requests"
             versionHeader="version string"/>

Optional Attributes

Attribute | Option | Description
appRequestQueueLimit |  | The maximum number of requests that ASP.NET will queue for the application. When there are not enough free threads to process a request, the requests are queued. Incoming requests will be rejected with a "503 - Server Too Busy" error when the queue exceeds the limit specified in this setting.
executionTimeout |  | Indicates the maximum number of seconds that a request is allowed to execute before being automatically shut down by ASP.NET.
maxRequestLength |  | Indicates the maximum file upload size supported by ASP.NET. This limit can be used to prevent denial of service attacks caused by users posting large files to the server. The size specified is in kilobytes. The default is 4096 KB (4 MB).
minFreeLocalRequestFreeThreads |  | The minimum number of free threads that ASP.NET keeps available to allow execution of new local requests. This number of threads is kept reserved for requests coming from the local host, in case some requests issue child requests to the local host during their processing. This avoids a possible deadlock with recursive reentry into the Web server.
minFreeThreads |  | The minimum number of free threads to allow execution of new requests. ASP.NET keeps this many threads free for requests that require additional threads to complete their processing.
useFullyQualifiedRedirectUrl |  | Indicates whether client-side redirects are fully qualified (in {HYPERLINK "http://server/path" } form, which is necessary for some mobile controls) or whether relative redirects are instead sent to the client.
 | true | Specifies that client-side redirects need to be sent fully qualified. This is achieved by automatically converting all redirects that are not fully qualified to fully qualified form.
 | false | Specifies that client-side redirects do not need to be automatically converted to the fully qualified form. false is the default.
versionHeader |  | Specifies the value of a version header that ASP.NET sends with every response. This attribute is used by Microsoft Visual Studio .NET to determine which version of ASP.NET is in use. It is not necessary for production sites and can be disabled either by removing the attribute from Web.config or Machine.config, or setting the attribute to an empty string (versionHeader="").

Example

The following example specifies HTTP runtime parameters for an ASP.NET application.

<configuration>
   <system.web>
      <httpRuntime maxRequestLength="4000"
         useFullyQualifiedRedirectUrl="true"
         executionTimeout="45"
         versionHeader="1.1.4128"/>
   </system.web>
</configuration>

Requirements

  • Contained Within: <system.web>
  • Web Platform: IIS 5.0, IIS 5.1, IIS 6.0
  • Configuration File: Machine.config, Web.config
  • Configuration Section Handler: System.Web.Configuration.HttpRuntimeConfigurationHandler

Related Topics
  • ASP.NET Configuration
  • ASP.NET Settings Schema


<identity> Element

Helps control the application identity of the Web application. This element can be declared at any level (machine, site, application, subdirectory, or page).

Example Configuration Structure:

<configuration>
<system.web>
<identity>

<identity impersonate="true|false"
          userName="domain\username"
          password="password"/>

Required Attributes

Attribute | Option | Description
impersonate |  | Specifies whether client impersonation is used on each request.
 | true | Specifies that client impersonation is used.
 | false | Specifies that client impersonation is not used.

Optional Attributes

Attribute | Description
userName | Specifies the user name to use if impersonate is set to true. userName and password are stored in clear text in the configuration file. Although IIS will not transmit .config files in response to a user agent request, configuration files can be read by other means, for instance by an authenticated user with proper credentials on the domain that contains the server. To help maintain security, the identity section supports storage of encrypted userName and password attributes in the registry. The credentials must be in REG_BINARY format encrypted by the Windows 2000 and Windows XP Data Protection API (DPAPI) encryption functions. For more information, see the Remarks and Example sections below.
password | Specifies the password to use if impersonate is set to true. See userName for information about storing encrypted worker process credentials in the registry.

Remarks

Storing a User Name and Password in the Registry

To encrypt the user name and password and store them in the registry, set the userName and password as follows.

userName="registry:HKLM\Software\AspNetProcess,Name"

password="registry:HKLM\Software\AspNetProcess,Pwd"

The portion of the string after the keyword registry and before the comma indicates the name of the registry key that ASP.NET opens. The portion after the comma contains a single string value name from which ASP.NET will read the credentials. The comma is required, and the credentials must be stored in the HKLM hive. If the configuration format is incorrect, ASP.NET will not launch the worker process and the current account creation failure code path will be followed.

The credentials must be in REG_BINARY format, containing the output of a call to the Windows API function CryptProtectData. You can create the encrypted credentials and store them in the registry with the ASP.NET Set Registry console application (Aspnet_setreg.exe), which uses CryptProtectData to accomplish the encryption. To download Aspnet_setreg.exe, along with the Visual C++ source code and Help , visit the Web site www.asp.net and search for aspnet_setreg.

You should configure access to the key storing the encrypted credentials so that access is provided only to Administrators and SYSTEM. Because the key will be read by the ASP.NET process running as SYSTEM, you should set the following permissions:

Administrators:F

SYSTEM:F

CREATOR OWNER:F

ProcessAccount:R

This provides two lines of defense to protect the data:

  • The ACL permissions require the identity accessing the data to be an Administrator.
  • An attacker must run code on the server (CryptUnprotectData) to recover the credentials for the account.

Example

The following example sets client identity impersonation to true.

<configuration>
   <system.web>
      <identity impersonate="true"/>
   </system.web>
</configuration>

The following example specifies that the encrypted username and password are stored in the registry under the user-defined key AspNetIdentity.

<configuration>
   <system.web>
      <identity>
         userName="registry:HKLM\Software\AspNetIdentity,Name"
         password="registry:HKLM\Software\AspNetIdentity,Pwd"
      </identity>
   </system.web>
</configuration>

Requirements

  • Contained Within: <system.web>
  • Web Platform: IIS 5.0, IIS 5.1, IIS 6.0
  • Configuration File: Machine.config, Web.config
  • Configuration Section Handler: System.Web.Configuration.IdentityConfigHandler

Related Topics
  • ASP.NET Configuration
  • ASP.NET Settings Schema


<location> Element

Specifies the resource that specified configuration settings apply to.

Example Configuration Structure:

<configuration>

<location>

<location path="path"
    allowoverride="true|false" />

Optional Attribute

Attribute | Option | Description
path |  | The resource that the specified configuration settings apply to. Using <location> with a missing path attribute applies the configuration settings to the current directory and all child directories. If <location> is used with no path attribute and allowOverride is specified to be false, configuration settings cannot be altered by Web.config files in child directories.
allowOverride |  | Specifies whether configuration settings can be overridden by configuration settings in Web.config files in child directories.
 | true | Specifies that configuration settings can be overridden. The default is true.
 | false | Specifies that configuration settings cannot be overridden.

Example

The following example allows an anonymous user to access the Logon.aspx page.

<configuration>
   <location path="Logon.aspx">
      <system.web>
         <authorization>
            <allow users="?"/>
         </authorization>
      </system.web>
   </location>
</configuration>

The following example sets the uploaded file size limit to 128KB for only the page specified.

<configuration>
   <location path="UploadPage.aspx">
      <httpRuntime maxRequestLength="128"/>
   </location>
</configuration>

The following example prevents configuration settings from being changed by Web.config files in child directories.

<configuration>
   <location allowOverride="false"/>
</configuration>

Requirements

  • Web Platform: IIS 5.0, IIS 5.1, IIS 6.0
  • Configuration File: Machine.config, Web.config

Related Topics
  • ASP.NET Configuration
  • ASP.NET Settings Schema


<machineKey> Element

Configures keys to use for encryption and decryption of forms authentication cookie data and view state data, and for verification of out-of-process session state identification. This section can be declared at the machine, site, and application levels, but not at the subdirectory level.

Example Configuration Structure:

<configuration>
<system.web>
<machineKey>

<machineKey validationKey="AutoGenerate|value[,IsolateApps]"
            decryptionKey="AutoGenerate|value[,IsolateApps]
            validation="SHA1|MD5|3DES"/>

Required Attributes

Attribute | Option | Description
validationKey |  | Specifies the key used for validation of encrypted data. validationKey is used when enableViewStateMAC is true to create a message authentication code (MAC) to ensure that view state has not been tampered with. validationKey is also used to generate out-of-process, application-specific session IDs to ensure that session state variables are isolated between sessions.
 | AutoGenerate | Specifies that ASP.NET generates a random key and stores it in the Local Security Authority (LSA). The AutoGenerate option is the default value. If you add the IsolateApps modifier to the validationKey value, ASP.NET generates a unique encrypted key for each application using each application's application ID.
 | value | Specifies a manually assigned validation key. This value must be manually set to ensure consistent configuration across a network of Web servers (a Web farm). The key must be a minimum of 40 characters (20 bytes) and a maximum of 128 characters (64 bytes) long. If keys shorter than the maximum length are used, they should be created by a truly random means, such as by using RNGCryptoServiceProvider. The recommended key length is 128 hexadecimal characters. If you add the IsolateApps modifier to the validationKey value, ASP.NET generates a unique encrypted key for each application using each application's application ID.
decryptionKey |  | Specifies the key used to encrypt data. decryptionKey is used for Forms authentication encryption and decryption and for view state encryption when validation is 3DES.
 | AutoGenerate | Specifies that ASP.NET generates a random key and stores it in the LSA. The AutoGenerate option is the default value. If you add the IsolateApps modifier to the decryptionKey value, ASP.NET generates a unique encrypted key for each application using each application's application ID.
 | value | Specifies a manually assigned key. This value must be manually set to a string of hexadecimal characters to ensure consistent configuration across a Web farm. The key should be 16 characters in length when using DES encryption and 48 characters in length when using Triple DES encryption. If keys shorter than the maximum length are used, they should be created by a truly random means. ASP.NET can use Triple DES only on computers on which 128-bit encryption is available. If you add the IsolateApps modifier to the decryptionKey value, ASP.NET generates a unique encrypted key for each application using each application's application ID.
validation |  | Specifies the type of encryption used for validation of data.
 | SHA1 | Specifies that ASP.NET uses SHA1 encryption.
 | MD5 | Specifies that ASP.NET uses MD5 encryption.
 | 3DES | Specifies that ASP.NET uses Triple-DES (3DES) encryption. When 3DES is specified, forms authentication defaults to SHA1. When the validation attribute is set to 3DES, the view state validation technique uses 3DES encryption.

Example

The following example sets both validationKey and decryptionKey to AutoGenerate. The isolateApps option is specified to generate unique keys for each application on the server.

<machineKey validationKey="AutoGenerate,IsolateApps"
            decryptionKey="AutoGenerate,IsolateApps"
            validation="SHA1"/>

Requirements

  • Contained Within: <system.web>
  • Web Platform: IIS 5.0, IIS 5.1, IIS 6.0
  • Configuration File: Machine.config, Web.config
  • Configuration Section Handler: System.Web.Configuration.MachineKeyConfigHandler

Related Topics
  • ASP.NET Configuration
  • ASP.NET Settings Schema


<pages> Element

Identifies page-specific configuration settings. The <pages> section can be declared at the machine, site, application, and subdirectory levels.

Example Configuration Structure:

<configuration>
<system.web>
<pages>

<pages buffer="true|false"
       enableSessionState="true|false|ReadOnly"
       enableViewState="true|false"
       enableViewStateMac="true|false"
       autoEventWireup="true|false"
       smartNavigation="true|false"
       pageBaseType="typename, assembly"
       userControlBaseType="typename"
       validateRequest="true|False"/>

Optional Attributes

Attribute | Option | Description
buffer |  | Specifies whether the URL resource uses response buffering.
 | true | Indicates that response buffering is enabled.
 | false | Indicates that response buffering is not enabled.
enableSessionState |  | Specifies whether session state is enabled.
 | true | Indicates that session state is enabled.
 | false | Indicates that session state is not enabled.
 | ReadOnly | Specifies that an application can read but cannot modify session state variables.
enableViewState |  | Specifies whether view state is enabled.
 | true | Indicates that view state is enabled.
 | false | Indicates that view state is not enabled.
enableViewStateMac |  | Specifies whether ASP.NET should run a message authentication code (MAC) on the page's view state when the page is posted back from the client. A view state MAC is an encrypted version of the hidden variable that a page's view state is persisted to when sent to the browser. If true, the encrypted view state is checked to verify that it has not been tampered with on the client.
 | true | Indicates that view state is MAC checked.
 | false | Indicates that view state is not MAC checked. The default is false.
smartNavigation |  | Specifies whether smart navigation is enabled. Smart navigation requires Microsoft Internet Explorer 5.5 or greater.
 | true | Indicates that smart navigation is enabled.
 | false | Indicates that smart navigation is not enabled. The default is false.
pageBaseType |  | Specifies a code-behind class that .aspx pages inherit by default.
userControlBaseType |  | Specifies a code-behind class that user controls inherit by default.
autoEventWireup |  | Indicates whether page events are automatically enabled.
 | true | Indicates that page events are automatically enabled.
 | false | Indicates that page events are not automatically enabled.
validateRequest |  | Indicates that ASP.NET examines all input from the browser for potentially dangerous data. If true, request validation is performed by comparing all input data to a list of potentially dangerous values. If a match occurs, ASP.NET raises an HttpRequestValidationException exception.
 | true | Indicates that input from the browser is checked. The default is true.
 | false | Indicates that input from the browser is not checked.

Example

The following example specifies several page configuration settings.

<configuration>
   <system.web>
      <pages buffer="true"
             enableSessionState="true"
             autoEventWireup="true"
             smartNavigation="true"/>
   </system.web>
</configuration>

Requirements

  • Contained Within: <system.web>
  • Web Platform: IIS 5.0, IIS 5.1, IIS 6.0
  • Configuration File: Machine.config, Web.config
  • Configuration Section Handler: System.Web.UI.PagesConfigurationHandler

Related Topics
  • ASP.NET Configuration
  • ASP.NET Settings Schema


<passport> Element

Specifies the page to redirect to if the page requires authentication and the user has not signed on with Microsoft Passport authentication.

Example Configuration Structure:

<configuration>
<system.web>
<authentication>
<passport>

<passport redirectUrl="redirectURL"/>

Required Attribute

Attribute | Description
redirectUrl | The URL to which the request is redirected.

Example

The following example specifies the logon page that requests are redirected to.

<configuration>
   <system.web>
      <authentication>
         <passport redirectUrl="Login.aspx"/>
      </authentication>
   </system.web>
</configuration>

Requirements

  • Contained Within: <system.web>
  • Web Platform: IIS 5.0, IIS 5.1, IIS 6.0
  • Configuration File: Machine.config, Web.config
  • Configuration Section Handler: System.Web.Configuration.AuthenticationConfigHandler

Related Topics
  • <authentication> Element
  • ASP.NET Configuration
  • ASP.NET Settings Schema


<processModel> Element

Configures the ASP.NET process model settings on an Internet Information Services (IIS) Web server. The <processModel> section can be set only within the Machine.config file and affects all ASP.NET applications running on the server.

caution Caution Read the Remarks section for this element.

Example Configuration Structure:

<configuration>
<system.web>
<processModel>

<processModel enable="true|false"
              timeout="hrs:mins:secs|Infinite"
              idleTimeout="hrs:mins:secs|Infinite"
              shutdownTimeout="hrs:mins:secs|Infinite"
              requestLimit="hrs:mins:secs|Infinite"
              requestQueueLimit="num|Infinite"
              restartQueueLimit="num|Infinite"
              memoryLimit="percent"
              cpuMask="num"
              webGarden="true|false"
              userName="username"
              password="password"
              logLevel="All|None|Errors"
              clientConnectedCheck="hrs:mins:secs|Infinite"
              responseDeadlockInterval="hrs:mins:secs|Infinite"
              responseRestartDeadlockInterval="hrs:mins:secs|Infinite"
              comAuthenticationLevel="Default|None|Connect|Call|
                                      Pkt|PktIntegrity|PktPrivacy"
              comImpersonationLevel="Default|Anonymous|Identify|
                                     Impersonate|Delegate"
              maxWorkerThreads="num"
              maxIoThreads="num"/>

Optional Attributes

Attribute | Option | Description
clientConnectedCheck | Specifies how long a request is left in the queue before ASP.NET does a client connected check.
comAuthenticationLevel | Specifies the level of authentication for DCOM security. The default is Connect.
Default | Specifies that DCOM determines the authentication level using its normal security negotiation algorithm.
None | Specifies no authentication.
Connect | Specifies that DCOM authenticates the credentials of the client only when the client establishes a relationship with the server.
Call | Specifies that DCOM authenticates the credentials of the client when the server receives the request at the beginning of each remote procedure call.
Pkt | Specifies that DCOM authenticates that all data received is from the expected client. Datagram transports always use Pkt authentication.
PktIntegrity | Specifies that DCOM authenticates and verifies that none of the data transferred between the client and the server has been modified.
PktPrivacy | Specifies that DCOM authenticates all previous levels and encrypts the argument value of each remote procedure call.
comImpersonationLevel | Specifies the authentication level for COM security.
Default | Specifies that DCOM determines the impersonation level using its normal security negotiation algorithm.
Anonymous | Specifies that the client is anonymous to the server. The server can impersonate the client, but the impersonation token will not contain any information. Anonymous is not supported in version 1.1.
Identify | Specifies that the server can obtain the client's identity. The server can impersonate the client for access control list (ACL) checking, but it cannot access system objects as the client.
Impersonate | Specifies that the server process can impersonate the client's security context while acting on behalf of the client. This level of impersonation can be used to access local resources such as files. When impersonating at this level, the impersonation token can be passed across only one machine boundary.
Delegate | Specifies that the server process can impersonate the client's security context while acting on behalf of the client. The server process can also make outgoing calls to other servers while acting on behalf of the client, using cloaking. The server can use the client's security context on other computers to access local and remote resources as the client. When impersonating at this level, the impersonation token can be passed across any number of machine boundaries.
cpuMask | Specifies which processors on a multiprocessor server are eligible to run ASP.NET processes. The cpuMask value specifies a bit pattern that indicates the CPUs eligible to run ASP.NET threads. For example, the cpuMask hexadecimal value 0x0d represents the bit pattern 1101. On a computer with four CPUs, this indicates that ASP.NET processes can be scheduled on CPUs 0, 2, and 3, but not on CPU 1. ASP.NET launches one worker process for each eligible CPU. If the webGarden attribute (see below) is set to true, the cpuMask limits worker processes to the number of eligible CPUs. (The maximum allowed number of worker processes is equal to the number of CPUs.) By default, all CPUs are enabled and ASP.NET launches one process for each CPU. If webGarden is set to false, the cpuMask attribute is ignored and only one worker process will run.
enable | Specifies whether the process model is enabled.
true | Indicates that the process model is enabled.
false | Indicates that the process model is not enabled.
idleTimeout | Specifies the period of inactivity, in hr:min:sec string format, after which ASP.NET automatically ends the worker process. The default is Infinite.
logLevel | Specifies event types to be logged to the event log.
All | Specifies that all process events are logged.
None | Specifies that no events are logged.
Errors | Specifies that only unexpected shutdowns, memory limit shutdowns, and deadlock shutdowns are logged. Errors is the default.
maxWorkerThreads | 5 to 100 | Configures the maximum amount of worker threads to be used for the process on a per-CPU basis. For example, if this value is 25 on a single-processor server, ASP.NET uses the runtime APIs to set the process limit to 25. On a two-processor server, the limit is set to 50. The default is 20. The value of maxWorkerThreads must be equal to or greater than the minFreeThread attribute setting in the <httpRuntime> configuration section.
maxIoThreads | 5 to 100 | Configures the maximum number of I/O threads to be used for the process on a per-CPU basis. For example, if this value is 25 on a single-processor server, ASP.NET uses the runtime APIs to set the process limit to 25. On a two-processor server, the limit is set to 50. The default is 20. The value of maxIoThreads must be equal to or greater than the minFreeThread attribute setting in the <httpRuntime> configuration section.
memoryLimit | Specifies the maximum allowed memory size, as a percentage of total system memory, that the worker process can consume before ASP.NET launches a new process and reassigns existing requests. The default is 60 percent.
password | If present (and in conjunction with a userName), this attribute causes the worker process to run with the configured Windows identity. The default value is AutoGenerate. See userName for more details on the special names System and Machine, which do not require a password, and for information about storing encrypted worker process credentials in the registry.
pingFrequency | Specifies the time interval, in standard process model format (hr:min:sec), at which the ISAPI extension pings the worker process to see if it is running. If it is not running for the pingTimeout interval, the worker process is restarted. The default is 30 seconds.
pingTimeout | Specifies the time interval, in standard process model format (hr:min:sec), after which a nonresponsive worker process is restarted. The ISAPI extensions ping the worker process at the pingFrequency interval. If the worker process does not respond within the pingTimeout interval, the process is restarted. The default is 5 seconds.
requestLimit | Specifies the number of requests allowed before ASP.NET automatically launches a new worker process to take the place of the current one. The default is Infinite.
requestQueueLimit | Specifies the number of requests allowed in the queue before ASP.NET begins returning "503 – Server Too Busy" errors to new requests. The default is 5000.
responseDeadlockInterval Specifies the time interval, in standard process model format (hr:min:sec), after which the process will be restarted if the following conditions are met:
  • There are queued requests.
  • There has not been a response during this interval.

The default is 3 minutes.
responseRestartDeadlockInterval | This attribute is no longer used by ASP.NET and is provided for backward compatibility only. It will not cause a configuration error if it is already present in a configuration file. All recycling in the event of a deadlock condition is now controlled by the responseDeadlockInterval attribute.
serverErrorMessageFile | If present, specifies the contents of a file to use instead of the default "Server Unavailable" message in the event of a fatal error. The file location is relative to Machine.config or can be an absolute file path. If this attribute is not present, the default "Server Unavailable" message will be used.
shutdownTimeout | Specifies the number of minutes allowed for the worker process to shut itself down. When the timeout expires, ASP.NET shuts down the worker process. The time is expressed in hr:min:sec string format. The default is 5 seconds, or 0:00:05.
timeout | Specifies the number of minutes until ASP.NET launches a new worker process to take the place of the current one. The default is Infinite.
userName If present, the userName attribute runs the ASP.NET worker process with a Windows identity different from that of the default process identity. By default, userName is set to the special value Machine, and the process runs under a user account named ASPNET that is created automatically when ASP.NET is installed. The password for the ASPNET account is cryptographically generated at the time of installation. If valid credentials are presented in the userName and password attributes, the process is run with the given account. One other special value for userName is System, with the password AutoGenerate, which runs the process as an administrative account and allows all ASP.NET user code running under the process to have full administrative privileges. See the Remarks section below for information about using ASP.NET on a server that is a domain controller.

userName and password are stored in clear text in the configuration file. Although IIS will not transmit .config files in response to a user agent request, configuration files can be read by other means, for instance by an authenticated user with proper credentials on the domain that contains the server. To help maintain security, the processModel section supports storage of encrypted userName and password attributes in the registry. The credentials must be in REG_BINARY format encrypted by the Windows 2000 and Windows XP Data Protection API (DPAPI) encryption functions. For more information, see the Remarks and Example sections below.
webGarden | Controls CPU affinity when used in conjunction with the cpuMask attribute. (A multiprocessor Web server is called a Web garden).
true | Indicates that the cpuMask attribute is used to specify which CPUs are eligible to run ASP.NET processes.
false | Indicates that CPU usage is scheduled by the Windows operating system. The cpuMask attribute is ignored and only one worker process will run. The default is false.

Remarks

The managed code configuration system does not read the <processModel> configuration settings. Instead, they are read directly by the aspnet_isapi.dll unmanaged DLL. Changes to this section are not applied until IIS is restarted.

If you install ASP.NET on a domain controller, there are special steps you must take to make the installation work properly. For more information, see article Q315158, "ASP.NET Does Not Work with the Default ASPNET Account on a Domain Controller," in the Microsoft Knowledge Base at http://support.microsoft.com.

When ASP.NET is running under IIS version 6 in native mode, the IIS 6 process model is used and the settings in the <processModel> section are ignored. To configure the process identity, cycling, or other process model values, use the Internet Services Manager user interface to configure the IIS worker process for your application.

Time values are in the form "hours:minutes:seconds". If a single number with no colons is given, the value is assumed to be minutes; thus timeout="4" is equivalent to timeout="00:04:00".

If an ASP.NET application is causing the ASP.NET worker process (Aspnet_wp.exe on Windows 2000 and Windows XP Professional, W3wp.exe on Windows Server 2003) to restart with an error message indicating that the restart was due to a suspected deadlock state, you should increase the responseDeadlockInterval setting.

Storing username and password in the registry

Storing a User Name and Password in the Registry

To encrypt the user name and password and store them in the registry, set the userName and password as follows.

userName="registry:HKLM\Software\AspNetProcess,Name"

password="registry:HKLM\Software\AspNetProcess,Pwd"

The portion of the string after the keyword registry and before the comma indicates the name of the registry key that ASP.NET opens. The portion after the comma contains a single string value name from which ASP.NET will read the credentials. The comma is required, and the credentials must be stored in the HKLM hive. If the configuration format is incorrect, ASP.NET will not launch the worker process and the current account creation failure code path will be followed.

The credentials must be in REG_BINARY format, containing the output of a call to the Windows API function CryptProtectData. You can create the encrypted credentials and store them in the registry with the ASP.NET Set Registry console application (Aspnet_setreg.exe), which uses CryptProtectData to accomplish the encryption. To download Aspnet_setreg.exe, along with the Visual C++ source code and Help , visit the Web site www.asp.net and search for "aspnet_setreg."

You should configure access to the key storing the encrypted credentials so that access is provided only to Administrators and SYSTEM. Because the key will be read by the ASP.NET process running as SYSTEM, you should set the following permissions:

Administrators:F

SYSTEM:F

CREATOR OWNER:F

ProcessAccount: R

This provides two lines of defense to protect the data:

  • The ACL permissions require the identity accessing the data to be an Administrator.
  • An attacker must run code on the server (CryptUnprotectData) to recover the credentials for the account.

Examples

The following example specifies several <processModel> configuration settings.

<configuration>
   <system.web>
      <processModel
         enable="true"
         timeout="15"
         idleTimeout="25"
         shutdownTimeout="5"
         requestLimit="1000"
         requestQueueLimit="500"
         responseDeadlockInterval="00:03:00"
         responseRestartDeadlockInterval="Infinite"
         memoryLimit="20"
         webGarden="true"
         maxWorkerThreads="25"
         maxIoThreads="25"/>
   </system.web>
</configuration>

The following example specifies that the encrypted username and password are stored in the registry under the user-defined key AspNetProcess.

<configuration>
   <system.web>
      <processModel>
         userName="registry:HKLM\Software\AspNetProcess,Name"
         password="registry:HKLM\Software\AspNetProcess,Pwd"
      </processModel>
   </system.web>
</configuration>

Requirements

  • Contained Within: <system.web>
  • Web Platform: IIS 5.0, IIS 5.1, IIS 6.0
  • Configuration File: Machine.config, Web.config
  • Configuration Section Handler: System.Web.Configuration.ProcessModelConfigurationHandler

Related Topics
  • ASP.NET Configuration
  • ASP.NET Settings Schema


<protocols> Element

Specifies the transmission protocols that ASP.NET can use to decrypt data sent from a client browser in the HTTP request. The data sent in an HTTP request to an XML Web service can contain method calls and parameters.

Example Configuration Structure:

<configuration>
   <system.web>
      <webServices>
         <protocols>

<protocols>
   <add name="protocolname"/>
   <remove name="protocolname"/>
   <clear>
</protocols>

Subtag

Subtag | Description
<add> | Adds a transmission protocol to the list of supported protocols.
<remove> | Removes a single protocol from a Web service's list of supported transmission protocols.
<clear> | Removes all protocols from a Web service's list of supported transmission protocols.

Example

The following example enables all four currently supported protocols.

<configuration>
   <system.web>
      <webServices>
         <protocols>
            <add name="HttpSoap"/>
            <add name="HttpPost"/>
            <add name="HttpGet"/>
            <add name="Documentation"/>
         </protocols>
      </webServices>
   <system.web>
</configuration>

Requirements

  • Contained Within: <system.web>
  • Web Platform: IIS 5.0, IIS 5.1, IIS 6.0
  • Configuration File: Machine.config, Web.config
  • Configuration Section Handler: System.Web.Services.Configuration.WebServicesConfigurationSectionHandler

Related Topics
  • <webServices> Element
  • ASP.NET Configuration
  • ASP.NET Settings Schema


<remove> Element for <assemblies>

Removes a reference to an assembly.

Example Configuration Structure:

<configuration>
<system.web>
<compilation>
<assemblies>
<remove>

<remove assembly="assembly"/>

Required Attribute

Attribute | Description
assembly | The assembly to be removed.

Example

The following example configures compilation settings for an application.

<configuration>
   <system.web>
      <compilation defaultLanguage="VB">
         <assemblies>
            <remove assembly="ADODB"/>
            <remove assembly="*"/>
         </assemblies>
      </compilation>
   </system.web>
</configuration>

Requirements

  • Contained Within: <system.web>
  • Web Platform: IIS 5.0, IIS 5.1, IIS 6.0
  • Configuration File: Machine.config, Web.config
  • Configuration Section Handler: System.Web.Configuration.

Related Topics
  • <assemblies> Element
  • ASP.NET Configuration
  • ASP.NET Settings Schema


<remove> Element for <clientTarget>

Removes an alias for a specific user agent from an internal collection of user agent aliases.

Example Configuration Structure:

<configuration>
<system.web>
<clientTarget>
<remove>

<remove alias="alias name"/>

Required Attribute

Attribute | Description
alias | The user agent alias to be removed.

Example

The following example removes a user agent alias from the internal user agent alias collection.

<configuration>
   <system.web>
      <clientTarget>
         <remove alias="downlevel"/>
      </clientTarget>
   </system.web>
</configuration>

Requirements

  • Contained Within: <system.web>
  • Web Platform: IIS 5.0, IIS 5.1, IIS 6.0
  • Configuration File: Machine.config, Web.config
  • Configuration Section Handler: System.Web.Configuration.

Related Topics
  • <clientTarget> Element
  • ASP.NET Configuration
  • ASP.NET Settings Schema


<remove> Element for <httpHandlers>

Removes a verb/path mapping to an IHttpHandler interface. The remove directive must exactly match the verb/path mapping of a previous <add> directive. Wildcard characters are not supported.

Example Configuration Structure:

<configuration>
<system.web>
<httpHandlers>
<remove>

<remove verb="[verb list]" path="path"/>

Required Attributes

Attribute | Description
verb | The verb list that matches the verb list of the handler to be removed.
path | The path that matches the path of the handler to be removed.

Example

The following example removes all handler mappings to SOAP handlers.

<configuration>
   <system.web>
      <httpHandlers>
         <remove verb="*" path="*.soap"/>
      </httpHandlers>
   </system.web>
</configuration>

Requirements

  • Contained Within: <system.web>
  • Web Platform: IIS 5.0, IIS 5.1, IIS 6.0
  • Configuration File: Machine.config, Web.config
  • Configuration Section Handler: System.Web.Configuration.HttpHandlersSectionHandler

Related Topics
  • <httpHandlers> Element
  • ASP.NET Configuration
  • ASP.NET Settings Schema


<remove> Element for <httpModules>

Removes a reference to a module. The value of <remove> must exactly match that of a previous <add> directive.

Example Configuration Structure:

<configuration>
<system.web>
<httpModules>
<remove>

<remove name="ModuleName"/>

Required Attribute

Attribute | Description
name | The name under which the module was previously added using <add>.

Example

The following example removes the OutputCache module.

<configuration>
   <system.web>
      <httpModules>
         <remove name="OutputCache"/>
      </httpModules>
   </system.web>
</configuration>

Requirements

  • Contained Within: <system.web>
  • Web Platform: IIS 5.0, IIS 5.1, IIS 6.0
  • Configuration File: Machine.config, Web.config
  • Configuration Section Handler: System.Web.Configuration.HttpModulesConfigurationHandler

Related Topics
  • <httpModules> Element
  • ASP.NET Configuration
  • ASP.NET Settings Schema


<remove> Element for <protocols>

Removes a single protocol from a specific application's list of supported HTML encoding protocols.

Example Configuration Structure:

<configuration>
<system.web>
<webServices>
<protocols>
<remove>

<remove name="protocol name"/>

Required Attribute

Attribute | Description
name | The name of the protocol to remove.

Example

The following example removes a protocol for a Web service.

<configuration>
   <system.web>
      <webServices>
         <protocols>
            <remove name="HttpPost"/>
         </protocols>
      <webServices>
   </system.web>
</configuration>

Requirements

  • Contained Within: <system.web>
  • Web Platform: IIS 5.0, IIS 5.1, IIS 6.0
  • Configuration File: Machine.config, Web.config
  • Configuration Section Handler: System.Web.Services.Configuration.WebServicesConfigurationSectionHandler

Related Topics
  • <webServices> Element
  • <protocols> Element
  • ASP.NET Configuration
  • ASP.NET Settings Schema


<remove> Element for <serviceDescriptionFormatExtensionTypes>

Removes a single service description format extension type from within the scope of the configuration file.

Example Configuration Structure:

<configuration>
<system.web>
<webServices>
<serviceDescriptionFormatExtensionTypes>

<remove>

<remove type="service description format extension type"/>

Required Attribute

Attribute | Description
type | The service description format extension to remove.

Example

The following example removes a protocol for a Web application.

<configuration>
   <system.web>
      <webServices>
         <serviceDescriptionFormatExtensionType>
            <remove type=""/>
         </serviceDescriptionFormatExtensionType >
      <webServices>
   </system.web>
</configuration>

Requirements

  • Contained Within: <system.web>
  • Web Platform: IIS 5.0, IIS 5.1, IIS 6.0
  • Configuration File: Machine.config, Web.config
  • Configuration Section Handler: System.Web.Services.Configuration.WebServicesConfigurationSectionHandler

Related Topics
  • <webServices> Element
  • <serviceDescriptionFormatExtensionTypes> Element
  • ASP.NET Configuration
  • ASP.NET Settings Schema


<result> Element

Specifies the HttpCapabilitiesBase-derived class used to hold the results (key/value string pairs) from parsing this section. This string is used at run time to create the return type.

Example Configuration Structure:

<configuration>
<system.web>
<browserCaps>

<result>

<result type="section type"/>

Required Attribute

Attribute | Description
type | The class responsible for parsing the section and storing the key/value pairs describing browser capabilities.

Example

The following example specifies the type responsible for parsing the <browserCaps> section.

<result type="System.Web.HttpBrowserCapabilities, System.Web,
           Version=1.0.3102.0, Culture=neutral,
           PublicKeyToken=b03f5f7f11d50a3a"/>

Requirements

  • Contained Within: <system.web>
  • Web Platform: IIS 5.0, IIS 5.1, IIS 6.0
  • Configuration File: Machine.config, Web.config
  • Configuration Section Handler: System.Web.Configuration. HttpCapabilitiesSectionHandler

Related Topics
  • <browserCaps> Element
  • ASP.NET Configuration
  • ASP.NET Settings Schema


<securityPolicy> Element

Defines valid mappings of named security levels to policy files. This section can be declared at the machine, site, and application levels. You can help extend the security system by providing your own named <trustLevel> subtag mapped to a file specified by the policyFile attribute.

Example Configuration Structure:

<configuration>
<system.web>
<securityPolicy>

<securityPolicy>
   <trustLevel name="value" policyFile="value"/>
</securityPolicy>

Subtag

Subtag | Description
<trustLevel> | Specifies a security level name and associated policy file for each security level.

Example

The following example specifies the policy files that handle different trust levels.

<securityPolicy>
    <trustLevel name="Full"    policyFile="internal"/>
    <trustLevel name="High"    policyFile="web_hightrust.config"/>
    <trustLevel name="Medium"  policyFile="web_mediumtrust.config"/>
    <trustLevel name="Low"     policyFile="web_lowtrust.config"/>
    <trustLevel name="Minimal" policyFile="web_minimaltrust.config"/>
</securityPolicy>

Requirements

  • Contained Within: <system.web>
  • Web Platform: IIS 5.0, IIS 5.1, IIS 6.0
  • Configuration File: Machine.config, Web.config
  • Configuration Section Handler: System.Web.Configuration.SecurityPolicyConfigHandler

Related Topics
  • ASP.NET Configuration
  • ASP.NET Settings Schema
  • ASP.NET Trust Levels and Policy Files


<serviceDescriptionFormatExtensionTypes> Element

Specifies the service description format extensions to run within the scope of the configuration file.

Example Configuration Structure:

<configuration>
<system.web>
<webServices>
<serviceDescriptionFormatExtensionTypes>

<serviceDescriptionFormatExtensionTypes>
   <add type=""
        group="0"
        priority="2"/>
   <remove type="type name"/>
   <clear/>
</serviceDescriptionFormatExtensionTypes>

Subtags

Subtag | Description
<add> | Adds a service description format extension to run with all XML Web services within the scope of the configuration file.
<remove> | Removes the specified service description format extension reference from the compile settings. The value of <remove> must exactly match that of a previous <add> directive. Wildcard selections are not supported.
<clear> | Removes all service description format extension classes currently contained in or inherited by the specified Web.config file.

Remarks

For details on SOAP extensions, see the Altering the SOAP Message Using SOAP Extensions topic in .NET Framework Help .

Requirements

  • Contained Within: <system.web>
  • Web Platform: IIS 5.0, IIS 5.1, IIS 6.0
  • Configuration File: Machine.config, Web.config
  • Configuration Section Handler: System.Web.Services.Configuration.WebServicesConfigurationSectionHandler

Related Topics
  • <webServices> Element
  • ASP.NET Configuration
  • ASP.NET Settings Schema


<sessionState> Element

Configures session state settings for the current application.

Example Configuration Structure:

<configuration>
<system.web>
<sessionState>

<sessionState mode="Off|InProc|StateServer|SQLServer"
              cookieless="true|false"
              timeout="number of minutes"
              stateConnectionString="tcpip=server:port"
              sqlConnectionString="sql connection string"
              stateNetworkTimeout="number of seconds"/>

Required Attributes

Attribute | Option | Description
mode |  | Specifies where to store the session state.
 | Off | Indicates that session state is not enabled.
 | InProc | Indicates that session state is stored locally.
 | StateServer | Indicates that session state is stored on a remote server.
 | SQLServer | Indicates that session state is stored on the Microsoft SQL Server™.

Optional Attributes

Attribute | Option | Description
cookieless |  | Specifies whether sessions without cookies should be used to identify client sessions.
 | true | Indicates that sessions without cookies should be used.
 | false | Indicates that sessions without cookies should not be used. The default is false.
timeout |  | Specifies the number of minutes a session can be idle before it is abandoned. The default is 20.
stateConnectionString |  | Specifies the server name and port where session state is stored remotely. For example, "tcpip=127.0.0.1:42424". This attribute is required when mode is StateServer.
sqlConnectionString |  | Specifies the connection string for a SQL Server. For example, "data source=localhost;Integrated Security=SSPI;Initial Catalog=northwind". This attribute is required when mode is SQLServer.
stateNetworkTimeout |  | When using StateServer mode to store session state, specifies the number of seconds the TCP/IP network connection between the Web server and the state server can be idle before the session is abandoned. The default is 10.

Remarks

To use StateServer mode

  1. Make sure ASP.NET state service is running on the remote server that will store session state information. This service is installed with ASP.NET and is located by default at <Drive>:\systemroot\Microsoft.NET\Framework\version\aspnet_state.exe.
  2. In the application's Web.config file, set mode=StateServer and set the stateConnectionString attribute. For example, stateConnectionString="tcpip=sarath:42424".

To use SQLServer mode

  1. Run InstallSqlState.sql (installed by default in <Drive>:\systemroot\Microsoft.NET\Framework\version) on the computer running SQL Server that will store the session state. This creates a database called ASPState with new stored procedures and ASPStateTempApplications and ASPStateTempSessions tables in the TempDB database.
  2. In the application's Web.config file, set mode=SQLServer and set the sqlConnectionString attribute. For example, sqlConnectionString="data source=localhost;Integrated Security=SSPI;Initial Catalog=northwind".

Example

The following example specifies several session state configuration settings.

<configuration>
   <system.web>
      <sessionState mode="InProc"
                    cookieless="true"
                    timeout="20"/>
      </sessionState>
   </system.web>
</configuration>

Requirements

  • Contained Within: <system.web>
  • Web Platform: IIS 5.0, IIS 5.1, IIS 6.0
  • Configuration File: Machine.config, Web.config
  • Configuration Section Handler: System.Web.SessionState.SessionStateSectionHandler

Related Topics
  • ASP.NET Configuration
  • ASP.NET Settings Schema


<soapExtensionImporterTypes> Element

Specifies the SOAP extensions to run when a service description for an XML Web service within the scope of the configuration file is accessed.

Example Configuration Structure:

<configuration>
<system.Web>
<webServices>
<soapExtensionImporterTypes>

<soapExtensionImporterTypes>
   <add type="soap extension class"
        priority="number"
        group="0|1"/>
</soapExtensionImporterTypes>

Subtag

Subtag | Description
<add> | Adds a SOAP extension to run with all XML Web services within the scope of the configuration file.
<remove> | Removes a single SOAP extension from a Web service's list of supported extensions.
<clear> | Removes all SOAP extensions from a Web service's list of supported extensions.

Remarks

For details on SOAP extensions, see Altering the SOAP Message Using SOAP Extensions topic in .NET Framework Help .

Requirements

  • Contained Within: <system.web>
  • Web Platform: IIS 5.0, IIS 5.1, IIS 6.0
  • Configuration File: Machine.config, Web.config
  • Configuration Section Handler: System.Web.Services.Configuration.WebServicesConfigurationSectionHandler

Related Topics
  • <webServices> Element
  • ASP.NET Configuration
  • ASP.NET Settings Schema


<soapExtensionReflectorTypes> Element

Specifies the SOAP extensions to run when a service description is generated for all XML Web services within the scope of the configuration file.

Example Configuration Structure:

<configuration>
<system.Web>
<webServices>
<soapExtensionReflectorTypes>

<soapExtensionReflectorTypes>
   <add type="soap extension class"
        priority="number"
        group="0|1"/>
</soapExtensionReflectorTypes>

Subtags

Subtag | Description
<add> | Adds a SOAP extension to run with all XML Web services within the scope of the configuration file.
<remove> | Removes a single SOAP extension from a Web service's list of supported extensions.
<clear> | Removes all SOAP extensions from a Web service's list of supported extensions.

Remarks

For details on SOAP extensions, see Altering the SOAP Message Using SOAP Extensions topic in .NET Framework Help .

Requirements

  • Contained Within: <system.web>
  • Web Platform: IIS 5.0, IIS 5.1, IIS 6.0
  • Configuration File: Machine.config, Web.config
  • Configuration Section Handler: System.Web.Services.Configuration.WebServicesConfigurationSectionHandler

Related Topics
  • <webServices>
  • ASP.NET Configuration
  • ASP.NET Settings Schema


<soapExtensionTypes> Element

Specifies the SOAP extensions to run with all XML Web services within the scope of the configuration file.

Example Configuration Structure:

<configuration>
<system.Web>
<webServices>
<soapExtensionTypes>

<soapExtensionTypes>
   <add type="soap extension class"
        priority="number"
        group="0|1"/>
</soapExtensionTypes>

Subtag

Subtag | Description
<add> | Adds a SOAP extension to run with all XML Web services within the scope of the configuration file.
<remove> | Removes a single SOAP extension from a Web service's list of supported extensions.
<clear> | Removes all SOAP extensions from a Web service's list of supported extensions

Remarks

For details on SOAP extensions, see Altering the SOAP Message Using SOAP Extensions In .NET Framework Help .

Requirements

  • Contained Within: <system.web>
  • Web Platform: IIS 5.0, IIS 5.1, IIS 6.0
  • Configuration File: Machine.config, Web.config
  • Configuration Section Handler: System.Web.Services.Configuration.WebServicesConfigurationSectionHandler

Related Topics
  • <webServices>
  • ASP.NET Configuration
  • ASP.NET Settings Schema


<trace> Element

Configures the ASP.NET trace service.

Example Configuration Structure:

<configuration>
<system.web>
<trace>

<trace enabled="true|false"
       localOnly="true|false"
       pageOutput="true|false"
       requestLimit="integer"
       traceMode="SortByTime|sortByCategory"/>

Optional Attributes

Attribute | Option | Description
enabled |  | Specifies whether tracing is enabled for an application.
 | true | Indicates that tracing is enabled. Trace must be enabled in order to use the Trace.axd viewer.
 | false | Indicates that tracing is not enabled. The default is false.
localOnly | true | Indicates that the trace viewer (Trace.axd) is available only on the host Web server. The default is true.
 | false | Indicates that the trace viewer is available from any computer.
pageOutput |  | Specifies whether trace output is rendered at the end of each page.
 | true | Indicates that trace output is appended to each page.
 | false | Indicates that trace output is accessible through the trace utility only. The default is false.
requestLimit |  | Specifies the number of trace requests to store on the server. The default is 10. If the limit is reached, trace is automatically disabled.
traceMode | SortByTime | Indicates that trace information is displayed in the order it is processed. The default is SortByTime.
 | SortByCategory | Indicates that trace information is displayed alphabetically by user-defined category.

Example

The following example specifies tracing configuration settings.

<configuration>
   <system.web>
      <trace enabled="false"
             pageOutput="true"
             requestLimit="15"/>
   <system.web>
</configuration>

Requirements

  • Contained Within: <system.web>
  • Web Platform: IIS 5.0, IIS 5.1, IIS 6.0
  • Configuration File: Machine.config, Web.config
  • Configuration Section Handler: System.Web.Configuration.TraceConfigurationHandler

Related Topics
  • ASP.NET Configuration
  • ASP.NET Settings Schema


<trust> Element

Configures the code access security level applied to an application. The <trust> section can be declared at the machine, site, and application levels.

Example Configuration Structure:

<configuration>
<system.web>
<trust>

<trust level="Full|High|Medium|Low|Minimal" originUrl="url"/>

Required Attribute

Attribute | Option | Description
level |  | Specifies the security zone under which the application will be run. The default is Full. The named levels correspond to the security levels defined in <trustLevel>.
 | Full | Specifies that ASP.NET does not restrict security policy.
 | High | Specifies that the High level is applied to code access security.
 | Medium | Specifies that the Medium level is applied to code access security.
 | Low | Specifies that the Low level is applied to code access security.
 | Minimal | Specifies that the Minimal level is applied to code access security.

Optional Attribute

Attribute | Description
originUrl | Specifies an application's URL of origin. If present, this can be used for some permissions such as WebRequest that allow connectivity back to the host of origin. This allows permissions that rely on the notion of a host to function correctly.

Example

The following example specifies trust level settings for an ASP.NET application.

<system.web>
   <trust level="Full" originUrl=""/>
</system.web>

Requirements

  • Contained Within: <system.web>
  • Web Platform: IIS 5.0, IIS 5.1, IIS 6.0
  • Configuration File: Machine.config, Web.config
  • Configuration Section Handler: System.Web.Security.CodeAccessSecurityHandler

Related Topics
  • ASP.NET Configuration
  • ASP.NET Settings Schema


<trustLevel> Element

Defines the mapping of specific security levels to named policy files. The <trustLevel> element can be declared at the site level only.

Example Configuration Structure:

<configuration>
<system.web>
<securityPolicy>
<trustLevel>

   <trustLevel name="Full|High||Medium|Low|Minimal"
               policyFile="filename.config"/>

Required Attributes

Attribute | Option | Description
name |  | Specifies a named security level that is mapped to a policy file. The default is Full.
 | Full | Specifies that ASP.NET does not restrict security policy with an application domain-specific policy. There is no security policy file associated with Full.
 | High | Specifies the High security level policy file mapping.
 | Medium | Specifies the Medium security level policy file mapping.
 | Low | Specifies the Low security level policy file mapping.
 | Minimal | Specifies the Minimum security level policy file mapping.
policyFile |  | Specifies the configuration file that contains security policy settings for the named security level.

Remarks

ASP.NET treats the Full trust specially so it does not have an associated policy file. If Full is set, the ASP.NET host does not add extra application domain-level policy to the application. The Full trust level is always mapped to an internal handler and the policyFile attribute is ignored.

Example

The following example specifies trust level settings for an ASP.NET application.

<system.web>
   <securityPolicy>
      <trustLevel name="Full"    policyFile="internal"/>
      <trustLevel name="High"    policyFile="web_hightrust.config"/>
      <trustLevel name="Medium"  policyFile="web_mediumtrust.config"/>
      <trustLevel name="Low"     policyFile="web_lowtrust.config"/>
      <trustLevel name="Minimal" policyFile="web_minimaltrust.config"/>
   </securityPolicy>
</system.web>

Requirements

  • Contained Within: <system.web>
  • Web Platform: IIS 5.0, IIS 5.1, IIS 6.0
  • Configuration File: Machine.config, Web.config
  • Configuration Section Handler: System.Web.Security.CodeAccessSecurityHandler

Related Topics
  • <securityPolicy> Element
  • ASP.NET Configuration
  • ASP.NET Settings Schema


<use> Element

Specifies the HTTP request string used to parse browser capability information.

Example Configuration Structure:

<configuration>
<system.web>
<browserCaps>
<use>

<use var="[server variable]" as="[variableName]"/>

Optional Attributes

Attribute | Description
var | The Internet Information Services (IIS) server variable that is parsed to extract browser capability information. The default is "HTTP_USER_AGENT"
as | A name that can be used to reference the server variable in subsequent regular expressions.

Example

The following example specifies that the IIS HTTP_USER_AGENT server variable is the source of the browser capabilities information.

<use var="HTTP_USER_AGENT">

Requirements

  • Contained Within: <system.web>
  • Web Platform: IIS 5.0, IIS 5.1, IIS 6.0
  • Configuration File: Machine.config, Web.config
  • Configuration Section Handler: System.Web.Configuration. HttpCapabilitiesSectionHandler

Related Topics
  • <browserCaps> Element
  • ASP.NET Configuration
  • ASP.NET Settings Schema


<user> Element

Allows definition of user name and password credentials within the configuration file.

Example Configuration Structure:

<configuration>
<system.web>
<authentication>
<credentials>
<user>

<user name="username" password="password"/>

Required Attributes

Attribute | Description
name | The logon user name.
password | The user's password.

Example

The following example sets password format and supplies a user name and password.

<authentication mode="Windows">
   <credentials passwordFormat="SHA1">
      <user name="UserName"
            password="07B7F3EE06F278DB966BE960E7CBBD103DF30CA6"/>
   </credentials>
</authentication>

Requirements

  • Contained Within: <system.web>
  • Web Platform: IIS 5.0, IIS 5.1, IIS 6.0
  • Configuration File: Machine.config, Web.config
  • Configuration Section Handler: System.Web.Configuration.AuthenticationConfigHandler

Related Topics
  • <authentication> Element
  • <credentials> Element
  • ASP.NET Configuration
  • ASP.NET Settings Schema


<webServices> Element

Helps control the settings of XML Web services created using ASP.NET.

Example Configuration Structure:

<configuration>
<system.web>
<webServices>

<webServices>
   <protocols>
      <add name="protocol name"/>
   </protocols>
   <serviceDescriptionFormatExtensionTypes>
   </serviceDescriptionFormatExtensionTypes>
   <soapExtensionTypes>
      <add type="type"/>
   </soapExtensionTypes>
   <soapExtensionReflectorTypes>
      <add type="type"/>
   </soapExtensionReflectorTypes>
   <soapExtensionImporterTypes>
      <add type="type"/>
   </soapExtensionImporterTypes>
   <wsdlHelpGenerator href="help generator file"/>
</webServices>

Subtags

Subtag | Description
<protocols> | Specifies the transmission protocols that ASP.NET can use to decrypt data sent from a client browser in the HTTP request. The data sent in an HTTP request to an XML Web service can contain method calls and parameters.
<serviceDescriptionFormatExtensionTypes> | Specifies the service description format extension to run within the scope of the configuration file.
<soapExtensionTypes> | Specifies the SOAP extensions to run with all XML Web services within the scope of the configuration file.
<soapExtensionReflectorTypes> | Specifies the SOAP extensions to run when a service description is generated for all XML Web services within the scope of the configuration file.
<soapExtensionImporterTypes> | Specifies the SOAP extensions to run when a service description for an XML Web service within the scope of the configuration file is accessed to create a proxy class.
<wsdlHelpGenerator> | The XML Web service Help page (an .aspx file) that is displayed to a browser when the browser navigates directly to an ASMX page.

Example

The following example specifies XML Web service configuration settings.

<configuration>
   <system.web>
      <webServices>
         <protocols>
            <add name="HttpGet"/>
            <add type="HttpPost"/>
            <add type="Documentation"/>
         </protocols>
         <serviceDescriptionFormatExtensionTypes>
         </serviceDescriptionFormatExtensionTypes>
         <soapExtensionTypes>
         </soapExtensionTypes>
         <soapExtensionReflectorTypes>
         </soapExtensionReflectorTypes>
         <soapExtensionImporterTypes>
         </soapExtensionImporterTypes>
         <wsdlHelpGenerator href="DefaultSdlHelpGenerator.aspx"/>
      </webServices>
   <system.web>
</configuration>

Requirements

  • Contained Within: <system.web>
  • Web Platform: IIS 5.0, IIS 5.1, IIS 6.0
  • Configuration File: Machine.config, Web.config
  • Configuration Section Handler: System.Web.Services.Configuration.WebServicesConfigurationSectionHandler

Related Topics
  • ASP.NET Configuration
  • ASP.NET Settings Schema


<wsdlHelpGenerator> Element

Specifies the XML Web service Help page (an .aspx file) that is displayed to a browser when the browser navigates directly to an ASMX XML Web services page.

Example Configuration Structure:

<configuration>
<system.Web>
<webServices>
<wsdlHelpGenerator>

<wsdlHelpGenerator href="path.aspx"/>

Required Attribute

Attribute | Description
href | The file path to the Help page.

Remarks

You can create your own Help page containing images and text for your XML Web service application. The following code example is an excerpt from a Web.config file that sets the Help page to a custom MyServiceHelpPage.aspx file in the docs folder beneath the folder containing the main application files and the Web.config file.

The value of href is a file path, not a URL. The file path can be relative or absolute. If it is relative, it is relative to the location of the configuration file.

Example

<configuration>
   <system.web>
      <webServices>
         <wsdlHelpGenerator href="docs/MyServiceHelpPage.aspx"/>
      </webServices>
   </system.web>
</configuration>

Requirements

  • Contained Within: <system.web>
  • Web Platform: IIS 5.0, IIS 5.1, IIS 6.0
  • Configuration File: Machine.config, Web.config
  • Configuration Section Handler: System.Web.Services.Configuration.WebServicesConfigurationSectionHandler

Related Topics
  • <webServices> Element
  • ASP.NET Configuration
  • ASP.NET Settings Schema


ASP.NET Security

Most Web sites need to selectively restrict access to some portions of the site. You can think of a Web site as somewhat analogous to an art gallery. The gallery is open for the public to come in and browse, but there are certain parts of the facility, such as the business offices, that are accessible only to people with certain credentials, such as employees. When a Web site stores its customer's credit card information in a database, for example, ASP.NET helps protect the database from public access. ASP.NET security addresses this and many other security issues.

ASP.NET, in conjunction with Internet Information Services (IIS), can authenticate user credentials such as names and passwords using any of the following authentication methods:

  • Windows: Basic, digest, or Integrated Windows Authentication (NTLM or Kerberos).
  • Microsoft Passport authentication
  • Forms authentication
  • Client Certificate authentication

ASP.NET helps control access to site information by comparing authenticated credentials, or representations of them, to NTFS file system permissions or to an XML file that lists authorized users, authorized roles (groups), or authorized HTTP verbs.

The topics in this section describe the specifics of ASP.NET security.

This section includes the following information:

  • How ASP.NET Security Works: Provides an overview of ASP.NET security.
  • ASP.NET Architecture: Provides an overview of ASP.NET infrastructure and subsystem relationships, as related to security.
  • ASP.NET Data Flow: Describes the security data flow for two common scenarios.
  • ASP.NET Authentication: Describes ASP.NET authentication providers.
  • ASP.NET Authorization: Describes two fundamental ways to authorize access to a resource.
  • ASP.NET Impersonation: Describes how and when to use ASP.NET Impersonation.
  • Authentication and ASP.NET Impersonation: Describes how to create ASP.NET applications with incorporated security.
  • ASP.NET Application Security in Hosted Environments: Describes ASP.NET security features for multi-application Web servers.
Related Topics
  • For introductory information on the ASP.NET administration guide, see ASP.NET Administration.


How ASP.NET Security Works

Helping protect Web sites against unauthorized access is a critical, complex issue for Web developers. A successful system requires careful planning, and Web site administrators and programmers must have a clear understanding of the options for securing their site.

ASP.NET works in concert with the Microsoft .NET Framework and Internet Information Services (IIS) to help provide Web application protection. To help protect an ASP.NET application, you must perform the two fundamental functions described in the following table.

Security function | Description
Authentication | Assures that the user is, in fact, who the user claims to be. The application obtains credentials (various forms of identification, such as name and password) from a user and validates those credentials against some authority. If the credentials are valid, the entity that submitted the credentials is considered an authenticated identity.
Authorization | Limits access rights by granting or denying specific permissions to an authenticated identity.

IIS can also grant or deny access based on a user's host name or IP address. Any further access authorization is performed by NTFS file access permission's URL authorization.

It is helpful to understand how all the various security subsystems interact. Since ASP.NET is built on the Microsoft .NET Framework, the ASP.NET application developer also has access to all the built-in security features of the .NET Framework, such as code access security and role-based user-access security. For details about the security capabilities of ASP.NET, see ASP.NET Code Access Security.

Related Topics
  • ASP.NET Security


ASP.NET Architecture

This section provides an overview of the ASP.NET infrastructure and subsystem relationships, as they relate to the subject of security. The following illustration shows the relationships among the security systems in ASP.NET.

As the illustration shows, all Web clients communicate with ASP.NET applications through Internet Information Services (IIS). IIS deciphers and optionally authenticates the request. If Allow Anonymous is set to true, no authentication occurs. IIS also finds the requested resource (such as an ASP.NET application), and, if the client is authorized, returns the appropriate resource.

In addition to the built-in ASP.NET features, an ASP.NET application can use the low-level security features of the .NET Framework. For more information, see the Key Security Concepts topic in .NET Framework Help.

Integrating with IIS

When considering ASP.NET authentication, you should understand the interaction with IIS authentication services.

IIS always assumes that a set of credentials maps to a Microsoft Windows NT account and uses them to authenticate a user. There are three different kinds of authentication available in IIS 5.0 through 6.0: basic, digest, and Integrated Windows Authentication (NTLM or Kerberos). You can select the type of authentication to use in IIS administrative services. For more information on IIS authentication, see IIS Help.

If you request a URL containing an ASP.NET application, the request and authentication information are handed off to the application. ASP.NET provides the two additional types of authentication described in the following table.

ASP.NET authentication provider | Description
Forms authentication | A system by which unauthenticated requests are redirected to an HTML form using HTTP client-side redirection. The user provides credentials and submits the form. If the application authenticates the request, the system issues an authentication ticket in a cookie that contains the credentials or a key for reacquiring the identity. Subsequent requests are issued with the cookie in the request headers; they are authenticated and authorized by an ASP.NET handler using whatever validation method the application developer specifies.
Passport authentication | Centralized authentication service provided by Microsoft that offers a single logon and core profile services for member sites.

Using ASP.NET Configuration Files

ASP.NET configuration, of which security is a part, has a hierarchical architecture. All configuration information for ASP.NET is contained in files named Web.config and Machine.config. Web.config can be placed in the same directories as the application files. The Machine.config file is in the Config directory of the install root. Subdirectories inherit a directory's settings unless overridden by a Web.config file in the subdirectory. In a Web.config file, there are sections for each major category of ASP.NET functionality. To see an example of the way in which the hierarchical configuration system works for security, see Hierarchical Configuration Architecture.

The security section of a Web.config file is organized as follows.

<authentication mode="[Windows|Forms|Passport|None]">
    <forms name="[name]"
           loginUrl="[url]"
           protection="[All|None|Encryption|Validation]"
           path="[path]" timeout="[minutes]"
           requireSSL="[true|false]"
           slidingExpiration="[true|false]">
        <credentials passwordFormat="[Clear|MD5|SHA1]">
            <user name="[UserName]"
                  password="[password]"/>
        </credentials>
    </forms>
    <passport redirectUrl="internal"/>
</authentication>

<authorization>
    <allow users="[comma separated list of users]"
           roles="[comma separated list of roles]"/>
    <deny  users="[comma separated list of users]"
           roles="[comma separated list of roles]"/>
</authorization>

<identity impersonate ="[true|false]"
          userName="[domain\user_name]"
          password="[user_password]"/>

<trust level="[Full|High|Medium|Low|Minimal]"
       originUrl=""/>

<securityPolicy>
    <trustLevel name="Full" policyFile="internal"/>
    <trustLevel name="High" policyFile="web_hightrust.config"/>
    <trustLevel name="Medium" policyFile="web_mediumtrust.config"/>
    <trustLevel name="Low"  policyFile="web_lowtrust.config"/>
    <trustLevel name="Minimal" policyFile="web_minimaltrust.config"/>
</securityPolicy>

The default settings for these elements are shown in the following table.

Default value | Description
<allow roles= > | No default value.
<allow users="*"> | All
<authentication mode="Windows"> | The authentication mode cannot be set at a level below the application root directory.
<credentials passwordFormat="SHA1"> | The hashing algorithm to be used on passwords.
<deny roles=""> | Empty
<deny users=""> | Empty
<forms loginUrl="login.aspx"> | If you set the mode to Forms, and if the request does not have a valid ticket (cookie), this is the URL to which the request is directed for a forms-based logon.
<forms name=".ASPXAUTH"> | Default cookie name.
<forms path="/"> | Path
<forms protection="All"> | Type=[All|None|Encryption|Validation].
<forms requireSSL="false"> | Specifies that an encrypted connection is not required to transmit the authentication cookie.
<forms slidingExpiration="true"> | Specifies that sliding expiration is enabled.
<forms timeout="30"> | Time-out in minutes. 30 minutes is the default.
<identity impersonate="false"> | Impersonation is disabled by default.
<identity userName=""> | Empty
<identity password=""> | Empty
<passport redirectUrl="internal"> | If you set the mode to Passport, and if the requested page requires authentication (anonymous users are denied access) but the user has not logged on with Passport, then the user will be redirected to this URL.
<trustLevel name="Full" policyFile="internal"/> | Default policy file for Full trust level.
<trustLevel name="High" policyFile="web_hightrust.config"/> | Default policy file for High trust level.
<trustLevel name="Medium" policyFile="web_mediumtrust.config"/> | Default policy file for Medium trust level.
<trustLevel name="Low" policyFile="web_lowtrust.config"/> | Default policy file for Low trust level.
<trustLevel name="Minimal" policyFile="web_minimaltrust.config"/> | Default policy file for Minimal trust level.
<user name=""> | Empty
<user password=""> | Empty

There are three major subsections to a Web.config file: authentication, authorization, and identity. The values for each of the security elements are usually set by overriding a section of the computer-level configuration file with a similar section in an application configuration file placed in the application root directory. All subdirectories automatically inherit those settings. However, subdirectories can have their own configuration files that override other settings.

note Note ASP.NET configuration only applies to ASP.NET resources (those registered to be handled by Aspnet_isapi.dll). Unfortunately, ASP.NET configuration cannot provide authorization for non-Aspnet_isapi.dll resources, so TXT, HTML, GIF, JPEG, ASP, and other types of files are still accessible by all users, subject to IIS permissions. For example, even though the ASP.NET resources in a directory might be restricted by a Web.config file, all users can still view the files located in that directory if directory browsing is turned on and no other restrictions are in place.

You can avoid this situation by explicitly mapping such files, but not directories, to Aspnet_isapi.dll using the IIS administration tool. However, there could be a performance impact if you do this.

You can use the <location></location> tags to specify a particular file or directory to which settings should apply. For more information about how to use the <location> tag, see Configuration <Location> Settings and <location> Element.

Related Topics
  • ASP.NET Security


ASP.NET Data Flow

There are a number of different ways to design security into ASP.NET applications. This section describes the data flow for two common scenarios: impersonation and forms authentication using cookies.

Scenario 1: Impersonation

This scenario relies on Internet Information Services (IIS) authentication and Microsoft Windows NT® file access security to minimize security programming in the ASP.NET application itself. The data flow is shown in the following illustration.

The illustration shows the following sequence of events:

  1. A request for access comes to IIS from a network client.
  2. IIS authenticates the client using basic, digest, or Integrated Windows Authentication (NTLM or Kerberos).
  3. If the client is authenticated, IIS hands the authenticated request over to ASP.NET.
  4. The ASP.NET application impersonates the requesting client using the access token passed from IIS, and relies on NTFS file permissions for granting access. The ASP.NET application needs only to verify that in the ASP.NET configuration file, the impersonation-enable directive is set to true; no ASP.NET security code needs to be written.

    Notice that if impersonation is not enabled, the application runs with the IIS process identity. For Microsoft Windows® 2000 Server and Windows XP, the default identity is a User account named ASPNET that is created automatically when ASP.NET is installed. For products in the Microsoft Windows Server 2003 family, the default identity is the Network Service account. If you want to restrict access, you must use some other means of authorization, such as URL authorization.

    For more details about using impersonation in ASP.NET applications, see Impersonation and Using IIS Authentication With ASP.NET Impersonation.

  5. If access is granted, the ASP.NET application returns the requested page through IIS.

Scenario 2 - Forms Authentication

In this scenario an application uses ASP.NET forms authentication, a process that enables the application to collect credentials such as name and password directly from the client requestor and make its own determination about their authenticity. IIS authentication is not used by the application, but IIS authentication settings are important to the ASP.NET forms authentication process. Unless you decide to reject all requests that do not meet the criteria for the enabled method of IIS authentication, you must enable the IIS Anonymous Access setting.

note Note If you do not enable the IIS Anonymous Access setting, requests not meeting the criteria for IIS authentication will be rejected and never reach the ASP.NET application.

The data flow in this scenario is shown in the following illustration.

This illustration shows the following sequence of events:

  1. A client generates a request for a protected resource.
  2. IIS receives the request, and if the requestor is authenticated by IIS, or if IIS Anonymous Access is enabled, the request gets passed on to the ASP.NET application. Because the authentication mode in the ASP.NET application is set to forms in this case, IIS authentication is not used.
  3. If there is no cookie attached to the request, ASP.NET redirects the request to a logon page, the path of which resides in the application's configuration file. On the logon page, the client user enters the required credentials (usually a name and password).
  4. The application code checks the credentials to confirm their authenticity, usually in an event handler. If the credentials are authenticated, the application code attaches a ticket (as a cookie) containing the user name, but not the password. If authentication fails, the request is usually returned with an Access Denied message or the logon form is presented again.
  5. After a ticket is issued by the application, ASP.NET just checks the ticket for validity using a message authentication check. Applications do not need the credentials in the *.config files. In fact, ASP.NET does not check them after the cookie is issued, even if they are present.
  6. If the user is authenticated, ASP.NET checks authorization and can either allow access to the originally requested, protected resource or redirect the request to some other page, depending on the design of the application. It can also direct the request to a custom authorization module where the credentials are tested for authorization to access the protected resource. If authorization fails, ASP.NET always redirects to the logon page.
  7. If the user is authorized, access is granted to the protected resource; or the application might require an additional test of the credentials before authorizing access to the protected resource, depending on the design of the application.

Related Topics
  • ASP.NET Security


ASP.NET Authentication

Authentication is the process of obtaining identification credentials such as name and password from a user and validating those credentials against some authority. If the credentials are valid, the entity that submitted the credentials is considered an authenticated identity. Once an identity has been authenticated, the authorization process determines whether that identity has access to a given resource.

ASP.NET implements authentication through authentication providers, the code modules that contain the code necessary to authenticate the requestor's credentials. ASP.NET supports the authentication providers described in the following table.

ASP.NET authentication provider | Description
Forms authentication | A system by which unauthenticated requests are redirected to an HTML form using HTTP client-side redirection. The user provides credentials and submits the form. If the application authenticates the request, the system issues a cookie that contains the credentials or a key for reacquiring the identity. Subsequent requests are issued with the cookie in the request headers; they are authenticated and authorized by an ASP.NET event handler using whatever validation method the application developer specifies.
Passport authentication | Centralized authentication service provided by Microsoft that offers a single logon and core profile services for member sites.
Windows authentication | ASP.NET uses Windows authentication in conjunction with Internet Information Services (IIS) authentication. Authentication is performed by IIS in one of three ways: basic, digest, or Integrated Windows Authentication. When IIS authentication is complete, ASP.NET uses the authenticated identity to authorize access.

To enable an authentication provider for an ASP.NET application, you only need to create an entry for the application configuration file as follows.

// Web.config file
<authentication mode= "[Windows|Forms|Passport|None]"/>

The mode is set to one of the authentication modes: Windows, Forms, Passport, or None. The default is Windows. If the mode is None, ASP.NET does not apply any additional authentication to the request - this can be useful when you want to implement a custom authentication scheme, or if you are solely using anonymous authentication and want the highest possible level of performance.

The authentication mode cannot be set at a level below the application root directory. As is the case with other ASP.NET modules, subdirectories in the URL space inherit authentication modules unless explicitly overridden.

Related Topics
  • WindowsAuthenticationModule Provider
  • Passport Authentication Provider
  • FormsAuthentication Provider


Windows Authentication Provider

The WindowsAuthenticationModule provider relies on Internet Information Services (IIS) to provide authenticated users, using any of the mechanisms that IIS supports. If you want to help protect site security with a minimum of ASP.NET coding, this is the provider configuration you should use. The provider module constructs a WindowsIdentity object. The default implementation constructs a WindowsPrincipal object and attaches it to the application context. The WindowsPrincipal object maps identities to Windows groups.

If you use IIS authentication, the provider module uses the authenticated identity passed in from IIS. IIS authenticates the identity using basic, digest, or Integrated Windows authentication, or some combination of them. You can use impersonation and NTFS ACL permissions to restrict or allow access to protected resources.

An important reason to use the WindowsAuthenticationModule provider is to implement an impersonation scheme that can use any of the authentication methods that might have already been performed by IIS before passing the request to the ASP.NET application. To do this, set the authentication mode to Windows, and confirm that the impersonate element is set to true, as shown in the following example:

<authentication mode="Windows"/>
<identity impersonate="true"/>

Please note that configuring an ASP.NET application has no effect on the IIS Directory Security settings. The systems are completely independent and are applied in sequence. In addition to selecting an authentication mode for an ASP.NET application, it is also important to configure IIS authentication appropriately.

Next, you must set the NTFS ACLs to allow access only to the proper identities.

Related Topics
  • ASP.NET Security


Passport Authentication Provider

Passport authentication is a centralized authentication service provided by Microsoft that offers a single logon and core profile services for member sites. This benefits the user because it is no longer necessary to log on to access new encrypted resources or sites. If you want your site to be compatible with Passport authentication and authorization, this is the provider you should use. This topic provides some introductory material about Microsoft . NET Passport and the ASP.NET support for it. For more information, see the Passport documentation located at http://www.passport.com/business. In order to access the documentation, you must get a Passport and register.

Passport is a cookies-based authentication service. A sample transaction conversation using Passport authentication might look similar to the following:

  1. A client issues an HTTP GET request for a protected resource, such as http://www.contoso.com/default.aspx.
  2. The client's cookies are examined for an existing Passport authentication ticket. If the site finds valid credentials, the site authenticates the client. If the request does not include a valid authentication ticket, the server returns status code 302 and redirects the client to the Passport Logon Service. The response includes a URL in the query string that is sent to the Passport logon service to direct the client back to the original site.
  3. The client follows the redirect and requests the original resource again, this time with the Passport cookie.
  4. The Passport logon server presents the client with a logon form.
  5. The client fills out the form and does a POST back to the logon server, using Secure Sockets Layer (SSL).
  6. The logon server authenticates the user and redirects the client back to the original URL (http://www.contoso.com/default.aspx). The response contains an encrypted Passport cookie in the query string.
  7. The client follows the redirect and requests the original protected resource again, this time with the Passport cookie.
  8. Back on the originating server, the PassportAuthenticationModule detects the presence of the Passport cookie and tests for authentication. If successful, the request is then authenticated.

Subsequent requests for protected resources at the site are authenticated at the originating server using the supplied ticket. Passport also makes provisions for ticket expiration and reusing tickets on other member sites.

Passport uses the Triple DES encryption scheme. When member sites register with Passport, they are granted a site-specific key. The Passport logon server uses this key to encrypt and decrypt the query strings passed between sites.

note Note To use Passport authentication, you must register your site with the Passport service, accept the license agreement, and install the .NET Passport SDK prior to use.

The ASP.NET PassportAuthenticationModule provides a wrapper around the .NET Passport SDK for ASP.NET applications, and provides Passport authentication services and profile information from an IIdentity-derived class called PassportIdentity.

As is the case with WindowsIdentity, the primary purpose of handling the PassportAuthentication_OnAuthenticate event is to attach a custom IPrincipal object to the context. A special IIdentity-derived class called PassportIdentity provides an interface to the Passport profile information and methods to encrypt and decrypt Passport authentication tickets.

To implement Passport authentication in an ASP.NET application

  1. Download, install, and configure the .NET Passport SDK from http://www.passport.com/business. You must complete a registration form to obtain the SDK. Windows Server 2003 includes the .NET Passport SDK and does not require this step.
  2. Set up Passport as the authentication mode in the application configuration file as follows.
    <authentication mode= "Passport"/>
  3. Using the Passport documentation and the .NET Passport SDK functionality, implement Passport authentication and authorization.
  4. For a code example of an ASP.NET page using Passport authentication, see the article Creating a Microsoft .NET Passport-Authenticated Web Site with ASP.NET in the MSDN Library.

Related Topics
  • ASP.NET Security


Forms Authentication Provider

Forms authentication generally refers to a system in which unauthenticated requests are redirected to an HTML form, using HTTP client-side redirection. Forms authentication is a good choice if your application needs to collect its own user credentials at logon time through HTML forms. The user provides credentials and submits the form. If the application authenticates the request, the system issues a cookie that contains the credentials or a key for reacquiring the identity. Subsequent requests are issued with the cookie in the request headers. The requests are authenticated and authorized by an ASP.NET event handler using whatever validation method the application specifies.

Note that forms authentication is often used for personalization, where content is customized for a known user. In some of these cases, identification is the issue rather than authentication, so it is enough merely to store the user name in a durable cookie and use that cookie to access the user's personalization information.

For detailed information on how to develop ASP.NET applications that use forms authentication, see documentation on the forms authentication provider in the MSDN Library.

Forms Authentication Across Applications

ASP.NET supports forms authentication in a distributed environment, either across applications on a single server or in a Web farm. Several configuration attributes in the <forms> element configuration section must match for all applications participating in shared forms authentication. The directives name, protection, path, validationKey, decryptionKey, and validation in the following example must be identical (unless otherwise noted) across the applications.

<configuration>
    <system.web>
        <authentication>
            <forms name=".ASPXAUTH"
                   loginUrl="logon.aspx"
                   protection="all"  <!-- Protection must be identical.-->
                   timeout="30"
                   path="/" >   <!-- Path must have a compatible scope.-->
        </authentication>

        <!-- Validation and decryption keys must exactly match and cannot
             be set to "AutoGenerate". The validation algorithm must also
             be the same. -->
        <machineKey>
            validationKey= "C50B3C89CB21F4F1422FF158A5B42D0E8DB8CB5CDA1742572A487D9401E3400267682B202B746511891C1BAF47F8D25C07F6C39A104696DB51F17C529AD3CABE"
            decryptionKey= "8A9BE8FD67AF6979E7D20198CFEA50DD3D3799C77AF2B72F"
            validation="SHA1"
            isolateApplications="false"
        </machineKey>
    </system.web>
</configuration>

The encryption and validation keys and the encryption scheme used for cookie data must be exactly the same. If the settings do not match, cookies cannot be shared.

After a cookie has been issued, expiration of the cookie is tracked based on the Expires property value in the cookie itself. This means that if two applications have different timeout attributes, the expiration date and time that was set when each cookie was originally issued is retained throughout the lifetime of the cookie. When a cookie is updated, the cookie's original expiration is used to compute the new expiration. The only time the configuration timeout value is used is when the cookie is initially created.

Related Topics
  • ASP.NET Security


ASP.NET Authorization

The purpose of authorization is to determine whether an identity should be granted the requested type of access to a given resource. There are two fundamental ways to authorize access to a given resource:

  • File authorization

    File authorization is performed by the FileAuthorizationModule, and is active when you use Windows authentication. It does an access control list (ACL) check of the .aspx or .asmx handler file to determine if a user should have access. Applications can further use impersonation to get resource checks on resources that they are accessing. For more information about impersonation, see ASP.NET Impersonation.

  • URL authorization

    URL authorization is performed by the URLAuthorizationModule class, which maps users and roles to pieces of the URL namespace. This module implements both positive and negative authorization assertions. That is, the module can be used to selectively allow or deny access to arbitrary parts of the URL namespace for certain sets, users, or roles.

The URLAuthorizationModule is available for use at any time. You only need to place a list of users and/or roles in the <allow> or <deny> elements of the <authorization> section of a configuration file.

To establish the conditions for access to a particular directory, you must place a configuration file that contains an <authorization> section in that directory. The conditions set for that directory also apply to its subdirectories, unless configuration files in a subdirectory override them. The general syntax for this section is as follows.

<[element] [users] [roles] [verbs]/>

An element is required. Either the users or the roles attribute must be included. Both can be included, but both are not required. The verbs attribute is optional.

The permissible elements are <allow> and <deny>, which grant and revoke access, respectively. Each element supports three attributes, which are defined in the following table.

Attribute | Description
roles | Identifies a targeted role for this element. The associated IPrincipal object for the request determines the role membership. You can attach arbitrary IPrincipal objects to the context for a given request and they can determine role membership in whatever way you like. For example, the default WindowsPrincipal class uses Microsoft Windows NT groups to determine role membership.
users | Identifies the targeted identities for this element.
verbs | Defines the HTTP verbs to which the action applies, such as GET, HEAD, and POST.

Anonymous users are also denied.

The following example grants access to Kim and members of the Admins role, while denying it to John and all anonymous users:

<authorization>
    <allow users="Kim"/>
    <allow roles="Admins"/>
    <deny users="John"/>
    <deny users="?"/>
</authorization>

Both users and roles can refer to multiple entities by using a comma-separated list, as shown in the following example.

<allow users="John, Kim, contoso\Jane"/>

Notice that the domain account (contoso\Jane) must include both the domain and user name combination.

In addition to identity names, there are two special identities, as shown in the following table.

Identity | Description
* | Refers to all identities
? | Refers to the anonymous identity

To allow John and deny everyone else, one might construct the following configuration section.

<authorization>
    <allow users="John"/>
    <deny users="*"/>
</authorization>

The following example lets everyone do a GET, but only Kim can use POST.

<authorization>
    <allow verb="GET" users="*"/>
    <allow verb="POST" users="Kim"/>
    <deny verb="POST" users="*"/>
</authorization>

Rules are applied using the following heuristics:

  • Rules contained in configuration files at lower directory levels take precedence over rules at higher directory levels. The system determines which rule takes precedence by constructing a merged list of all rules for a URL, with the most recent (nearest in the hierarchy) rules at the head of the list.
  • Given a set of merged rules for a URL, the system starts at the head of the list and checks rules until the first match is found. Note that the default configuration for ASP.NET contains an <allow users="*"> element, which authorizes all users. If no rules match, the request is allowed unless otherwise denied. If a match is found and the match is a <deny> element, it returns the 401 status code. Applications or sites can easily configure a <deny users="*"> element at the top level of their site or application to prevent this behavior.

    If an <allow> matches, the module does nothing and lets the request be processed further.

There is also a <location> tag that you can use to specify a particular file or directory to which settings wrapped by that tag (between <location> and </location> tags) should apply.

Related Topics
  • ASP.NET Security
  • Hierarchical Configuration Architecture
  • Configuration <Location> Settings
  • ASP.NET Impersonation


ASP.NET Impersonation

When using impersonation, ASP.NET applications can optionally execute with the identity of the client on whose behalf they are operating. The usual reason for doing this is to avoid dealing with authentication and authorization issues in the ASP.NET application code. Instead, you rely on Internet Information Services (IIS) to authenticate the user and either pass an authenticated token to the ASP.NET application or, if unable to authenticate the user, pass an unauthenticated token. In either case, the ASP.NET application impersonates whichever token is received if impersonation is enabled. The ASP.NET application, now impersonating the client, then relies on the settings in the NTFS directories and files to allow it to gain access, or not. Be sure to format the server file space as NTFS, so that access permissions can be set.

Impersonation is disabled by default. For ASP compatibility, the user must explicitly enable impersonation. If impersonation is enabled for a given application, ASP.NET always impersonates the access token that IIS provides to ISAPI extensions. That token can be either an authenticated user token, or the token for the anonymous user (such as IUSR_MACHINENAME). The impersonation occurs regardless of the type of authentication being used in the application.

Only application code is impersonated; compilation and configuration are read as the process token. The result of the compilation is put in the "Temporary ASP.NET files" directory. The account that is being impersonated needs to have read/write access to this directory. If an application is on a universal naming convention (UNC) share, ASP.NET will always impersonate the token provided to IIS to access that share unless a configured account is used. If an explicit configured account is provided, ASP.NET will use that account in preference to the IIS UNC token. Applications that do want per-request impersonation can simply be configured to impersonate the user making the request.

Impersonation is disabled at the computer level by default and, unless overridden, all the application domains inherit this setting. You can enable impersonation by putting a configuration file in the application root directory. For more information about the ASP.NET configuration system, see ASP.NET Configuration.

As is the case with other configuration directives, this directive applies hierarchically. It is respected by nested applications in the hierarchy, unless explicitly overridden. The default value for this setting is as follows.

<impersonation enable="false"/>

A minimal configuration file to enable impersonation for an application might look similar to the following example.

<!-- Web.config file. -->
<identity impersonate="true"/>

There is also name support for running an application as a configurable identity. For example:

<identity impersonate="true" userName="contoso\Jane" password="pass"/>

This enables the entire application to run as contoso\Jane, regardless of the identity of the request, as long as the password is correct. This type of impersonation can be delegated to another computer.

You can programmatically read the identity of the impersonated user, as shown in the following example.

[Visual Basic]
Dim username As String = System.Security.Principal.WindowsIdentity.GetCurrent().Name
[C#]
String username = System.Security.Principal.WindowsIdentity.GetCurrent().Name;

In the preceding example, userName and password are stored in clear text in the configuration file. Although IIS will not transmit .config files in response to a user agent request, configuration files can be read by other means, for instance by an authenticated user with proper credentials on the domain that contains the server. To help maintain security, the identity section supports storage of encrypted userName and password attributes in the registry as shown in the following example.

   userName="registry:HKLM\Software\AspNetIdentity,Name"
   password="registry:HKLM\Software\AspNetIdentity,Password"

The portion of the string after the keyword registry and up to the first comma indicates the registry key that ASP.NET must open. The portion after the comma contains a single string value name from which ASP.NET will read the credentials. The comma is required and the credentials must be stored in the HKLM hive. If the configuration format is incorrect, ASP.NET will not launch the worker process and the current account creation failure code path will be followed.

The portion of the string after the keyword registry and before the comma indicates the name of the registry key that ASP.NET opens. The portion after the comma contains a single string value name from which ASP.NET will read the credentials. The comma is required, and the credentials must be stored in the HKLM hive. If the configuration format is incorrect, ASP.NET will not launch the worker process and the current account creation failure code path will be followed.

The credentials must be in REG_BINARY format, containing the output of a call to the Windows API function CryptProtectData. You can create the encrypted credentials and store them in the registry with the ASP.NET Set Registry console application(Aspnet_setreg.exe), which uses CryptProtectData to accomplish the encryption. To download Aspnet_setreg.exe, along with the Visual C++ source code and Help , visit the Web site www.asp.net and search for aspnet_setreg.

You should configure access to the key storing the encrypted credentials so that access is provided only to Administrators and SYSTEM. Because the key will be read by the ASP.NET process running as SYSTEM, you should set the following permissions:

Administrators:F

SYSTEM:F

CREATOR OWNER:F

ProcessAccount:R

This provides two lines of defense to protect the data.

The ACL permissions require the identity accessing the data to be an Administrator. An attacker must run code on the server (CryptUnprotectData) to recover the credentials for the account.

Related Topics
  • ASP.NET Security


Authentication and ASP.NET Impersonation

The examples in this section show how to create ASP.NET applications that incorporate various kinds of industry-standard security technologies. For examples of how to create applications that use forms authentication, see information on forms authentication in the MSDN Library.

Using IIS Authentication with ASP.NET Impersonation

In this scenario, you are setting up an application on an intranet Web site for posting employee information. However, some of the information is for managers only. The manager information can be posted to a subdirectory of the general employee information, so that access to it can be limited. The scenario also assumes that:

  • You are using a Microsoft Windows NT or Microsoft Windows 2000 server.
  • The hard disk is formatted for NTFS.
  • Internet Information Services (IIS) 6.0 is the Web server.
  • All employees needing access are using Windows platforms.

You, as administrator:

  1. Create the files and directories shown in the following illustration.

    Files and directories

  2. Create a Windows group called Managers that contains all users who should have access to the ManagerInfo.aspx file.
  3. Set up Windows authentication using the IIS administration tool.
  4. Set the impersonate attribute in the <identity> element in the ASP.NET configuration file to true.
  5. Set the NTFS access control list (ACL) for the ManagerInformation directory to allow access to only those identities that are in the Windows Manager group. Note that the local system still needs access as well so that the ASP.NET process itself can read the files. Settings in this directory typically resemble the following:
    1. Remove access from the Everyone group, if it has access.
    2. Deny anonymous users.
    3. Add accounts that are to have access privileges.
    4. Give the system account access.

This helps provide the necessary security without the necessity of writing any code.

Related Topics
  • ASP.NET Security


ASP.NET Application Security in Hosted Environments

ASP.NET offers an excellent environment for hosting multiple applications on a single Web server. Application Service Providers (ASPs) and Internet Service Providers (ISPs) are able to host multiple applications from different outside sources on a shared server and keep the applications isolated from each other and from critical resources on the server. ASP.NET's configuration system is designed to make it easy to isolate Web applications and to grant code access security permissions to individual applications.

In This Section

Configuring ASP.NET Process Identity
Describes the trust level and policy settings that you can use to help protect the configuration of the server that hosts your ASP.NET applications.
ASP.NET Required Access Control Lists (ACLs)
Lists the permissions that ASP.NET needs to access specific server resources.
ASP.NET Code Access Security
Describes the importance of configuring your Web applications so that they will accept code only from trusted sources.
ASP.NET Trust Levels and Policy Files
Describes the trust level and policy settings that you can use to securely configure the server that hosts your ASP.NET applications.

Related Sections

ASP.NET Security
Describes how to work with authorization and authentication in ASP.NET applications.
ASP.NET Configuration
Describes how to configure ASP.NET applications and includes reference information on each of the ASP.NET configuration elements.


Configuring ASP.NET Process Identity

The ASP.NET worker process (Aspnet_wp.exe) should run with a different and less privileged identity than the Windows default System identity. This allows the process to run as a relatively untrusted user so that hosted Web applications do not have administrative privileges and cannot compromise the integrity of the server. If the security of the ASP.NET worker process were breached, only a relatively weak account would be compromised and the intruder would not have administrative access to the entire server.

To run the ASP.NET worker process with its own account under Windows 2000 and Windows Server, you can apply the following two attributes to the <processModel> configuration element:

  • userName

    The name of the account under which the process will run.

  • password

    The clear-text password for the account. There are risks associated with storing clear-text passwords in a configuration file. For applications published on the Internet, you should use alternative means of running the application with a specific identity, or you should store encrypted credentials in the registry. For more information on storing credentials in the registry, see the <processModel> Element.

The following example shows how to set these attributes in the <processModel> section of a configuration file to run the worker process under a local user account.

<system.web>
    <processModel enable="true"
                  userName="LOCALMACHINE\IUSR_SomeUser"
                  password="password"/>
</system.web>

System and Machine are two predefined userName identity settings. The System account runs the worker process with the same identity as Internet Information Services (IIS) itself (typically System). The Machine account runs the worker process with a special unprivileged account named ASPNET. With either identity, the password is AutoGenerate, which means that the process does not have to supply credentials to the operating system.

To enable running the worker process with the special ASPNET account, add the following lines to the Machine.config file. If you change the process account in Machine.config, you must reset IIS or stop the Aspnet_wp.exe process.

<system.web>
    <processModel enable="true"
                  userName="Machine"
                  password="AutoGenerate"/>
</system.web>

With the new process model enabled on Internet Information Services version 6, ASP.NET does not use its own process model. Its identity is inherited from the IIS worker process.

The following example is supported only if you explicitly add the appropriate account rights to the account under which the worker process runs. There are risks associated with storing clear-text passwords in a configuration file. For applications published on the Internet, you should use alternative means of running the application with a specific identity, or you should store encrypted credentials in the registry. For more information, see the <processModel> Element.

<system.web>
    <identity impersonate="true"
              userName="LOCAL\SomeUser"
              password="password"/>
</system.web>

The technique described in the following paragraphs is commonly used by administrators hosting ASP sites and it will work in an ASP.NET environment with a weaker process identity.

The application grants access to an anonymous user (this assumes that the authentication scheme allows anonymous users), and the anonymous account is configured to be the desired account for the application. Also, the application uses per-request impersonation and the application code executes as the impersonated account. The process account still compiles and reads configuration because impersonation is used only with the request handler.

If you alternate between running the worker process with an account that has administrator privileges and a weaker account, the weaker account will not be able to read the Local Security Authority (LSA) secret used for Forms authentication, so all Forms authentication users must be reauthenticated. This does not apply when going from an account without administrative privileges to an account with administrative privileges. It does apply to applications with the following configuration.

<system.web>
    <authentication mode="Forms"/>
    <machineKey validationKey="AutoGenerate"
                decryptionKey="AutoGenerate"/>
</system.web>

Related Topics
  • ASP.NET Security


ASP.NET Required Access Control Lists (ACLs)

The following table shows which type of access permissions ASP.NET must have in order to access the listed locations.

Location | Access type | Account | Comments
installroot\ASP.NET Temporary Files | Read/write | Process or configured impersonation. | This is the location for dynamically compiled files. Beneath this location, application code generation takes place in a discrete directory for each application. The root location itself can be configured using the tempDir attribute of the <compilation> section.
systemroot\assembly | Read | Process or configured impersonation. | This is the location of the global assembly cache.
systemroot\system32 | R | Process | Contains system DLLs loaded by the .NET Framework.
systemroot\temp | Read/write/delete | Process | Used for XML Web services support.
userprofile directory | Read/write | Process | Used by the global assembly cache lock files and the common language runtime security configuration caching mechanism. If the user profile directory for the account does not exist, ASP.NET will use the default userprofile directory.
application directory | Read | Process or configured impersonation. | This is the location for application files.
installroot hierarchy | Read | Process or configured impersonation | ASP.NET must be able to access the system assemblies referenced in the Machine.config file in the config subdirectory under installroot.
Default Web Site monitoring | Read | Process | Used for file change notification monitoring.

Related Topics
  • ASP.NET Security


ASP.NET Code Access Security

One of the major benefits of using ASP.NET to host multiple Web sites is the common language runtime's support for code access security to help provide an execution platform for server applications. Code is assigned to a security zone classification based on evidence about the code's origin (evidence such as a strongly named assembly or the URL of origin, for example). Without the ability to configure security for individual, unrelated applications installed on a common server, code in an ASP.NET page belonging to one application would be able to read the files, for example, the Web.config file, in another application. Applications that run with full trust are constrained only by the operating system account under which they are executing.

Code access security can be easily handled for an individual assembly by strongly naming it and adding policy for that assembly. However, many ASP.NET assemblies are dynamically generated as a result of dynamic page compilation and therefore are not strongly named, so an additional facility is required.

ASP.NET lets you assign to an application a configurable level of trust that corresponds to a predefined set of permissions. By default (unless you explicitly alter the configuration), applications receive a level of trust commensurate to the evidence they present. For example, local applications must run in the MyComputer zone with the Full trust permission set, and applications located on a Universal Naming Convention (UNC) share must run in the Intranet zone with the LocalIntranet restricted permission set. If you want to run a Web application with less than Full trust, you must use one of the predefined trust levels defined in ASP.NET Trust Levels and Policy Files to enforce a partial trust policy.

You can use the following configuration settings to override the default behavior and associate an application with a given security policy.

<location path="MyApp" allowOverride="false">
    <trust level="High"
           originUrl="http://www.contoso.com"/>
</location>

The <trust> configuration tag can apply to the machine level or to any application root directory in the hierarchy.

If you want to set policy for the entire site, you can do so by specifying the root of the site as the path location, as follows.

<location path="ContosoSite" allowOverride="false">
    <trust level="High"
           originUrl="http://www.contoso.com"/>
</location>

You should take care to specify the <location> directive using the allowOverride attribute if you do not want applications to be able to specify their own trust level (this is the case in most shared server installations).

The following table lists the default supported attributes for the <trust> element.

Attribute | Description | Default supported values
level | Specifies the security zone under which the application will run. | Full, High, Medium, Low, and Minimal.
originUrl | Allows an administrator to set the application's URL of origin. This allows the permissions that rely on the notion of host to function correctly | Well-formed HTTP URLs.

By default, the policies associated with the various security levels are granted the permissions shown in the following table.

 | Level
Permission | Full | High | Medium | Low | Minimal
AspNetHostingPermission | Full | High | Medium | Low | Minimal
Environment | Un | Un | Read: TEMP, TMP, OS, USERNAME, COMPUTERNAME |  |
FileIO | Un | Un | Read, Write, Append, PathDiscovery:Application Directory | Read, Path Discovery: Application Directory |
IsolatedStorage | Un | Un | AssemblyIsolationByUser, Unrestricted UserQuota | 1 MB quota (can be varied for individual sites), AssemblyIsolationByUser |
Reflection | Un | ReflectionEmit |  |  |
Registry | Un |  |  |  |
Security | Un | Execution, Assertion, ControlPrincipal, ControlThread, RemotingConfiguration | Execution, Assertion, ControlPrincipal, ControlThread, RemotingConfiguration | Execution | Execution
Socket | Un | Un |  |  |
WebPermission | Un | Un | Connect to origin host (if configured) |  |
DNS | Un | Un | Un |  |
Printing | Un | Default Printing | Default Printing |  |
OleDBPermission | Un |  |  |  |
SqlClientPermission | Un | Un | AllowBlankPassword=false |  |
EventLog | Un |  |  |  |
Message Queue | Un |  |  |  |
Service Controller | Un |  |  |  |
Performance Counters | Un |  |  |  |
Directory Service | Un |  |  |  |

Un = Unrestricted

Blank = No Permission

When a permission level is available but is not explicitly mentioned in security policy, applications running with the Full level of trust can use it (since they have the Full trust permission set). Applications running with lower trust levels will not be able to use resources protected by nonexplicit permissions unless you specifically alter policy to allow it.

As the table shows, High trust applications have read/write permission for files in their application directories, and Low trust applications have read-only permission for files in their application directories. Because FileIO permission relies on a physical path (for example, c:\MyAppPath), ASP.NET uses a tokenized statement in the policy files that is replaced at run time with relevant path information for the application.

Note that WebPermission allows the application to connect to the origin host. This mechanism works from ASP.NET by providing an optional OriginUrl attribute on the <trust> section for a given application. The OriginUrl attribute is used to replace the $OriginHost$ variable in policy files, as demonstrated in the following code from Web_hightrust.config.

<IPermission class="WebPermission" version="1">
    <ConnectAccess>
        <URI uri="$OriginHost$"/>
    </ConnectAccess>
</IPermission>

SocketPermission takes a host name or a dotted IP string (possibly with wildcard characters) and WebPermission takes a regular expression that includes the protocol (for example, http://backendmachine/.*). If you want to change this, you can alter the policy files (or create new ones by copying the defaults) with the desired permissions. For example, you can alter the SocketPermission section from the ASP.NET named permission set to grant TCP socket connectivity to "backend1" and "backend2" on port 8080, as follows.

<IPermission class="SocketPermission" version="1">
    <ConnectAccess>
        <ENDPOINT host="backend1" transport="Tcp" port="8080"/>
        <ENDPOINT host="backend2" transport="Tcp" port="8080"/>
    </ConnectAccess>
</IPermission>

Related Topics
  • ASP.NET Security


ASP.NET Trust Levels and Policy Files

Trust levels are associated with policy files using the <securityPolicy> configuration element, which is only valid in a site level (Web.config) configuration file.

<system.web>
   <securityPolicy>
      <trustLevel name="Full"    policyFile="internal"/>
      <trustLevel name="High"    policyFile="web_hightrust.config"/>
      <trustLevel name="Medium"  policyFile="web_mediumtrust.config"/>
      <trustLevel name="Low"     policyFile="web_lowtrust.config"/>
      <trustLevel name="Minimal" policyFile="web_minimaltrust.config"/>
   </securityPolicy>
</system.web>

You should take care to specify a <location> directive using the allowOverride=False attribute if you do not want applications to be able to specify their own trust level (as is the case in most shared server scenarios). You can remove or add trust levels by adding a new entry to the configuration section specifying the trust level name and the policy file to be used. The default trust files will be installed in the config directory under the location where the aspnet_isapi.dll file is stored. This is the same location as the Machine.config configuration file and the runtime security policy file.

The Full trust Level is a special case. Because it is exactly equivalent to having full trust in the local machine zone, the ASP.NET host does not apply any additional policy to these applications. Therefore, it is mapped to an internal handler and the host does not add additional policy to the application domain for Full trust applications.

In order to preserve the default settings, ASP.NET will ship two copies of each default file. One copy will be as described above in the configuration section, the second will have a .default.config extension and will not be consumed directly by the system.

ASP.NET Policy Mechanics

The application domain policy for the various trust levels consists of a policy level (for example, an instance of the System.Security.Policy.PolicyLevel class that is loaded and applied to the application domain as an application domain policy. The policy tree itself is the same for High, Medium, Low, and Minimal trust levels (no policy is applied for Full), except for the set of granted permissions in the ASP.NET permission set. The policy tree with the permissions granted to the High trust level is shown in the table below.

To find the location of the global assembly cache, check for "CacheLocation" in the following registry key: HKLM\Software\Microsoft\Fusion. If this key does not exist, the location defaults to %windir%\assembly.

The three code groups that use a UrlMembershipCondition object rely on paths that are dynamically computed at run time; ASP.NET loads the policy files and replaces the specially delimited arguments (for example, it replaces $AppDirUrl$ with the proper path before performing the policy resolution).

After computing the application domain policy for a given application (Full trust applications are exempt from this step), the policy is applied to the application domain. Application domain policy is intersected with the various other policy levels (Enterprise, Machine, and User) so that it can only further restrict, not expand, the existing policy.

To see how application domain policy is used to restrict granted permissions, consider the fictitious permission sets and policy levels shown in the following table.

Level | Name | Permissions
Enterprise | P1 | {A, B, C, D}
Machine | P2 | {A, B, C}
User | P3 | {A, B, C}
Application Domain | P4 | {A, B}

The simplified application permission (ignoring permission requests) of these policy sets would be the intersection of the permissions granted at the various levels. Thus, the intersection of P1, P2, P3, and P4 is {A, B}.

Managing Policy Files

Policy files can be hand-edited. You can use the .NET Framework Configuration Tool or the Code Access Security Policy Tool to administer security policy for the enterprise, machine, or user levels. For more information about using these tools, see the Administering Security Policy topic in .NET Framework Help .

Related Topics
  • ASP.NET Security


ASP.NET Deployment

Deployment is the process of distributing a completed application or component to be installed on other computers. Microsoft® ASP.NET is designed to make Web application deployment easy. To that purpose, it includes the following features:

  • When a newer version of a Web.config, .aspx, .asmx, or any other ASP.NET file is copied to an existing Web application, ASP.NET detects that the file has been updated. It then loads a new version of the Web application to handle all new requests, while allowing the original instance of the Web application to finish responding to any current requests. When all requests have been satisfied for the original application, it is automatically removed This feature eliminates downtime while Web applications are being updated.
  • All ASP.NET application configuration settings are stored in a Web.config file, an XML-based text file stored in the application root directory, for easy deployment of application settings. If you modify these settings when the application is running, ASP.NET automatically detects the changes, reapplies all the settings, and recompiles the application for you. For more information, see ASP.NET Configuration.

    note Note This does not apply to Internet Information Services (IIS) or COM configuration settings. ASP.NET application settings also can be made in IIS, such as security or process model configuration. Configuration changes made in IIS are not automatically detected and updated by ASP.NET. For more information, see IIS Metabase.

  • No registration is required for local application components. To include any precompiled managed code in your application, you simply need to place it in the local assembly cache. The local assembly cache is the \Bin directory, which is a subdirectory of the application root directory. In addition, any assembly stored in the \Bin directory can be replaced while the application is running.
  • All ASP.NET pages are dynamically compiled when they are first requested. The application then uses the compiled class to satisfy requests until a change is made to the page. This allows you to make changes to a page and replace it in a running application.

To deploy application files and local component files, you can simply copy them to the directory structure on the production server. To do this on a network you can use either the XCOPY command-line tool or Microsoft Windows® Explorer. To deploy files over the Internet, you can use the FTP tool of your choice. If you are developing your ASP.NET application using Microsoft Visual Studio® .NET, use Visual Studio to deploy any Microsoft FrontPage® Server Extensions associated with your application. For more information, see Visual Studio .NET Help.

This section describes how to deploy ASP.NET applications and individual application files to a production server. In addition, it explains how to support multiple versions of ASP.NET on a single server and how to ensure that individual applications on that server reference the correct version of ASP.NET. Also, this section describes how to send a redistributable version of the Microsoft .NET Framework to a production server in an application setup program.

This section includes the following information:

  • Deploying ASP.NET Applications: Describes the options for distributing ASP.NET applications and components from a development or test server to a production environment.
  • Side-By-Side Support in ASP.NET: Describes how you can run multiple applications that use different versions of the .NET Framework.
  • Redistributing the .NET Framework: Describes how you can use the redistibutable version of the .NET Framework to support applications on a production server.
Related Topics
  • For introductory information on the ASP.NET administration guide, see ASP.NET Administration.


Deploying ASP.NET Applications

When you are ready to deploy your ASP.NET Web application to a production server, you have many options. Your choice depends on the complexity of your application, whether it uses local-only or shared assemblies, and what tools you used to develop the application.

For ASP.NET applications that do not require modifications to IIS settings or registration of COM objects, you can simply copy the application's files to the directory structure on the production server, using one of the following tools:

  • The XCOPY command-line tool can copy files from one computer to another on an intranet or internal network.
  • Windows Explorer can copy files from one computer to another on an intranet or internal network.
  • You can use the FTP tool of your choice to copy application files from one computer to another over the Internet.
  • If your application has been developed using Visual Studio .NET, you can use the Copy Project command to copy files from one computer to another on an intranet or internal network. For more information, see Visual Studio .NET Help .

    note Note Front Page Server Extensions must be installed on the target server to use the Copy Project command.

These choices have limitations, however. None performs any IIS configuration that your application might require, and if your application uses COM objects, they will not be registered on the target server. Also, if your application uses shared assemblies stored in the server's global assembly cache, you cannot use any of these methods. For more information, see Deploying Shared Components to the Global Assembly Cache and the Global Assembly Cache topic in .NET Framework Help .

note Note You should deploy components that are used only by your application to the \Bin directory.

If your application is complex — for example, if it includes shared assemblies or relies on specific IIS settings — deploying your application to production servers using Windows Installer 2.0 is recommended. For more information, see the Deploying Applications and Components topic in Visual Studio .NET Help .

In This Section

Creating an ASP.NET Application Root Directory with IIS
Describes how to use IIS to create a virtual directory or to mark a directory in the C:\Inetpub\Wwwroot directory as an application.
Creating a Directory Structure for an ASP.NET Application
Describes how to create a directory structure for your ASP.NET applications.
Deploying ASP.NET Application Files and Local Components
Describes how to distribute all files associated with your ASP.NET application to a production server.
Deploying Local Application Components
Describes how to compile and distribute component assemblies to your ASP.NET application's \Bin directory.
Deploying Shared Components to the Global Assembly Cache
Describes the global assembly cache and how to distribute shared component assemblies to it.
Deploying HTTP Handlers and HTTP Modules
Describes how to distribute compiled assemblies that contain classes that implement the IHttpHandler and IHttpModule interfaces. This includes required configuration settings for including new HTTP handlers and HTTP modules in your application.

Related Sections

ASP.NET Deployment
Describes how to distribute ASP.NET applications and components from development and test servers to production servers.


Creating an ASP.NET Application Root Directory with IIS

All ASP.NET applications use IIS virtual directories as their application root directories. The procedures in this topic show you how to create a virtual directory in IIS.

To prepare for this procedure

  1. Create a new directory. This walkthrough uses the directory C:\myWebApp.
  2. Next, open IIS Manager and create a virtual directory using one of the following procedures.

To create a virtual directory on a computer running Windows Server 2003

  1. From the Start menu, point to Administrative Tools, and then click Internet Information Services (IIS) Manager.
  2. Expand the local computer, and then expand Web Sites.
  3. Right click Default Web Site, point to New, and then click Virtual Directory.
  4. In the Virtual Directory Creation wizard, click Next.
  5. Enter the name of your application in the Alias box, and then click Next.
  6. Enter the path to the physical directory that you created to prepare for this walkthrough, C:\myWebApp, and then click Next.
  7. In the Access Permissions page, select the access permissions that you want for your application, and then click Next.
  8. Click Finish.

Related Topics
  • Deploying ASP.NET Applications
  • Creating a Directory Structure for an ASP.NET Application
  • Deploying Local Application Components
  • Deploying ASP.NET Application Files and Local Components
  • Deploying Shared Components to the Global Assembly Cache
  • Deploying HTTP Handlers and HTTP Modules


Creating a Directory Structure for an ASP.NET Application

How you organize the directories that your applications contains affects any virtual or relative paths that are included in the files that your application contains. In addition, if your application uses local compiled code, you must include a \Bin directory directly beneath your application root. ASP.NET automatically resolves any references to components stored there.

The procedures in this topic explain which directories to include in the root directory of your ASP.NET Web application. A short discussion of possible directory structures follows, and a sample directory structure with potential file names is included at the end of the topic.

To prepare for this walkthrough

  • Create a root directory for your application and mark it as an application, as described in Creating an ASP.NET Application Root Directory with IIS.

To create a directory structure for your ASP.NET Web application

  1. At the command prompt or in Windows Explorer, open the root directory you created.
  2. Create a new directory and name it Bin.
  3. Create any other directories that your application requires. For example, you could create a directory to contain all the images that your application contains.

The \Bin directory is the default assembly cache for your Web application. Unless your Web application shares DLLs with another application, place all DLLs that your application uses in the \Bin directory to ensure that references to the objects contained in them resolve correctly. These assemblies can include business logic or compiled custom server controls. If your application shares assemblies with other applications, place the shared DLLs in the global assembly cache. For more information, see Deploying Shared Components to the Global Assembly Cache.

note Note These instructions do not apply to assemblies compiled by Visual Studio .NET when you create an ASP.NET Web application in that environment. For information about how to deploy Web applications developed using Visual Studio .NET, see Visual Studio Help.

If you want to modify the default configuration for your Web application, create a Web.config file, make the modifications you want, and save it in the root directory. For more information, see ASP.NET Configuration.

In addition, if you write any application-wide functions, including handlers for Application_Error events, place those in a Global.asax file and save the file in the application root directory. For more information, see the ASP.NET Applications topic in .NET Framework Help .

In the following sample directory structure, C:\myWebApp is the application root directory. For the application to function properly, the myWebApp directory must be an IIS virtual directory.

note Note This simple application includes the \Bin directory and an |Img directory, which stores the image associated with the application. Your directory structure might be more complex than this.

c:\myWebApp
         Default.aspx
         Menu.ascx
         Service.asmx
         Web.config
         Global.asax
         \Bin
              myBizLogic.dll
         \Img
              myImage.gif

Related Topics
  • Deploying ASP.NET Applications
  • Creating a Directory Structure for an ASP.NET Application
  • Deploying Local Application Components
  • Deploying ASP.NET Application Files and Local Components
  • Deploying Shared Components to the Global Assembly Cache
  • Deploying HTTP Handlers and HTTP Modules


Deploying Local Application Components

ASP.NET application components are all of the DLL files that the application uses to perform a variety of tasks. They can include business logic and database access logic for three-tier applications, as well as custom ASP.NET server controls that you have developed. To work for an application, each of the DLLs associated with these components must be deployed to your application's \Bin directory.

To deploy ASP.NET application components from the command line

  1. From the Start menu, click Run.
  2. In the Open box in the Run dialog box, type cmd, and then click OK.
  3. At the command prompt, type the following command:

    xcopy <source path> <destination path>

    note Note In this command, <source path> is a placeholder that represents the full path to the compiled component files that you want to deploy, including the drive and directory names. You can omit the file names if you want all files in the directory to be copied. The <destination path> placeholder represents the full path to the directory where the files should be placed.

    The following example command copies all compiled components from the C:\devApp\bin directory to the D:\liveApp\bin directory.

    xcopy c:\devApp\bin d:\liveApp\bin
  4. Answer any questions about the files or directory you are copying.

The following example copies a single DLL from a \Bin directory on one drive to a \Bin directory on another.

xcopy c:\devApp\bin\myAssembly.dll d:\liveApp\bin\

To compile and deploy an assembly to an application's \Bin directory from the command line

  1. From the Start menu, click Run.
  2. In the Open box in the Run dialog box, type cmd, and then click OK.
  3. Use the cd command to navigate to the directory that you want. This command uses relative paths to navigate through the directories and drives on a computer or network.

    The root location of any path that this command uses is the local drive, often C:\. The examples shown in this procedure assume that you have navigated to the directory where the source files are located. The following use of the cd command moves the command prompt from a directory two directories beneath the local drive root to a myApp directory directly beneath the root.

    cd..\..\myApp
  4. At the command prompt, type the following command:
    csc /t:library /out: <destination path> <source path>
vbc /t:library /out: <destination path> <source path>

    note Note In this command, <destination path> is a placeholder that represents the path to the .dll file that is compiled by this command, and <source path> represents the path to the source file. Each <destination path> should include \Bin and the full name you assign to the .dll file. Both <destination path> and <source path> are relative paths.

    The following example compiles HelloObj.dll from the command line from a HelloObj.cs or HelloObj.vb source file. The destination path is a relative path from the directory where the command line currently is to the \Bin directory of the ASP.NET application where the .dll is used. The source file is in the same directory as the command line.

    csc /t:library /out:..\..\..\..\bin\HelloObj.dll HelloObj.cs
vbc /t:library /out:..\..\..\..\bin\HelloObjVB.dll HelloObj.vb

Related Topics
  • Deploying ASP.NET Applications
  • Creating a Directory Structure for an ASP.NET Application
  • Deploying Local Application Components
  • Deploying ASP.NET Application Files and Local Components
  • Deploying Shared Components to the Global Assembly Cache
  • Deploying HTTP Handlers and HTTP Modules


Deploying ASP.NET Application Files and Local Components

To deploy an ASP.NET application, simply copy the application files you have created from your development computer to the production Web server that will host your application. You can use the XCOPY command-line tool or any FTP application to copy the files from one location to another.

To deploy assemblies that you want to share across Web applications, such as assemblies that contain custom ASP.NET server controls, you must deploy them to the global assembly cache. For more information, see the Global Assembly Cache topic in .NET Framework Help .

To deploy ASP.NET application files from the command line

  1. From the Start menu, click Run.
  2. In the Open box in the Run dialog box, type cmd, and then click OK.
  3. At the command prompt, type the following command:

    xcopy <source path> <destination path>

    note Note In this command, <source path> is a placeholder that represents the full path to the source files you want to copy, including the drive, the directory, and the file names. You can omit the file names if you want all files in the directory to be copied. The <destination path> placeholder represents the full path to the directory where the copied files should be placed.

    The following example command copies all files from the C:\myWebApp directory to the D:\liveApp directory.

    xcopy c:\myWebApp d:\liveApp
  4. Answer any questions about the files or directory you are copying.

You can use this procedure when you want to update a DLL stored in your application's \Bin directory, or if you want to update any of your other application files. The following example copies a single DLL from a \Bin directory on one drive to a \Bin directory on another.

xcopy c:\devApp\bin\myAssembly.dll d:\liveApp\bin\

You can also use this command to update files in your application once you have deployed it. Although you can copy an entire directory at once, individual files must be copied one at a time. You can exclude subdirectories, files with a specific file name extension, or specific file names from being copied by using the XCOPY /exclude option. For more information on how to use the XCOPY tool, open Help for your operating system and search for XCOPY.

note Note You must use physical directory names with the XCOPY tool. You cannot use virtual directory names.

Related Topics
  • Deploying ASP.NET Applications
  • Creating a Directory Structure for an ASP.NET Application
  • Deploying Local Application Components
  • Deploying ASP.NET Application Files and Local Components
  • Deploying Shared Components to the Global Assembly Cache
  • Deploying HTTP Handlers and HTTP Modules


Deploying Shared Components to the Global Assembly Cache

If you plan to share a component between two or more applications on your Web server, you must deploy the component to the server's computer-wide code cache, called the global assembly cache. Each computer on which the common language runtime is installed has a global assembly cache. The global assembly cache stores assemblies that are shared by several applications on the computer. For more information, see the Global Assembly Cache topic in .NET Framework Help

You should share assemblies by installing them into the global assembly cache only when you need to. As a general guideline, keep assembly dependencies private and locate assemblies in the application directory unless sharing an assembly is explicitly required. Assemblies do not have to be in the global assembly cache to be accessible to COM interop or unmanaged code.

note Note There are scenarios in which you should not install an assembly into the global assembly cache. If you place one of the assemblies that make up an application in the global assembly cache, you can no longer replicate or install the application by using the XCOPY tool to copy the application directory. You must move the assembly in the global assembly cache as well.

There are two ways to install an assembly into the global assembly cache:

  • Using Microsoft Windows Installer 2.0.

    This is the recommended and most common way to add assemblies to the global assembly cache. The installer provides reference counting of assemblies in the global assembly cache, plus other benefits. The only time you should not use the installer is when you are installing to a development or test server.

  • Using the Global Assembly Cache tool (Gacutil.exe).

    You can use Gacutil.exe to add strong-named assemblies to the global assembly cache and to view the contents of the global assembly cache.

    note Note Gacutil.exe is only for development purposes and should not be used to install production assemblies into the global assembly cache.

    For more information, see the Global Assembly Cache Tool (Gacutil.exe) topic in .NET Framework Help.

To install a strong-named assembly into the global assembly cache

  1. From the Start menu, click Run, type cmd, and then click OK.
  2. At the command prompt, type the following command:

    gacutil –i <assemblyname>

    note Note In this command, assembly name is the name of the assembly to install in the global assembly cache.

The following example installs an assembly with the file name Hello.dll into the global assembly cache.

gacutil -i Hello.dll

The .NET Framework SDK also provides a Windows shell extension called the Assembly Cache Viewer (Shfusion.dll), which you can use to drag and drop assemblies into the global assembly cache.

Related Topics
  • Deploying ASP.NET Applications
  • Creating a Directory Structure for an ASP.NET Application
  • Deploying Local Application Components
  • Deploying ASP.NET Application Files and Local Components
  • Deploying Shared Components to the Global Assembly Cache
  • Deploying HTTP Handlers and HTTP Modules


Deploying HTTP Handlers and HTTP Modules

ASP.NET provides IHttpHandler and IHttpModule interfaces that allow you to use APIs that are as powerful as the Internet Server API (ISAPI) programming interfaces available with IIS but with a simpler programming model. HTTP handler objects are functionally similar to IIS ISAPI extensions, and HTTP module objects are functionally similar to IIS ISAPI filters.

ASP.NET maps HTTP requests to HTTP handlers. Each HTTP handler enables processing of individual HTTP URLs or groups of URL extensions within an application. HTTP handlers have the same functionality as ISAPI extensions with a much simpler programming model.

An HTTP module is an assembly that handles events. ASP.NET includes a set of HTTP modules that can be used by your application. For example, the SessionStateModule is provided by ASP.NET to supply session-state services to an application. You can also create custom HTTP modules to respond to either ASP.NET events or user events.

To compile, deploy, and register HTTP handlers

  1. Compile and deploy the .NET class for the HTTP handler in the \Bin directory under the application's virtual root. For more information, see Deploying Local Application Components.
  2. Register the HTTP handler, synchronous or asynchronous, in the application's Web.config configuration file. The following example maps all HTTP requests to the classes MyHandler.New and MyHandler.Fin in the assembly MyHandler that is in the file Myhandler.dll.
    <configuration>
   <system.web>
      <httpHandlers>
         <add verb="*" path="MyHandler.New"
               type="MyHandler.New, MyHandlerAssembly" />
         <add verb="*" path="*.myNewFileExtension"
               type="MyHandler.Fin, MyHandlerAssembly" />
      </httpHandlers>
   <system.web>
</configuration>

    The <add> elements within the <httpHandlers> configuration section have three attributes: path, type, and verb. For more information, see <add> Element for <httpHandlers>.

  3. Register the HTTP handler extension as a script map in IIS. For more information, see Setting Application Mappings.

To compile, register, and deploy HTTP modules

  1. Compile and deploy the .NET class for the HTTP module in the \Bin directory under the application's virtual root. For more information, see Deploying Local Application Components.
  2. Register the HTTP module in the application's Web.config configuration file. The following example registers an OutputCache module to an application.
    <configuration>
   <system.web>
      <httpModules>
         <add name="OutputCache"
              type="System.Web.Caching.OutputCacheModule, System.Web,
                    Version=1.0.2800.0, Culture=neutral,
                    PublicKeyToken=b03f5f7f11d50a3a"/>
      </httpModules>
   <system.web>
</configuration>

    For more information, see <add> Element for <httpModules>.

For more information on working with and registering HTTP handlers and HTTP modules, see information on HTTP handlers or HTTP modules in the MSDN Library.

Related Topics
  • Deploying ASP.NET Applications
  • Creating a Directory Structure for an ASP.NET Application
  • Deploying Local Application Components
  • Deploying ASP.NET Application Files and Local Components
  • Deploying Shared Components to the Global Assembly Cache
  • Deploying HTTP Handlers and HTTP Modules


Side-By-Side Support in ASP.NET

Traditionally, when a component or application is updated on a computer, the older version is removed and replaced with the newer version. If the new version is not compatible with the previous version, this usually breaks other applications that use the component or application. The .NET Framework provides support for side-by-side execution, which allows multiple versions of an assembly or application to be installed on the same computer, at the same time. Since multiple versions can be installed simultaneously, managed applications can select which version to use without affecting other applications that use a different version.

In ASP.NET, applications are said to be running side by side when they are installed on the same computer but use different versions of the .NET Framework. The following topics describe side-by-side support in ASP.NET and how to configure ASP.NET applications for side-by-side execution.

In This Section

ASP.NET Side-by-Side Support Overview

Describes side-by-side support in ASP.NET and how it relates to side-by-side support in the .NET Framework.

Managing Multiple Versions of ASP.NET

Describes how to upgrade, uninstall, and redistribute multiple versions of ASP.NET.

Configuring an ASP.NET Application for an ASP.NET Version

Describes how to configure an ASP.NET application to use a specific version of ASP.NET when multiple versions of the .NET Framework are installed on a computer.

.NET Framework Assembly Unification

Describes how an ASP.NET application determines which version of the .NET Framework to use if the application and the components it uses were built on different versions of the runtime.

Related Sections

ASP.NET Deployment
Describes how to distribute ASP.NET applications and components from development and test servers to production servers.


ASP.NET Side-by-Side Support Overview

The .NET Framework allows you to install multiple versions of the runtime on the same computer. By default, when the .NET Framework is installed on a computer with an existing installation, all ASP.NET applications are automatically updated to use this version of the .NET Framework. The only exceptions are applications that are bound to an incompatible version of the runtime or to a later version of the runtime. Although later versions of the .NET Framework are designed to be backwards compatible, you might want to configure an ASP.NET application to use an earlier version.

Script Maps for ASP.NET Applications

When multiple versions of the .NET Framework are installed on the same computer, each installation contains an associated version of the ASP.NET ISAPI. An ASP.NET application uses the ASP.NET ISAPI to determine which version of the .NET Framework to use for the application. An ASP.NET application can be configured to use any of the installed ASP.NET ISAPI versions. To specify the ASP.NET ISAPI version to use for an ASP.NET application, a script map is registered in Internet Information Services (IIS) for the application.

A script map associates a file name extension and HTTP verb with the appropriate ISAPI for script handling. For example, when IIS receives a request for an .aspx file, the script map for the application directs IIS to forward the requested file to the appropriate version of the ASP.NET ISAPI for processing. The script map for each ASP.NET application is normally set in the Internet Information Services management console and can be applied directly to an application, or inherited from a parent application. By default, when the .NET Framework is installed, the script maps for all existing ASP.NET applications on the computer are automatically updated to use the ASP.NET ISAPI version associated with the installation, unless the application uses a later or an incompatible version.

To make it easier to reconfigure the script map for an ASP.NET application, each installation of the .NET Framework comes with an associated version of the ASP.NET IIS Registration tool (Aspnet_regiis.exe). By default, this tool is installed in the following directory:

systemroot\Microsoft.NET\Framework\versionNumber

Administrators can use this tool to remap an ASP.NET application to the ASP.NET ISAPI version associated with the tool.

note Note Because Aspnet_regiis.exe is associated with a specific version of the .NET Framework, administrators must use the appropriate version of Aspnet_regiis.exe to reconfigure the script map for an ASP.NET application. Aspnet_regiis.exe only reconfigures the script map of an ASP.NET application to the ASP.NET ISAPI version associated with the tool.

The tool can also be used to display the status of all installed versions of ASP.NET, register the associated version of ASP.NET, create client-script directories, and perform other configuration operations.

For more information about script maps and IIS configuration, see IIS Help . For more information on updating script maps for an ASP.NET application, see the ASP.NET IIS Registration Tool (Aspnet_regiis.exe).

ASP.NET Performance Counters

Performance counters allow you to monitor the operation of ASP.NET from the Performance console. Each installation of ASP.NET installs performance counters that apply to each individual version of ASP.NET, as well as to all installed versions.

Each version of ASP.NET installs a separate set of performance counter objects to monitor the ASP.NET system and ASP.NET applications. These objects use the naming conventions "ASP.NET v.X.X.XXXX.X" and "ASP.NET Apps v.X.X.XXXX.X", respectively, where v.X.X.XXXX.X denotes the ASP.NET version and build numbers.

In addition, ASP.NET also installs ASP.NET system and ASP.NET applications performance counters that apply to all installed versions of ASP.NET. Since these counters are shared between all versions of ASP.NET, they always correspond to the latest installed version on the machine. If the latest version of ASP.NET is uninstalled, these counters are automatically re-associated with the latest remaining version of ASP.NET.

ASP.NET State Service

ASP.NET state service is used to manage session state on a computer. All compatible versions of ASP.NET that are installed on the same computer share the same state service. The state service version that is used is always the one that is installed with the latest version of ASP.NET. This version is registered under aspnet_state. Therefore, when this version of ASP.NET is uninstalled, the latest remaining version on the computer is then registered and used in its place.

ASP.NET SQL State Server

ASP.NET SQL state server is used to manage session state in SQL on a computer. All compatible versions of ASP.NET that are installed on the same computer share the same SQL state server. The SQL state server version that is used is always the one that is installed with the latest version of ASP.NET. When this version of ASP.NET is uninstalled, the latest remaining version on the computer is then registered and used in its place.

ASPNET User Account and Filter

All installed versions of ASP.NET share the same ASPNET user account (for the worker process) and Aspnet_filter.dll (for storing and removing the session ID from cookie-less session-state requests). The ASPNET user account and Aspnet_filter.dll always corresponds to the latest installed version of ASP.NET. When this version of ASP.NET is uninstalled from a computer, the latest remaining version on the computer is then registered and used in its place.

Related Topics
  • Side-by-Side Support in ASP.NET
  • Managing Multiple Versions of ASP.NET
  • Configuring an ASP.NET Application for an ASP.NET Version
  • ASP.NET IIS Registration Tool (Aspnet_regiis.exe)
  • .NET Framework Assembly Unification


Managing Multiple Versions of ASP.NET

The .NET Framework allows you to install multiple versions of the runtime on the same computer. This allows an ASP.NET application to use the version it needs to run without affecting other applications. The following sections describe how to install, uninstall, and redistribute multiple versions of ASP.NET on the same computer.

Installing Multiple Versions of ASP.NET

To add a version of ASP.NET to a computer, run the .NET Framework redistributable package setup program (Dotnetfx.exe) for the version you want to install. By default, all existing ASP.NET applications are automatically reconfigured during installation to use the installing version of the runtime if the following conditions are met:

  • The installing .NET Framework version is later than the version that is currently mapped to the application.
  • The installing .NET Framework version is compatible with the version mapped to the application. In general, the version number determines compatibility. Minor revision and build number changes are usually compatible, whereas major revision numbers are not.

    caution Caution Although ASP.NET applications are automatically updated to use the installing version of ASP.NET if the preceding conditions are met, custom configuration settings in the current Machine.config file are not transferred to the installing Machine.config file. If your application uses custom configuration settings, be sure to either manually update the new Machine.config file or use the ASP.NET IIS Registration tool (Aspnet_regiis.exe) to remap the application to the previous version of ASP.NET. For more information on remapping an application, see Configuring an ASP.NET Application for an ASP.NET Version.

To prevent the automatic remapping of all existing applications to the installing version of the .NET Framework, use the /noaspupgrade command-line option with the Dotnetfx.exe setup program. The following shows the entire command line:

Dotnetfx.exe /c:"install /noaspupgrade"

For more information on the .NET Framework redistributable package, see Redistributing the .NET Framework.

Web Service Extensions in IIS 6.0

If you're using Internet Information Services 6.0, you might need to enable ASP.NET in the Internet Information Services management console after installing ASP.NET. IIS 6.0 introduces a new Web Service Extensions folder, which allows an administrator to selectively enable and disable functionality in IIS. When ASP.NET version 1.1 or later is installed on a computer that uses IIS 6.0, the installation script creates a metabase key for that version of ASP.NET. This metabase key allows ASP.NET to appear in the console as a configurable component. A separate key is created for each installed version of ASP.NET, allowing each version to be separately configurable in the console. When a version of ASP.NET is uninstalled from a computer, the respective key is also removed.

note Note When ASP.NET is installed through the Add or Remove Programs item in Control Panel, or the Configure Your Server wizard, ASP.NET is enabled in the Web Service Extensions by default. However, if it is installed through Microsoft Visual Studio .NET, Windows Update, or the .NET Framework redistributable package (Dotnetfx.exe), ASP.NET is disabled by default.

To manage items in the Web Service Extensions folder

  1. Open IIS Manager, expand local computer, and then click the Web Service Extensions folder.
  2. Click the Extended tab, and then click the Web Service Extension item you want to configure.
  3. Click the Allow or Prohibit button to enable or disable the item.
  4. Click the Add a new Web service extension link to add a new item to the console.

Uninstalling a Version of ASP.NET

If you have multiple versions of ASP.NET installed on a machine, you can uninstall a version on an individual basis. Uninstalling ASP.NET is usually accomplished by uninstalling the .NET Framework through the Add or Remove Programs Control Panel item. During the uninstall process, the setup program calls the ASP.NET IIS Registration tool (Aspnet_regiis.exe) with the -u option (uninstall flag).

note Note If you just want to uninstall a version of ASP.NET without uninstalling the associated .NET Framework, you can use Aspnet_regiis.exe directly. Each installation of the .NET Framework contains an associated version of the tool. To uninstall only ASP.NET, use the -u option of the tool version associated with the ASP.NET version you want to uninstall. For more information, see the ASP.NET IIS Registration Tool (Aspnet_regiis.exe).

The -u option of Aspnet_regiis.exe performs the following actions:

  • All ASP.NET applications currently mapped to the ASP.NET version being uninstalled are remapped to the next-latest compatible version on the computer. If no compatible version exists, the script map for the application is removed completely.

    caution Caution Removing the script maps will cause IIS to serve ASP.NET pages as literal text. This could potentially expose source code to the client.

  • The ASP.NET state service is shared across all compatible versions of ASP.NET and is always mapped to the latest installed version of ASP.NET. If the ASP.NET version you are uninstalling is currently the latest version, the next-highest compatible version on the computer is then registered to replace it. If no compatible version exists, the ASP.NET State Service is uninstalled.
  • Performance objects and their associated performance counters specific to the version being uninstalled are removed. The generic performance objects and counters that apply to all installed versions of ASP.NET, ASP.NET and ASP.NET Applications, are directed to the latest installed version remaining on the computer.
  • The ASPNET user account is shared across all compatible versions of ASP.NET. If no additional ASP.NET installations remain on the computer, the ASPNET user account and the associated access control lists are removed.

For information on other effects of installing multiple versions of ASP.NET, see ASP.NET Side-by-Side Support Overview.

Third-Party Redistribution of the .NET Framework

Third-party applications can package and install the .NET Framework as part of their setup under a special redistribution license. This allows an application to install the specific version of the .NET Framework it needs to run. The .NET Framework redistributable package (Dotnetfx.exe) is provided for an application to deploy with the runtime. The default installation script of Dotnetfx.exe might not suit the needs of your application. It is up to the third-party application developer to use the options described below when installing the .NET Framework as part of an application's setup.

For more information on the .NET Framework redistributable package, see Redistributing the .NET Framework. For more information on the EULA of the redistributable package, see the Where to Obtain the .NET Framework Redistributable Package topic in .NET Framework Help .

Disabling Automatic Script Map Updates

By default, when the .NET Framework is installed on a computer with an existing installation, all ASP.NET applications are automatically updated to use this version of the .NET Framework, unless the applications are bound to an incompatible version of the runtime or to a later version of the runtime. Usually, only a system administrator performs this type of installation. When the .NET Framework is installed as part of an application's setup, it should not force other applications on the computer to use that version of the runtime.

As part of the setup script, Dotnetfx.exe normally calls the ASP.NET IIS Registration tool (Aspnet_regiis.exe) with the -i option to install ASP.NET. This option attempts to update the script maps of all existing ASP.NET applications. To prevent the installation from automatically updating other applications on the computer, the /noaspnetupgrade option is provided as part of Dotnetfx.exe. This option causes the setup program to use the -ir option of Aspnet_regiis.exe instead, which skips the automatic script map updates, default documentation, and MIME swapping steps. The following shows the entire command line.

Dotnetfx.exe /c:"install /noaspupgrade"

Manually Updating Script Maps

Sometimes, it is necessary to manually set up the script maps for an application. If the application needs its own virtual directory that targets the installing version of the .NET Framework, make sure the application's setup program also explicitly calls Aspnet_regiis.exe with the -s or -sn option to set up the script maps.

The following shows a sample command line that updates the script maps for an application called SampleApp1.

Aspnet_regiis.exe -s W3SVC/1/ROOT/SampleApp1.

For more information, see the ASP.NET IIS Registration Tool (Aspnet_regiis.exe).

Related Topics
  • Side-by-Side Support in ASP.NET


Configuring an ASP.NET Application for an ASP.NET Version

By default, when the .NET Framework is installed on a computer with an existing installation, all ASP.NET applications are automatically updated to use this version of the .NET Framework. The only exceptions are applications that are bound to an incompatible version of the runtime or to a later version of the runtime. Although later versions of the .NET Framework are designed to be backward compatible, you might want to configure an ASP.NET application to use an earlier version. The following sections describe the process to configure an ASP.NET application to target a specific version of the .NET Framework.

Viewing the Script Map for an ASP.NET Application

When managing a computer with multiple versions of the .NET Framework installed, it is often useful to view the script map for an ASP.NET application to determine which version is used by the application. You can view the script map for an ASP.NET application using the Internet Information Services management console.

To view the script map for an ASP.NET application

  1. Open IIS Manager, expand the local computer by clicking the plus sign, and navigate to the folder that contains the ASP.NET application.
  2. Right-click the folder and click Properties. The application's Properties dialog box appears.
  3. On the Directory tab, click the Configuration button. The Application Configuration dialog box appears.
  4. On the Mappings tab, select an ASP.NET application extension, such as .asmx or .aspx.

The Executable Path column of the dialog box will list the path to the ASP.NET ISAPI version used by the application. By default, the ASP.NET ISAPI is installed in the following location:

systemroot\Microsoft.NET\Framework\versionNumber

The version number shown in the path indicates the version number of the ASP.NET ISAPI used by the application. The ASP.NET ISAPI version determines which version of the runtime is used by the application.

Updating Script Maps Using Aspnet_regiis.exe

To make it easier to reconfigure the script map for an ASP.NET application, each installation of the .NET Framework comes with an associated version of the ASP.NET IIS Registration tool (Aspnet_regiis.exe). Administrators can use this tool to remap an ASP.NET application to the ASP.NET ISAPI version associated with the tool.

note Note Because Aspnet_regiis.exe is linked to a specific version of the .NET Framework, administrators must use the appropriate version of Aspnet_regiis.exe to reconfigure the script map for an ASP.NET application. Aspnet_regiis.exe only reconfigures the script map of an ASP.NET application to the ASP.NET ISAPI version associated with the tool.

The tool can also be used to display the status of all installed versions of ASP.NET, register the associated version of ASP.NET, create client-script directories, and perform other configuration operations.

To use Aspnet_regiis.exe to update a script map for an ASP.NET application

  1. Open a command window. (Click Start, click Run, type cmd, and then click OK.)
  2. Navigate to the directory of the Aspnet_regiis.exe version you want to use. Remember that each version of the .NET Framework comes with its own version. The file is usually located in the following directory:

    systemroot\Microsoft.NET\Framework\versionNumber

  3. Use the –s or –sn option of Aspnet_regiis.exe along with the path to the application to setup the script maps. The following shows a sample command line that updates the script maps for an application called SampleApp1.
    Aspnet_regiis.exe -s W3SVC/1/ROOT/SampleApp1

Application Pooling in IIS 6.0

IIS versions earlier than 6.0 use the ASP.NET process model (Aspnet_wp.exe). Under the ASP.NET process model, each unique application version automatically runs in a separate process at run time. All applications that target the same version of the runtime share the same process (or processes in Web garden mode). However, IIS 6.0 uses the IIS 6.0 process model (W3wp.exe) and introduces a new isolation feature called application pooling. Application pooling allows applications to run together in one or more processes, as long as they share the same pool designation. Applications that are assigned different application pools never run in the same process.

When multiple versions of the .NET Framework are installed on a computer that uses IIS 6.0, you might encounter the following error message in the Application Event log.

It is not possible to run different versions of ASP.NET in the same IIS process. Please use the IIS Administration Tool to reconfigure your server to run the application in a separate process.

This error occurs when more than one version of ASP.NET is configured to run in the same process. Different versions of the .NET Framework and runtime cannot coexist side-by-side in the same process. Therefore, an ASP.NET application that uses a particular version of the runtime must not share a process with an application that uses a different version. This error commonly occurs when two or more applications are mapped to different versions of ASP.NET, but share the same application pool.

To use application pooling, first make sure IIS 5.0 isolation mode is disabled. Next, navigate to the desired application in the Internet Information Services management console and assign it an application pool. If you want to isolate your application from the existing application pools, create a new pool designation.

note Note The process isolation for each application is configured manually.

To disable IIS 5.0 isolation mode in IIS 6.0

  1. Open IIS Manager and expand local computer.
  2. Right-click the Web Sites folder and click Properties.
  3. On the Service tab, clear the Run Web service in IIS 5.0 isolation mode check box.

To assign a pool designation to an ASP.NET application in IIS 6.0

  1. Open IIS Manager and expand local computer, and then navigate to the folder that contains the ASP.NET application.
  2. Right-click the folder and click Properties. The application's Properties dialog box appears.
  3. On the Directory tab, select the desired pool designation from the Application Pool drop down list.

To create a pool designation in IIS 6.0

  1. Open IIS Manager and expand local computer.
  2. Right-click the Application Pools folder, point to New, and then click Application Pool. The Add New Application Pool dialog box appears.
  3. Enter the new pool designation in the Application pool text box, and then click OK.

Related Topics
  • Side-by-Side Support in ASP.NET
  • ASP.NET Side-by-Side Support Overview


.NET Framework Assembly Unification

In side-by-side execution, it is possible for an application to be composed of components that are built using different versions of the .NET Framework. This can create conflicts between the dependencies of the components. For example, suppose component A is built using the .NET Framework version 1.0 and needs to use version 1.0 of the System.Data assembly. Component B is built using the .NET Framework version 1.1 and needs to use version 1.1 of the System.Data assembly. If the assembly versions are incompatible, but are loaded at the same time, this could lead to unintended type casting exceptions, or even worse problems.

How an Application Determines Which .NET Framework Version to Use

To solve this problem, when an application uses components that are built on different versions of the .NET Framework, the runtime version that is associated with an application determines which version of the .NET Framework assemblies are used by the application and all its components. In the previous example, if the application is associated with version 1.1 of the .NET Framework, version 1.1 of the System.Data assembly is then loaded and shared across all components used by the application. The reference from component A to version 1.0 of the System.Data assembly is promoted at run time to reference version 1.1.

You can override this behavior by adding <bindingRedirect> elements to the Machine.config or Web.config files. This allows an application to use an updated assembly version that was designed to replace an existing assembly for certain types of applications. For example, if an updated version of System.Web.Service.dll is released in the future that supports SOAP version 1.2, you might want your application to use that version, instead of the version that was installed with the runtime originally.

note Note For more information, see the <bindingRedirect> topic in .NET Framework Help .

This behavior can also be overridden in the ASP.NET host configuration file (Aspnet.config). ASP.NET uses this file to ensure that the version of System.Web.dll and System.Web.RegularExpressions.dll always matches the runtime version associated with an application, regardless of any overrides in the Web.config file.

Sometimes you might want to use a component that was built using a later version of ASP.NET in an application built with an earlier version. Remember that the ASPNET ISAPI version associated with an application always determines the version of the runtime used for an application. If the application is configured to use the earlier version of the runtime, the component will be automatically redirected at runtime to use that version, as well. When using a component built with a later version of the .NET Framework in an application built on an earlier version, consider the following:

  • Make sure the component does not use any features or depend on any behaviors specific to the later version of the .NET Framework. These features might not be available in the earlier version of the runtime.
  • ASP.NET uses script maps in IIS to bind an application to a version of the runtime. <supportedRuntime> and <requiredRuntime> configuration elements are not applicable to ASP.NET applications.

Alternatively, if the runtime version used to build the component is installed on the computer, you could also reconfigure the application to use the later runtime version. Since later versions of the .NET Framework are designed to be backward compatible, the application should work without any modifications. For information on configuring an ASP.NET application to use a specific version of the runtime, see Configuring an ASP.NET Application for an ASP.NET Version.

Related Topics
  • Side-by-Side Support in ASP.NET


Redistributing the .NET Framework

When you deploy an ASP.NET application to a production server, you also need to install the .NET Framework redistributable package (Dotnetfx.exe) to support the ASP.NET server controls and other portions of the application that run on the server. However, your application can use one version of the redistributable package while other applications on the server use another.

When you include the .NET Framework redistributable package with an application that you are installing to a production server, ASP.NET is automatically updated. If the server hosts other applications that use a different version of ASP.NET, you need to incorporate the following command in your application's setup program:

Dotnetfx.exe /c:"install /NOASPUPGRADE"

Once the application is installed, you must create a script map between the application's virtual directory to the version of the .NET Framework that you installed. For more information about how to create custom script maps, see Setting Application Mappings.

For more information about the Microsoft .NET Framework redistributable package, see information in Dotnetfx.exe in the MSDN Library.

Related Topics
  • ASP.NET Deployment
  • Deploying ASP.NET Applications
  • Side-By-Side Support in ASP.NET


ASP.NET Process Isolation

When Microsoft® ASP.NET is enabled on a server running Microsoft Windows® Server 2003, by default it runs in the Internet Information Services (IIS) 6.0 worker process isolation mode. Using worker process isolation mode enables application pooling, recycling, and various application health detection. However, if your application has compatibility problems in this mode, you can switch to run IIS 6.0 to IIS 5.0 isolation mode. For more information about both of these modes, see IIS Isolation Modes.

If you install ASP.NET and the Microsoft .NET Framework on a server running Windows XP Professional or Windows 2000 Server, ASP.NET automatically provides its own process model to run in.

This section outlines the process model, and discusses how to use the ASP.NET process model.

This section includes the following information:

  • Process Model Modes: Describes the differences between the IIS 6.0 worker process isolation process model and the ASP.NET process model.
  • Using the ASP.NET Process Model: Describes how to enable and configure the ASP.NET process model in IIS 6.0.
Related Topics
  • For introductory information on the ASP.NET administration guide, see ASP.NET Administration.


Process Model Modes

When you install ASP.NET on a server running Windows Server 2003, ASP.NET applications are executed by IIS 6.0. IIS 6.0 runs in one of two distinct modes of operation, called application isolation modes. These are worker process isolation mode, the default, and IIS 5.0 isolation mode. IIS functions differently in the two isolation modes.

When ASP.NET runs in the worker process isolation mode, it runs in the W3wp.exe worker process and picks up the IIS 6.0 application pool process properties for its operation. Be aware, however, that when your application is running in worker process isolation mode, any <processModel> Element configuration settings that you have created in the computer-wide Machine.config file are ignored, except the following three settings:

  • maxWorkerThreads
  • maxIoThreads
  • ResponseDeadlockInterval

When running on IIS 6.0 in worker process isolation mode, ASP.NET uses the IIS 6.0 process model settings. For information about how to migrate ASP.NET process model configuration settings to IIS 6.0 application pool settings, see Web Application Isolation.

When you configure IIS 6.0 to run in IIS 5.0 isolation mode, ASP.NET runs in its own process model, Aspnet_wp.exe, and uses its own configuration settings. These settings are stored in the computer-wide Machine.config configuration file.

In almost all situations, ASP.NET applications running on Windows Server 2003 should be run in worker process isolation mode. If your application uses read raw data filters, you should use IIS 5.0 isolation mode instead.

When installed on servers running Windows XP or Windows 2000 Server, ASP.NET runs in IIS 5.1 or IIS 5.0, respectively, and runs in the Aspnet_wp.exe process by default. The ASP.NET process model provides process recycling, health detection, and support for affinities between worker processes and particular CPUs on a server with multiple CPUs. For more information, see Using the ASP.NET Process Model.

To configure IIS 6.0 for IIS 5.0 isolation mode

important Important You must have administrative privileges to perform this procedure. To keep security risks low, log on to your computer using an account that is not in the Administrators group, and then use the Run as command to run IIS Manager as an administrator. From the command prompt, type runas /user: administrative_accountname "mmc %windir%\system32\inetsrv\iis.msc".

  1. In IIS Manager, expand the local computer, right-click Web Sites, and then click Properties.
  2. On the Service tab, select the Run WWW service in IIS 5.0 isolation mode check box, and then click OK. The Internet Services Manager dialog box appears.
  3. To start the Web service, click Yes.

    note Note When you have completed this procedure, you must restart the Web service, which will temporarily interrupt the service.

Related Topics
  • ASP.NET Process Isolation
  • Using the ASP.NET Process Model


Using the ASP.NET Process Model

One of the most important requirements for .NET Framework applications is reliability. An architecture in which applications run inside the server process (in IIS, Inetinfo.exe) does not produce a solid foundation for building reliable applications that can continue to run over a long period of time. Too many resources are shared on the process level, and it is too easy for an error to bring down the entire server process.

To solve this problem, ASP.NET provides an out-of-process execution model, Aspnet_wp.exe, which helps protect the server process from user code. It also enables you to apply heuristics to the lifetime of the process to improve the availability of your Web applications. Using asynchronous interprocess communication helps provide a balance between performance, scalability, and reliability.

Process model settings are exposed in the root configuration file for the computer, Machine.config. The configuration section is named <processModel> Element and is shown in the following example. On computers running Windows 2000 and Windows XP, the process model is enabled by default (enable="true").

note Note On computers running Windows Server 2003, ASP.NET runs in IIS 6.0 worker process isolation mode by default. If your application is designed with specific ASP.NET process model settings, to be able to use them on Windows Server 2003 you must configure the server to run in IIS 5.0 isolation mode. For more information, see Configuring Isolation Modes.

<processModel
    enable="true"
    timeout="Infinite"
    idleTimeout="Infinite"
    shutdownTimeout="0:00:05"
    requestLimit="Infinite"
    requestQueueLimit="5000"
    restartQueueLimit="10"
    memoryLimit="60"
    webGarden="false"
    cpuMask="0xffffffff"
    userName="machine"
    password="AutoGenerate"
    logLevel="Errors"
    clientConnectedCheck="0:00:05"
    comAuthenticationLevel="Connect"
    comImpersonationLevel="Impersonate"
    responseRestartDeadlockInterval="00:09:00"
    responseDeadlockInterval="00:03:00"
    maxWorkerThreads="20"
    maxIoThreads="20"
/>

Most of configuration settings in this example help control when a new worker process begins to serve requests (gracefully taking the place of an old worker process). The userName and password attributes define the account under which the ASP.NET worker process runs. These default to the values machine and autogenerate, respectively. These values tell ASP.NET to use the built-in ASPNET account and to use a cryptographically strong random password stored in the Local Security Authority (LSA) for that account.

note Note On computers running Windows Server 2003, by default ASP.NET runs as part of the IIS 6.0 (W3wp.exe) process using the default identity NETWORK SERVICE. If IIS5 isolation mode is configured on a computer running Windows Server 2003, the ASP.NET worker process runs in the ASPNET account.

If you want a more privileged process, you can set the userName attribute to System, which causes the ASP.NET worker process to run with the same identity as the Inetinfo.exe process. This process runs by default as the System identity. When so configured, the ASP.NET worker process will have the right to access nearly all resources on the local server. In Windows 2000, Windows XP, and Windows Server 2003 family systems, the System account also has network credentials and can access network resources as the machine account.

caution Caution Changing the userName attribute to System enables access to and the ability to alter nearly all the resources on the computer, creating a significant security risk to your server.

The following example changes the userName attribute in the <processModel> section of the Machine.config file to run the process as System.

<processModel userName="system" password="autogenerate" />

The process model supports two types of recycling: reactive and proactive.

Reactive Process Recycling

Reactive process recycling occurs when a process is not functioning properly or is unable to serve requests. The process typically displays detectable symptoms, such as deadlocks, access violations, memory leaks, and so on, in order to trigger a process recycle. You can help control the conditions that cause a process restart by using the requestQueueLimit, memoryLimit, and shutdownTimeout configuration attributes. For more information about these attributes, see the <processModel> Element configuration section.

Proactive Process Recycling

Proactive process recycling restarts the worker process periodically even if the process is healthy. This can be a useful way to prevent denials of service due to conditions the process model is unable to detect. A process can be restarted after a specific number of requests or after a time-out period has elapsed. You can enable proactive process recycling using the timeout, idleTimeout, and requestLimit configuration attributes. For more information, see the <processModel> Element configuration section.

Logging Process Model Events

The process model can write events to the Windows event log when process cycling occurs. This is controlled by the logLevel configuration attribute. For more information, see the <processModel> Element configuration section.

When a cycling event occurs, if logging is enabled for that event, the following entries are written to the application event log.

Shutdown reason | Event Log Type | Description
Unexpected | Error | The ASP.NET worker process shut down unexpectedly.
RequestQueueLimit | Error | The ASP.NET worker process restarted because the request queue limit was exceeded.
RequestLimit | Information | The ASP.NET worker process restarted because the request limit was exceeded.
Timeout | Information | The ASP.NET worker process restarted because the time-out interval was met.
IdleTimeout | Information | The ASP.NET worker process shut down because the idle time-out interval was met.
MemoryLimitExceeded | Error | The ASP.NET worker process restarted because the process memory limit was exceeded.

Enabling Web Gardens on Multiprocessor Computers

The process model helps enable scalability on multiprocessor computers by distributing the work to several processes, one per CPU, each with the processor affinity set to its own CPU. This eliminates cross-processor lock contention and is ideal for large symmetric multiprocessing (SMP) systems. This technique is called Web gardening. To enable Web gardening, you need to set the cpuMask and webGarden configuration settings in the <processModel> element. The following example enables Web gardening on a server running ASP.NET.

<configuration>
   <system.web>
      <processModel
         enable="true"
         timeout="15"
         webGarden="true"
         maxWorkerThreads="25"
         maxIoThreads="25"/>
   </system.web>
</configuration>

Web gardening has some side effects that you should be aware of:

  • If your application uses session state, it must choose an out-of-process provider (NT Service or SQL).
  • Application state and application statics are per process, not per computer.
  • Caching is per process, not per computer.

Related Topics
  • ASP.NET Process Isolation
  • Process Model Modes
  • <processModel> Element


ASP.NET Performance Monitoring

There are a number of tools available to help you test and monitor the performance of your Web application. Microsoft® Visual Studio® .NET provides Application Center Test 1.0 (ACT), which simulates a large group of users by opening multiple connections to a Web server and rapidly sending HTTP requests. ASP.NET includes a number of performance counters that you can use to track the execution of your application. You can also use the built-in ASP.NET tracing feature to track code execution for a page or an application.

ACT is designed to stress-test Web servers and to analyze performance and scalability problems with Web applications. For more information about ACT, either install Visual Studio .NET and open ACT Help, or see information located in the MSDN Library.

When you are doing steady-state running analysis, it is often best to ignore the first request and any one-time initialization costs for objects. For example, when requesting an ASP.NET page for the first time, there is always the cost of compiling an instance of the Page class. Once that has occurred, performance will improve for subsequent requests.

This section includes the following information:

  • Using the System Monitor (PerfMon) with ASP.NET Applications: Describes the System Monitor tool and how to use it to monitor the performance of ASP.NET applications.
  • Performance Counters for ASP.NET: Lists the performance counters included with ASP.NET.
  • Related Performance Counters: Provides guidelines for monitoring an ASP.NET application's performance using the System Monitor tool (PerfMon).
Related Topics
  • For introductory information on the ASP.NET administration guide, see ASP.NET Administration.


Using the System Monitor (PerfMon) with ASP.NET Applications

Unlike traditional Active Server Pages (ASP), which exposed performance counters globally for the entire server computer, most of the ASP.NET performance counters are exposed per application. In the System Monitor tool (PerfMon), per-application counters are available under the ASP.NET Applications performance object. If there are multiple applications on the server, you need to specify a particular application instance when selecting a counter to monitor. However, there is a special __Total__ application instance in PerfMon that aggregates the counter values for all applications on a server. The value of __Total__ is usually a sum of the counter values.

ASP.NET also exposes global-only counters that are not bound to a particular application instance. These counters are located under the ASP.NET performance object.

To view the available ASP.NET counters on a computer running Windows Server 2003

  1. From the Start menu, point to Administrative Tools, and then click Performance.
  2. Right-click the System Monitor details pane and click Add Counters.
  3. To monitor any computer on which the monitoring console is run, click Use local computer counters.

    Or, to monitor a specific computer, regardless of where the monitoring console is run, click Select counters from computer and specify a computer name or IP address.

  4. In Performance object, click an object to monitor.
  5. To monitor all counters, click All counters.

    Or, to monitor only selected counters, click Select counters from list and select the counters you want to monitor.

  6. To monitor all instances of the selected counters, click All instances.

    Or, to monitor only selected instances, click Select instances from list and select the instances you want to monitor.

  7. Click Add, and then click OK.

For information about each of the ASP.NET system and ASP.NET application performance counters, see Performance Counters for ASP.NET.

Related Topics
  • ASP.NET Performance Monitoring
  • Performance Counters for ASP.NET
  • Related Performance Counters


Performance Counters for ASP.NET

ASP.NET supports two groups of performance counters: system and application. The former is exposed in PerfMon in the ASP.NET performance counter object; the latter is exposed in the ASP.NET Applications performance object. There is a significant difference between the State Server Sessions counters found in the ASP.NET performance object, which apply only to the server computer on which the state server is running, and the Sessions counters found in the ASP.NET Applications performance object, which apply only to user sessions that occur in process.

note Note The value associated with each performance counter is updated every 400 milliseconds.

When monitoring the performance of your ASP.NET Web applications, you should always track the performance counters listed in the following table.

Performance object | Performance counter
ASP.NET | Application Restarts
ASP.NET | Requests Queued
ASP.NET | Worker Process Restarts
ASP.NET Applications | Errors Total
ASP.NET Applications | Requests/Sec
Processor | % CPU Utilization

The % CPU Utilization counter monitors CPU utilization on the Web server computer. Low CPU utilization or the inability to maximize CPU utilization regardless of client load can signify contention for resource or a lock in your Web application.

In addition, the performance counters listed in the following table can be valuable in determining problems with your Web applications' performance.

Performance object | Performance counter
ASP.NET Applications | Pipeline Instance Count
.NET CLR Exceptions | # of Exceps Thrown
System | Context Switches/sec

The # of Exceps Thrown counter displays the number of exceptions thrown in an application, since these can have performance implications. Some code paths, however, rely on exceptions for their proper functioning. For example, the HttpResponse.Redirect method always throws an uncatchable exception, ThreadAbortException. Therefore, it can be more useful to track the number of exceptions thrown using the Errors Total counter to see if the exception generated an error on the application.

The Context Switches/sec counter measures the rate at which thread contexts are switched by all CPUs in the Web server computer. A high number for this counter usually indicates either high contention in locks or many switches between user and kernel mode by the thread. Further investigation with sampling profilers and other tools might be warranted.

The counters in the ASP.NET and ASP.NET Applications performance objects are detailed in the following lists.

ASP.NET System Performance Counters

ASP.NET supports the following ASP.NET system performance counters. These aggregate information for all ASP.NET applications on a Web server computer, or they apply generally to a system of ASP.NET servers running the same applications. These can include Web farms and Web gardens.

Application Restarts
The number of times that an application has been restarted during the Web server's lifetime. Application restarts are incremented with each Application_OnEnd event. An application restart can occur because of changes to the Web.config file, changes to assemblies stored in the application's \Bin directory, or too many changes in Web Forms pages. Unexpected increases in this counter can mean that unforeseen problems are causing your Web application to shut down. In such circumstances you should investigate as soon as possible.

note Note This value is reset every time the Internet Information Services (IIS) host is restarted.

Application Running
The number of applications running on the server computer.
Requests Disconnected
The number of requests that have been disconnected due to a communication failure.
Requests Queued
The number of requests waiting for service from the queue. When this number starts to increment linearly with respect to client load, the Web server computer has reached the limit of concurrent requests that it can process. The default maximum for this counter is 5,000. You can change this setting in the computer's Machine.config file.
Requests Rejected
The total number of requests not executed because of insufficient server resources to process them. This counter represents the number of requests that return a 503 HTTP status code, indicating that the server is too busy.
Request Wait Time
The number of milliseconds that the most recent request waited for processing in the queue.
Session State Server Connections Total
The total number of session-state connections to the computer on which out-of-process session-state data is stored.
Session SQL Server Connections Total
The total number of session-state connections to the Microsoft SQL Server™ database in which session-state data is stored.
State Server Sessions Abandoned
The number of user sessions that have been explicitly abandoned. These are sessions that are ended by specific user actions, such as closing the browser or navigating to another site. This counter is available only on the computer where the state server service (aspnet_state) is running.
State Server Sessions Active
The number of currently active user sessions. This counter is available only on the computer where the state server service (aspnet_state) is running.
State Server Sessions Timed Out
The number of user sessions that have become inactive through user inaction. This counter is available only on the computer where the state server service (aspnet_state) is running.
State Server Sessions Total
The number of sessions created during the lifetime of the process. This counter is the cumulative value of State Server Sessions Active, State Server Sessions Abandoned, and State Server Sessions Timed Out. This counter is available only on the computer where the state server service (aspnet_state) is running.
Worker Process Restarts
The number of times a worker process has been restarted on the server computer. A worker process can be restarted if it fails unexpectedly or when it is intentionally recycled. In the case of unexpected increases in this counter you should investigate as soon as possible.
Worker Process Running
The number of worker processes running on the server computer.

ASP.NET Application Performance Counters

ASP.NET supports the following application performance counters, which you can use to monitor the performance of a single instance of an ASP.NET application. A unique instance appears for these counters, named __Total__, which aggregates counters for all applications on a Web server (similar to the global counters described in the first section of this topic). The __Total__ instance is always available. The counters will display zero when no applications are present on the server.

Anonymous Requests
The number of requests that are using anonymous authentication.
Anonymous Requests/Sec
The number of requests per second that are using anonymous authentication.
Cache Total Entries
The total number of entries in the cache. This counter includes both internal use of the cache by the ASP.NET page framework and external use of the cache through exposed APIs.
Cache Total Hits
The total number of hits from the cache. This counter includes both internal use of the cache by the ASP.NET page framework and external use of the cache through exposed APIs.
Cache Total Misses
The number of failed cache requests per application. This counter includes both internal use of the cache by ASP.NET and external use of the cache through exposed APIs.
Cache Total Hit Ratio
The ratio of hits to misses for the cache. This counter includes both internal use of the cache by ASP.NET and external use of the cache through exposed APIs.
Cache Total Turnover Rate
The number of additions and removals to the total cache per second. It is useful in helping determine how effectively the cache is being used. If the turnover is large, the cache is not being used efficiently.
Cache API Entries
The total number of entries in the application cache.
Cache API Hits
The total number of hits from the cache when it is accessed through only the external cache APIs. This counter does not track any use of the cache internally by ASP.NET.
Cache API Misses
The total number of failed requests to the cache when accessed through the external cache APIs. This counter does not track any use of the cache internally by ASP.NET.
Cache API Hit Ratio
The cache hit-to-miss ratio when accessed through the external cache APIs. This counter does not track any use of the cache internally by ASP.NET.
Cache API Turnover Rate
The number of additions and removals to the cache per second, when used through the external APIs (excluding internal use by the ASP.NET page framework). It is useful in helping determine how effectively the cache is being used. If the turnover is large, then the cache is not being used effectively.
Compilations Total
The total number of compilations that have taken place during the lifetime of the current Web server process. This occurs when a file with an .aspx, .asmx, .ascx, or .ashx extension, or a code-behind source file, is dynamically compiled on the server.

note Note This number will initially climb to a peak value as requests are made to all parts of an application. Once a compilation occurs, however, the resulting binary is saved to disk, where it is reused until its source file changes. This means that, even in the event of a process restart, the counter can remain at zero (inactive) until the application is modified or redeployed.

Debugging Requests
The number of requests that occur while debugging is enabled.
Errors During Preprocessing
The number of errors that occurred during parsing. Excludes compilation and run-time errors.
Errors During Compilation
The number of errors that occur during dynamic compilation. Excludes parser and run-time errors.
Errors During Execution
The total number of errors that occur during the execution of an HTTP request. Excludes parser and compilation errors.
Errors Unhandled During Execution
The total number of unhandled errors that occur during the execution of HTTP requests.

note Note An unhandled error is any uncaught run-time exception that escapes user code on the page and enters the ASP.NET internal error-handling logic. Exceptions to this rule occur when:

  • Custom errors are enabled, an error page is defined, or both.
  • The Page_Error event is defined in user code and either the error is cleared (using the HttpServerUtility.ClearError method) or a redirect is performed.
Errors Unhandled During Execution/Sec
The number of unhandled exceptions per second that occur during the execution of HTTP requests.
Errors Total
The total number of errors that occur during the execution of HTTP requests. Includes any parser, compilation, or run-time errors. This counter is the sum of the Errors During Compilation, Errors During Preprocessing, and Errors During Execution counters. A well-functioning Web server should not generate errors. If errors occur in your ASP.NET Web application, they may skew any throughput results because of very different code paths for error recovery. Investigate and fix any bugs in your application before performance testing.
Errors Total/Sec
The number of errors per second that occur during the execution of HTTP requests. Includes any parser, compilation, or run-time errors.
Output Cache Entries
The total number of entries in the output cache.
Output Cache Hits
The total number of requests serviced from the output cache.
Output Cache Misses
The number of failed output-cache requests per application.
Output Cache Hit Ratio
The percentage of total requests serviced from the output cache.
Output Cache Turnover Rate
The number of additions and removals to the output cache per second. If the turnover is large, the cache is not being used effectively.
Pipeline Instance Count
The number of active request pipeline instances for the specified ASP.NET application. Since only one execution thread can run within a pipeline instance, this number gives the maximum number of concurrent requests that are being processed for a given application. In most circumstances it is better for this number be low when under load, which signifies that the CPU is well utilized.
Request Bytes In Total
The total size, in bytes, of all requests.
Request Bytes Out Total
The total size, in bytes, of responses sent to a client. This does not include standard HTTP response headers.
Requests Executing
The number of requests currently executing.
Requests Failed
The total number of failed requests. Any and all status codes greater than or equal to 400 will increment this counter.

note Note Requests that cause a 401 status code will increment this counter and the Requests Not Authorized counter. Requests that cause a 404 or 414 status code will increment this counter and the Requests Not Found counter. Requests that cause a 500 status code will increment this counter and the Requests Timed Out counter.

note Note The equivalent ASP counter would also increment on requests rejected, which cannot be done (because the rejection is done by IIS and not the process model).

Requests Not Found
The number of requests that failed because resources were not found (status code 404, 414).
Requests Not Authorized
The number of requests that failed due to no authorization (status code 401).
Requests Succeeded
The number of requests that executed successfully (status code 200).
Requests Timed Out
The number of requests that timed out (status code 500).
Requests Total
The total number of requests since the service was started.
Requests/Sec
The number of requests executed per second. This represents the current throughput of the application. Under constant load, this number should remain within a certain range, barring other server work (such as garbage collection, cache cleanup thread, external server tools, and so on).
Sessions Active
The number of sessions currently active. This counter is supported only with in-memory session state.
Sessions Abandoned
The number of sessions that have been explicitly abandoned. This counter is supported only with in-memory session state.
Sessions Timed Out
The number of sessions that timed out. This counter is supported only with in-memory session state.
Sessions Total
The number of sessions timed out. This counter is supported only with in-memory session state.
Transactions Aborted
The number of transactions aborted.
Transactions Committed
The number of transactions committed.
Transactions Pending
The number of transactions in progress.
Transactions Total
The total number of transactions since the service was started.
Transactions/Sec
The number of transactions started per second.

Related Topics
  • ASP.NET Performance Monitoring
  • Using the System Monitor (PerfMon) with ASP.NET Applications
  • Related Performance Counters


Related Performance Counters

The following sections list other performance objects and counters that can be useful when monitoring your ASP.NET applications. The list is alphabetical by performance object, then by counter.

For a full list of performance counters on a computer running a version of the .NET Framework, see the Performance Counters topic in .NET Framework Help . For objects and counters associated specifically with ASP.NET, see Performance Counters for ASP.NET.

.NET CLR Exceptions

# of Exceptions Thrown/Sec
The total number of managed exceptions thrown per second. As this number increases, performance degrades.

.NET CLR Loading

Bytes in loader Heap
The number of bytes committed by the class loader across all application domains.
Current App Domains
The current number of application domains loaded in the process. The value of this counter should be the same as the number of virtual directories, plus 1 (to account for the default application domain).
Current Assemblies
The current number of assemblies loaded in the process. Note that assemblies cannot be unloaded from an application domain; the entire application domain must be unloaded. This is an issue for sites with a large number of pages.

.NET CLR Memory

# Bytes in all heaps
Displays the sum of the Gen 0 Heap Size, Gen 1 Heap Size, Gen 2 Heap Size, and the Large Object Heap Size counters. This counter indicates, in bytes, the current memory allocated on the garbage collection heaps.
# Gen 0 Collections
Displays the number of times that generation 0 objects (that is, the youngest, most recently allocated objects) have been reclaimed by garbage collection since the application started.

Generation 0 garbage collection occurs when the available memory in generation 0 is not sufficient to satisfy an allocation request. This counter is incremented at the end of a generation 0 garbage collection. Higher-generation garbage collections include all lower-generation collections. This counter is explicitly incremented when a higher-generation (generation 1 or 2) garbage collection occurs.

This counter displays the last observed value. The _Global_ counter value is not accurate and should be ignored.

# Gen 1 Collections
Displays the number of times that generation 1 objects have been reclaimed by garbage collection since the application started.

The counter is incremented at the end of a generation 1 garbage collection. Higher-generation garbage collections include all lower generation collections. This counter is explicitly incremented when a higher-generation (generation 2) garbage collection occurs.

This counter displays the last observed value. The _Global_ counter value is not accurate and should be ignored.

# Gen 2 Collections
Displays the number of times that generation 2 objects have been reclaimed by garbage collection since the application started. The counter is incremented at the end of a generation 2 garbage collection (also called a full garbage collection).

This counter displays the last observed value. The _Global_ counter value is not accurate and should be ignored.

Memory

Available Mbytes
The amount of physical memory available to processes running on the computer, in megabytes. It is calculated by adding the amount of space on the zeroed, free, and standby memory lists. Free memory is ready for use; zeroed memory is filled with zeros to prevent later processes from seeing data used by a previous process; standby memory is removed from a process's working set (its physical memory) to be stored on the server's hard drive but is still available to be recalled. This counter displays the last observed value only; it is not an average.

Process

% Processor Time
The percentage of the elapsed time on the processor that it took all threads associated with a single process to perform execution instructions. An instruction is the basic unit of execution in a computer; a thread is the object that executes instructions; and a process is the object created when a program is run. Code executed to handle some hardware interrupts and trap conditions are included in this count.
Handle Count
The total number of handles currently open that are associated with this process. This number is equal to the sum of the handles currently open for each thread in this process.
Private Bytes
The current amount of memory, in bytes, that this process has allocated that cannot be shared with other processes.
Thread Count
The number of threads currently active in this process. An instruction is the basic unit of execution in a processor, and a thread is the object that executes instructions. Every running process has at least one thread.

Processor

% Processor Time
The percentage of sampled time that the processor spends to execute a non-Idle thread. It is calculated by measuring how long the idle thread is active in the sample interval and subtracting that time from the interval duration. (Each processor has an idle thread that consumes cycles when no other threads are ready to run). This counter is the primary indicator of processor activity, and displays the average percentage of busy time observed during the sample interval.

Web Service

Bytes Received/Sec
The number of bytes per second received by the Web service.
Bytes Sent/Sec
The number of bytes per second sent by the Web service.
Current Connections
The current number of connections established with the Web service.
ISAPI Extension Requests/Sec
The number of ISAPI Extension requests per second that are being processed by the Web service.
Total Method Requests/Sec
The number of HTTP requests per second received by the Web service.

Related Topics
  • ASP.NET Performance Monitoring
  • Performance Counters for ASP.NET


Additional Resources

There are a number of other useful sources of information on ASP.NET, including Microsoft ASP.NET Help found in the Creating ASP.NET Applications section of Microsoft .NET Framework Help.

In addition, the following resources contain a great deal of information on ASP.NET:

  • The official ASP.NET Web site contains links to tools, forums, articles, sample applications, a gallery of ASP.NET server controls, links to third-party Web sites, and more.
  • The official .NET Framework Community Website Web site contains links to tools, white papers, sample applications and third-party Web sites. This site can help you understand how to access other portions of the .NET Framework from your ASP.NET applications.
  • The MSDN® Library contains technical articles and columns about ASP.NET, as well as links to other resources. Go to the MSDN Library, expand the .NET Development node in the left pane, and then click ASP.NET.
  • The ASP.NET QuickStart, included when you install the .NET Framework, contains overview information and samples of how to develop and administer ASP.NET applications.

Related Topics
  • ASP.NET Administration


ASP

Microsoft® Active Server Pages (ASP) is a server-side scripting environment that you can use to create dynamic and interactive Web pages, and to build powerful Web applications. When the server receives a request for an ASP file, it processes server-side script code contained in the file to build the HTML Web page that is sent to the browser. In addition to server-side script code, ASP files can contain HTML (including related client-side scripts) as well as calls to COM components that perform a variety of tasks, such as connecting to a database or processing business logic.

FPSE does not support unicode content directory names or WebDAV. New FPSE virtual servers should be assigned to the MSSharePointPool application pool. Also, do not make changes to the Microsoft SharePoint™ application pool configuration.

note Note If you have a Sharepoint™ Team Services (STS) Web site, the following types of pages do not work without excluding the virtual directory containing the pages from the STS ISAPI filter:

  • ASP pages.
  • ASP.NET pages.
  • PHP pages.
  • PerlScript pages.
To enable these types of pages to work on your STS Web site
  1. In the Central Administration Web site for STS, choose to Manage your virtual directory or Web site.
  2. Under Defined Managed Paths, type the path to the virtual directory that contains your excluded pages (such as <code>\MyASPPages</code>) and select Exclude.

The topics in this section introduce ASP, explain the basic concepts of scripting with ASP, and discuss more complex application issues such as how to maintain state.

important Important In order to take a more proactive stance against malicious users and attackers, IIS is not installed on members of the Microsoft® Windows® Server 2003 family by default. Furthermore, when you initially install IIS, the service is installed in a highly secure and "locked" mode. By default, IIS serves only static content — meaning features like ASP, ASP.NET, Server-Side Includes, WebDAV publishing, and FrontPage® Server Extensions do not work unless enabled. If you do not enable this functionality after installing IIS, IIS returns a 404 error. You can serve dynamic content and enable these features through the Web Service Extensions node in IIS Manager. Also, if an application extension is not mapped in IIS, IIS returns a 404 error. To map an extension, see Setting Application Mappings. For more information on how to troubleshoot 404 errors, including 404.2 and 404.3; issues related to a new installation of IIS 6.0; or an upgrade from a previous version of IIS, see Troubleshooting.

This section includes the following information:

  • Checklist: ASP Security: Provides a checklist of issues to monitor when developing ASP applications that include user input or database access.
  • What's New in ASP: Describes new features added in this release.
  • Important Changes in ASP: Describes functionality and behavior that has changed for this release.
Related Topics
  • For information on writing server-side scripts with ASP and creating ASP applications, see the Active Server Pages Guide on MSDN® Online or in the Internet Information Services (IIS) Software Development Kit (SDK).
  • For reference topics related to ASP, see the ASP references on MSDN Online or in the IIS SDK.


Checklist: ASP Security

The following is a list of issues to keep in mind when you are developing Web pages using ASP.

 | Step | Reference
Check box | Never trust user input to be of an appropriate size or contain appropriate characters. Always verify user input before using it to make decisions. The best option is to create a COM+ component which you can call from an ASP page to verify user input. You can also use the Server.HTMLEncode method, the Server.URLEncode method, or one of the code examples at the bottom of this page. | Writing Secure Code
Check box | Do not create database connection strings in an ASP page by concatenating strings of user input together. Malicious users can inject code in their input to gain access to your database. If you are using an SQL database, use stored procedures for creating database connection strings. | Writing Secure Code
Check box | Do not use the default SQL administrator account name, sa. Everyone who uses SQL knows that the sa account exists. Create a different SQL administrative account with a strong password and delete the sa account. | Passwords
Check box | Before you store client user passwords, hash them, base64 encode them, or use Server.HTMLEncode or Server.URLEncode to encode them. You can also use one of the code examples at the bottom of this page to verify the characters in the client's password. | Encrypting File System
Check box | Do not put administrative account names or passwords in administration scripts or ASP pages. | Writing Secure Code
Check box | Do not make decisions in your code based on request headers because header data can be fabricated by a malicious user. Before using request data, always encode it or use one of the code examples below to verify the characters it contains. | Writing Secure Code
Check box | Do not store secure data in cookies or hidden input fields in your Web pages. | Writing Secure Code
Check box | Always use Secure Sockets Layer (SSL) for session-based applications so that you never risk sending session cookies without encrypting them. If session cookies are not encrypted, a malicious user can use a session cookie from one application to gain entry to another application that resides in the same process as the first application. | Secure Sockets Layer; Encryption
Check box | When writing ISAPI applications, filters, or COM+ objects, watch out for buffer over-runs caused by assuming sizes of variables and data. Also watch out for canonicalization issues that can be caused by interpreting things, like absolute path names, as relative path names or URLs. | Writing Secure Code
Check box | When you switch an ASP application from running in Single Threaded Apartment (STA) to Multi-Threaded Apartment (MTA), the impersonation token becomes obsolete. This can cause the application to run with no impersonation, effectively letting it run with the identity of the process which might allow access to other resources. If you must switch threading models, disable the application and unload it before you make the change. | Configuring Applications to Use COM+ Services; "COM+ Services" in the IIS Software Development Kit (SDK)

Code Example

This code example includes a function that removes potentially harmful characters from a string that is sent to the function. In both examples above, the code page is specified to ensure proper encoding. The example below is in Microsoft Visual Basic® Scripting Edition (VBScript):

<%@ LANGUAGE="VBScript" %>
<%
  Response.CodePage = 1252
  Response.Write("Hello, " & RemoveBadCharacters(Request.Form("UserName")))
  Response.Write("<BR>This is why you received an error:")

  Function RemoveBadCharacters(strTemp)
    Dim regEx
    Set regEx = New RegExp
    regEx.Pattern = "[^\s\w]"
    regEx.Global = True
    RemoveBadCharacters = regEx.Replace(strTemp, "")
  End Function
%>

The example below is in Microsoft JScript®:

<%@ LANGUAGE="JScript" %>
<%
  Response.CodePage = 1252;
  Response.Write("Hello, " + RemoveBadCharacters(Request.Form("UserName")));
  Response.Write("<BR>This is why you received an error:");

  function RemoveBadCharacters(strTemp) {
    strTemp = strTemp.replace(/[^\s\w]/g,"");
    return strTemp;
  }
%>
Related Topics
  • For a metabase security checklist, see Checklist: Metabase Security.
  • For a global security checklist, see Security Best Practices.


What's New in ASP

In addition to internal performance enhancements and optimizations, this version of Active Server Pages (ASP) has the following new features:

  • Better International and UTF-8 Support
  • Improved POST Support
  • ASP Hang Detection
  • Caching of Popular Files
  • UNC Enhancements
  • COM+ Services in ASP
    • Apartment Model Selection
    • Side-by-side Assemblies
    • COM+ Partitions
    • Tracker
    • Transactions
  • New Metabase Properties for ASP

Better International and UTF-8 Support

UTF-8 support has been expanded to all ASP built-in object properties and methods. The last version of ASP supported UTF-8 only for Response.Write.

Improved POST Support

ASP can now read chunked-encoded POST data from a client.

ASP Hang Detection

When an IIS Web site is busy there may be instances when the maximum number of ASP threads has been spawned and some of the ASP threads are hung, resulting in degraded performance. HSE_REQ_REPORT_UNHEALTHY, and the World Wide Web Publishing Service (WWW service) will recycle the worker process hosting ASP.dll and make an entry in the event log.

note Note Threads are considered hung if they do not respond to a timeout.

Caching of Popular Files

ASP now caches some of the most-recently used files on disk, in addition to keeping a memory cache. The default location of the disk cache is %systemroot%\System32\inetsrv\ASP Compiled Templates. You can change the location of the disk cache by setting the AspDiskTemplateCacheDirectory metabase property.

UNC Enhancements

ASP can now handle UNC paths in ASP scripts.

COM+ Services in ASP

If you wanted to use COM+ services from an ASP application in previous versions of IIS, you had to create a COM component that would call the methods of those services. Now, you can configure your ASP application to use the following COM+ services without having to create a COM component:

  • Apartment Model Selection:

    ASP is now capable of running all of its threads in a multi-threaded apartment (MTA). If your COM components are primarily free-threaded or both-threaded, running the ASP threads as MTA can improve performance significantly.

    To enable an ASP application to run in an MTA, you can use the metabase setting, AspExecuteInMTA, at the application level. This means that you can have one application running on ASP MTA threads and a second application running on ASP STA (single-threaded apartment) threads. The default for ASP threads continues to be STA.

    important Important When you switch an ASP application from running in STA to MTA (or from MTA to STA), the impersonation token becomes obsolete. This can cause the application to run with no impersonation, effectively letting it run with the identity of the process which might allow access to other resources. If you must switch threading models, disable the application and unload it before you make the change.

    The following example sets the Default Web Site application (W3SVC/1/ROOT) to execute in MTA:

    On Error Resume Next
set providerObj = GetObject("winmgmts://MyMachine/root/MicrosoftIISv2")
' Get a reference to the ASP application called Default Web Site
set IIsWebVirtualDirSettingObj = providerObj.get("IIsWebVirtualDirSetting='W3SVC/1/ROOT'")
WScript.Echo "Before: AspExecuteInMTA = " & IIsWebVirtualDirSettingObj.AspExecuteInMTA
' Set the ASP application to execute in MTA
IIsWebVirtualDirSettingObj.AspExecuteInMTA = 1
IIsWebVirtualDirSettingObj.Put_()
WScript.Echo "After: AspExecuteInMTA = " & IIsWebVirtualDirSettingObj.AspExecuteInMTA
  • Side-by-side Assemblies:

    Side-by-side (SxS) assemblies allow ASP applications to specify which version of a system DLL or classic COM component to use, such as MDAC, MFS, MSVCRT, MSXML, and so on. For example, if your ASP application relies on MSXML version 2.0, you can ensure that your application still uses MSXML version 2.0 even after service packs are applied to the server. Any new version of MSXML is still installed on the computer, but version 2.0 remains and is used by your application. Configuring SxS assemblies requires that you know the path to the DLL, and that the COM+ manifest file exists in every virtual directory that needs to use the DLL. The COM+ manifest is an XML file that has information about where a DLL is installed. IIS does not verify that the manifest exists. A manifest looks like the following file excerpt:

<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
<assemblyIdentity publicKeyToken="75e377300ab7b886" type="win32" name="Test4Dir" version="1.0.0.0" processorArchitecture="x86"/>
<file name="DirComp.dll" hash="35ca6f27b11ed948ac6e50b75566355f0991d5d9" hashalg="SHA1">
<comClass clsid="{6C6CC20E-0F85-49C0-A14D-D09102BD7CDC}" progid="DirComp.PathInfo" threadingModel="apartment"/>
<typelib tlbid="{AA56D6B8-9ADB-415D-9E10-16DD68447319}" version="1.0" helpdir=""/>
</file>
</assembly>

    You can enable side-by-side assemblies on the IIS side programmatically or by using IIS Manager.

    To enable side-by-side assemblies on the IIS side using IIS Manager

    1. In IIS Manager, right-click a Web site or virtual directory and click Properties.
    2. Click the Virtual Directory tab, and click Configuration.
    3. If the configuration button is not available, it is because you have not created an application for this virtual directory. Click Create to create an application.
    4. In the Application Configuration dialog box, click the Options tab.
    5. Select the Enable Side by Side assemblies check box.
    6. In the Manifest file name box, type the name of the COM+ manifest file.
    7. Click OK twice.

    To enable side-by-side assemblies programmatically, set the AspEnableSxs flag of the AspAppServiceFlags metabase property. Also set the AspSxsName metabase property to the name of the COM+ manifest name. Set both metabase properties at the application level.

    important Important Only one version of a system DLL can be used in any application pool, even though this feature is configurable at the application level. For example, if application App1 uses MDAC, version 2.5 and application App2 uses MDAC, version 2.4, then App1 and App2 should not be in the same application pool. If they are, the application that is loaded first has its version of MDAC loaded, and the other application is forced to use it until the applications are unloaded.

    The following example enables side-by-side assemblies on the Default Web Site application (W3SVC/1/ROOT). Notice that after setting only the AspEnableTracker property, the AspAppServiceFlags property changes as well:

    On Error Resume Next
set providerObj = GetObject("winmgmts://MyMachine/root/MicrosoftIISv2")
' Get a reference to the ASP application called Default Web Site
set IIsWebVirtualDirSettingObj = providerObj.get("IIsWebVirtualDirSetting='W3SVC/1/ROOT'")
WScript.Echo "Before: AspEnableSxs = " & IIsWebVirtualDirSettingObj.AspEnableSxs
WScript.Echo "        AspSxsName = " & IIsWebVirtualDirSettingObj.AspSxsName
WScript.Echo "        AspAppServiceFlags = " & IIsWebVirtualDirSettingObj.AspAppServiceFlags
' Set the ASP application to enable COM+ side-by-side assemblies
IIsWebVirtualDirSettingObj.AspEnableSxs = 1
' Set the AspSxsName property
IIsWebVirtualDirSettingObj.AspSxsName = "VersionInfo"
' Save the values to the IIS metabase
IIsWebVirtualDirSettingObj.Put_()
' Get the reference again in order to refresh the AspAppServiceFlags property.
set IIsWebVirtualDirSettingObj = Nothing
set IIsWebVirtualDirSettingObj = providerObj.get("IIsWebVirtualDirSetting='W3SVC/1/ROOT'")
WScript.Echo "After: AspEnableSxs = " & IIsWebVirtualDirSettingObj.AspEnableSxs
WScript.Echo "       AspSxsName = " & IIsWebVirtualDirSettingObj.AspSxsName
WScript.Echo "       AspAppServiceFlags = " & IIsWebVirtualDirSettingObj.AspAppServiceFlags
  • COM+ Partitions:

    COM+ Partitions can be used to isolate Web applications into their own COM+ partitions. This is useful to prevent one Web application from accessing the private COM+ applications, configuration information, and data of another Web application. COM+ partitions can hold different versions of your own custom COM components. For example, if you host Web sites for two competing companies that both use COM+ in their Web applications, you can use COM+ partitions to ensure that one company's Web application cannot access the COM+ components in the other company's Web applications. If one of those companies asks you to change certain features in a COM+ application that they both use, you can isolate the new version of that COM+ application in the partition that is linked to their Web application.

    To enable COM+ partitions on the IIS side, set the AspUsePartition flag of the AspAppServiceFlags metabase property at the application level. The partition is identified by a GUID (created using the Component Services Manager snap-in), which can be set at the AspPartitionID metabase property. If no partition is specified, the default system partition is used. For more information, please see "Creating and Configuring COM+ Partitions" in the COM+ SDK or online at COM+ (Component Services).

    important Important Only one version of a COM+ component can be used in any application pool, even though this feature is configurable at the application level. For example, if application App1 uses version 1.0 of a custom COM+ application called Shop.dll, and application App2 uses version 2.0 of Shop.dll, then App1 and App2 should not be in the same application pool. If they are, the application that is loaded first has its version of Shop.dll loaded, and the other application is forced to use it until the applications are unloaded.

    The following example enables partitions on the Default Web Site application (W3SVC/1/ROOT). Notice that after setting only the AspEnableTracker property, the AspAppServiceFlags property changes as well.

    On Error Resume Next
set providerObj = GetObject("winmgmts://MyMachine/root/MicrosoftIISv2")
' Get a reference to the ASP application called Default Web Site
set IIsWebVirtualDirSettingObj = providerObj.get("IIsWebVirtualDirSetting='W3SVC/1/ROOT'")
WScript.Echo "Before: AspUsePartition = " & IIsWebVirtualDirSettingObj.AspUsePartition
WScript.Echo "        AspPartitionID = " & IIsWebVirtualDirSettingObj.AspPartitionID
WScript.Echo "        AspAppServiceFlags = " & IIsWebVirtualDirSettingObj.AspAppServiceFlags
' Set the ASP application to enable COM+ partitioning
IIsWebVirtualDirSettingObj.AspUsePartition = 1
' Set the AspPartitionID property to the GUID configured in Component Services Manager
' when you created the COM+ partition
IIsWebVirtualDirSettingObj.AspPartitionID = "{00000000-0000-0000-0000-000000000000}"
' Save the values to the IIS metabase
IIsWebVirtualDirSettingObj.Put_()
' Get the reference again in order to refresh the AspAppServiceFlags property.
set IIsWebVirtualDirSettingObj = Nothing
set IIsWebVirtualDirSettingObj = providerObj.get("IIsWebVirtualDirSetting='W3SVC/1/ROOT'")
WScript.Echo "After: AspUsePartition = " & IIsWebVirtualDirSettingObj.AspUsePartition
WScript.Echo "       AspPartitionID = " & IIsWebVirtualDirSettingObj.AspPartitionID
WScript.Echo "       AspAppServiceFlags = " & IIsWebVirtualDirSettingObj.AspAppServiceFlags
  • Tracker:

    COM+ tracker allows administrators or developers to debug ASP applications. For example, if a Web application is causing problems on your server, you can enable COM+ tracker to determine when ASP pages are being loaded, when COM components are loaded, and when threads leave a page. After you have debugged your application, you can disable COM+ tracker to return your application to normal performance speed.

    To enable COM+ tracker on the IIS side, set the AspEnableTracker flag of the AspAppServiceFlags metabase property at the application level.

    The following example enables tracking on the Default Web Site application (W3SVC/1/ROOT). Notice that after setting only the AspEnableTracker property, the AspAppServiceFlags property changes as well:

    On Error Resume Next
set providerObj = GetObject("winmgmts://MyMachine/root/MicrosoftIISv2")
' Get a reference to the ASP application called Default Web Site
set IIsWebVirtualDirSettingObj = providerObj.get("IIsWebVirtualDirSetting='W3SVC/1/ROOT'")
WScript.Echo "Before: AspEnableTracker = " & IIsWebVirtualDirSettingObj.AspEnableTracker
WScript.Echo "        AspAppServiceFlags = " & IIsWebVirtualDirSettingObj.AspAppServiceFlags
' Set the ASP application to enable COM+ tracking
IIsWebVirtualDirSettingObj.AspEnableTracker = 1
IIsWebVirtualDirSettingObj.Put_()
' Get the reference again in order to refresh the AspAppServiceFlags property.
set IIsWebVirtualDirSettingObj = Nothing
set IIsWebVirtualDirSettingObj = providerObj.get("IIsWebVirtualDirSetting='W3SVC/1/ROOT'")
WScript.Echo "After: AspEnableTracker = " & IIsWebVirtualDirSettingObj.AspEnableTracker
WScript.Echo "       AspAppServiceFlags = " & IIsWebVirtualDirSettingObj.AspAppServiceFlags
  • Transactions: Transaction support in ASP pages has been available since IIS version 4.0. However, IIS has changed its internal implementation of transactions to take advantage of COM+ services. IIS no longer creates a COM component to house a transaction but accesses the COM+ transaction service directly, thus greatly improving the speed of transaction processing. As always, transactions can only be configured at the page level using the @TRANSACTION directive and the events of the ASP built-in object called ObjectContext.
New Metabase Properties for ASP

The following metabase settings have been added for this release of ASP.

Metabase Property Name | Purpose
AspAppServiceFlags | Enables features like COM+ side-by-side assembly (formerly known as Fusion), partitioning, and so on.
AspDiskTemplateCacheDirectory | Specifies the location of the ASP disk cache.
AspExecuteInMTA | Enables ASP threads to execute in a multi-threaded apartment.
AspKeepSessionIDSecure | Sends the ASP session cookie to a browser securely.
AspMaxDiskTemplateCacheFiles | Specifies the ASP Disk cache maximum.
AspPartitionID | Specifies the COM+ partition to use for the application.
AspRunOnEndAnonymously | Enables ASP to run the global.asa Application_OnEnd and Session_OnEnd events anonymously.
AspBufferingLimit | Specifies the limit of the buffer size.
AspMaxRequestEntityAllowed | Specifies the maximum number of bytes allowed in the entity body of an ASP request.
AspSxsName | Allows ASP applications to specify which version of a system DLL or classic COM component to use.


Important Changes in ASP

ASP has undergone several important changes and enhancements to improve security and performance:

note Note To learn about new ASP features, see What's New in ASP.

  • ASP Pages are Disabled by Default
  • Using Parent Paths
  • The "Templates Cached" Performance Counter
  • Global.asa Events
  • ASP Metabase Properties Removed

ASP Pages are Disabled by Default

important Important In order to take a more proactive stance against malicious users and attackers, IIS is not installed on members of the Microsoft® Windows® Server 2003 family by default. Furthermore, when you initially install IIS, the service is installed in a highly secure and "locked" mode. By default, IIS serves only static content — meaning features like ASP, ASP.NET, Server-Side Includes, WebDAV publishing, and FrontPage® Server Extensions do not work unless enabled. If you do not enable this functionality after installing IIS, IIS returns a 404 error. You can serve dynamic content and enable these features through the Web Service Extensions node in IIS Manager. Also, if an application extension is not mapped in IIS, IIS returns a 404 error. To map an extension, see Setting Application Mappings. For more information on how to troubleshoot 404 errors, including 404.2 and 404.3; issues related to a new installation of IIS 6.0; or an upgrade from a previous version of IIS, see Troubleshooting.

Using Parent Paths

As a security precaution, the AspEnableParentPaths metabase setting is now set to 0 by default. This affects your application if it has a Web page that contains the #include server-side include directive and uses ".." notation to refer to a parent directory.

The "Templates Cached" Performance Counter

The AspTemplatesCached performance counter now counts the number of cached ASP files, both on disk and in memory. In previous versions, because there was no disk-based caching, this counter referred only to the in-memory cache. There is also a new counter called AspInMemoryTemplatesCached that reflects the number of ASP pages in the memory cache; it's the number of templates cached in total memory.

Global.asa Events

Earlier versions of ASP executed events in the security context (or user identity) of the host process because during these events there is no user context. This caused problems such as access denied errors when writing to a file in the Session_OnEnd event. ASP, by default, now runs the global.asa events, Application_OnEnd, and Session_OnEnd, anonymously. This can be controlled by the metabase setting, AspRunOnEndAnonymously.

ASP Metabase Properties Removed

The following metabase settings are no longer used by ASP, even though they are still in the metabase for compatibility with existing administration scripts:

Metabase Property Name
AspAllowOutOfProcComponents
AspTrackThreadingModel
AspExceptionCatchEnable


Reference

The reference section provides detailed information about the interfaces, objects, and data structures available for programming and administering IIS.

This section contains the following topics:

  • Programmatic Administration Reference: This section is useful for administrators, script writers, and programmers who use Windows Management Instrumentation (WMI), Active Directory® Services Interface (ADSI), or IIS Admin Base Object (ABO) to administer Internet Information Services (IIS) through scripts or compiled code.
  • Metabase Property Reference: This section defines the metabase properties used for IIS and includes code examples that show how to access the properties.
  • Registry Reference: This section defines the registry entries that pertain to IIS.
  • Events Reference: This section describes the events that IIS lists in the Event Viewer and explains how to use them to monitor your Web server.
  • Performance Counters Reference: This section describes counters that you can enable in the Performance Monitor MMC snap-in, allowing you to evaluate the performance of your Web server.
  • Timeouts Reference: This section defines the IIS timeout properties and explains how to individually set them to configure your Web server for different tasks.
  • Logging Properties Reference: This section describes the different values that you can log to the IIS log files using one of four log file formats.
  • Redirect Reference: This section explains how to format a server redirection correctly. For reference topics related to ASP, see ASP References at MSDN Online or in the IIS Software Developer Kit (SDK).


Programmatic Administration Reference

Each system on your computer comes with a graphical user interface (GUI) to manage and configure your settings such as IIS Manager, the Computer Management snap-in, the Control Panel, Windows® Explorer, and so on. However, if administrators manage systems frequently, or access large amounts of data on multiple servers, then using each GUI takes a lot of time. It is faster to use command-line scripts that can manage single or multiple systems programmatically. For example, if you have twenty Web servers that are running Internet Information Services (IIS) to which you want to add a script mapping, it would take a lot of mouse clicks and key strokes to do so through IIS Manager. However, if you wrote a command-line script that took as input a file containing the names of your Web servers and the name of the property you want to change, then you could make all the changes from one server with a single command.

To help you administer your server programmatically, this reference section describes the objects, methods, and properties of the Windows Management Interfaces (WMI) and the Active Directory® Service Interfaces (ADSI) which are technologies that can be used from any language that supports automation.

  • IIS WMI Provider Reference: Describes the classes, methods, and properties of the IIS WMI provider.
  • Windows WMI Reference: Provides a link to Windows WMI Help that describes the base classes, methods, and properties available in WMI.
  • IIS ADSI Provider Reference: Describes the classes, methods, and properties of the IIS ADSI provider.
  • Windows ADSI Reference: Provides a link to Windows ADSI Help that describes the base methods, and properties available in ADSI.


IIS WMI Provider Reference

Any script or code that attempts to manage Internet Information Services (IIS) using Windows Management Instrumentation (WMI) needs to access the IIS WMI provider objects. For example, if you want to change a Web site property in the metabase, you must instantiate the class called IIsWebServerSetting, which is a child of the CIM_Setting class. When writing scripts and code that use the IIS WMI provider, it saves time to have this documentation open on your screen.

This topic contains a reference page for each of the classes of the IIS WMI provider namespace which is called MicrosoftIISv2. Each page includes reference material for any existing properties and methods of those classes.

Each of the top-level classes in the IIS WMI provider are listed in the table below. The classes that begin with "__" are inherited from the root namespace and are therefore not documented in the IIS WMI provider reference.

IIS WMI Provider Class | Description
__SecurityRelatedClass | Inherited from the root namespace. An abstract class that contains the __NTLMUser9X concrete class holding NTLM-related properties.
__PARAMETERS | Inherited from the root namespace. An abstract class containing no concrete classes.
__SystemSecurity | Inherited from the root namespace. A concrete class that contains inherited properties and methods to get security descriptors and access rights associated with an object.
__NotifyStatus | Inherited from the root namespace. An abstract class that contains the __ExtendedStatus abstract class. A user must derive another class that inherits from one of these abstract classes to access the properties.
__SystemClass | Inherited from the root namespace. An abstract class that contains other abstract classes, and two concrete classes called __thisNAMESPACE and __NAMESPACE. __thisNAMESPACE contains a SECURITY_DESCRIPTOR property.
CIM_ManagedSystemElement (WMI) | An abstract class that contains the CIM_LogicalElement class, which contains elements that correspond to nodes of the IIS Metabase Schema. Each element contains read-only properties that relate to IIS metabase properties, and methods that work on the writable properties in the root class.
CIM_Setting (WMI) | An abstract class that contains the IIsSetting class, which contains elements that correspond to nodes of the IIS Metabase Schema. Each element contains writable properties that relate to IIS metabase properties.
IIsStructuredDataClass (WMI) | A unique class that contains elements whose data is represented in a complicated ADSI format .
CIM_Component (WMI) | An association class that maps each element in the CIM_ManagedSystemElement class to another element in the CIM_ManagedSystemElement class so the elements can mimic ADSI containment.
CIM_ElementSetting (WMI) | An association class that maps each element in the CIM_ManagedSystemElement class to its matching element in the CIM_Setting class.

Related Topics

  • For more information about the IIS WMI Provider, see Using the IIS WMI Provider.
  • For a reference to the Windows WMI interfaces, see Windows WMI Reference.
  • For examples of scripts that use the properties and methods of the Windows WMI provider to access the IIS WMI provider, see Module 3: Writing Administration Scripts that Use WMI of the IIS WMI Provider Tutorial.
  • For more examples of WMI scripts that manage IIS, see Using Command-Line Administration Scripts.


CIM_ManagedSystemElement (WMI)

For each IIS Admin object type listed in KeyType in the Metabase Property Reference, there exists an element class and a setting class. The elements in the CIM_ManagedSystemElement class contain the methods and the read-only properties for the IIS Admin object type. The elements in the CIM_Setting class contain all the read-write properties for the IIS Admin object type.

For example, the IIsWebServer object type in the metabase is represented by the IIsWebServer element in the CIM_ManagedSystemElement class, and it is also represented by the IIsWebServerSetting element in the CIM_Setting class. The IIsWebServer element contains all the methods that can be applied on a Web server and all the read-only properties for the Web server. IIsWebServerSetting contains all the read-write properties for the Web server.

Each IIS Admin object type is represented in the Metabase Schema file. When you create an instance of an element in the CIM_ManagedSystemElement class or the CIM_Setting class, the created object represents a node in the Metabase Configuration File.

Properties

The table below lists the properties for this class.

Property Name | Data Type | Description
Caption | String | The Caption property provides a short textual description (one-line String) of the object.
Description | String | The Description property provides a longer textual description of the object.
InstallDate | datetime | The InstallDate property indicates when the object was installed. A lack of a value does not indicate that the object is not installed.
Name | String | The Name property defines the label by which the object is known. When subclassed, the Name property can be overridden to be a Key property.
Status | String | The Status property indicates the current status of the object. Various operational and non-operational statuses can be defined. Operational statuses are "OK", "Degraded" and "Pred Fail". "Pred Fail" indicates that an element may be functioning properly but predicting a failure in the near future. An example is a SMART-enabled hard drive. Non-operational statuses can also be specified. These are "Error", "Starting", "Stopping" and "Service". The latter, "Service", could apply during mirror-resilvering of a disk, reload of a user permissions list, or other administrative work. Not all such work is on-line, yet the managed element is neither "OK" nor in one of the other states.
Related Topics
  • For more information about the IIS WMI Provider, see Using the IIS WMI Provider.
  • For detailed examples of scripts that use the properties and methods of the Windows WMI provider to access the IIS WMI provider, see Module 3: Writing Administration Scripts that Use WMI of the IIS WMI Provider Tutorial.
  • For basic examples in VBScript, JScript, and Perl, see Code Examples to Configure Metabase Properties.
  • Your installation of IIS 6.0 includes command-line administration scripts that manage IIS. See Using Command-Line Administration Scripts.


CIM_LogicalElement (WMI)

This class carries inherited properties from the parent class through to the child classes.

Parent Class

CIM_ManagedSystemElement (WMI)

Properties

This class inherits only properties from the parent classes.

Related Topics
  • For more information about the IIS WMI Provider, see Using the IIS WMI Provider.
  • For detailed examples of scripts that use the properties and methods of the Windows WMI provider to access the IIS WMI provider, see Module 3: Writing Administration Scripts that Use WMI of the IIS WMI Provider Tutorial.
  • For basic examples in VBScript, JScript, and Perl, see Code Examples to Configure Metabase Properties.
  • Your installation of IIS 6.0 includes command-line administration scripts that manage IIS. See Using Command-Line Administration Scripts.


CIM_Service (WMI)

This class, and the child classes Win32_BaseService (WMI) and Win32_Service (WMI) take advantage of the way classes in WMI automatically inherit characteristics from WMI regular classes to pass on to child classes. Use the child classes IIsNntpService (WMI), IIsPop3Service (WMI), IIsImapService (WMI), IIsSmtpService (WMI), IIsFtpService (WMI), and IIsWebService (WMI), for their useful properties and methods.

Parent Class

CIM_LogicalElement (WMI)

Methods

The table below lists the methods for this class.

Method Name | Return Data Type | Description
CIM_Service.StartService (WMI) | uint32 | The StartService method starts the service that is specified by the object variable, which can be an instance of the IIsNntpService (WMI), IIsPop3Service (WMI), IIsImapService (WMI), IIsSmtpService (WMI), IIsFtpService (WMI), or IIsWebService (WMI) class. For example, if the object is an instance of the IIsWebService object, StartService starts the World Wide Web Publishing Service (WWW service).
CIM_Service.StopService (WMI) | uint32 | The StopService method stops the service that is specified by the object variable, which can be an instance of the IIsNntpService (WMI), IIsPop3Service (WMI), IIsImapService (WMI), IIsSmtpService (WMI), IIsFtpService (WMI), or IIsWebService (WMI) class. For example, if the object is an instance of the IIsWebService object, StopService stops the WWW service.
Properties

The table below lists properties other than those that are inherited from parent classes.

Property Name | Data Type | Description
Name | String | The Name property uniquely identifies the service and provides an indication of the functionality that is managed. This functionality is described in more detail in the object's Description property.
CreationClassName | String | The CreationClassName property indicates the name of the class or the subclass used in the creation of an instance. When used with the other key properties of this class, this property allows all instances of this class and its subclasses to be uniquely identified.
StartMode | String | The StartMode property indicates whether the service is automatically started by a operating system, or only started upon request.
Started | Boolean | The Started property indicates whether the service has been started (true), or stopped (false).
SystemCreationClassName | String | The SystemCreationClassName property indicates the type name of the system that hosts this service.
SystemName | String | The SystemName property indicates the name of the system that hosts this service.
Related Topics
  • For more information about the IIS WMI Provider, see Using the IIS WMI Provider.
  • For detailed examples of scripts that use the properties and methods of the Windows WMI provider to access the IIS WMI provider, see Module 3: Writing Administration Scripts that Use WMI of the IIS WMI Provider Tutorial.
  • For basic examples in VBScript, JScript, and Perl, see Code Examples to Configure Metabase Properties.
  • Your installation of IIS 6.0 includes command-line administration scripts that manage IIS. See Using Command-Line Administration Scripts.


CIM_Service.StartService (WMI)

The StartService method starts the service that is specified by the object variable, which can be an instance of the IIsNntpService (WMI), IIsPop3Service (WMI), IIsImapService (WMI), IIsSmtpService (WMI), IIsFtpService (WMI), or IIsWebService (WMI) class. For example, if the object is an instance of the IIsWebService object, StartService starts the World Wide Web Publishing Service (WWW service).

Syntax

return_value = object.StartService

Parameters

There are no parameters for this method.

Related Topics
  • For more information about the IIS WMI Provider, see Using the IIS WMI Provider.
  • For detailed examples of scripts that use the properties and methods of the Windows WMI provider to access the IIS WMI provider, see Module 3: Writing Administration Scripts that Use WMI of the IIS WMI Provider Tutorial.
  • For basic examples in VBScript, JScript, and Perl, see Code Examples to Configure Metabase Properties.
  • Your installation of IIS 6.0 includes command-line administration scripts that manage IIS. See Using Command-Line Administration Scripts.


CIM_Service.StopService (WMI)

The StopService method stops the service that is specified by the object variable, which can be an instance of the IIsNntpService (WMI), IIsPop3Service (WMI), IIsImapService (WMI), IIsSmtpService (WMI), IIsFtpService (WMI), or IIsWebService (WMI) class. For example, if the object is an instance of the IIsWebService object, StopService stops the World Wide Web Publishing Service (WWW service).

Syntax

return_value = object.StopService

Parameters

There are no parameters for this method.

Related Topics
  • For more information about the IIS WMI Provider, see Using the IIS WMI Provider.
  • For detailed examples of scripts that use the properties and methods of the Windows WMI provider to access the IIS WMI provider, see Module 3: Writing Administration Scripts that Use WMI of the IIS WMI Provider Tutorial.
  • For basic examples in VBScript, JScript, and Perl, see Code Examples to Configure Metabase Properties.
  • Your installation of IIS 6.0 includes command-line administration scripts that manage IIS. See Using Command-Line Administration Scripts.


Win32_BaseService (WMI)

This class, and the child Win32_Service (WMI) class take advantage of the way classes in WMI automatically inherit characteristics from WMI regular classes to pass on to child classes. Use the child classes IIsNntpService (WMI), IIsPop3Service (WMI), IIsImapService (WMI), IIsSmtpService (WMI), IIsFtpService (WMI), and IIsWebService (WMI), class for their useful properties and methods.

Parent Class

CIM_Service (WMI)

Methods

The table below lists methods other than those that are inherited from the parent classes.

Method Name | Return Data Type | Description
Win32_BaseService.StartService (WMI) | uint32 | The StartService method starts the service that is specified by the object variable, which can be an instance of the IIsNntpService (WMI), IIsPop3Service (WMI), IIsImapService (WMI), IIsSmtpService (WMI), IIsFtpService (WMI), or IIsWebService (WMI) class. For example, if the object is an instance of the IIsWebService object, StartService starts the World Wide Web Publishing Service (WWW service).
Win32_BaseService.StopService (WMI) | uint32 | The StopService method stops the service that is specified by the object variable, which can be an instance of the IIsNntpService (WMI), IIsPop3Service (WMI), IIsImapService (WMI), IIsSmtpService (WMI), IIsFtpService (WMI), or IIsWebService (WMI) class. For example, if the object is an instance of the IIsWebService object, StopService stops the WWW service.
Win32_BaseService.PauseService (WMI) | uint32 | The PauseService method pauses the service that is specified by the object variable, which can be an instance of the IIsNntpService (WMI), IIsPop3Service (WMI), IIsImapService (WMI), IIsSmtpService (WMI), IIsFtpService (WMI), or IIsWebService (WMI) class. For example, if the object is an instance of the IIsWebService object, PauseService pauses the WWW service.
Win32_BaseService.ResumeService (WMI) | uint32 | The ResumeService method resumes a paused service that is specified by the object variable, which can be an instance of the IIsNntpService (WMI), IIsPop3Service (WMI), IIsImapService (WMI), IIsSmtpService (WMI), IIsFtpService (WMI), or IIsWebService (WMI) class. For example, if the object is an instance of the IIsWebService object, ResumeService resumes the WWW service if it is paused.
Win32_BaseService.InterrogateService (WMI) | uint32 | The InterrogateService method requests that the service update its state to the service manager.
Win32_BaseService.UserControlService (WMI) | uint32 | The UserControlService method attempts to send a user-defined control code to a service.
Win32_BaseService.Create (WMI) | uint32 | The Create method creates a new service.
Win32_BaseService.Change (WMI) | uint32 | The Change method modifies a service.
Win32_BaseService.ChangeStartMode (WMI) | uint32 | The ChangeStartMode method modifies the start mode of a service.
Win32_BaseService.Delete (WMI) | uint32 | The Delete method deletes an existing service.
Properties

The table below lists properties other than those that are inherited from parent classes.

Property Name | Data Type | Description
Name | String | The Name property defines the label by which the object is known. When subclassed, the Name property can be overridden to be a Key property.
StartMode String The StartMode property contains an integer specifying the start mode of the service.

Values are:
"Boot" = Device driver started by the operating system loader (valid only for driver services)
"System" = Device driver started by the IoInitSystem method (valid only for driver services)
"Auto" = Service to be started automatically by the service control manager during system startup
"Manual" = Service to be started by the service control manager when a process calls the StartService method
"Disabled" = Service that can no longer be started
AcceptPause | Boolean | The AcceptPause property contains a boolean value that indicates whether the service can be paused.
AcceptStop | Boolean | The AcceptStop property contains a boolean value that indicates whether the service can be stopped.
DesktopInteract | Boolean | The DesktopInteract property contains a boolean value that indicates whether the service can create or communicate with windows on the desktop. Do not set this to true for an IIS service.
DisplayName | String | The DisplayName property contains the display name of the service. This string has a maximum length of 256 characters. The name is case-preserved in the Service Control Manager. DisplayName comparisons are always case-insensitive. Constraints: Accepts the same value as the Name property.
ErrorControl String The ErrorControl property contains a string that represents the severity of the error if this service fails to start during startup. The value indicates the action taken by the startup program if failure occurs. All errors are logged by the computer system.

Values are:
"Ignore" = User is not notified
"Normal" = User is notified
"Severe" = System restarted with last-known-good configuration
"Critical" = System attempts to restart with good configuration
"Unknown"

PathName | String | The PathName property contains the fully-qualified path to the service binary file that implements the service.
ServiceType | String | The ServiceType property contains the type of service provided to calling processes. In the case of IIsWebService.Name='W3SVC', this property is set to "Share Process".
StartName | String | The StartName property contains the account name under which the service runs. Depending on the service type, the account name may be in the form of DomainName\Username.The service process will be logged using one of these two forms when it runs. If the account belongs to the built-in domain, .\Username can be specified. If NULL is specified, the service will be logged on as the LocalSystem account. For kernel or system level drivers, StartName contains the driver object name (that is, \FileSystem\Rdr or \Driver\Xns) which the input and output (I/O) system uses to load the device driver. Additionally, if NULL is specified, the driver runs with a default object name created by the I/O system based on the service name.
State String The State property contains Current state of the base service. Values are:
"Stopped"
"Start Pending"
"Stop Pending"
"Running"
"Continue Pending"
"Pause Pending"
"Paused"
"Unknown"
TagId uint32 The TagId property contains a unique tag value for this service in the group. A value of 0 indicates that the service has not been assigned a tag. A tag can be used for ordering service startup within a load order group by specifying a tag order vector in the registry located at:

If IIS must access files on a UNIX or Linux system, file name case sensitivity can be an issue unless Network File System (NFS) support is enabled in IIS.

Unix and Linux both support mixed-case file names, and IIS fully supports requesting static files in a case-sensitive manner. An issue arises, however, when IIS makes a subsequent request for a file from its static file cache. Because all file names are converted to uppercase letters in the IIS cache, any request after the first request from the IIS static file cache might fail or return the wrong file.

The solution to this issue is to disable the IIS static file cache so that all file requests are issued fresh, thereby retaining correct file name case. The static file cache can be disabled for individual virtual directories on Web sites, or globally for all of IIS.

note Note Changing this setting has no effect on how ASP files and templates are cached.

To disable the static file cache for a particular Web site virtual directory

  • Edit the metabase and set the MD_VR_NO_CACHE property to 1. For example:

    LM/W3SVC/n/ROOT/vdir
  MD_VR_NO_CACHE=1

    If you subsequently want to enable the static file cache, set this property to 0.

To disable the static file cache for all of IIS

  • Edit the registry and add the binary value DisableStaticFileCache=1 to the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\InetInfo\Parameters key.

    If you subsequently want to enable the static file cache, set this value to 0.

. Tags are only evaluated for Kernel Driver and File System Driver start type services that have Boot or System start modes.

ExitCode | uint32 | The ExitCode property contains the Win32® error code defining any problems encountered in starting or stopping the service. This property is set to ERROR_SERVICE_SPECIFIC_ERROR (1066) when the error is unique to the service represented by this class, and information about the error is available in the ServiceSpecificExitCode property. The service sets this value to NO_ERROR when running, and again upon normal termination.
ServiceSpecificExitCode | uint32 | The ServiceSpecificExitCode property contains Service-specific error code for errors that occur while the service is either starting or stopping. The exit codes are defined by the service represented by this class. This value is only set when the ExitCode property value is ERROR_SERVICE_SPECIFIC_ERROR, 1066.
Related Topics
  • For more information about the IIS WMI Provider, see Using the IIS WMI Provider.
  • For detailed examples of scripts that use the properties and methods of the Windows WMI provider to access the IIS WMI provider, see Module 3: Writing Administration Scripts that Use WMI of the IIS WMI Provider Tutorial.
  • For basic examples in VBScript, JScript, and Perl, see Code Examples to Configure Metabase Properties.
  • Your installation of IIS 6.0 includes command-line administration scripts that manage IIS. See Using Command-Line Administration Scripts.


Win32_BaseService.Change (WMI)

The Change method modifies a service. The Win32_LoadOrderGroup parameter represents a grouping of system services defining execution dependencies. The services must be initiated in the order specified by the Load Order Group as the services are dependent on each other. These dependent services require the presence of the antecedent services in order to function correctly. Change returns an integer value of 0 if the service was successfully modified, 1 if the request is not supported and any other number to indicate an error.
Syntax

return_value = object.Change

(
Name As String,
DisplayName As String,
PathName As String,
ServiceType As Integer,
ErrorControl As Integer,
StartMode As String,
DesktopInteract As Boolean,
StartName As String,
StartPassword As String,
LoadOrderGroup As String,
LoadOrderGroupDependencies As Array,
ServiceDependencies As Array _)
Parameters

BaseService
Expression that resolves to an instance of Win32_BaseService.

Name
[in] Name of the service to install to the Change method. The maximum string length is 256 characters. The service control manager database preserves the case of the characters, but service name comparisons are always case-insensitive. Forward-slashes (/) and double back-slashes (\) are invalid service name characters.

DisplayName
[in] Display name of the service. This string has a maximum length of 256 characters. The name is case-preserved in the service control manager. DisplayName comparisons are always case-insensitive. Constraints: Accepts the same value as the Name parameter. Example: "Atdisk".

PathName
[in] Fully-qualified path to the executable file that implements the service. Example: "\SystemRoot\System32\drivers\afd.sys".

ServiceType
[in] Type of services provided to processes that call them.

Value | Meaning
0 | Kernel Driver
1 | File System Driver
2 | Adapter
3 | Recognizer Driver
4 | Own Process
5 | Win32 Share Process
8 |

ErrorControl
[in] Severity of the error if this service fails to start during startup. The value indicates the action taken by the startup program if failure occurs. All errors are logged by the system.

Value | Meaning
Ignore | User is not notified.
Normal | User is notified.
Severe | System is restarted with the last-known-good configuration.
Critical | System attempts to restart with a good configuration.

StartMode
[in] Start mode of the Win32 base service.

Value | Meaning
Boot | Device driver started by the operating system loader.
System | Device driver started by the IoInitSystem method. This value is valid only for driver services.
Automatic | Service to be started automatically by the service control manager during system startup.
Manual | Service to be started by the service control manager when a process calls the StartService method.
Disabled | Service that can no longer be started.

DesktopInteract
[in] Indicates whether the service can create or communicate with windows on the desktop.

StartName
[in] Account name the service runs under. Depending on the service type, the account name may be in the form of DomainName\Username, The service process will be logged using one of these two forms when it runs. If the account belongs to the built-in domain, .\Username can be specified. If NULL is specified, the service will be logged on as the LocalSystem account. For kernel or system-level drivers, StartName contains the driver object name (that is, \FileSystem\Rdr or \Driver\Xns) that the input and output (I/O) system uses to load the device driver. If NULL is specified, the driver runs with a default object name created by the I/O system based on the service name. Example: DWDOM\Admin.

StartPassword
[in] Password to the account name specified by the StartName parameter. Specify NULL if you are not changing the password. Specify an empty string if the service has no password.

LoadOrderGroup
[in] Group name that it is associated with. Load order groups are contained in the system registry, and determine the sequence in which services are loaded into the operating system. If the pointer is NULL, or if it points to an empty string, the service does not belong to a group. Dependencies between groups should be listed in the LoadOrderGroupDependencies parameter. Services in the load-ordering group list are started first, followed by services in groups not in the load-ordering group list, followed by services that do not belong to a group. The system registry has a list of load ordering groups located at HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\ServiceGroupOrder.

LoadOrderGroupDependencies
[in, String] List of load-ordering groups that must start before this service starts. The array is doubly null-terminated. If the pointer is NULL, or if it points to an empty string, the service has no dependencies. Group names must be prefixed by the SC_GROUP_IDENTIFIER (defined in the Winsvc.h file) character to differentiate them from service names because services and service groups share the same name space. Dependency on a group means that this service can run if at least one member of the group is running after an attempt to start all members of the group.

ServiceDependencies
[in, String] List containing names of services that must start before this service starts. The array is doubly null-terminated. If the pointer is NULL, or if it points to an empty string, the service has no dependencies. Dependency on a service means that this service can run only if the service it depends on is running.

Related Topics
  • For more information about the IIS WMI Provider, see Using the IIS WMI Provider.
  • For detailed examples of scripts that use the properties and methods of the Windows WMI provider to access the IIS WMI provider, see Module 3: Writing Administration Scripts that Use WMI of the IIS WMI Provider Tutorial.
  • For basic examples in VBScript, JScript, and Perl, see Code Examples to Configure Metabase Properties.
  • Your installation of IIS 6.0 includes command-line administration scripts that manage IIS. See Using Command-Line Administration Scripts.


Win32_BaseService.ChangeStartMode (WMI)

The ChangeStartMode method modifies the start mode of a service. ChangeStartMode returns an integer value of 0 if the service was successfully deleted, 1 if the request is not supported, and any other number to indicate an error.
Syntax

return_value = object.ChangeStartMode

(
uint32 StartMode
)
Parameters

StartMode
An expression that resolves to an instance of Win32_BaseService.

Related Topics
  • For more information about the IIS WMI Provider, see Using the IIS WMI Provider.
  • For detailed examples of scripts that use the properties and methods of the Windows WMI provider to access the IIS WMI provider, see Module 3: Writing Administration Scripts that Use WMI of the IIS WMI Provider Tutorial.
  • For basic examples in VBScript, JScript, and Perl, see Code Examples to Configure Metabase Properties.
  • Your installation of IIS 6.0 includes command-line administration scripts that manage IIS. See Using Command-Line Administration Scripts.


Win32_BaseService.Create (WMI)

The Create method creates a new service. The Win32_LoadOrderGroup parameter represents a grouping of system services defining execution dependencies. The services must be initiated in the order specified by the Load Order Group, as the services are dependent on each other. These dependent services require the presence of the antecedent services in order to function correctly. Create returns an integer value of 0 if the service was successfully created, 1 if the request is not supported, and any other number to indicate an error.
Syntax

return_value = object.Create

(
uint32 Crea
)
Parameters
(
Name As String,
DisplayName As String,
PathName As String,
ServiceType As Integer,
ErrorControl As Integer,
StartMode As String,
DesktopInteract As Boolean,
StartName As String,
StartPassword As String,
LoadOrderGroup As String,
LoadOrderGroupDependencies As Array,
ServiceDependencies As Array _)

BaseService
Expression that resolves to an instance of Win32_BaseService.

Name
[in] Name of the service to install to the Change method. The maximum string length is 256 characters. The service control manager database preserves the case of the characters, but service name comparisons are always case-insensitive. Forward-slashes (/) and double back-slashes (\) are invalid service name characters.

DisplayName
[in] Display name of the service. This string has a maximum length of 256 characters. The name is case-preserved in the service control manager. DisplayName comparisons are always case-insensitive. Constraints: Accepts the same value as the Name parameter. Example: "Atdisk".

PathName
[in] Fully-qualified path to the executable file that implements the service. Example: "\SystemRoot\System32\drivers\afd.sys".

ServiceType
[in] Type of services provided to processes that call them.

Value | Meaning
0 | Kernel Driver
1 | File System Driver
2 | Adapter
3 | Recognizer Driver
4 | Own Process
5 | Win32 Share Process
8 |

ErrorControl
[in] Severity of the error if this service fails to start during startup. The value indicates the action taken by the startup program if failure occurs. All errors are logged by the system.

Value | Meaning
Ignore | User is not notified.
Normal | User is notified.
Severe | System is restarted with the last-known-good configuration.
Critical | System attempts to restart with a good configuration.

StartMode
[in] Start mode of the Win32 base service.

Value | Meaning
Boot | Device driver started by the operating system loader.
System | Device driver started by the IoInitSystem method. This value is valid only for driver services.
Automatic | Service to be started automatically by the service control manager during system startup.
Manual | Service to be started by the service control manager when a process calls the StartService method.
Disabled | Service that can no longer be started.

DesktopInteract
[in] Indicates whether the service can create or communicate with windows on the desktop.

StartName
[in] Account name the service runs under. Depending on the service type, the account name may be in the form of DomainName\Username, The service process will be logged using one of these two forms when it runs. If the account belongs to the built-in domain, .\Username can be specified. If NULL is specified, the service will be logged on as the LocalSystem account. For kernel or system-level drivers, StartName contains the driver object name (that is, \FileSystem\Rdr or \Driver\Xns) that the input and output (I/O) system uses to load the device driver. If NULL is specified, the driver runs with a default object name created by the I/O system based on the service name. Example: DWDOM\Admin.

StartPassword
[in] Password to the account name specified by the StartName parameter. Specify NULL if you are not changing the password. Specify an empty string if the service has no password.

LoadOrderGroup
[in] Group name that it is associated with. Load order groups are contained in the system registry, and determine the sequence in which services are loaded into the operating system. If the pointer is NULL, or if it points to an empty string, the service does not belong to a group. Dependencies between groups should be listed in the LoadOrderGroupDependencies parameter. Services in the load-ordering group list are started first, followed by services in groups not in the load-ordering group list, followed by services that do not belong to a group. The system registry has a list of load ordering groups located at HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\ServiceGroupOrder.

LoadOrderGroupDependencies
[in, String] List of load-ordering groups that must start before this service starts. The array is doubly null-terminated. If the pointer is NULL, or if it points to an empty string, the service has no dependencies. Group names must be prefixed by the SC_GROUP_IDENTIFIER (defined in the Winsvc.h file) character to differentiate them from service names because services and service groups share the same name space. Dependency on a group means that this service can run if at least one member of the group is running after an attempt to start all members of the group.

ServiceDependencies
[in, String] List containing names of services that must start before this service starts. The array is doubly null-terminated. If the pointer is NULL, or if it points to an empty string, the service has no dependencies. Dependency on a service means that this service can run only if the service it depends on is running.

Related Topics
  • For more information about the IIS WMI Provider, see Using the IIS WMI Provider.
  • For detailed examples of scripts that use the properties and methods of the Windows WMI provider to access the IIS WMI provider, see Module 3: Writing Administration Scripts that Use WMI of the IIS WMI Provider Tutorial.
  • For basic examples in VBScript, JScript, and Perl, see Code Examples to Configure Metabase Properties.
  • Your installation of IIS 6.0 includes command-line administration scripts that manage IIS. See Using Command-Line Administration Scripts.


Win32_BaseService.Delete (WMI)

The Delete method deletes an existing service. Delete returns an integer value of 0 if the service was successfully deleted, 1 if the request is not supported, and any other number to indicate an error.
Syntax

return_value = object.Delete

Parameters

There are no parameters for this method.

Related Topics
  • For more information about the IIS WMI Provider, see Using the IIS WMI Provider.
  • For detailed examples of scripts that use the properties and methods of the Windows WMI provider to access the IIS WMI provider, see Module 3: Writing Administration Scripts that Use WMI of the IIS WMI Provider Tutorial.
  • For basic examples in VBScript, JScript, and Perl, see Code Examples to Configure Metabase Properties.
  • Your installation of IIS 6.0 includes command-line administration scripts that manage IIS. See Using Command-Line Administration Scripts.


Win32_BaseService.InterrogateService (WMI)

The InterrogateService method requests that the service update its state to the service manager. InterrogateService returns an integer value of 0 if the InterrogateService request was accepted, 1 if the request is not supported, and any other number to indicate an error.
Syntax

return_value = object.InterrogateService

Parameters

There are no parameters for this method.

Related Topics
  • For more information about the IIS WMI Provider, see Using the IIS WMI Provider.
  • For detailed examples of scripts that use the properties and methods of the Windows WMI provider to access the IIS WMI provider, see Module 3: Writing Administration Scripts that Use WMI of the IIS WMI Provider Tutorial.
  • For basic examples in VBScript, JScript, and Perl, see Code Examples to Configure Metabase Properties.
  • Your installation of IIS 6.0 includes command-line administration scripts that manage IIS. See Using Command-Line Administration Scripts.


Win32_BaseService.PauseService (WMI)

The PauseService method pauses the service that is specified by the object variable, which can be an instance of the IIsNntpService (WMI), IIsPop3Service (WMI), IIsImapService (WMI), IIsSmtpService (WMI), IIsFtpService (WMI), or IIsWebService (WMI) class. For example, if the object is an instance of the IIsWebService object, PauseService pauses the World Wide Web Publishing Service (WWW service).

Syntax

return_value = object.PauseService

Parameters

There are no parameters for this method.

Related Topics
  • For more information about the IIS WMI Provider, see Using the IIS WMI Provider.
  • For detailed examples of scripts that use the properties and methods of the Windows WMI provider to access the IIS WMI provider, see Module 3: Writing Administration Scripts that Use WMI of the IIS WMI Provider Tutorial.
  • For basic examples in VBScript, JScript, and Perl, see Code Examples to Configure Metabase Properties.
  • Your installation of IIS 6.0 includes command-line administration scripts that manage IIS. See Using Command-Line Administration Scripts.


Win32_BaseService.ResumeService (WMI)

The ResumeService method resumes a paused service that is specified by the object variable, which can be an instance of the IIsNntpService (WMI), IIsPop3Service (WMI), IIsImapService (WMI), IIsSmtpService (WMI), IIsFtpService (WMI), or IIsWebService (WMI) class. For example, if the object is an instance of the IIsWebService object, ResumeService resumes the World Wide Web Publishing Service (WWW service) if it is paused.

Syntax

return_value = object.ResumeService

Parameters

There are no parameters for this method.

Related Topics
  • For more information about the IIS WMI Provider, see Using the IIS WMI Provider.
  • For detailed examples of scripts that use the properties and methods of the Windows WMI provider to access the IIS WMI provider, see Module 3: Writing Administration Scripts that Use WMI of the IIS WMI Provider Tutorial.
  • For basic examples in VBScript, JScript, and Perl, see Code Examples to Configure Metabase Properties.
  • Your installation of IIS 6.0 includes command-line administration scripts that manage IIS. See Using Command-Line Administration Scripts.


Win32_BaseService.StartService (WMI)

The StartService method starts the service that is specified by the object variable, which can be an instance of the IIsNntpService (WMI), IIsPop3Service (WMI), IIsImapService (WMI), IIsSmtpService (WMI), IIsFtpService (WMI), or IIsWebService (WMI) class. For example, if the object is an instance of the IIsWebService object, StartService starts the World Wide Web Publishing Service (WWW service).

Syntax

return_value = object.StartService

Parameters

There are no parameters for this method.

Related Topics
  • For more information about the IIS WMI Provider, see Using the IIS WMI Provider.
  • For detailed examples of scripts that use the properties and methods of the Windows WMI provider to access the IIS WMI provider, see Module 3: Writing Administration Scripts that Use WMI of the IIS WMI Provider Tutorial.
  • For basic examples in VBScript, JScript, and Perl, see Code Examples to Configure Metabase Properties.
  • Your installation of IIS 6.0 includes command-line administration scripts that manage IIS. See Using Command-Line Administration Scripts.


Win32_BaseService.StopService (WMI)

The StopService method stops the service that is specified by the object variable, which can be an instance of the IIsNntpService (WMI), IIsPop3Service (WMI), IIsImapService (WMI), IIsSmtpService (WMI), IIsFtpService (WMI), or IIsWebService (WMI) class. For example, if the object is an instance of the IIsWebService object, StopService stops the World Wide Web Publishing Service (WWW service).

Syntax

return_value = object.StopService

Parameters

There are no parameters for this method.

Related Topics
  • For more information about the IIS WMI Provider, see Using the IIS WMI Provider.
  • For detailed examples of scripts that use the properties and methods of the Windows WMI provider to access the IIS WMI provider, see Module 3: Writing Administration Scripts that Use WMI of the IIS WMI Provider Tutorial.
  • For basic examples in VBScript, JScript, and Perl, see Code Examples to Configure Metabase Properties.
  • Your installation of IIS 6.0 includes command-line administration scripts that manage IIS. See Using Command-Line Administration Scripts.


Win32_BaseService.UserControlService (WMI)

The UserControlService method attempts to send a user-defined control code to a service. UserControlService returns an integer value of 0 if the UserControlService request was accepted, 1 if the request is not supported, and any other number to indicate an error.
Syntax

return_value = object.UserControlService

(
uint32 ControlCode
)
Parameters

ControlCode [in]
Specifies defined values(from 128 to 255) that provide control commands specific to a user.

Related Topics
  • For more information about the IIS WMI Provider, see Using the IIS WMI Provider.
  • For detailed examples of scripts that use the properties and methods of the Windows WMI provider to access the IIS WMI provider, see Module 3: Writing Administration Scripts that Use WMI of the IIS WMI Provider Tutorial.
  • For basic examples in VBScript, JScript, and Perl, see Code Examples to Configure Metabase Properties.
  • Your installation of IIS 6.0 includes command-line administration scripts that manage IIS. See Using Command-Line Administration Scripts.


Win32_Service (WMI)

This class takes advantage of the way classes in WMI automatically inherit characteristics from WMI regular classes to pass on to child classes. Use the child classes IIsNntpService (WMI), IIsPop3Service (WMI), IIsImapService (WMI), IIsSmtpService (WMI), IIsFtpService (WMI), and IIsWebService (WMI), class for their useful properties and methods.

Parent Class

Win32_BaseService (WMI)

Methods

This class inherits only methods from the parent classes.

Properties

The table below lists properties other than those that are inherited from parent classes.

Property Name | Data Type | Description
CheckPoint | uint32 | The CheckPoint property contains a value that the service increments periodically to report its progress during a lengthy start, stop, pause, or continue operation. For example, the service should increment this value as it completes each step of its initialization when it is starting up. The user interface program that invoked the operation on the service uses this value to track the progress of the service during a lengthy operation. This value is not valid and should be zero when the service does not have a start, stop, pause, or continue operation pending.
WaitHint | uint32 | The WaitHint property contains the estimated time required (in milliseconds) for a pending start, stop, pause, or continue operation. After the specified amount of time has elapsed, the service makes its next call to the SetServiceStatus method with either an incremented CheckPoint value or a change in CurrentState. If the amount of time specified by WaitHint passes, and CheckPoint has not been incremented, or CurrentState has not changed, the service control manager or service control program assumes that an error has occurred.
ProcessId | uint32 | The ProcessId property contains the process ID for the instance of the service.
Related Topics
  • For more information about the IIS WMI Provider, see Using the IIS WMI Provider.
  • For detailed examples of scripts that use the properties and methods of the Windows WMI provider to access the IIS WMI provider, see Module 3: Writing Administration Scripts that Use WMI of the IIS WMI Provider Tutorial.
  • For basic examples in VBScript, JScript, and Perl, see Code Examples to Configure Metabase Properties.
  • Your installation of IIS 6.0 includes command-line administration scripts that manage IIS. See Using Command-Line Administration Scripts.


IIsFtpService (WMI)

This class corresponds to the IIsFtpService IIS Admin object, and contains the methods and read-only properties for the object.

Parent Class

Win32_Service (WMI)

Methods

The table below lists methods other than those that are inherited from the parent classes.

Method Name Return Data Type Description
IIsFtpService.CreateNewSite (WMI) String The CreateNewSite method creates a new FTP site on an IIS 6.0 server. CreateNewSite works in the following way:
  • If the method succeeds, it returns a reference to the site identification number for the newly created site.
  • If the method fails to create a site, it returns an error. This may happen if the ServerId does not exist. If a site already exists with the ServerComment that you want to use, an error is not returned because the new site can still be created with a unique site identification number. See the Remarks.
Properties

This class inherits only properties from the parent classes.

Related Topics
  • For more information about the IIS WMI Provider, see Using the IIS WMI Provider.
  • For detailed examples of scripts that use the properties and methods of the Windows WMI provider to access the IIS WMI provider, see Module 3: Writing Administration Scripts that Use WMI of the IIS WMI Provider Tutorial.
  • For basic examples in VBScript, JScript, and Perl, see Code Examples to Configure Metabase Properties.
  • Your installation of IIS 6.0 includes command-line administration scripts that manage IIS. See Using Command-Line Administration Scripts.


IIsFtpService.CreateNewSite (WMI)

The CreateNewSite method creates a new FTP site on an IIS 6.0 server. CreateNewSite works in the following way:

  • If the method succeeds, it returns a reference to the site identification number for the newly created site.
  • If the method fails to create a site, it returns an error. This may happen if the ServerId does not exist. If a site already exists with the ServerComment that you want to use, an error is not returned because the new site can still be created with a unique site identification number. See the Remarks.
Syntax

return_value = object.CreateNewSite

(
String ServerComment,
ServerBinding ServerBindings[],
String PathOfRootVirtualDir,
[SINT32 ServerId]
)
Parameters

ServerComment [in]
Contains a String representing the ServerComment for the new FTP site. In IIS Manager, this would be the Description field under FTP Site Identification in an FTP Site property sheet.

ServerBindings[] [in]
Contains an array of instances of the ServerBinding class specifying what server bindings you want on this site. Each ServerBinding instance includes at least one of the host name, port, and IP address.

PathOfRootVirtualDir [in]
Contains a String representing a fully qualified path to a physical directory to which you want the FTP site mapped.

ServerId [in,optional]
An optional String parameter containing the site identification number which you want the method to use. If this parameter is empty, a hash function is used to create the site identification number. See the information above.

Remarks

In the IIS Metabase, FTP sites are represented by the service type, and a unique site identification number. For example, on a new installation of IIS, the Default FTP Site is represented in ADSI as msftpsvc/1.

In IIS versions 5.1 and earlier, the site identification number increases by one for each new site. For example, if you create an FTP site called Contoso that becomes msftpsvc/3, the next site you create will become msftpsvc/4.

CreateNewSite allows you to specify the site identification number that you want to use. If you do not specify a site identification number, the method performs a hash function on the ServerComment passed to the method and creates a new number. If there are multiple sites with the same ServerComment, the hash function detects a collision and selects the next available site identification number. For example, create a site with the following line of code:

myNewSiteID = IIsWebServiceObj.CreateNewSite("MyNewSite", Bindings, "C:\Inetpub\Wwwroot")

If there is already a FTP site on the server called MyNewSite whose site identification number is 5555, then CreateNewSite will return 5556 if 5556 is not already taken.

If you create duplicate sites on multiple IIS 6.0 servers using the IIS Manager or the CreateNewSite method, there is a good chance that the site identification numbers will be the same on each server for each duplicated site.

Related Topics
  • For more information about the IIS WMI Provider, see Using the IIS WMI Provider.
  • For detailed examples of scripts that use the properties and methods of the Windows WMI provider to access the IIS WMI provider, see Module 3: Writing Administration Scripts that Use WMI of the IIS WMI Provider Tutorial.
  • For basic examples in VBScript, JScript, and Perl, see Code Examples to Configure Metabase Properties.
  • Your installation of IIS 6.0 includes command-line administration scripts that manage IIS. See Using Command-Line Administration Scripts.


IIsImapService (WMI)

This class corresponds to the IIsImapService IIS Admin object, and contains the methods and read-only properties for the object.

Parent Class

Win32_Service (WMI)

Methods

This class inherits only methods from the parent classes.

Properties

The table below lists properties other than those that are inherited from parent classes.

Property Name | Data Type | Description
ImapServiceVersion | SINT32 | See ImapServiceVersion in the Metabase Property Reference.
ImapRoutingSources[] | array of String | See ImapRoutingSources in the Metabase Property Reference.
Related Topics
  • For more information about the IIS WMI Provider, see Using the IIS WMI Provider.
  • For detailed examples of scripts that use the properties and methods of the Windows WMI provider to access the IIS WMI provider, see Module 3: Writing Administration Scripts that Use WMI of the IIS WMI Provider Tutorial.
  • For basic examples in VBScript, JScript, and Perl, see Code Examples to Configure Metabase Properties.
  • Your installation of IIS 6.0 includes command-line administration scripts that manage IIS. See Using Command-Line Administration Scripts.


IIsNntpService (WMI)

This class corresponds to the IIsNntpService IIS Admin object, and contains the methods and read-only properties for the object.

Parent Class

Win32_Service (WMI)

Methods

This class inherits only methods from the parent classes.

Properties

The table below lists properties other than those that are inherited from parent classes.

Property Name | Data Type | Description
NntpServiceVersion | SINT32 | See NntpServiceVersion in the Metabase Property Reference.
Related Topics
  • For more information about the IIS WMI Provider, see Using the IIS WMI Provider.
  • For detailed examples of scripts that use the properties and methods of the Windows WMI provider to access the IIS WMI provider, see Module 3: Writing Administration Scripts that Use WMI of the IIS WMI Provider Tutorial.
  • For basic examples in VBScript, JScript, and Perl, see Code Examples to Configure Metabase Properties.
  • Your installation of IIS 6.0 includes command-line administration scripts that manage IIS. See Using Command-Line Administration Scripts.


IIsPop3Service (WMI)

This class corresponds to the IIsPop3Service IIS Admin object, and contains the methods and read-only properties for the object.

Parent Class

Win32_Service (WMI)

Methods

This class inherits only methods from the parent classes.

Properties

The table below lists properties other than those that are inherited from parent classes.

Property Name | Data Type | Description
Pop3ServiceVersion | SINT32 | See Pop3ServiceVersion in the Metabase Property Reference.
Pop3RoutingSources[] | array of String | See Pop3RoutingSources in the Metabase Property Reference.
Related Topics
  • For more information about the IIS WMI Provider, see Using the IIS WMI Provider.
  • For detailed examples of scripts that use the properties and methods of the Windows WMI provider to access the IIS WMI provider, see Module 3: Writing Administration Scripts that Use WMI of the IIS WMI Provider Tutorial.
  • For basic examples in VBScript, JScript, and Perl, see Code Examples to Configure Metabase Properties.
  • Your installation of IIS 6.0 includes command-line administration scripts that manage IIS. See Using Command-Line Administration Scripts.


IIsSmtpService (WMI)

This class corresponds to the IIsSmtpService IIS Admin object, and contains the methods and read-only properties for the object.

Parent Class

Win32_Service (WMI)

Methods

This class inherits only methods from the parent classes.

Properties

The table below lists properties other than those that are inherited from parent classes.

Property Name | Data Type | Description
SmtpServiceVersion | SINT32 | See SmtpServiceVersion in the Metabase Property Reference.
RoutingSources[] | array of String | See RoutingSources in the Metabase Property Reference.
DomainRouting[] | array of String | See DomainRouting in the Metabase Property Reference.
LocalDomains[] | array of String | See LocalDomains in the Metabase Property Reference.
Related Topics
  • For more information about the IIS WMI Provider, see Using the IIS WMI Provider.
  • For detailed examples of scripts that use the properties and methods of the Windows WMI provider to access the IIS WMI provider, see Module 3: Writing Administration Scripts that Use WMI of the IIS WMI Provider Tutorial.
  • For basic examples in VBScript, JScript, and Perl, see Code Examples to Configure Metabase Properties.
  • Your installation of IIS 6.0 includes command-line administration scripts that manage IIS. See Using Command-Line Administration Scripts.


IIsWebService (WMI)

This class corresponds to the IIsWebService IIS Admin object, and contains the methods and read-only properties for the object.

Parent Class

Win32_Service (WMI)

Methods

The table below lists methods other than those that are inherited from the parent classes.

Method Name | Return Data Type | Description
IIsWebService.AddDependency (WMI) | void | The AddDependency method adds an entry in ApplicationDependencies for a single application.
IIsWebService.AddExtensionFile (WMI) | void | The AddExtensionFile method adds an entry to ISAPIRestrictions or CGIRestrictions identified by filepath.
IIsWebService.CreateNewSite (WMI) String The CreateNewSite method creates a new Web site on an IIS 6.0 server. CreateNewSite works in the following way:
  • If the method succeeds, it returns a reference to the site identification number for the newly created site.
  • If the method fails to create a site, it returns an error. This may happen if the ServerId does not exist. If a site already exists with the ServerComment that you want to use, an error is not returned because the new site can still be created with a unique site identification number. See Remarks.
IIsWebService.DeleteExtensionFileRecord (WMI) | void | The DeleteExtensionFileRecord method deletes an entry in ISAPIRestrictions or CGIRestrictions. If the entry is not marked not deletable, then the command line tool returns an error.
IIsWebService.DisableExtensionFile (WMI) | void | The DisableExtensionFile method sets the Access flag on each of the ISAPIRestrictions or CGIRestrictions identified by filepath to 0 (Deny).
IIsWebService.DisableWebServiceExtension (WMI) | void | The DisableWebServiceExtension method sets the Access flag on each of the ISAPIRestrictions or CGIRestrictions identified by GroupID to 0 (Deny).
IIsWebService.EnableApplication (WMI) | void | The EnableApplication method enables the Web service extensions required by a specific application.
IIsWebService.EnableExtensionFile (WMI) | void | The EnableExtensionFile method sets the Access flag on each of the extension files identified by filepath to 1 (Allow).
IIsWebService.EnableWebServiceExtension (WMI) | void | The EnableWebServiceExtension method sets the Access flag on each of the ISAPIRestrictions or CGIRestrictions identified by GroupID to 1 (Allow).
IIsWebService.GetCurrentMode (WMI) | SINT32 | The GetCurrentMode method returns the mode under which the World Wide Web Publishing Service (WWW service) is running; either the IIS 5.0 isolation mode or the new worker process isolation mode.
IIsWebService.ListApplications (WMI) | void | The ListApplications method lists the applications that can be enabled on the server.
IIsWebService.ListExtensionFiles (WMI) | void | The ListExtensionFiles method lists the extension files that can be enabled on the server. This essentially enumerates all entries in WebSvcExtRestrictionList.
IIsWebService.ListWebServiceExtensions (WMI) | void | The ListWebServiceExtensions method lists the Web service extensions that can be enabled on the server. If there are multiple entries with the same GroupID, the Web service extension is listed only once.
IIsWebService.QueryGroupIDStatus (WMI) | void | The QueryGroupIDStatus method lists applications that depend on the given set of ISAPI or CGI extensions.
IIsWebService.RemoveApplication (WMI) | void | The RemoveApplication method removes an entry in ApplicationDependencies for a single application.
IIsWebService.RemoveDependency (WMI) | void | The RemoveDependency method removes an entry in ApplicationDependencies for a single application.
Properties

The table below lists properties other than those that are inherited from parent classes.

Property Name | Data Type | Description
AppRoot | String | See AppRoot in the Metabase Property Reference.
AppIsolated | SINT32 | See AppIsolated in the Metabase Property Reference.
AppPackageID | String | See AppPackageID in the Metabase Property Reference.
AppPackageName | String | See AppPackageName in the Metabase Property Reference.
SSLCertHash[] | array of uint8 | See SSLCertHash in the Metabase Property Reference.
AuthChangeURL | String | See AuthChangeURL in the Metabase Property Reference.
AuthExpiredURL | String | See AuthExpiredURL in the Metabase Property Reference.
AuthNotifyPwdExpURL | String | See AuthNotifyPwdExpURL in the Metabase Property Reference.
AuthExpiredUnsecureURL | String | See AuthExpiredUnsecureURL in the Metabase Property Reference.
AuthNotifyPwdExpUnsecureURL | String | See AuthNotifyPwdExpUnsecureURL in the Metabase Property Reference.
Related Topics
  • For more information about the IIS WMI Provider, see Using the IIS WMI Provider.
  • For detailed examples of scripts that use the properties and methods of the Windows WMI provider to access the IIS WMI provider, see Module 3: Writing Administration Scripts that Use WMI of the IIS WMI Provider Tutorial.
  • For basic examples in VBScript, JScript, and Perl, see Code Examples to Configure Metabase Properties.
  • Your installation of IIS 6.0 includes command-line administration scripts that manage IIS. See Using Command-Line Administration Scripts.


IIsWebService.AddDependency (WMI)

The AddDependency method adds an entry in ApplicationDependencies for a single application.
Syntax
return_value = object.AddDependency
(
String Application,
String GroupID
)
Parameters
Application
[in] The name of the application to which the dependency is added.
GroupID
[in] The name of the groupid to add to the appdep entry.
Related Topics
  • For more information about the IIS WMI Provider, see Using the IIS WMI Provider.
  • For detailed examples of scripts that use the properties and methods of the Windows WMI provider to access the IIS WMI provider, see Module 3: Writing Administration Scripts that Use WMI of the IIS WMI Provider Tutorial.
  • For basic examples in VBscript, Jscript, and Perl, see Code Examples to Configure Metabase Properties.
  • Your installation of IIS 6.0 includes command-line administration scripts that manage IIS. See Using Command-Line Administration Scripts.


IIsWebService.AddExtensionFile (WMI)

The AddExtensionFile method adds an entry to ISAPIRestrictions or CGIRestrictions identified by filepath.
Syntax
return_value = object.AddExtensionFile
(
String ExtensionFile,
Boolean bEnable,
String GroupID,
Boolean bCanDelete,
String Description
)
Parameters
ExtensionFile
[in] The file to add. This becomes the second token in the wserl entry.
bEnable
[in] Is this enabled? This becomes the first token in the wserl entry.
GroupID
[in] The groupid. This becomes the fourth token in the wserl entry.
bCanDelete
[in] Is this deletable? This becomes the third token in the wserl entry.
Description
[in]A description of the entry. This becomes the last token in the wserl entry.
Related Topics
  • For more information about the IIS WMI Provider, see Using the IIS WMI Provider.
  • For detailed examples of scripts that use the properties and methods of the Windows WMI provider to access the IIS WMI provider, see Module 3: Writing Administration Scripts that Use WMI of the IIS WMI Provider Tutorial.
  • For basic examples in VBscript, Jscript, and Perl, see Code Examples to Configure Metabase Properties.
  • Your installation of IIS 6.0 includes command-line administration scripts that manage IIS. See Using Command-Line Administration Scripts.


IIsWebService.CreateNewSite (WMI)

The CreateNewSite method creates a new Web site on an IIS 6.0 server. CreateNewSite works in the following way:
  • If the method succeeds, it returns a reference to the site identification number for the newly created site.
  • If the method fails to create a site, it returns an error. This may happen if the ServerId does not exist. If a site already exists with the ServerComment that you want to use, an error is not returned because the new site can still be created with a unique site identification number. See the Remarks.
Syntax
return_value = object.CreateNewSite
(
String ServerComment,
ServerBinding ServerBindings[],
String PathOfRootVirtualDir,
[SINT32 ServerId]
)
Parameters

ServerComment
[in] Contains a String representing the ServerComment for the new Web site. In IIS Manager, this would be the Description field under Web Site Identification in a Web Site property sheet.

ServerBindings[]
[in] Contains an array of instances of the ServerBinding class specifying what server bindings you want on this site. Each ServerBinding instance includes at least one of the host name, port, and IP address.

PathOfRootVirtualDir
[in] Contains a String representing a fully qualified path to a physical directory to which you want the Web site mapped.

ServerId
[in,optional] An optional String parameter containing the site identification number which you want the method to use. If this parameter is empty, a hash function is used to create the site identification number. See the information above.

Remarks

In the IIS Metabase, Web sites are represented by the service type, and a unique site identification number. For example, on a new installation of IIS, the Default Web Site is represented in ADSI as w3svc/1.

In IIS versions 5.1 and earlier, the site identification number increases by one for each new site. For example, if you create a Web site called CohoWinery that becomes w3svc/3, the next site you create will become w3svc/4.

CreateNewSite allows you to specify the site identification number that you want to use. If you do not specify a site identification number, the method performs a hash function on the ServerComment passed to the method and creates a new number. If there are multiple sites with the same ServerComment, the hash function detects a collision and selects the next available site identification number. For example, create a site with the following line of code:

myNewSiteID = IIsWebServiceObj.CreateNewSite("MyNewSite", Bindings, "C:\Inetpub\Wwwroot")

If there is already a Web site on the server called MyNewSite whose site identification number is 5555, then CreateNewSite will return 5556 if 5556 is not already taken.

If you create duplicate sites on multiple IIS 6.0 servers using the IIS Manager or the CreateNewSite method, there is a good chance that the site identification numbers will be the same on each server for each duplicated site. These servers can then be included in a Microsoft Application Center Web farm without problems.

Code Example
' Make connections to WMI, to the IIS namespace on MyMachine, and to the WWW service.
set locatorObj = CreateObject("Wbemscripting.SWbemLocator")
set providerObj = locatorObj.ConnectServer("MyMachine", "root/MicrosoftIISv2")
set serviceObj = providerObj.Get("IIsWebService='W3SVC'")

' Build binding object, which is a required parameter of the CreateNewSite method.
' Use the SpawnInstance WMI method since we are creating a new instance of an object.
Bindings = Array(0)
Set Bindings(0) = providerObj.get("ServerBinding").SpawnInstance_()
Bindings(0).IP = ""
Bindings(0).Port = "8383"
Bindings(0).Hostname = ""

' Create the new Web site using the CreateNewSite method of the IIsWebService object.
Dim strSiteObjPath
strSiteObjPath = serviceObj.CreateNewSite("MyNewSite", Bindings, "C:\Inetpub\Wwwroot")

A more complete example is in the Module Three, Lesson 3 of the IIS WMI Provider Tutorial.

Related Topics
  • For more information about the IIS WMI Provider, see Using the IIS WMI Provider.
  • For detailed examples of scripts that use the properties and methods of the Windows WMI provider to access the IIS WMI provider, see Module 3: Writing Administration Scripts that Use WMI of the IIS WMI Provider Tutorial.
  • For basic examples in VBscript, Jscript, and Perl, see Code Examples to Configure Metabase Properties.
  • Your installation of IIS 6.0 includes command-line administration scripts that manage IIS. See Using Command-Line Administration Scripts.


IIsWebService.DeleteExtensionFileRecord (WMI)

The DeleteExtensionFileRecord method deletes an entry in ISAPIRestrictions or CGIRestrictions. If the entry is not marked not deletable, then the command line tool returns an error.

Syntax
return_value = object.DeleteExtensionFileRecord
(
String ExtensionFile
)
Parameters
ExtensionFile
[in] The file name to delete.
Related Topics
  • For more information about the IIS WMI Provider, see Using the IIS WMI Provider.
  • For detailed examples of scripts that use the properties and methods of the Windows WMI provider to access the IIS WMI provider, see Module 3: Writing Administration Scripts that Use WMI of the IIS WMI Provider Tutorial.
  • For basic examples in VBscript, Jscript, and Perl, see Code Examples to Configure Metabase Properties.
  • Your installation of IIS 6.0 includes command-line administration scripts that manage IIS. See Using Command-Line Administration Scripts.


IIsWebService.DisableExtensionFile (WMI)

The DisableExtensionFile method sets the Access flag on each of the ISAPIRestrictions or CGIRestrictions identified by filepath to 0 (Deny).

Syntax

return_value = object.DisableExtensionFile

(
String ExtensionFile
)
Parameters
ExtensionFile
[in] The file to disable in wserl. This becomes the second token in the wserl entry.
Related Topics
  • For more information about the IIS WMI Provider, see Using the IIS WMI Provider.
  • For detailed examples of scripts that use the properties and methods of the Windows WMI provider to access the IIS WMI provider, see Module 3: Writing Administration Scripts that Use WMI of the IIS WMI Provider Tutorial.
  • For basic examples in VBscript, Jscript, and Perl, see Code Examples to Configure Metabase Properties.
  • Your installation of IIS 6.0 includes command-line administration scripts that manage IIS. See Using Command-Line Administration Scripts.


IIsWebService.DisableWebServiceExtension (WMI)

The DisableWebServiceExtension method sets the Access flag on each of the ISAPIRestrictions or CGIRestrictions identified by GroupID to 0 (Deny).

Syntax

return_value = object.DisableWebServiceExtension

(
String Extension
)
Parameters
Extension
[in] The name of the GroupID to disable.
Related Topics
  • For more information about the IIS WMI Provider, see Using the IIS WMI Provider.
  • For detailed examples of scripts that use the properties and methods of the Windows WMI provider to access the IIS WMI provider, see Module 3: Writing Administration Scripts that Use WMI of the IIS WMI Provider Tutorial.
  • For basic examples in VBscript, Jscript, and Perl, see Code Examples to Configure Metabase Properties.
  • Your installation of IIS 6.0 includes command-line administration scripts that manage IIS. See Using Command-Line Administration Scripts.


IIsWebService.EnableApplication (WMI)

The EnableApplication method enables the Web service extensions required by a specific application.
Syntax

return_value = object.EnableApplication

(
String Application
)
Parameters
Application
[in] The name of the application to be enabled.
Related Topics
  • For more information about the IIS WMI Provider, see Using the IIS WMI Provider.
  • For detailed examples of scripts that use the properties and methods of the Windows WMI provider to access the IIS WMI provider, see Module 3: Writing Administration Scripts that Use WMI of the IIS WMI Provider Tutorial.
  • For basic examples in VBscript, Jscript, and Perl, see Code Examples to Configure Metabase Properties.
  • Your installation of IIS 6.0 includes command-line administration scripts that manage IIS. See Using Command-Line Administration Scripts.


IIsWebService.EnableExtensionFile (WMI)

The EnableExtensionFile method sets the Access flag on each of the extension files identified by filepath to 1 (Allow).

Syntax

return_value = object.EnableExtensionFile

(
String ExtensionFile
)
Parameters
ExtensionFile
[in] The file to enable in the wserl list.
Related Topics
  • For more information about the IIS WMI Provider, see Using the IIS WMI Provider.
  • For detailed examples of scripts that use the properties and methods of the Windows WMI provider to access the IIS WMI provider, see Module 3: Writing Administration Scripts that Use WMI of the IIS WMI Provider Tutorial.
  • For basic examples in VBscript, Jscript, and Perl, see Code Examples to Configure Metabase Properties.
  • Your installation of IIS 6.0 includes command-line administration scripts that manage IIS. See Using Command-Line Administration Scripts.


IIsWebService.EnableWebServiceExtension (WMI)

The EnableWebServiceExtension method sets the Access flag on each of the ISAPIRestrictions or CGIRestrictions identified by GroupID to 1 (Allow).

Syntax

return_value = object.EnableWebServiceExtension

(
String Extension
)
Parameters
Extension
[in] The name of the GroupID to enable.
Related Topics
  • For more information about the IIS WMI Provider, see Using the IIS WMI Provider.
  • For detailed examples of scripts that use the properties and methods of the Windows WMI provider to access the IIS WMI provider, see Module 3: Writing Administration Scripts that Use WMI of the IIS WMI Provider Tutorial.
  • For basic examples in VBscript, Jscript, and Perl, see Code Examples to Configure Metabase Properties.
  • Your installation of IIS 6.0 includes command-line administration scripts that manage IIS. See Using Command-Line Administration Scripts.


IIsWebService.GetCurrentMode (WMI)

The GetCurrentMode method returns the mode under which the World Wide Web Publishing Service (WWW service) is running; either the IIS 5.0 isolation mode or the new worker process isolation mode.

Syntax

return_value = object.GetCurrentMode

Parameters
There are no parameters for this method.
Related Topics
  • For more information about the IIS WMI Provider, see Using the IIS WMI Provider.
  • For detailed examples of scripts that use the properties and methods of the Windows WMI provider to access the IIS WMI provider, see Module 3: Writing Administration Scripts that Use WMI of the IIS WMI Provider Tutorial.
  • For basic examples in VBscript, Jscript, and Perl, see Code Examples to Configure Metabase Properties.
  • Your installation of IIS 6.0 includes command-line administration scripts that manage IIS. See Using Command-Line Administration Scripts.


IIsWebService.ListApplications (WMI)

The ListApplications method lists the applications that can be enabled on the server.

Syntax

return_value = object.ListApplications

(
String Applications[]
)
Parameters
Applications[]
[out] An array of Strings containing applications. In other words, an array of first tokens in appdep entries.
Related Topics
  • For more information about the IIS WMI Provider, see Using the IIS WMI Provider.
  • For detailed examples of scripts that use the properties and methods of the Windows WMI provider to access the IIS WMI provider, see Module 3: Writing Administration Scripts that Use WMI of the IIS WMI Provider Tutorial.
  • For basic examples in VBscript, Jscript, and Perl, see Code Examples to Configure Metabase Properties.
  • Your installation of IIS 6.0 includes command-line administration scripts that manage IIS. See Using Command-Line Administration Scripts.


IIsWebService.ListExtensionFiles (WMI)

The ListExtensionFiles method lists the extension files that can be enabled on the server. This essentially enumerates all entries in WebSvcExtRestrictionList.

Syntax

return_value = object.ListExtensionFiles

(
String ExtensionFiles[]
)
Parameters
ExtensionFiles[]
[out] An array of Strings containing the list of files. In other words, an array of second-tokens in wserl entries.
Related Topics
  • For more information about the IIS WMI Provider, see Using the IIS WMI Provider.
  • For detailed examples of scripts that use the properties and methods of the Windows WMI provider to access the IIS WMI provider, see Module 3: Writing Administration Scripts that Use WMI of the IIS WMI Provider Tutorial.
  • For basic examples in VBscript, Jscript, and Perl, see Code Examples to Configure Metabase Properties.
  • Your installation of IIS 6.0 includes command-line administration scripts that manage IIS. See Using Command-Line Administration Scripts.


IIsWebService.ListWebServiceExtensions (WMI)

The ListWebServiceExtensions method lists the Web service extensions that can be enabled on the server. If there are multiple entries with the same GroupID, the Web service extension is listed only once.

Syntax

return_value = object.ListWebServiceExtensions

(
String Extensions[]
)
Parameters
Extensions[]
[out] An array of Strings containing GroupIDs.
Related Topics
  • For more information about the IIS WMI Provider, see Using the IIS WMI Provider.
  • For detailed examples of scripts that use the properties and methods of the Windows WMI provider to access the IIS WMI provider, see Module 3: Writing Administration Scripts that Use WMI of the IIS WMI Provider Tutorial.
  • For basic examples in VBscript, Jscript, and Perl, see Code Examples to Configure Metabase Properties.
  • Your installation of IIS 6.0 includes command-line administration scripts that manage IIS. See Using Command-Line Administration Scripts.


IIsWebService.QueryGroupIDStatus (WMI)

The QueryGroupIDStatus method lists applications that depend on the given GroupID. An application dependency can be configured using the IIsWebService.AddDependency method, and can be removed using the IIsWebService.RemoveDependency method. QueryGroupIDStatus returns a 1 if the group is enabled, or returns a 0 if the group is disabled.
Syntax
return_value = object.QueryGroupIDStatus
(
string GroupID,
string Applications[]
)
Parameters
GroupID [in]
A non-localizable string used to identify groups of extensions. For example, "ASP", "HTTPODBC", or "SSINC", and so on.

Applications[] [out]
An array of applications which are dependent upon the GroupID.

Related Topics
  • For more information about the IIS WMI Provider, see Using the IIS WMI Provider.
  • For detailed examples of scripts that use the properties and methods of the Windows WMI provider to access the IIS WMI provider, see Module 3: Writing Administration Scripts that Use WMI of the IIS WMI Provider Tutorial.
  • For basic examples in VBScript, JScript, and Perl, see Code Examples to Configure Metabase Properties.
  • Your installation of IIS 6.0 includes command-line administration scripts that manage IIS. See Using Command-Line Administration Scripts.


IIsWebService.RemoveApplication (WMI)

The RemoveApplication method removes an entry in ApplicationDependencies for a single application.

Syntax

return_value = object.RemoveApplication

(
String Application
)
Parameters
Application
[in] The name of the application to be removed.
Related Topics
  • For more information about the IIS WMI Provider, see Using the IIS WMI Provider.
  • For detailed examples of scripts that use the properties and methods of the Windows WMI provider to access the IIS WMI provider, see Module 3: Writing Administration Scripts that Use WMI of the IIS WMI Provider Tutorial.
  • For basic examples in VBscript, Jscript, and Perl, see Code Examples to Configure Metabase Properties.
  • Your installation of IIS 6.0 includes command-line administration scripts that manage IIS. See Using Command-Line Administration Scripts.


IIsWebService.RemoveDependency (WMI)

The RemoveDependency method removes an entry in ApplicationDependencies for a single application.

Syntax

return_value = object.RemoveDependency

(
String Application,
String GroupID
)
Parameters
Application
[in] The name of the application to remove.
GroupID
[in] The name of the GroupID to remove.
Related Topics
  • For more information about the IIS WMI Provider, see Using the IIS WMI Provider.
  • For detailed examples of scripts that use the properties and methods of the Windows WMI provider to access the IIS WMI provider, see Module 3: Writing Administration Scripts that Use WMI of the IIS WMI Provider Tutorial.
  • For basic examples in VBscript, Jscript, and Perl, see Code Examples to Configure Metabase Properties.
  • Your installation of IIS 6.0 includes command-line administration scripts that manage IIS. See Using Command-Line Administration Scripts.


CIM_System (WMI)

This class, and the child CIM_ApplicationSystem (WMI) class take advantage of the way classes in WMI automatically inherit characteristics from WMI regular classes to pass on to child classes. Use the child IIsComputer (WMI) class for its useful methods.

Parent Class

CIM_LogicalElement (WMI)

Properties

The table below lists properties other than those that are inherited from parent classes.

Property Name | Data Type | Description
CreationClassName | String | The CreationClassName property indicates the name of the class or the subclass used in the creation of an instance. When used with the other key properties of this class, this property allows all instances of this class and its subclasses to be uniquely identified.
Name | String | The inherited Name property serves as key of a CIM_System instance in an enterprise environment.
NameFormat | String | The CIM_System object and its derivatives are top level objects of CIM. They provide the scope for numerous components. Having unique system keys is required. A heuristic can be defined in individual system subclasses to attempt to always generate the same system name key. The NameFormat property identifies how the system name was generated, using the subclass' heuristic.
PrimaryOwnerContact | String | The PrimaryOwnerContact property provides information on how the primary system owner can be reached, for example, phone number, e-mail address, and so on.
PrimaryOwnerName | String | The PrimaryOwnerName property indicates the name of the primary system owner.
Roles[] | array of String | The Roles[] property specifies the roles this system plays in the IT-environment.
Related Topics
  • For more information about the IIS WMI Provider, see Using the IIS WMI Provider.
  • For detailed examples of scripts that use the properties and methods of the Windows WMI provider to access the IIS WMI provider, see Module 3: Writing Administration Scripts that Use WMI of the IIS WMI Provider Tutorial.
  • For basic examples in VBScript, JScript, and Perl, see Code Examples to Configure Metabase Properties.
  • Your installation of IIS 6.0 includes command-line administration scripts that manage IIS. See Using Command-Line Administration Scripts.


CIM_ApplicationSystem (WMI)

This class takes advantage of the way classes in WMI automatically inherit characteristics from WMI regular classes to pass on to child classes. Use the child IIsComputer (WMI) class for its useful methods.

Parent Class

CIM_System (WMI)

Properties

This class inherits only properties from the parent classes.

Related Topics
  • For more information about the IIS WMI Provider, see Using the IIS WMI Provider.
  • For detailed examples of scripts that use the properties and methods of the Windows WMI provider to access the IIS WMI provider, see Module 3: Writing Administration Scripts that Use WMI of the IIS WMI Provider Tutorial.
  • For basic examples in VBScript, JScript, and Perl, see Code Examples to Configure Metabase Properties.
  • Your installation of IIS 6.0 includes command-line administration scripts that manage IIS. See Using Command-Line Administration Scripts.


IIsComputer (WMI)

This class corresponds to the LM key in the metabase which deals with the entire configuration of your Web server. Because of its scope, methods such as Export and Import can handle all or part of the metabase.

Parent Class

CIM_ApplicationSystem (WMI)

Methods

The table below lists the methods for this class.

Method Name | Return Data Type | Description
IIsComputer.SaveData (WMI) | void | The SaveData method triggers IIS to create a set of history files that back up the entire IIS metabase. History files can only be restored to the computer on which the files were created.
IIsComputer.BackupWithPassword (WMI) | void | The BackupWithPassword method backs up the metabase to a location you specify by providing a backup location name of up to 100 characters in length and a password valid for the targeted computer. Multiple metabase backups can be stored in a backup location.
IIsComputer.DeleteBackup (WMI) | void | The DeleteBackup method deletes a metabase backup from a backup location.
IIsComputer.EnumBackups (WMI) | void | The EnumBackups method enumerates metabase backups stored in one or more backup locations, retrieving the location, version number, and date of each backup.
IIsComputer.RestoreWithPassword (WMI) | void | The RestoreWithPassword method restores the metabase from a backup and requires a valid password (but only if one was used when the BackupWithPassword method was invoked). The restore operation stops all services dependent on the IIS Admin service (including all servers) until the restore has completed; then it restarts all services. Because of this, if you are restoring the metabase by using a script in an ASP page, you must specify a machine name (and the associated password) other than the one on which your script is executing. You cannot use LocalHost as the machine name. You should be careful to plan for this service interruption when restoring the metabase from a backup.
IIsComputer.Export (WMI) | void |
IIsComputer.Import (WMI) | void |
IIsComputer.RestoreHistory (WMI) | void | The RestoreHistory method restores the entire metabase from a set of history files that are periodically created by IIS. You can only use history files that were created on the same computer.
IIsComputer.EnumHistory (WMI) | void | The EnumHistory method enumerates metabase history files stored in one or more backup locations, retrieving the location, version number, and date of each automated backup.
Properties

The table below lists properties other than those that are inherited from parent classes.

Property Name | Data Type | Description
Name | String | The Name property defines the label by which the object is known. When subclassed, the Name property can be overridden to be a Key property.
Related Topics
  • For more information about the IIS WMI Provider, see Using the IIS WMI Provider.
  • For detailed examples of scripts that use the properties and methods of the Windows WMI provider to access the IIS WMI provider, see Module 3: Writing Administration Scripts that Use WMI of the IIS WMI Provider Tutorial.
  • For basic examples in VBScript, JScript, and Perl, see Code Examples to Configure Metabase Properties.
  • Your installation of IIS 6.0 includes command-line administration scripts that manage IIS. See Using Command-Line Administration Scripts.


IIsComputer.BackupWithPassword (WMI)

The BackupWithPassword method of the IIsComputer (WMI) object backs up the metabase to a location you specify by providing a backup location name of up to 100 characters in length and a password valid for the targeted computer. Multiple metabase backups can be stored in a backup location.

Syntax

return_value = object.BackupWithPassword

(
String BackupLocation,
SINT32 BackupVersion,
SINT32 BackupFlags,
String Password
)
Parameters

BackupLocation [in]
A string of up to 100 characters that specifies the backup location. The storage mechanism will be determined by IIS. If an empty string is specified, the backup will be stored in the default location.
BackupVersion [in]
Specifies the version number to be assigned to the backup. Must be less than or equal to MD_BACKUP_MAX_VERSION. Can be set to one of the following values.

MD_BACKUP_HIGHEST_VERSION | Overwrite the highest existing backup version in the specified backup location.
MD_BACKUP_NEXT_VERSION | Use the next backup version number available in the specified backup location.

BackupFlags [in]
One or more of the following flags.
MD_BACKUP_FORCE_BACKUP | Force the backup even if the SaveData operation specified by MD_BACKUP_SAVE_FIRST fails.
MD_BACKUP_OVERWRITE | Back up even if a backup of the same name and version exists in the specified backup location, overwriting if necessary.
MD_BACKUP_SAVE_FIRST | Perform a SaveData operation before the backup. Default if no flags are specified.

Password [in]
Optional. Unencrypted valid password.

Remarks

IIS determines the backup storage mechanism, so the backup location name you provide does not necessarily translate to a particular directory, file, or database storage mechanism. Metabase backups are stored as files in the systemroot\System32\Inetsrv\MetaBack directory.

important Important The metabase backup and restore functionality exists for versioning purposes, not for cross-machine replication. However, you are not necessarily restricted to backing up and restoring the computer from which you initiate the process. For more information about restoring from a back up, see Restoring the Metabase from Backup Files.

Related Topics
  • For more information about the IIS WMI Provider, see Using the IIS WMI Provider.
  • For detailed examples of scripts that use the properties and methods of the Windows WMI provider to access the IIS WMI provider, see Module 3: Writing Administration Scripts that Use WMI of the IIS WMI Provider Tutorial.
  • For basic examples in VBScript, JScript, and Perl, see Code Examples to Configure Metabase Properties.
  • Your installation of IIS 6.0 includes command-line administration scripts that manage IIS. See Using Command-Line Administration Scripts.


IIsComputer.DeleteBackup (WMI)

The DeleteBackup method of the IIsComputer (WMI) object deletes a metabase backup from a backup location.

Syntax

return_value = object.DeleteBackup

(
String BackupLocation,
SINT32 BackupVersion
)
Parameters

BackupLocation [in]
A string of up to 100 characters that specifies the backup location. If an empty string is specified, the backup will be deleted from the default location.
BackupVersion [in]
Specifies the version number of the backup to be deleted from the backup location, or it can be the constant MD_BACKUP_HIGHEST_VERSION which deletes the highest existing backup version in the specified backup location.

Related Topics
  • For more information about the IIS WMI Provider, see Using the IIS WMI Provider.
  • For detailed examples of scripts that use the properties and methods of the Windows WMI provider to access the IIS WMI provider, see Module 3: Writing Administration Scripts that Use WMI of the IIS WMI Provider Tutorial.
  • For basic examples in VBScript, JScript, and Perl, see Code Examples to Configure Metabase Properties.
  • Your installation of IIS 6.0 includes command-line administration scripts that manage IIS. See Using Command-Line Administration Scripts.


IIsComputer.EnumBackups (WMI)

The EnumBackups method of the IIsComputer (WMI) object enumerates metabase backups stored in one or more backup locations, retrieving the location, version number, and date of each backup.

Syntax

return_value = object.EnumBackups

(
String BackupLocation,
SINT32 IndexIn,
SINT32 BackupVersionOut,
datetime BackupDateTimeOut
)
Parameters

BackupLocation [in,out]
A string of up to 100 characters that specifies the backup location. If an empty string is specified, all backup locations will be searched.
IndexIn [in]
Specifies the index of the backup to enumerate. Start the index at 0 and increment by 1 until MD_ERROR_DATA_NOT_FOUND is returned.
BackupVersionOut [out]
Receives the version number of the backup enumerated.
BackupDateTimeOut [out]
Receives the date and time of the backup, in Coordinated Universal Time (UTC), formerly GMT (Greenwich Mean Time).

Related Topics
  • For more information about the IIS WMI Provider, see Using the IIS WMI Provider.
  • For detailed examples of scripts that use the properties and methods of the Windows WMI provider to access the IIS WMI provider, see Module 3: Writing Administration Scripts that Use WMI of the IIS WMI Provider Tutorial.
  • For basic examples in VBScript, JScript, and Perl, see Code Examples to Configure Metabase Properties.
  • Your installation of IIS 6.0 includes command-line administration scripts that manage IIS. See Using Command-Line Administration Scripts.


IIsComputer.EnumHistory (WMI)

The EnumHistory method of the IIsComputer (WMI) object enumerates metabase history files stored in one or more backup locations, retrieving the location, version number, and date of each automated backup.

Syntax

return_value = object.EnumHistory

(
String MDHistoryLocation,
SINT32 MajorVersion,
SINT32 MinorVersion,
datetime HistoryTime,
SINT32 EnumIndex
)
Parameters

MDHistoryLocation [in,out]
A string of up to 100 characters that specifies the history files location. If an empty string is specified, all history locations will be searched.
MajorVersion [out]
The major version number of the enumerated history files.
MinorVersion [out]
The minor version number of the enumerated history files.
HistoryTime [out]
Receives the date and time of the backup, in Coordinated Universal Time (UTC), formerly GMT (Greenwich Mean Time).
EnumIndex [in]
Specifies the index of the backup to enumerate. Start the index at 0 and increment by 1 until MD_ERROR_DATA_NOT_FOUND is returned.

Related Topics
  • For more information about the IIS WMI Provider, see Using the IIS WMI Provider.
  • For detailed examples of scripts that use the properties and methods of the Windows WMI provider to access the IIS WMI provider, see Module 3: Writing Administration Scripts that Use WMI of the IIS WMI Provider Tutorial.
  • For basic examples in VBScript, JScript, and Perl, see Code Examples to Configure Metabase Properties.
  • Your installation of IIS 6.0 includes command-line administration scripts that manage IIS. See Using Command-Line Administration Scripts.


IIsComputer.Export (WMI)

The Export method exports a section of the IIS metabase to a file for importing to the same IIS server or a different IIS server. Please see About Metabase Import and Export for more information about how to select sections of the metabase, and see Machine-Specific and System-Specific Information for a list of properties to clear from your export file.
Syntax

return_value = object.Export

(
String Passwd,
String FileName,
String SourcePath,
SINT32 MDFlags
)
Parameters

Passwd [in]
Encrypts the export file with the specified password. You can use any string as the password. The /d parameter creates a secure export file by encrypting the session key and secure properties with the specified password. You must provide the password to use the file in an /import operation. If you omit this parameter or omit the password argument, then the export file is encrypted with a blank password. As a result, only the secure properties are encrypted and any administrator can use the export file to import a metabase configuration.
FileName [in]
Required. Specifies a unique name and location for the export file. If you specify an existing file or if the directories in the path you specify do not exist, the method fails. Also, the file path must be local. When exporting a file from a remote computer, the FileName parameter refers to a path on the remote computer.
SourcePath [in]
Required. Specifies the metabase keys to export. Enter a metabase path, including /LM/ROOT, to indicate the selected keys.
MDFlags [in]
A constant that specifies what inherit and merge flags to set. The constant can be one of the following.

IMPORT_EXPORT_INHERITED | Adds the inherited properties of the exported keys to the export file. Without this flag, the export file does not include properties inherited from higher-level keys. If you use this flag, the Export method adds the inherited properties of the exported keys to an IIsInheritedProperties key in the export file. When you import keys from this file, you can elect to import the inherited properties with the keys.
IMPORT_EXPORT_NODE_ONLY | Prevents the subkeys of the specified key from being added to the export file.

Related Topics
  • For more information about the IIS WMI Provider, see Using the IIS WMI Provider.
  • For detailed examples of scripts that use the properties and methods of the Windows WMI provider to access the IIS WMI provider, see Module 3: Writing Administration Scripts that Use WMI of the IIS WMI Provider Tutorial.
  • For basic examples in VBScript, JScript, and Perl, see Code Examples to Configure Metabase Properties.
  • Your installation of IIS 6.0 includes command-line administration scripts that manage IIS. See Using Command-Line Administration Scripts.


IIsComputer.Import (WMI)

The Import method imports a section of an IIS metabase from an export file that has been created on the same IIS server or a different IIS server. Please see About Metabase Import and Export for more information about how to select sections of the metabase, and see Machine-Specific and System-Specific Information for a list of properties to clear from your export file before importing it.
Syntax

return_value = object.Import

(
String Passwd,
String FileName,
String SourcePath,
String DestPath,
SINT32 MDFlags
)
Parameters

Passwd [in]
Required only when the export file was encrypted when it was created. Specifies the password that was used to encrypt the export file.
FileName [in]
Required. Specifies the path and file name of the XML source file.
SourcePath [in]
Required. Specifies the location in the XML file of the keys being imported. Enter the metabase path as it appears in the XML file. To import all of the keys in the source file, enter the metabase path of the root key.
DestPath [in]
Required. Specifies the metabase path into which the keys are placed. Enter the metabase path as it appears in the XML file. The imported key must be of the type expected in its new position in the metabase path. If the key is not of the expected type, the configuration will not operate properly. For example, do not import the event logging configuration (/LM/Logging) to a Web site configuration path, such as /LM/W3SVC/3. If you specify a path that already exists in the metabase, the imported keys overwrite and replace the keys currently in that metabase path, without warning.
MDFlags [in]
A constant that specifies what inherit and merge flags to set. The constant can be one of the following.

IMPORT_EXPORT_INHERITED | Imports the inherited properties of the keys. This parameter is only effective when the source file includes inherited properties.
IMPORT_EXPORT_NODE_ONLY | Prevents the subkeys of the specified key from being imported.
IMPORT_EXPORT_MERGE | Combines keys in the XML file with the existing metabase keys. Without this parameter, the keys in the XML file replace existing keys in the same metabase path. The IMPORT_EXPORT_MERGE flag adds keys to the metabase that appear only in the XML file, retains keys in the metabase that are not in the XML file, and applies the values in the XML file when a key appears in both the XML file and the metabase.

Related Topics
  • For more information about the IIS WMI Provider, see Using the IIS WMI Provider.
  • For detailed examples of scripts that use the properties and methods of the Windows WMI provider to access the IIS WMI provider, see Module 3: Writing Administration Scripts that Use WMI of the IIS WMI Provider Tutorial.
  • For basic examples in VBScript, JScript, and Perl, see Code Examples to Configure Metabase Properties.
  • Your installation of IIS 6.0 includes command-line administration scripts that manage IIS. See Using Command-Line Administration Scripts.


IIsComputer.RestoreHistory (WMI)

The RestoreHistory method of the IIsComputer (WMI) object restores the entire metabase from a set of history files that are periodically created by IIS. You can only use history files that were created on the same computer.

Syntax

return_value = object.RestoreHistory

(
String MDHistoryLocation,
SINT32 MajorVersion,
SINT32 MinorVersion,
SINT32 MDFlags
)
Parameters

MDHistoryLocation [in]
Absolute path of the folder that contains the metabase history files.
MajorVersion [in]
The major version number of the selected history file.
MinorVersion [in]
The minor version number of the selected history file.
MDFlags [in]
Reserved. Must be zero.

Related Topics
  • For more information about the IIS WMI Provider, see Using the IIS WMI Provider.
  • For detailed examples of scripts that use the properties and methods of the Windows WMI provider to access the IIS WMI provider, see Module 3: Writing Administration Scripts that Use WMI of the IIS WMI Provider Tutorial.
  • For basic examples in VBScript, JScript, and Perl, see Code Examples to Configure Metabase Properties.
  • Your installation of IIS 6.0 includes command-line administration scripts that manage IIS. See Using Command-Line Administration Scripts.


IIsComputer.RestoreWithPassword (WMI)

The RestoreWithPassword method of the IIsComputer (WMI) object restores the metabase from a backup and requires a valid password (but only if one was used when the BackupWithPassword method was invoked). The restore operation stops all services dependent on the IIS Admin service (including all servers) until the restore has completed; then it restarts all services. Because of this, if you are restoring the metabase by using a script in an ASP page, you must specify a machine name (and the associated password) other than the one on which your script is executing. You cannot use LocalHost as the machine name. You should be careful to plan for this service interruption when restoring the metabase from a backup.

Syntax

return_value = object.RestoreWithPassword

(
String BackupLocation,
SINT32 BackupVersion,
SINT32 BackupFlags,
String Password
)
Parameters

BackupLocation [in]
A string of up to 100 characters that specifies the backup location. If an empty string is specified, the backup is retrieved from the default location.
BackupVersion [in]
Specifies the version number of the backup to be restored from the backup location, or can be the constant MD_BACKUP_HIGHEST_VERSION which restores from the highest existing backup version in the specified backup location.
BackupFlags [in]
Reserved. Must be zero.
Password [in]
Optional. Unencrypted valid password for targeted computer. This password must be the same as the one used when the BackupWithPassword method was invoked.

Remarks

The RestoreWithPassword method with LocalHost in scripts running in a command prompt by using Cscript.exe. For more information, see the Windows Script Host material in Windows Help.

important Important The metabase backup and restore functionality exists for versioning purposes, not for cross-machine replication. However, you are not necessarily restricted to restoring the computer from which you initiate the process. For more information about restoring from a backup, see Restoring the Metabase from Backup Files.

Related Topics
  • For more information about the IIS WMI Provider, see Using the IIS WMI Provider.
  • For detailed examples of scripts that use the properties and methods of the Windows WMI provider to access the IIS WMI provider, see Module 3: Writing Administration Scripts that Use WMI of the IIS WMI Provider Tutorial.
  • For basic examples in VBScript, JScript, and Perl, see Code Examples to Configure Metabase Properties.
  • Your installation of IIS 6.0 includes command-line administration scripts that manage IIS. See Using Command-Line Administration Scripts.


IIsComputer.SaveData (WMI)

The SaveData method of the IIsComputer (WMI) object triggers IIS to create a set of history files that back up the entire IIS metabase. History files can only be restored to the computer on which the files were created.

Syntax

return_value = object.SaveData

Parameters

There are no parameters for this method.

Related Topics
  • For more information about the IIS WMI Provider, see Using the IIS WMI Provider.
  • For detailed examples of scripts that use the properties and methods of the Windows WMI provider to access the IIS WMI provider, see Module 3: Writing Administration Scripts that Use WMI of the IIS WMI Provider Tutorial.
  • For basic examples in VBScript, JScript, and Perl, see Code Examples to Configure Metabase Properties.
  • Your installation of IIS 6.0 includes command-line administration scripts that manage IIS. See Using Command-Line Administration Scripts.


IIsACE (WMI)

This class holds read-only properties that correspond to one Access Control Entry (ACE) that grants permissions to a user or group.

Parent Class

CIM_LogicalElement (WMI)

Properties

The table below lists properties other than those that are inherited from parent classes.

Property Name | Data Type | Description
Name | String | The Name property defines the label by which the object is known. When subclassed, the Name property can be overridden to be a Key property.
Trustee | String | The Trustee property holds the name of the user account being granted, for example, "BUILTIN\Administrators".
AccessMask | SINT32 | The AccessMask contains a bitmask that, when applied to the AceFlags value, specifies the type of access being granted. A value of 137 grants enough access for an anonymous client to browse your Web site.
AceType | SINT32 | The AceType is typically set to 0 to allow AccessMask specify the access level.
AceFlags | SINT32 | The AceFlags property is typically set to 0 to allow AccessMask specify the access level.
Flags | SINT32 | The Flags property is typically set to 0 to allow AccessMask specify the access level.
ObjectType | String | The ObjectType property is typically empty.
InheritedObjectType | String | The InheritedObjectType is typically empty.
Related Topics
  • For more information about the IIS WMI Provider, see Using the IIS WMI Provider.
  • For detailed examples of scripts that use the properties and methods of the Windows WMI provider to access the IIS WMI provider, see Module 3: Writing Administration Scripts that Use WMI of the IIS WMI Provider Tutorial.
  • For basic examples in VBScript, JScript, and Perl, see Code Examples to Configure Metabase Properties.
  • Your installation of IIS 6.0 includes command-line administration scripts that manage IIS. See Using Command-Line Administration Scripts.


IIsAdminACL (WMI)

This class holds read-only properties that correspond to an Access Control List (ACL) that grants or denies specific users and groups permission to access the object.

Parent Class

CIM_LogicalElement (WMI)

Properties

The table below lists properties other than those that are inherited from parent classes.

Property Name | Data Type | Description
Name | String | The Name property defines the label by which the object is known. When subclassed, the Name property can be overridden to be a Key property.
Owner | String | The Owner property contains the name of the security account that owns the configuration of this IIS admin object. For example, Owner is typically set to "BUILTIN\Administrators".
Group | String | The Group property contains the name of the security account whose permissions are being set in the instance of this class.
ControlFlags | SINT32 | The ControlFlags property contains an integer representing the level of access that Group has to the instance of this class. For example, for IIsAdminACL.Name="W3SVC", the ControlFlags property typically contains 32775 which represents full control for the BUILTIN\Administrators group.
Related Topics
  • For more information about the IIS WMI Provider, see Using the IIS WMI Provider.
  • For detailed examples of scripts that use the properties and methods of the Windows WMI provider to access the IIS WMI provider, see Module 3: Writing Administration Scripts that Use WMI of the IIS WMI Provider Tutorial.
  • For basic examples in VBScript, JScript, and Perl, see Code Examples to Configure Metabase Properties.
  • Your installation of IIS 6.0 includes command-line administration scripts that manage IIS. See Using Command-Line Administration Scripts.


IIsApplicationPool (WMI)

This class corresponds to the IIsApplicationPool IIS Admin object, and contains the methods and read-only properties for the object.

Parent Class

CIM_LogicalElement (WMI)

Methods

The table below lists the methods for this class.

Method Name | Return Data Type | Description
IIsApplicationPool.EnumAppsInPool (WMI) | void | The EnumAppsInPool method populates an array of Strings with the applications in the application pool that is specified by the object variable, which must be an instance of the IIsApplicationPool (WMI) class.
IIsApplicationPool.Recycle (WMI) | void | The Recycle method recycles the application pool that is specified by the object variable, which must be an instance of the IIsApplicationPool (WMI) class. When recycling occurs, the worker process currently serving the application pool will terminate and the World Wide Web Publishing Service (WWW service) will restart a new worker process to replace it.
IIsApplicationPool.Start (WMI) | void | The Start method starts the application pool that is specified by the object variable, which must be an instance of the IIsApplicationPool (WMI) class.
IIsApplicationPool.Stop (WMI) | void | The Stop method stops the application pool that is specified by the object variable, which must be an instance of the IIsApplicationPool (WMI) class.
Properties

The table below lists properties other than those that are inherited from parent classes.

Property Name | Data Type | Description
Name | String | The Name property defines the label by which the object is known. When subclassed, the Name property can be overridden to be a Key property.
Related Topics
  • For more information about the IIS WMI Provider, see Using the IIS WMI Provider.
  • For detailed examples of scripts that use the properties and methods of the Windows WMI provider to access the IIS WMI provider, see Module 3: Writing Administration Scripts that Use WMI of the IIS WMI Provider Tutorial.
  • For basic examples in VBScript, JScript, and Perl, see Code Examples to Configure Metabase Properties.
  • Your installation of IIS 6.0 includes command-line administration scripts that manage IIS. See Using Command-Line Administration Scripts.


IIsApplicationPool.EnumAppsInPool (WMI)

The EnumAppsInPool method populates an array of Strings with the applications in the application pool that is specified by the object variable, which must be an instance of the IIsApplicationPool (WMI) class.

Syntax

return_value = object.EnumAppsInPool

(
String Applications[]
)
Parameters

Applications[] [out]
An array of strings containing the names of the applications in the instance of the application pool.

Related Topics
  • For more information about the IIS WMI Provider, see Using the IIS WMI Provider.
  • For detailed examples of scripts that use the properties and methods of the Windows WMI provider to access the IIS WMI provider, see Module 3: Writing Administration Scripts that Use WMI of the IIS WMI Provider Tutorial.
  • For basic examples in VBScript, JScript, and Perl, see Code Examples to Configure Metabase Properties.
  • Your installation of IIS 6.0 includes command-line administration scripts that manage IIS. See Using Command-Line Administration Scripts.


IIsApplicationPool.Recycle (WMI)

The Recycle method recycles the application pool that is specified by the object variable, which must be an instance of the IIsApplicationPool (WMI) class. When recycling occurs, the worker process currently serving the application pool will terminate and the World Wide Web Publishing Service (WWW service) will restart a new worker process to replace it.

Syntax

return_value = object.Recycle

Parameters

There are no parameters for this method.

Related Topics
  • For more information about the IIS WMI Provider, see Using the IIS WMI Provider.
  • For detailed examples of scripts that use the properties and methods of the Windows WMI provider to access the IIS WMI provider, see Module 3: Writing Administration Scripts that Use WMI of the IIS WMI Provider Tutorial.
  • For basic examples in VBScript, JScript, and Perl, see Code Examples to Configure Metabase Properties.
  • Your installation of IIS 6.0 includes command-line administration scripts that manage IIS. See Using Command-Line Administration Scripts.


IIsApplicationPool.Start (WMI)

The Start method starts the application pool that is specified by the object variable, which must be an instance of the IIsApplicationPool (WMI) class.

Syntax

return_value = object.Start

Parameters

There are no parameters for this method.

Related Topics
  • For more information about the IIS WMI Provider, see Using the IIS WMI Provider.
  • For detailed examples of scripts that use the properties and methods of the Windows WMI provider to access the IIS WMI provider, see Module 3: Writing Administration Scripts that Use WMI of the IIS WMI Provider Tutorial.
  • For basic examples in VBScript, JScript, and Perl, see Code Examples to Configure Metabase Properties.
  • Your installation of IIS 6.0 includes command-line administration scripts that manage IIS. See Using Command-Line Administration Scripts.


IIsApplicationPool.Stop (WMI)

The Stop method stops the application pool that is specified by the object variable, which must be an instance of the IIsApplicationPool (WMI) class.

Syntax

return_value = object.Stop

Parameters

There are no parameters for this method.

Related Topics
  • For more information about the IIS WMI Provider, see Using the IIS WMI Provider.
  • For detailed examples of scripts that use the properties and methods of the Windows WMI provider to access the IIS WMI provider, see Module 3: Writing Administration Scripts that Use WMI of the IIS WMI Provider Tutorial.
  • For basic examples in VBScript, JScript, and Perl, see Code Examples to Configure Metabase Properties.
  • Your installation of IIS 6.0 includes command-line administration scripts that manage IIS. See Using Command-Line Administration Scripts.


IIsApplicationPools (WMI)

The IIsApplicationPools class corresponds to the IIsApplicationPools IIS Admin object, and contains the methods and read-only properties for the object.

Parent Class

CIM_LogicalElement (WMI)

Properties

The table below lists properties other than those that are inherited from parent classes.

Property Name | Data Type | Description
Name | String | The Name property defines the label by which the object is known. When subclassed, the Name property can be overridden to be a Key property.
Related Topics
  • For more information about the IIS WMI Provider, see Using the IIS WMI Provider.
  • For detailed examples of scripts that use the properties and methods of the Windows WMI provider to access the IIS WMI provider, see Module 3: Writing Administration Scripts that Use WMI of the IIS WMI Provider Tutorial.
  • For basic examples in VBScript, JScript, and Perl, see Code Examples to Configure Metabase Properties.
  • Your installation of IIS 6.0 includes command-line administration scripts that manage IIS. See Using Command-Line Administration Scripts.


IIsCertMapper (WMI)

This class corresponds to the IIsCertMapper IIS Admin object, and contains the methods and read-only properties for the object.

Parent Class

CIM_LogicalElement (WMI)

Methods

The table below lists the methods for this class.

Method Name | Return Data Type | Description
IIsCertMapper.CreateMapping (WMI) | void | The CreateMapping method maps a certificate to a Windows account.
IIsCertMapper.DeleteMapping (WMI) | void | The DeleteMapping method deletes an existing certificate mapping. Four seek methods are available to search for the mapping: by certificate, by name, by Windows account, and by numeric String index.
IIsCertMapper.GetMapping (WMI) | void | The GetMapping method retrieves a certificate and the mapping data from an existing certificate mapping. Four seek methods are available to search for the mapping: by certificate, by name, by Windows account, and by numeric String index. The retrieved mapping is returned in parameter variables that you provide.
IIsCertMapper.SetAcct (WMI) | void | The SetAcct method sets a new value for the Windows account String in an existing certificate mapping. Four seek methods are available to search for the mapping: by certificate, by name, by Windows account, and by numeric String index.
IIsCertMapper.SetEnabled (WMI) | void | The SetEnabled method enables or disables an existing certificate mapping. Four seek methods are available to search for the mapping: by certificate, by name, by Windows account, and by numeric String index.
IIsCertMapper.SetName (WMI) | void | The SetName method sets a new value for the name String in an existing certificate mapping. Four seek methods are available to search for the mapping: by certificate, by name, by Windows account, and by numeric String index.
IIsCertMapper.SetPwd (WMI) | void | The SetPwd method sets a new value for the Windows password String in an existing certificate mapping. Four seek methods are available to search for the mapping: by certificate, by name, by Windows account, and by numeric String index.
Properties

The table below lists properties other than those that are inherited from parent classes.

Property Name | Data Type | Description
Name | String | The Name property defines the label by which the object is known. When subclassed, the Name property can be overridden to be a Key property.
Related Topics
  • For more information about the IIS WMI Provider, see Using the IIS WMI Provider.
  • For detailed examples of scripts that use the properties and methods of the Windows WMI provider to access the IIS WMI provider, see Module 3: Writing Administration Scripts that Use WMI of the IIS WMI Provider Tutorial.
  • For basic examples in VBScript, JScript, and Perl, see Code Examples to Configure Metabase Properties.
  • Your installation of IIS 6.0 includes command-line administration scripts that manage IIS. See Using Command-Line Administration Scripts.


IIsCertMapper.CreateMapping (WMI)

The CreateMapping method of the IIsCertMapper (WMI) object maps a certificate to a Windows account.

Syntax

return_value = object.CreateMapping

(
String vCert,
String NtAcct,
String NtPwd,
String strName,
Boolean IEnabled
)
Parameters

vCert [in]
Contains the certificate. The certificate is either a string or an array of bytes, usually obtained from the ClientCertificate collection of the built-in ASP Request Object.
NtAcct [in]
Contains the Windows account string.
NtPwd [in]
Contains the password string for NtAcct.
strName [in]
Contains the friendly name for the account.
IEnabled [in]
Specifies TRUE to enable the mapping, FALSE to disable the mapping.

Related Topics
  • For more information about the IIS WMI Provider, see Using the IIS WMI Provider.
  • For detailed examples of scripts that use the properties and methods of the Windows WMI provider to access the IIS WMI provider, see Module 3: Writing Administration Scripts that Use WMI of the IIS WMI Provider Tutorial.
  • For basic examples in VBScript, JScript, and Perl, see Code Examples to Configure Metabase Properties.
  • Your installation of IIS 6.0 includes command-line administration scripts that manage IIS. See Using Command-Line Administration Scripts.


IIsCertMapper.DeleteMapping (WMI)

The DeleteMapping method of the IIsCertMapper (WMI) object deletes an existing certificate mapping. Four seek methods are available to search for the mapping: by certificate, by name, by Windows account, and by numeric String index.

Syntax

return_value = object.DeleteMapping

(
SINT32 IMethod,
String vKey
)
Parameters

IMethod [in]
Specifies the seek method to use for searching the mappings. Valid seek methods are 1, 2, 3, or 4. Seek method 1 specifies search by certificate, seek method 2 searches by name, method 3 searches by Windows account, and method 4 searches by a 1-based numeric string index (for example "1," "2," and so on).
vKey [in]
Specifies the key to use in the search specified by IMethod. For seek method 1, vKey specifies a certificate. For seek method 2, vKey specifies a name. For seek method 3, vKey specifies a Windows account. For seek method 4, vKey specifies a numeric string index (for example, "1," "2," and so on).

Related Topics
  • For more information about the IIS WMI Provider, see Using the IIS WMI Provider.
  • For detailed examples of scripts that use the properties and methods of the Windows WMI provider to access the IIS WMI provider, see Module 3: Writing Administration Scripts that Use WMI of the IIS WMI Provider Tutorial.
  • For basic examples in VBScript, JScript, and Perl, see Code Examples to Configure Metabase Properties.
  • Your installation of IIS 6.0 includes command-line administration scripts that manage IIS. See Using Command-Line Administration Scripts.


IIsCertMapper.GetMapping (WMI)

The GetMapping method of the IIsCertMapper (WMI) object retrieves a certificate and the mapping data from an existing certificate mapping. Four seek methods are available to search for the mapping: by certificate, by name, by Windows account, and by numeric String index. The retrieved mapping is returned in parameter variables that you provide.

Syntax

return_value = object.GetMapping

(
SINT32 IMethod,
String vKey,
String vCert,
String NtAcct,
String NtPwd,
String strName,
Boolean IEnabled
)
Parameters

IMethod [in]
Specifies the seek method to use for searching the mappings. Valid seek methods are 1, 2, 3, or 4. Seek method 1 specifies search by certificate, seek method 2 searches by name, method 3 searches by Windows account, and method 4 searches by a 1-based numeric string index (for example, "1," "2," and so on).
vKey [in]
Specifies the key to use in the search specified by IMethod. For seek method 1, vKey specifies a certificate. For seek method 2, vKey specifies a name. For seek method 3, vKey specifies a Windows account. For seek method 4, vKey specifies a numeric string index (for example, "1," "2," and so on).
vCert [out]
Receives the returned certificate.
NtAcct [out]
Receives the returned Windows account.
NtPwd [out]
Receives the returned Windows account password.
strName [out]
Receives the returned Windows account friendly name.
IEnabled [out]
Receives the returned value TRUE for an enabled mapping, or FALSE for a disabled mapping.

Related Topics
  • For more information about the IIS WMI Provider, see Using the IIS WMI Provider.
  • For detailed examples of scripts that use the properties and methods of the Windows WMI provider to access the IIS WMI provider, see Module 3: Writing Administration Scripts that Use WMI of the IIS WMI Provider Tutorial.
  • For basic examples in VBScript, JScript, and Perl, see Code Examples to Configure Metabase Properties.
  • Your installation of IIS 6.0 includes command-line administration scripts that manage IIS. See Using Command-Line Administration Scripts.


IIsCertMapper.SetAcct (WMI)

The SetAcct method of the IIsCertMapper (WMI) object sets a new value for the Windows account String in an existing certificate mapping. Four seek methods are available to search for the mapping: by certificate, by name, by Windows account, and by numeric String index.

Syntax

return_value = object.SetAcct

(
SINT32 IMethod,
String vKey,
String NtAcct
)
Parameters

IMethod [in]
Specifies the seek method to use for searching the mappings. Valid seek methods are 1, 2, 3, or 4. Seek method 1 specifies search by certificate, seek method 2 searches by name, method 3 searches by Windows account, and method 4 searches by a 1-based numeric string index (for example, "1," "2," and so on).
vKey [in]
Specifies the key to use in the search specified by IMethod. For seek method 1, vKey specifies a certificate. For seek method 2, vKey specifies a name. For seek method 3, vKey specifies a Windows account. For seek method 4, vKey specifies a numeric string index (for example, "1," "2," and so on).
NtAcct [in]
Specifies a new value for the Windows account string.

Related Topics
  • For more information about the IIS WMI Provider, see Using the IIS WMI Provider.
  • For detailed examples of scripts that use the properties and methods of the Windows WMI provider to access the IIS WMI provider, see Module 3: Writing Administration Scripts that Use WMI of the IIS WMI Provider Tutorial.
  • For basic examples in VBScript, JScript, and Perl, see Code Examples to Configure Metabase Properties.
  • Your installation of IIS 6.0 includes command-line administration scripts that manage IIS. See Using Command-Line Administration Scripts.


IIsCertMapper.SetEnabled (WMI)

The SetEnabled method of the IIsCertMapper (WMI) object enables or disables an existing certificate mapping. Four seek methods are available to search for the mapping: by certificate, by name, by Windows account, and by numeric String index.

Syntax

return_value = object.SetEnabled

(
SINT32 IMethod,
String vKey,
Boolean IEnabled
)
Parameters

IMethod [in]
Specifies the seek method to use for searching the mappings. Valid seek methods are 1, 2, 3, or 4. Seek method 1 specifies search by certificate, seek method 2 searches by name, method 3 searches by Windows account, and method 4 searches by a 1-based numeric string index (for example, "1," "2," and so on).
vKey [in]
Specifies the key to use in the search specified by IMethod. For seek method 1, vKey specifies a certificate. For seek method 2, vKey specifies a name. For seek method 3, vKey specifies a Windows account. For seek method 4, vKey specifies a numeric string index (for example, "1," "2," and so on).
IEnabled [in]
Specifies TRUE to enable the mapping, FALSE to disable the mapping.

Related Topics
  • For more information about the IIS WMI Provider, see Using the IIS WMI Provider.
  • For detailed examples of scripts that use the properties and methods of the Windows WMI provider to access the IIS WMI provider, see Module 3: Writing Administration Scripts that Use WMI of the IIS WMI Provider Tutorial.
  • For basic examples in VBScript, JScript, and Perl, see Code Examples to Configure Metabase Properties.
  • Your installation of IIS 6.0 includes command-line administration scripts that manage IIS. See Using Command-Line Administration Scripts.


IIsCertMapper.SetName (WMI)

The SetName method of the IIsCertMapper (WMI) object sets a new value for the name String in an existing certificate mapping. Four seek methods are available to search for the mapping: by certificate, by name, by Windows account, and by numeric String index.

Syntax

return_value = object.SetName

(
SINT32 IMethod,
String vKey,
String strName
)
Parameters

IMethod [in]
Specifies the seek method to use for searching the mappings. Valid seek methods are 1, 2, 3, or 4. Seek method 1 specifies search by certificate, seek method 2 searches by name, method 3 searches by Windows account, and method 4 searches by a 1-based numeric string index (for example, "1", "2", and so on).
vKey [in]
Specifies the key to use in the search specified by IMethod. For seek method 1, vKey specifies a certificate. For seek method 2, vKey specifies a name. For seek method 3, vKey specifies a Windows account. For seek method 4, vKey specifies a numeric string index (for example, "1," "2," and so on).
strName [in]
Specifies a new value for the name string.

Related Topics
  • For more information about the IIS WMI Provider, see Using the IIS WMI Provider.
  • For detailed examples of scripts that use the properties and methods of the Windows WMI provider to access the IIS WMI provider, see Module 3: Writing Administration Scripts that Use WMI of the IIS WMI Provider Tutorial.
  • For basic examples in VBScript, JScript, and Perl, see Code Examples to Configure Metabase Properties.
  • Your installation of IIS 6.0 includes command-line administration scripts that manage IIS. See Using Command-Line Administration Scripts.


IIsCertMapper.SetPwd (WMI)

The SetPwd method of the IIsCertMapper (WMI) object sets a new value for the Windows password String in an existing certificate mapping. Four seek methods are available to search for the mapping: by certificate, by name, by Windows account, and by numeric String index.

Syntax

return_value = object.SetPwd

(
SINT32 IMethod,
String vKey,
String NtPwd
)
Parameters

IMethod [in]
Specifies the seek method to use for searching the mappings. Valid seek methods are 1, 2, 3, or 4. Seek method 1 specifies search by certificate, seek method 2 searches by name, method 3 searches by Windows account, and method 4 searches by a 1-based numeric string index (for example, "1," "2," and so on).
vKey [in]
Specifies the key to use in the search specified by IMethod. For seek method 1, vKey specifies a certificate. For seek method 2, vKey specifies a name. For seek method 3, vKey specifies a Windows account. For seek method 4, vKey specifies a numeric string index (for example, "1," "2," and so on).
NtPwd [in]
Specifies a new value for the Windows password string.

Related Topics
  • For more information about the IIS WMI Provider, see Using the IIS WMI Provider.
  • For detailed examples of scripts that use the properties and methods of the Windows WMI provider to access the IIS WMI provider, see Module 3: Writing Administration Scripts that Use WMI of the IIS WMI Provider Tutorial.
  • For basic examples in VBScript, JScript, and Perl, see Code Examples to Configure Metabase Properties.
  • Your installation of IIS 6.0 includes command-line administration scripts that manage IIS. See Using Command-Line Administration Scripts.


IIsCompressionScheme (WMI)

This class corresponds to the IIsCompressionScheme IIS Admin object, and contains the methods and read-only properties for the object.

Parent Class

CIM_LogicalElement (WMI)

Properties

The table below lists properties other than those that are inherited from parent classes.

Property Name | Data Type | Description
Name | String | The Name property defines the label by which the object is known. When subclassed, the Name property can be overridden to be a Key property.
Related Topics
  • For more information about the IIS WMI Provider, see Using the IIS WMI Provider.
  • For detailed examples of scripts that use the properties and methods of the Windows WMI provider to access the IIS WMI provider, see Module 3: Writing Administration Scripts that Use WMI of the IIS WMI Provider Tutorial.
  • For basic examples in VBScript, JScript, and Perl, see Code Examples to Configure Metabase Properties.
  • Your installation of IIS 6.0 includes command-line administration scripts that manage IIS. See Using Command-Line Administration Scripts.


IIsCompressionSchemes (WMI)

This class corresponds to the IIsCompressionSchemes IIS Admin object, and contains the methods and read-only properties for the object.

Parent Class

CIM_LogicalElement (WMI)

Properties

The table below lists properties other than those that are inherited from parent classes.

Property Name | Data Type | Description
Name | String | The Name property defines the label by which the object is known. When subclassed, the Name property can be overridden to be a Key property.
Related Topics
  • For more information about the IIS WMI Provider, see Using the IIS WMI Provider.
  • For detailed examples of scripts that use the properties and methods of the Windows WMI provider to access the IIS WMI provider, see Module 3: Writing Administration Scripts that Use WMI of the IIS WMI Provider Tutorial.
  • For basic examples in VBScript, JScript, and Perl, see Code Examples to Configure Metabase Properties.
  • Your installation of IIS 6.0 includes command-line administration scripts that manage IIS. See Using Command-Line Administration Scripts.


IIsCustomLogModule (WMI)

This class corresponds to the IIsCustomLogModule IIS Admin object, and contains the methods and read-only properties for the object.

Parent Class

CIM_LogicalElement (WMI)

Properties

The table below lists properties other than those that are inherited from parent classes.

Property Name | Data Type | Description
Name | String | The Name property defines the label by which the object is known. When subclassed, the Name property can be overridden to be a Key property.
Related Topics
  • For more information about the IIS WMI Provider, see Using the IIS WMI Provider.
  • For detailed examples of scripts that use the properties and methods of the Windows WMI provider to access the IIS WMI provider, see Module 3: Writing Administration Scripts that Use WMI of the IIS WMI Provider Tutorial.
  • For basic examples in VBScript, JScript, and Perl, see Code Examples to Configure Metabase Properties.
  • Your installation of IIS 6.0 includes command-line administration scripts that manage IIS. See Using Command-Line Administration Scripts.


IIsDirectory (WMI)

This class takes advantage of the way classes in WMI automatically inherit characteristics from WMI regular classes to pass on to child classes. Use the child classes IIsWebDirectory (WMI), IIsFtpVirtualDir (WMI), IIsWebFile (WMI), and IIsWebVirtualDir (WMI)

Parent Class

CIM_LogicalElement (WMI)

Properties

The table below lists properties other than those that are inherited from parent classes.

Property Name | Data Type | Description
Name | String | The Name property defines the label by which the object is known. When subclassed, the Name property can be overridden to be a Key property.
Related Topics
  • For more information about the IIS WMI Provider, see Using the IIS WMI Provider.
  • For detailed examples of scripts that use the properties and methods of the Windows WMI provider to access the IIS WMI provider, see Module 3: Writing Administration Scripts that Use WMI of the IIS WMI Provider Tutorial.
  • For basic examples in VBScript, JScript, and Perl, see Code Examples to Configure Metabase Properties.
  • Your installation of IIS 6.0 includes command-line administration scripts that manage IIS. See Using Command-Line Administration Scripts.


IIsFtpVirtualDir (WMI)

This class corresponds to the IIsFtpVirtualDir IIS Admin object, and contains the methods and read-only properties for the object.

Parent Class

IIsDirectory (WMI)

Properties

This class inherits only properties from the parent classes.

Related Topics
  • For more information about the IIS WMI Provider, see Using the IIS WMI Provider.
  • For detailed examples of scripts that use the properties and methods of the Windows WMI provider to access the IIS WMI provider, see Module 3: Writing Administration Scripts that Use WMI of the IIS WMI Provider Tutorial.
  • For basic examples in VBScript, JScript, and Perl, see Code Examples to Configure Metabase Properties.
  • Your installation of IIS 6.0 includes command-line administration scripts that manage IIS. See Using Command-Line Administration Scripts.


IIsWebDirectory (WMI)

This class corresponds to the IIsWebDirectory IIS Admin object, and contains the methods and read-only properties for the object.

Parent Class

IIsDirectory (WMI)

Methods

The table below lists the methods for this class.

Method Name | Return Data Type | Description
IIsWebDirectory.AppCreate (WMI) | void | The AppCreate method of the IIsWebDirectory (WMI) or IIsWebVirtualDir (WMI) object creates a Web application definition and mark it as running in-process or out-of-process. If an application already exists at the specified path, you can use this method to reconfigure the application from in-process to out-of-process, or the reverse.
IIsWebDirectory.AppCreate2 (WMI) | void | The AppCreate2 method of the IIsWebDirectory (WMI) or IIsWebVirtualDir (WMI) object creates a Web application definition and mark it as running in-process, out-of-process, or in a process pool. If an application already exists at the specified path, you can use this method to reconfigure the application to run in whatever process space you want.
IIsWebDirectory.AppCreate3 (WMI) | void | The AppCreate3 method of the IIsWebDirectory (WMI) or IIsWebVirtualDir (WMI) object creates a Web application definition and mark it as running in-process, out-of-process, or in a process pool. If an application already exists at the specified path, you can use this method to reconfigure the application to run in whatever process space you want.
IIsWebDirectory.AppDelete (WMI) | void | The AppDelete method of the IIsWebDirectory (WMI) or IIsWebVirtualDir (WMI) object deletes a Web application definition from a metabase key. If the application is running, it will be shut down. If the application is in-process with IIS, all resources associated with the application (such as out-of-process applications) will be released if the resource is not referenced by another in-process application. note Note Server component DLLs are not released from in-process applications, even if they are not currently referenced by other applications. Deletions performed by using AppDelete cannot be undone.
IIsWebDirectory.AppUnLoad (WMI) | void | The AppUnload method of the IIsWebDirectory (WMI) or IIsWebVirtualDir (WMI) object unloads a Web application that is running out-of-process. All of the application's resources are released and the application's process is terminated. If the application is running in-process, the application is released, if it is not being referenced by any other applications. note Note Server component DLLs are not released from in-process applications, even if they aren't currently referenced by other applications.
IIsWebDirectory.AppDisable (WMI) | void | The AppDisable method of the IIsWebDirectory (WMI) or IIsWebVirtualDir (WMI) object disables a Web application that is running out-of-process. All of the application's resources are released and the application's process is terminated. Attempts to access this application will fail. The AppEnable method to re-enable a disabled application. Both methods are used primarily when moving, copying, or renaming metabase keys. The AppDisable method has no effect if the application is running in-process.
IIsWebDirectory.AppEnable (WMI) | void | The AppEnable method of the IIsWebDirectory (WMI) or IIsWebVirtualDir (WMI) object reinstates a Web application definition that was previously disabled with the AppDisable method. If the application specified was not previously deleted, it will be reregistered with Component Services.
IIsWebDirectory.AppGetStatus (WMI) | uint32 | The AppGetStatus method of the IIsWebDirectory (WMI) or IIsWebVirtualDir (WMI) object retrieves the current status of a Web application.
IIsWebDirectory.AspAppRestart (WMI) | void | The AspAppRestart method of the IIsWebDirectory (WMI) or IIsWebVirtualDir (WMI) object restarts ASP applications. Users can use this method to restart ASP applications without accessing the Global.asa file or stopping and starting the World Wide Web Publishing Service (WWW service) itself. Essentially, a user can restart the application on demand.
Properties

The table below lists properties other than those that are inherited from parent classes.

Property Name | Data Type | Description
AppRoot | String | See AppRoot in the Metabase Property Reference.
AppIsolated | SINT32 | See AppIsolated in the Metabase Property Reference.
AppPackageName | String | See AppPackageName in the Metabase Property Reference.
AppPackageID | String | See AppPackageID in the Metabase Property Reference.
Related Topics
  • For more information about the IIS WMI Provider, see Using the IIS WMI Provider.
  • For detailed examples of scripts that use the properties and methods of the Windows WMI provider to access the IIS WMI provider, see Module 3: Writing Administration Scripts that Use WMI of the IIS WMI Provider Tutorial.
  • For basic examples in VBScript, JScript, and Perl, see Code Examples to Configure Metabase Properties.
  • Your installation of IIS 6.0 includes command-line administration scripts that manage IIS. See Using Command-Line Administration Scripts.


IIsWebDirectory.AppCreate (WMI)

The AppCreate method of the IIsWebDirectory (WMI) or IIsWebVirtualDir (WMI) object creates a Web application definition and mark it as running in-process or out-of-process. If an application already exists at the specified path, you can use this method to reconfigure the application from in-process to out-of-process, or the reverse.

Syntax

return_value = object.AppCreate

(
Boolean InProcFlag
)
Parameters

InProcFlag [in]
Specifies whether the application being created is to run in-process (true) or out-of-process (false). If the application already exists and is running in-process, specifying this flag as false will cause the application definition to be deleted and a new application created to run out-of-process. If the application already exists and is running out-of-process, specifying this flag as true will cause the application definition to be deleted and a new application created to run in-process. If the application exists, and the setting of InProcFlag matches the application's existing in-process or out-of-process status, then this method will cause no change to the application definition.

Related Topics
  • For more information about the IIS WMI Provider, see Using the IIS WMI Provider.
  • For detailed examples of scripts that use the properties and methods of the Windows WMI provider to access the IIS WMI provider, see Module 3: Writing Administration Scripts that Use WMI of the IIS WMI Provider Tutorial.
  • For basic examples in VBScript, JScript, and Perl, see Code Examples to Configure Metabase Properties.
  • Your installation of IIS 6.0 includes command-line administration scripts that manage IIS. See Using Command-Line Administration Scripts.


IIsWebDirectory.AppCreate2 (WMI)

The AppCreate2 method of the IIsWebDirectory (WMI) or IIsWebVirtualDir (WMI) object creates a Web application definition and mark it as running in-process, out-of-process, or in a process pool. If an application already exists at the specified path, you can use this method to reconfigure the application to run in whatever process space you want.

Syntax

return_value = object.AppCreate2

(
SINT32 AppMode
)
Parameters

AppMode [in]
Binary value that specifies whether the application being created is to run in-process (0), out-of-process (1), or in a pooled process (2). If the application already exists and is running, changing the value of this flag will cause the application definition to be deleted and a new application created to run in the specified process space.

Related Topics
  • For more information about the IIS WMI Provider, see Using the IIS WMI Provider.
  • For detailed examples of scripts that use the properties and methods of the Windows WMI provider to access the IIS WMI provider, see Module 3: Writing Administration Scripts that Use WMI of the IIS WMI Provider Tutorial.
  • For basic examples in VBScript, JScript, and Perl, see Code Examples to Configure Metabase Properties.
  • Your installation of IIS 6.0 includes command-line administration scripts that manage IIS. See Using Command-Line Administration Scripts.


IIsWebDirectory.AppCreate3 (WMI)

The AppCreate3 method of the IIsWebDirectory (WMI) or IIsWebVirtualDir (WMI) object creates a Web application definition and mark it as running in-process, out-of-process, or in a process pool. If an application already exists at the specified path, you can use this method to reconfigure the application to run in whatever process space you want.

Syntax

return_value = object.AppCreate3

(
SINT32 AppMode,
String AppPoolName,
Boolean bCreate
)
Parameters

AppMode [in]
Binary value that specifies whether the application being created is to run in-process (0), out-of-process (1), or in a pooled process (2). If the application already exists and is running, changing the value of this flag will cause the application definition to be deleted and a new application created to run in the specified process space.
AppPoolName [in]
A string that specifies the friendly name of the application pool you want this application to be a part of.
bCreate [in]
A boolean value that specifies if you want to create a root virtual directory in the new application.

Related Topics
  • For more information about the IIS WMI Provider, see Using the IIS WMI Provider.
  • For detailed examples of scripts that use the properties and methods of the Windows WMI provider to access the IIS WMI provider, see Module 3: Writing Administration Scripts that Use WMI of the IIS WMI Provider Tutorial.
  • For basic examples in VBScript, JScript, and Perl, see Code Examples to Configure Metabase Properties.
  • Your installation of IIS 6.0 includes command-line administration scripts that manage IIS. See Using Command-Line Administration Scripts.


IIsWebDirectory.AppDelete (WMI)

The AppDelete method of the IIsWebDirectory (WMI) or IIsWebVirtualDir (WMI) object deletes a Web application definition from a metabase key. If the application is running, it will be shut down. If the application is in-process with IIS, all resources associated with the application (such as out-of-process applications) will be released if the resource is not referenced by another in-process application.

note Note Server component DLLs are not released from in-process applications, even if they are not currently referenced by other applications.

Deletions performed by using AppDelete cannot be undone.

Syntax

return_value = object.AppDelete

(
Boolean Recursive
)
Parameters

Recursive [in]
A value of true causes AppDelete to delete the application at the specified metabase keys and all sub-keys.

Related Topics
  • For more information about the IIS WMI Provider, see Using the IIS WMI Provider.
  • For detailed examples of scripts that use the properties and methods of the Windows WMI provider to access the IIS WMI provider, see Module 3: Writing Administration Scripts that Use WMI of the IIS WMI Provider Tutorial.
  • For basic examples in VBScript, JScript, and Perl, see Code Examples to Configure Metabase Properties.
  • Your installation of IIS 6.0 includes command-line administration scripts that manage IIS. See Using Command-Line Administration Scripts.


IIsWebDirectory.AppDisable (WMI)

The AppDisable method of the IIsWebDirectory (WMI) or IIsWebVirtualDir (WMI) object disables a Web application that is running out-of-process. All of the application's resources are released and the application's process is terminated. Attempts to access this application will fail. The AppEnable method to re-enable a disabled application. Both methods are used primarily when moving, copying, or renaming metabase keys. The AppDisable method has no effect if the application is running in-process.

Syntax

return_value = object.AppDisable

(
Boolean Recursive
)
Parameters

Recursive [in]
A value of true causes AppDisable to disable the application at the specified metabase keys and all sub-keys.

Related Topics
  • For more information about the IIS WMI Provider, see Using the IIS WMI Provider.
  • For detailed examples of scripts that use the properties and methods of the Windows WMI provider to access the IIS WMI provider, see Module 3: Writing Administration Scripts that Use WMI of the IIS WMI Provider Tutorial.
  • For basic examples in VBScript, JScript, and Perl, see Code Examples to Configure Metabase Properties.
  • Your installation of IIS 6.0 includes command-line administration scripts that manage IIS. See Using Command-Line Administration Scripts.


IIsWebDirectory.AppEnable (WMI)

The AppEnable method of the IIsWebDirectory (WMI) or IIsWebVirtualDir (WMI) object reinstates a Web application definition that was previously disabled with the AppDisable method. If the application specified was not previously deleted, it will be reregistered with Component Services.

Syntax

return_value = object.AppEnable

(
Boolean Recursive
)
Parameters

Recursive [in]
A value of true causes AppEnable to enable the application at the specified metabase keys and all sub-keys.

Related Topics
  • For more information about the IIS WMI Provider, see Using the IIS WMI Provider.
  • For detailed examples of scripts that use the properties and methods of the Windows WMI provider to access the IIS WMI provider, see Module 3: Writing Administration Scripts that Use WMI of the IIS WMI Provider Tutorial.
  • For basic examples in VBScript, JScript, and Perl, see Code Examples to Configure Metabase Properties.
  • Your installation of IIS 6.0 includes command-line administration scripts that manage IIS. See Using Command-Line Administration Scripts.


IIsWebDirectory.AppGetStatus (WMI)

The AppGetStatus method of the IIsWebDirectory (WMI) or IIsWebVirtualDir (WMI) object retrieves the current status of a Web application.

Syntax

return_value = object.AppGetStatus

Parameters

There are no parameters for this method.

Related Topics
  • For more information about the IIS WMI Provider, see Using the IIS WMI Provider.
  • For detailed examples of scripts that use the properties and methods of the Windows WMI provider to access the IIS WMI provider, see Module 3: Writing Administration Scripts that Use WMI of the IIS WMI Provider Tutorial.
  • For basic examples in VBScript, JScript, and Perl, see Code Examples to Configure Metabase Properties.
  • Your installation of IIS 6.0 includes command-line administration scripts that manage IIS. See Using Command-Line Administration Scripts.


IIsWebDirectory.AppUnLoad (WMI)

The AppUnload method of the IIsWebDirectory (WMI) or IIsWebVirtualDir (WMI) object unloads a Web application that is running out-of-process. All of the application's resources are released and the application's process is terminated. If the application is running in-process, the application is released, if it is not being referenced by any other applications.

note Note Server component DLLs are not released from in-process applications, even if they aren't currently referenced by other applications.

Syntax

return_value = object.AppUnLoad

(
Boolean Recursive
)
Parameters

Recursive [in]
A value of true causes AppUnLoad to unload the application at the specified metabase keys and all sub-keys.

Related Topics
  • For more information about the IIS WMI Provider, see Using the IIS WMI Provider.
  • For detailed examples of scripts that use the properties and methods of the Windows WMI provider to access the IIS WMI provider, see Module 3: Writing Administration Scripts that Use WMI of the IIS WMI Provider Tutorial.
  • For basic examples in VBScript, JScript, and Perl, see Code Examples to Configure Metabase Properties.
  • Your installation of IIS 6.0 includes command-line administration scripts that manage IIS. See Using Command-Line Administration Scripts.


IIsWebDirectory.AspAppRestart (WMI)

The AspAppRestart method of the IIsWebDirectory (WMI) or IIsWebVirtualDir (WMI) object restarts ASP applications. Users can use this method to restart ASP applications without accessing the Global.asa file or stopping and starting the World Wide Web Publishing Service (WWW service) itself. Essentially, a user can restart the application on demand.

Syntax

return_value = object.AspAppRestart

Parameters

There are no parameters for this method.

Related Topics
  • For more information about the IIS WMI Provider, see Using the IIS WMI Provider.
  • For detailed examples of scripts that use the properties and methods of the Windows WMI provider to access the IIS WMI provider, see Module 3: Writing Administration Scripts that Use WMI of the IIS WMI Provider Tutorial.
  • For basic examples in VBScript, JScript, and Perl, see Code Examples to Configure Metabase Properties.
  • Your installation of IIS 6.0 includes command-line administration scripts that manage IIS. See Using Command-Line Administration Scripts.


IIsWebFile (WMI)

This class corresponds to the IIsWebFile IIS Admin object, and contains the methods and read-only properties for the object.

Parent Class

IIsDirectory (WMI)

Properties

This class inherits only properties from the parent classes.

Related Topics
  • For more information about the IIS WMI Provider, see Using the IIS WMI Provider.
  • For detailed examples of scripts that use the properties and methods of the Windows WMI provider to access the IIS WMI provider, see Module 3: Writing Administration Scripts that Use WMI of the IIS WMI Provider Tutorial.
  • For basic examples in VBScript, JScript, and Perl, see Code Examples to Configure Metabase Properties.
  • Your installation of IIS 6.0 includes command-line administration scripts that manage IIS. See Using Command-Line Administration Scripts.


IIsWebVirtualDir (WMI)

This class corresponds to the IIsWebVirtualDir IIS Admin object, and contains the methods and read-only properties for the object.

Parent Class

IIsDirectory (WMI)

Methods

The table below lists the methods for this class.

Method Name | Return Data Type | Description
IIsWebVirtualDir.AppCreate (WMI) | void | The AppCreate method of the IIsWebDirectory (WMI) or IIsWebVirtualDir (WMI) object creates a Web application definition and marks it as running in-process or out-of-process. If an application already exists at the specified path, you can use this method to reconfigure the application from in-process to out-of-process, or the reverse.
IIsWebVirtualDir.AppCreate2 (WMI) | void | The AppCreate2 method of the IIsWebDirectory (WMI) or IIsWebVirtualDir (WMI) object creates a Web application definition and marks it as running in-process, out-of-process, or in a process pool. If an application already exists at the specified path, you can use this method to reconfigure the application to run in whatever process space you want.
IIsWebVirtualDir.AppCreate3 (WMI) | void | The AppCreate3 method of the IIsWebDirectory (WMI) or IIsWebVirtualDir (WMI) object creates a Web application definition and marks it as running in-process, out-of-process, or in a process pool. If an application already exists at the specified path, you can use this method to reconfigure the application to run in whatever process space you want.
IIsWebVirtualDir.AppDelete (WMI) | void | The AppDelete method of the IIsWebDirectory (WMI) or IIsWebVirtualDir (WMI) object deletes a Web application definition from a metabase key. If the application is running, it will be shut down. If the application is in-process with IIS, all resources associated with the application (such as out-of-process applications) will be released if the resource is not referenced by another in-process application. note Note Server component DLLs are not released from in-process applications, even if they are not currently referenced by other applications. Deletions performed by using AppDelete cannot be undone.
IIsWebVirtualDir.AppUnLoad (WMI) | void | The AppUnload method of the IIsWebDirectory (WMI) or IIsWebVirtualDir (WMI) object unloads a Web application that is running out-of-process. All of the application's resources are released and the application's process is terminated. If the application is running in-process, the application is released, if it is not being referenced by any other applications. note Note Server component DLLs are not released from in-process applications, even if they aren't currently referenced by other applications.
IIsWebVirtualDir.AppDisable (WMI) | void | The AppDisable method of the IIsWebDirectory (WMI) or IIsWebVirtualDir (WMI) object disables a Web application that is running out-of-process. All of the application's resources are released and the application's process is terminated. Attempts to access this application will fail. The AppEnable method reenables a disabled application. Both methods are used primarily when moving, copying, or renaming metabase keys. The AppDisable method has no effect if the application is running in-process.
IIsWebVirtualDir.AppEnable (WMI) | void | The AppEnable method of the IIsWebDirectory (WMI) or IIsWebVirtualDir (WMI) object reinstates a Web application definition that was previously disabled with the AppDisable method. If the application specified was not previously deleted, it will be reregistered with Component Services.
IIsWebVirtualDir.AppGetStatus (WMI) | uint32 | The AppGetStatus method of the IIsWebDirectory (WMI) or IIsWebVirtualDir (WMI) object retrieves the current status of a Web application.
IIsWebVirtualDir.AspAppRestart (WMI) | void | The AspAppRestart method of the IIsWebDirectory (WMI) or IIsWebVirtualDir (WMI) object restarts ASP applications. Users can use this method to restart ASP applications without accessing the Global.asa file or stopping and starting the World Wide Web Publishing Service (WWW service) itself. Essentially, a user can restart the application on demand.
Properties

The table below lists properties other than those that are inherited from parent classes.

Property Name | Data Type | Description
AppRoot | String | See AppRoot in the Metabase Property Reference.
AppIsolated | SINT32 | See AppIsolated in the Metabase Property Reference.
AppPackageName | String | See AppPackageName in the Metabase Property Reference.
AppPackageID | String | See AppPackageID in the Metabase Property Reference.
Related Topics
  • For more information about the IIS WMI Provider, see Using the IIS WMI Provider.
  • For detailed examples of scripts that use the properties and methods of the Windows WMI provider to access the IIS WMI provider, see Module 3: Writing Administration Scripts that Use WMI of the IIS WMI Provider Tutorial.
  • For basic examples in VBScript, JScript, and Perl, see Code Examples to Configure Metabase Properties.
  • Your installation of IIS 6.0 includes command-line administration scripts that manage IIS. See Using Command-Line Administration Scripts.


IIsWebVirtualDir.AppCreate (WMI)

The AppCreate method of the IIsWebDirectory (WMI) or IIsWebVirtualDir (WMI) object creates a Web application definition and marks it as running in-process or out-of-process. If an application already exists at the specified path, you can use this method to reconfigure the application from in-process to out-of-process, or the reverse.

Syntax

return_value = object.AppCreate

(
Boolean InProcFlag
)
Parameters

InProcFlag [in]
Specifies whether the application being created is to run in-process (true) or out-of-process (false). If the application already exists and is running in-process, specifying this flag as false will cause the application definition to be deleted and a new application created to run out-of-process. If the application already exists and is running out-of-process, specifying this flag as true will cause the application definition to be deleted and a new application created to run in-process. If the application exists, and the setting of InProcFlag matches the application's existing in-process or out-of-process status, then this method will cause no change to the application definition.

Related Topics
  • For more information about the IIS WMI Provider, see Using the IIS WMI Provider.
  • For detailed examples of scripts that use the properties and methods of the Windows WMI provider to access the IIS WMI provider, see Module 3: Writing Administration Scripts that Use WMI of the IIS WMI Provider Tutorial.
  • For basic examples in VBScript, JScript, and Perl, see Code Examples to Configure Metabase Properties.
  • Your installation of IIS 6.0 includes command-line administration scripts that manage IIS. See Using Command-Line Administration Scripts.


IIsWebVirtualDir.AppCreate2 (WMI)

The AppCreate2 method of the IIsWebDirectory (WMI) or IIsWebVirtualDir (WMI) object creates a Web application definition and marks it as running in-process, out-of-process, or in a process pool. If an application already exists at the specified path, you can use this method to reconfigure the application to run in whatever process space you want.

Syntax

return_value = object.AppCreate2

(
SINT32 AppMode
)
Parameters

AppMode [in]
Binary value that specifies whether the application being created is to run in-process (0), out-of-process (1), or in a pooled process (2). If the application already exists and is running, changing the value of this flag will cause the application definition to be deleted and a new application created to run in the specified process space.

Related Topics
  • For more information about the IIS WMI Provider, see Using the IIS WMI Provider.
  • For detailed examples of scripts that use the properties and methods of the Windows WMI provider to access the IIS WMI provider, see Module 3: Writing Administration Scripts that Use WMI of the IIS WMI Provider Tutorial.
  • For basic examples in VBScript, JScript, and Perl, see Code Examples to Configure Metabase Properties.
  • Your installation of IIS 6.0 includes command-line administration scripts that manage IIS. See Using Command-Line Administration Scripts.


IIsWebVirtualDir.AppCreate3 (WMI)

The AppCreate3 method of the IIsWebDirectory (WMI) or IIsWebVirtualDir (WMI) object creates a Web application definition and marks it as running in-process, out-of-process, or in a process pool. If an application already exists at the specified path, you can use this method to reconfigure the application to run in whatever process space you want.

Syntax

return_value = object.AppCreate3

(
SINT32 AppMode,
String AppPoolName,
Boolean bCreate
)
Parameters

AppMode [in]
Binary value that specifies whether the application being created is to run in-process (0), out-of-process (1), or in a pooled process (2). If the application already exists and is running, changing the value of this flag will cause the application definition to be deleted and a new application created to run in the specified process space.
AppPoolName [in]
A string that specifies the friendly name of the application pool you want this application to be a part of.
bCreate [in]
A boolean value that specifies if you want to create a root virtual directory in the new application.

Related Topics
  • For more information about the IIS WMI Provider, see Using the IIS WMI Provider.
  • For detailed examples of scripts that use the properties and methods of the Windows WMI provider to access the IIS WMI provider, see Module 3: Writing Administration Scripts that Use WMI of the IIS WMI Provider Tutorial.
  • For basic examples in VBScript, JScript, and Perl, see Code Examples to Configure Metabase Properties.
  • Your installation of IIS 6.0 includes command-line administration scripts that manage IIS. See Using Command-Line Administration Scripts.


IIsWebVirtualDir.AppDelete (WMI)

The AppDelete method of the IIsWebDirectory (WMI) or IIsWebVirtualDir (WMI) object deletes a Web application definition from a metabase key. If the application is running, it will be shut down. If the application is in-process with IIS, all resources associated with the application (such as out-of-process applications) will be released if the resource is not referenced by another in-process application.

note Note Server component DLLs are not released from in-process applications, even if they are not currently referenced by other applications.

Deletions performed by using AppDelete cannot be undone.

Syntax

return_value = object.AppDelete

(
Boolean Recursive
)
Parameters

Recursive [in]
A value of true causes AppDelete to delete the application at the specified metabase keys and all sub-keys.

Related Topics
  • For more information about the IIS WMI Provider, see Using the IIS WMI Provider.
  • For detailed examples of scripts that use the properties and methods of the Windows WMI provider to access the IIS WMI provider, see Module 3: Writing Administration Scripts that Use WMI of the IIS WMI Provider Tutorial.
  • For basic examples in VBScript, JScript, and Perl, see Code Examples to Configure Metabase Properties.
  • Your installation of IIS 6.0 includes command-line administration scripts that manage IIS. See Using Command-Line Administration Scripts.


IIsWebVirtualDir.AppDisable (WMI)

The AppDisable method of the IIsWebDirectory (WMI) or IIsWebVirtualDir (WMI) object disables a Web application that is running out-of-process. All of the application's resources are released and the application's process is terminated. Attempts to access this application will fail. The AppEnable method reenables a disabled application. Both methods are used primarily when moving, copying, or renaming metabase keys. The AppDisable method has no effect if the application is running in-process.

Syntax

return_value = object.AppDisable

(
Boolean Recursive
)
Parameters

Recursive [in]
A value of true causes AppDisable to disable the application at the specified metabase keys and all sub-keys.

Related Topics
  • For more information about the IIS WMI Provider, see Using the IIS WMI Provider.
  • For detailed examples of scripts that use the properties and methods of the Windows WMI provider to access the IIS WMI provider, see Module 3: Writing Administration Scripts that Use WMI of the IIS WMI Provider Tutorial.
  • For basic examples in VBScript, JScript, and Perl, see Code Examples to Configure Metabase Properties.
  • Your installation of IIS 6.0 includes command-line administration scripts that manage IIS. See Using Command-Line Administration Scripts.


IIsWebVirtualDir.AppEnable (WMI)

The AppEnable method of the IIsWebDirectory (WMI) or IIsWebVirtualDir (WMI) object reinstates a Web application definition that was previously disabled with the AppDisable method. If the application specified was not previously deleted, it will be reregistered with Component Services.

Syntax

return_value = object.AppEnable

(
Boolean Recursive
)
Parameters

Recursive [in]
A value of true causes AppEnable to enable the application at the specified metabase keys and all sub-keys.

Related Topics
  • For more information about the IIS WMI Provider, see Using the IIS WMI Provider.
  • For detailed examples of scripts that use the properties and methods of the Windows WMI provider to access the IIS WMI provider, see Module 3: Writing Administration Scripts that Use WMI of the IIS WMI Provider Tutorial.
  • For basic examples in VBScript, JScript, and Perl, see Code Examples to Configure Metabase Properties.
  • Your installation of IIS 6.0 includes command-line administration scripts that manage IIS. See Using Command-Line Administration Scripts.


IIsWebVirtualDir.AppGetStatus (WMI)

The AppGetStatus method of the IIsWebDirectory (WMI) or IIsWebVirtualDir (WMI) object retrieves the current status of a Web application.

Syntax

return_value = object.AppGetStatus

Parameters

There are no parameters for this method.

Related Topics
  • For more information about the IIS WMI Provider, see Using the IIS WMI Provider.
  • For detailed examples of scripts that use the properties and methods of the Windows WMI provider to access the IIS WMI provider, see Module 3: Writing Administration Scripts that Use WMI of the IIS WMI Provider Tutorial.
  • For basic examples in VBScript, JScript, and Perl, see Code Examples to Configure Metabase Properties.
  • Your installation of IIS 6.0 includes command-line administration scripts that manage IIS. See Using Command-Line Administration Scripts.


IIsWebVirtualDir.AppUnLoad (WMI)

The AppUnload method of the IIsWebDirectory (WMI) or IIsWebVirtualDir (WMI) object unloads a Web application that is running out-of-process. All of the application's resources are released and the application's process is terminated. If the application is running in-process, the application is released, if it is not being referenced by any other applications.

note Note Server component DLLs are not released from in-process applications, even if they aren't currently referenced by other applications.

Syntax

return_value = object.AppUnLoad

(
Boolean Recursive
)
Parameters

Recursive [in]
A value of true causes AppUnLoad to unload the application at the specified metabase keys and all sub-keys.

Related Topics
  • For more information about the IIS WMI Provider, see Using the IIS WMI Provider.
  • For detailed examples of scripts that use the properties and methods of the Windows WMI provider to access the IIS WMI provider, see Module 3: Writing Administration Scripts that Use WMI of the IIS WMI Provider Tutorial.
  • For basic examples in VBScript, JScript, and Perl, see Code Examples to Configure Metabase Properties.
  • Your installation of IIS 6.0 includes command-line administration scripts that manage IIS. See Using Command-Line Administration Scripts.


IIsWebVirtualDir.AspAppRestart (WMI)

The AspAppRestart method of the IIsWebDirectory (WMI) or IIsWebVirtualDir (WMI) object restarts ASP applications. Users can use this method to restart ASP applications without accessing the Global.asa file or stopping and starting theWorld Wide Web Publishing Service (WWW service) itself. Essentially, a user can restart the application on demand.

Syntax

return_value = object.AspAppRestart

Parameters

There are no parameters for this method.

Related Topics
  • For more information about the IIS WMI Provider, see Using the IIS WMI Provider.
  • For detailed examples of scripts that use the properties and methods of the Windows WMI provider to access the IIS WMI provider, see Module 3: Writing Administration Scripts that Use WMI of the IIS WMI Provider Tutorial.
  • For basic examples in VBScript, JScript, and Perl, see Code Examples to Configure Metabase Properties.
  • Your installation of IIS 6.0 includes command-line administration scripts that manage IIS. See Using Command-Line Administration Scripts.


IIsFilter (WMI)

This class corresponds to the IIsFilter IIS Admin object, and contains the methods and read-only properties for the object.

Parent Class

CIM_LogicalElement (WMI)

Properties

The table below lists properties other than those that are inherited from parent classes.

Property Name | Data Type | Description
Name | String | The Name property defines the label by which the object is known. When subclassed, the Name property can be overridden to be a Key property.
Related Topics
  • For more information about the IIS WMI Provider, see Using the IIS WMI Provider.
  • For detailed examples of scripts that use the properties and methods of the Windows WMI provider to access the IIS WMI provider, see Module 3: Writing Administration Scripts that Use WMI of the IIS WMI Provider Tutorial.
  • For basic examples in VBScript, JScript, and Perl, see Code Examples to Configure Metabase Properties.
  • Your installation of IIS 6.0 includes command-line administration scripts that manage IIS. See Using Command-Line Administration Scripts.


IIsFilters (WMI)

This class corresponds to the IIsFilters IIS Admin object, and contains the methods and read-only properties for the object.

Parent Class

CIM_LogicalElement (WMI)

Properties

The table below lists properties other than those that are inherited from parent classes.

Property Name | Data Type | Description
Name | String | The Name property defines the label by which the object is known. When subclassed, the Name property can be overridden to be a Key property.
Related Topics
  • For more information about the IIS WMI Provider, see Using the IIS WMI Provider.
  • For detailed examples of scripts that use the properties and methods of the Windows WMI provider to access the IIS WMI provider, see Module 3: Writing Administration Scripts that Use WMI of the IIS WMI Provider Tutorial.
  • For basic examples in VBScript, JScript, and Perl, see Code Examples to Configure Metabase Properties.
  • Your installation of IIS 6.0 includes command-line administration scripts that manage IIS. See Using Command-Line Administration Scripts.


IIsFtpInfo (WMI)

This class corresponds to the IIsFtpInfo IIS Admin object, and contains the methods and read-only properties for the object.

Parent Class

CIM_LogicalElement (WMI)

Properties

The table below lists properties other than those that are inherited from parent classes.

Property Name | Data Type | Description
Name | String | The Name property defines the label by which the object is known. When subclassed, the Name property can be overridden to be a Key property.
MajorIIsVersionNumber | SINT32 | See MajorIIsVersionNumber in the Metabase Property Reference.
MinorIIsVersionNumber | SINT32 | See MinorIIsVersionNumber in the Metabase Property Reference.
Related Topics
  • For more information about the IIS WMI Provider, see Using the IIS WMI Provider.
  • For detailed examples of scripts that use the properties and methods of the Windows WMI provider to access the IIS WMI provider, see Module 3: Writing Administration Scripts that Use WMI of the IIS WMI Provider Tutorial.
  • For basic examples in VBScript, JScript, and Perl, see Code Examples to Configure Metabase Properties.
  • Your installation of IIS 6.0 includes command-line administration scripts that manage IIS. See Using Command-Line Administration Scripts.


IIsFtpServer (WMI)

This class corresponds to the IIsFtpServer IIS Admin object, and contains the methods and read-only properties for the object.

Parent Class

CIM_LogicalElement (WMI)

Methods

The table below lists the methods for this class.

Method Name | Return Data Type | Description
IIsFtpServer.Start (WMI) | void | The Start method starts the FTP site that is referenced by the object.
IIsFtpServer.Stop (WMI) | void | The Stop method stops the FTP site that is referenced by the object.
IIsFtpServer.Continue (WMI) | void | The Continue method continues the paused FTP site that is referenced by the object.
IIsFtpServer.Pause (WMI) | void | The Pause method pauses the FTP site that is referenced by the object.
Properties

The table below lists properties other than those that are inherited from parent classes.

Property Name | Data Type | Description
Name | String | The Name property defines the label by which the object is known. When subclassed, the Name property can be overridden to be a Key property.
ServerState | SINT32 | See ServerState in the Metabase Property Reference.
Related Topics
  • For more information about the IIS WMI Provider, see Using the IIS WMI Provider.
  • For detailed examples of scripts that use the properties and methods of the Windows WMI provider to access the IIS WMI provider, see Module 3: Writing Administration Scripts that Use WMI of the IIS WMI Provider Tutorial.
  • For basic examples in VBScript, JScript, and Perl, see Code Examples to Configure Metabase Properties.
  • Your installation of IIS 6.0 includes command-line administration scripts that manage IIS. See Using Command-Line Administration Scripts.


IIsFtpServer.Continue (WMI)

The Continue method of the IIsFtpServer (WMI) object continues the paused FTP site that is referenced by the object.

Syntax

return_value = object.Continue

Parameters

There are no parameters for this method.

Related Topics
  • For more information about the IIS WMI Provider, see Using the IIS WMI Provider.
  • For detailed examples of scripts that use the properties and methods of the Windows WMI provider to access the IIS WMI provider, see Module 3: Writing Administration Scripts that Use WMI of the IIS WMI Provider Tutorial.
  • For basic examples in VBScript, JScript, and Perl, see Code Examples to Configure Metabase Properties.
  • Your installation of IIS 6.0 includes command-line administration scripts that manage IIS. See Using Command-Line Administration Scripts.


IIsFtpServer.Pause (WMI)

The Pause method of the IIsFtpServer (WMI) object pauses the FTP site that is referenced by the object.

Syntax

return_value = object.Pause

Parameters

There are no parameters for this method.

Related Topics
  • For more information about the IIS WMI Provider, see Using the IIS WMI Provider.
  • For detailed examples of scripts that use the properties and methods of the Windows WMI provider to access the IIS WMI provider, see Module 3: Writing Administration Scripts that Use WMI of the IIS WMI Provider Tutorial.
  • For basic examples in VBScript, JScript, and Perl, see Code Examples to Configure Metabase Properties.
  • Your installation of IIS 6.0 includes command-line administration scripts that manage IIS. See Using Command-Line Administration Scripts.


IIsFtpServer.Start (WMI)

The Start method of the IIsFtpServer (WMI) object starts the FTP site that is referenced by the object.

Syntax

return_value = object.Start

Parameters

There are no parameters for this method.

Related Topics
  • For more information about the IIS WMI Provider, see Using the IIS WMI Provider.
  • For detailed examples of scripts that use the properties and methods of the Windows WMI provider to access the IIS WMI provider, see Module 3: Writing Administration Scripts that Use WMI of the IIS WMI Provider Tutorial.
  • For basic examples in VBScript, JScript, and Perl, see Code Examples to Configure Metabase Properties.
  • Your installation of IIS 6.0 includes command-line administration scripts that manage IIS. See Using Command-Line Administration Scripts.


IIsFtpServer.Stop (WMI)

The Stop method of the IIsFtpServer (WMI) object stops the FTP site that is referenced by the object.

Syntax

return_value = object.Stop

Parameters

There are no parameters for this method.

Related Topics
  • For more information about the IIS WMI Provider, see Using the IIS WMI Provider.
  • For detailed examples of scripts that use the properties and methods of the Windows WMI provider to access the IIS WMI provider, see Module 3: Writing Administration Scripts that Use WMI of the IIS WMI Provider Tutorial.
  • For basic examples in VBScript, JScript, and Perl, see Code Examples to Configure Metabase Properties.
  • Your installation of IIS 6.0 includes command-line administration scripts that manage IIS. See Using Command-Line Administration Scripts.


IIsImapInfo (WMI)

This class corresponds to the IIsImapInfo IIS Admin object, and contains the methods and read-only properties for the object.

Parent Class

CIM_LogicalElement (WMI)

Properties

The table below lists properties other than those that are inherited from parent classes.

Property Name | Data Type | Description
Name | String | The Name property defines the label by which the object is known. When subclassed, the Name property can be overridden to be a Key property.
Related Topics
  • For more information about the IIS WMI Provider, see Using the IIS WMI Provider.
  • For detailed examples of scripts that use the properties and methods of the Windows WMI provider to access the IIS WMI provider, see Module 3: Writing Administration Scripts that Use WMI of the IIS WMI Provider Tutorial.
  • For basic examples in VBScript, JScript, and Perl, see Code Examples to Configure Metabase Properties.
  • Your installation of IIS 6.0 includes command-line administration scripts that manage IIS. See Using Command-Line Administration Scripts.


IIsImapRoutingSource (WMI)

This class corresponds to the IIsImapRoutingSource IIS Admin object, and contains the methods and read-only properties for the object.

Parent Class

CIM_LogicalElement (WMI)

Properties

The table below lists properties other than those that are inherited from parent classes.

Property Name | Data Type | Description
Name | String | The Name property defines the label by which the object is known. When subclassed, the Name property can be overridden to be a Key property.
Related Topics
  • For more information about the IIS WMI Provider, see Using the IIS WMI Provider.
  • For detailed examples of scripts that use the properties and methods of the Windows WMI provider to access the IIS WMI provider, see Module 3: Writing Administration Scripts that Use WMI of the IIS WMI Provider Tutorial.
  • For basic examples in VBScript, JScript, and Perl, see Code Examples to Configure Metabase Properties.
  • Your installation of IIS 6.0 includes command-line administration scripts that manage IIS. See Using Command-Line Administration Scripts.


IIsImapServer (WMI)

This class corresponds to the IIsImapServer IIS Admin object, and contains the methods and read-only properties for the object.

Parent Class

CIM_LogicalElement (WMI)

Properties

The table below lists properties other than those that are inherited from parent classes.

Property Name | Data Type | Description
Name | String | The Name property defines the label by which the object is known. When subclassed, the Name property can be overridden to be a Key property.
ServerState | SINT32 | See ServerState in the Metabase Property Reference.
ImapServiceVersion | SINT32 | See ImapServiceVersion in the Metabase Property Reference.
ImapRoutingSources[] | array of String | See ImapRoutingSources in the Metabase Property Reference.
SSLCertHash[] | array of uint8 | See SSLCertHash in the Metabase Property Reference.
Related Topics
  • For more information about the IIS WMI Provider, see Using the IIS WMI Provider.
  • For detailed examples of scripts that use the properties and methods of the Windows WMI provider to access the IIS WMI provider, see Module 3: Writing Administration Scripts that Use WMI of the IIS WMI Provider Tutorial.
  • For basic examples in VBScript, JScript, and Perl, see Code Examples to Configure Metabase Properties.
  • Your installation of IIS 6.0 includes command-line administration scripts that manage IIS. See Using Command-Line Administration Scripts.


IIsImapSessions (WMI)

This class corresponds to the IIsImapSessions IIS Admin object, and contains the methods and read-only properties for the object.

Parent Class

CIM_LogicalElement (WMI)

Properties

The table below lists properties other than those that are inherited from parent classes.

Property Name | Data Type | Description
Name | String | The Name property defines the label by which the object is known. When subclassed, the Name property can be overridden to be a Key property.
Related Topics
  • For more information about the IIS WMI Provider, see Using the IIS WMI Provider.
  • For detailed examples of scripts that use the properties and methods of the Windows WMI provider to access the IIS WMI provider, see Module 3: Writing Administration Scripts that Use WMI of the IIS WMI Provider Tutorial.
  • For basic examples in VBScript, JScript, and Perl, see Code Examples to Configure Metabase Properties.
  • Your installation of IIS 6.0 includes command-line administration scripts that manage IIS. See Using Command-Line Administration Scripts.


IIsImapVirtualDir (WMI)

This class corresponds to the IIsImapVirtualDir IIS Admin object, and contains the methods and read-only properties for the object.

Parent Class

CIM_LogicalElement (WMI)

Properties

The table below lists properties other than those that are inherited from parent classes.

Property Name | Data Type | Description
Name | String | The Name property defines the label by which the object is known. When subclassed, the Name property can be overridden to be a Key property.
Related Topics
  • For more information about the IIS WMI Provider, see Using the IIS WMI Provider.
  • For detailed examples of scripts that use the properties and methods of the Windows WMI provider to access the IIS WMI provider, see Module 3: Writing Administration Scripts that Use WMI of the IIS WMI Provider Tutorial.
  • For basic examples in VBScript, JScript, and Perl, see Code Examples to Configure Metabase Properties.
  • Your installation of IIS 6.0 includes command-line administration scripts that manage IIS. See Using Command-Line Administration Scripts.


IIsLogModule (WMI)

This class corresponds to the IIsLogModule IIS Admin object, and contains the methods and read-only properties for the object.

Parent Class

CIM_LogicalElement (WMI)

Properties

The table below lists properties other than those that are inherited from parent classes.

Property Name | Data Type | Description
Name | String | The Name property defines the label by which the object is known. When subclassed, the Name property can be overridden to be a Key property.
Related Topics
  • For more information about the IIS WMI Provider, see Using the IIS WMI Provider.
  • For detailed examples of scripts that use the properties and methods of the Windows WMI provider to access the IIS WMI provider, see Module 3: Writing Administration Scripts that Use WMI of the IIS WMI Provider Tutorial.
  • For basic examples in VBScript, JScript, and Perl, see Code Examples to Configure Metabase Properties.
  • Your installation of IIS 6.0 includes command-line administration scripts that manage IIS. See Using Command-Line Administration Scripts.


IIsLogModules (WMI)

This class corresponds to the IIsLogModules IIS Admin object, and contains the methods and read-only properties for the object.

Parent Class

CIM_LogicalElement (WMI)

Properties

The table below lists properties other than those that are inherited from parent classes.

Property Name | Data Type | Description
Name | String | The Name property defines the label by which the object is known. When subclassed, the Name property can be overridden to be a Key property.
Related Topics
  • For more information about the IIS WMI Provider, see Using the IIS WMI Provider.
  • For detailed examples of scripts that use the properties and methods of the Windows WMI provider to access the IIS WMI provider, see Module 3: Writing Administration Scripts that Use WMI of the IIS WMI Provider Tutorial.
  • For basic examples in VBScript, JScript, and Perl, see Code Examples to Configure Metabase Properties.
  • Your installation of IIS 6.0 includes command-line administration scripts that manage IIS. See Using Command-Line Administration Scripts.


IIsMimeMap (WMI)

This class corresponds to the IIsMimeMap IIS Admin object, and contains the methods and read-only properties for the object.

Parent Class

CIM_LogicalElement (WMI)

Properties

The table below lists properties other than those that are inherited from parent classes.

Property Name | Data Type | Description
Name | String | The Name property defines the label by which the object is known. When subclassed, the Name property can be overridden to be a Key property.
Related Topics
  • For more information about the IIS WMI Provider, see Using the IIS WMI Provider.
  • For detailed examples of scripts that use the properties and methods of the Windows WMI provider to access the IIS WMI provider, see Module 3: Writing Administration Scripts that Use WMI of the IIS WMI Provider Tutorial.
  • For basic examples in VBScript, JScript, and Perl, see Code Examples to Configure Metabase Properties.
  • Your installation of IIS 6.0 includes command-line administration scripts that manage IIS. See Using Command-Line Administration Scripts.


IIsNntpExpiration (WMI)

This class corresponds to the IIsNntpExpiration IIS Admin object, and contains the methods and read-only properties for the object.

Parent Class

CIM_LogicalElement (WMI)

Properties

The table below lists properties other than those that are inherited from parent classes.

Property Name | Data Type | Description
Name | String | The Name property defines the label by which the object is known. When subclassed, the Name property can be overridden to be a Key property.
Related Topics
  • For more information about the IIS WMI Provider, see Using the IIS WMI Provider.
  • For detailed examples of scripts that use the properties and methods of the Windows WMI provider to access the IIS WMI provider, see Module 3: Writing Administration Scripts that Use WMI of the IIS WMI Provider Tutorial.
  • For basic examples in VBScript, JScript, and Perl, see Code Examples to Configure Metabase Properties.
  • Your installation of IIS 6.0 includes command-line administration scripts that manage IIS. See Using Command-Line Administration Scripts.


IIsNntpExpire (WMI)

This class corresponds to the IIsNntpExpire IIS Admin object, and contains the methods and read-only properties for the object.

Parent Class

CIM_LogicalElement (WMI)

Properties

The table below lists properties other than those that are inherited from parent classes.

Property Name | Data Type | Description
Name | String | The Name property defines the label by which the object is known. When subclassed, the Name property can be overridden to be a Key property.
Related Topics
  • For more information about the IIS WMI Provider, see Using the IIS WMI Provider.
  • For detailed examples of scripts that use the properties and methods of the Windows WMI provider to access the IIS WMI provider, see Module 3: Writing Administration Scripts that Use WMI of the IIS WMI Provider Tutorial.
  • For basic examples in VBScript, JScript, and Perl, see Code Examples to Configure Metabase Properties.
  • Your installation of IIS 6.0 includes command-line administration scripts that manage IIS. See Using Command-Line Administration Scripts.


IIsNntpFeed (WMI)

This class corresponds to the IIsNntpFeed IIS Admin object, and contains the methods and read-only properties for the object.

Parent Class

CIM_LogicalElement (WMI)

Properties

The table below lists properties other than those that are inherited from parent classes.

Property Name | Data Type | Description
Name | String | The Name property defines the label by which the object is known. When subclassed, the Name property can be overridden to be a Key property.
Related Topics
  • For more information about the IIS WMI Provider, see Using the IIS WMI Provider.
  • For detailed examples of scripts that use the properties and methods of the Windows WMI provider to access the IIS WMI provider, see Module 3: Writing Administration Scripts that Use WMI of the IIS WMI Provider Tutorial.
  • For basic examples in VBScript, JScript, and Perl, see Code Examples to Configure Metabase Properties.
  • Your installation of IIS 6.0 includes command-line administration scripts that manage IIS. See Using Command-Line Administration Scripts.


IIsNntpFeeds (WMI)

This class corresponds to the IIsNntpFeeds IIS Admin object, and contains the methods and read-only properties for the object.

Parent Class

CIM_LogicalElement (WMI)

Properties

The table below lists properties other than those that are inherited from parent classes.

Property Name | Data Type | Description
Name | String | The Name property defines the label by which the object is known. When subclassed, the Name property can be overridden to be a Key property.
Related Topics
  • For more information about the IIS WMI Provider, see Using the IIS WMI Provider.
  • For detailed examples of scripts that use the properties and methods of the Windows WMI provider to access the IIS WMI provider, see Module 3: Writing Administration Scripts that Use WMI of the IIS WMI Provider Tutorial.
  • For basic examples in VBScript, JScript, and Perl, see Code Examples to Configure Metabase Properties.
  • Your installation of IIS 6.0 includes command-line administration scripts that manage IIS. See Using Command-Line Administration Scripts.


IIsNntpGroups (WMI)

This class corresponds to the IIsNntpGroups IIS Admin object, and contains the methods and read-only properties for the object.

Parent Class

CIM_LogicalElement (WMI)

Properties

The table below lists properties other than those that are inherited from parent classes.

Property Name | Data Type | Description
Name | String | The Name property defines the label by which the object is known. When subclassed, the Name property can be overridden to be a Key property.
Related Topics
  • For more information about the IIS WMI Provider, see Using the IIS WMI Provider.
  • For detailed examples of scripts that use the properties and methods of the Windows WMI provider to access the IIS WMI provider, see Module 3: Writing Administration Scripts that Use WMI of the IIS WMI Provider Tutorial.
  • For basic examples in VBScript, JScript, and Perl, see Code Examples to Configure Metabase Properties.
  • Your installation of IIS 6.0 includes command-line administration scripts that manage IIS. See Using Command-Line Administration Scripts.


IIsNntpInfo (WMI)

This class corresponds to the IIsNntpInfo IIS Admin object, and contains the methods and read-only properties for the object.

Parent Class

CIM_LogicalElement (WMI)

Properties

The table below lists properties other than those that are inherited from parent classes.

Property Name | Data Type | Description
Name | String | The Name property defines the label by which the object is known. When subclassed, the Name property can be overridden to be a Key property.
MajorIIsVersionNumber | SINT32 | See MajorIIsVersionNumber in the Metabase Property Reference.
MinorIIsVersionNumber | SINT32 | See MinorIIsVersionNumber in the Metabase Property Reference.
Related Topics
  • For more information about the IIS WMI Provider, see Using the IIS WMI Provider.
  • For detailed examples of scripts that use the properties and methods of the Windows WMI provider to access the IIS WMI provider, see Module 3: Writing Administration Scripts that Use WMI of the IIS WMI Provider Tutorial.
  • For basic examples in VBScript, JScript, and Perl, see Code Examples to Configure Metabase Properties.
  • Your installation of IIS 6.0 includes command-line administration scripts that manage IIS. See Using Command-Line Administration Scripts.


IIsNntpRebuild (WMI)

This class corresponds to the IIsNntpRebuild IIS Admin object, and contains the methods and read-only properties for the object.

Parent Class

CIM_LogicalElement (WMI)

Properties

The table below lists properties other than those that are inherited from parent classes.

Property Name | Data Type | Description
Name | String | The Name property defines the label by which the object is known. When subclassed, the Name property can be overridden to be a Key property.
Related Topics
  • For more information about the IIS WMI Provider, see Using the IIS WMI Provider.
  • For detailed examples of scripts that use the properties and methods of the Windows WMI provider to access the IIS WMI provider, see Module 3: Writing Administration Scripts that Use WMI of the IIS WMI Provider Tutorial.
  • For basic examples in VBScript, JScript, and Perl, see Code Examples to Configure Metabase Properties.
  • Your installation of IIS 6.0 includes command-line administration scripts that manage IIS. See Using Command-Line Administration Scripts.


IIsNntpServer (WMI)

This class corresponds to the IIsNntpServer IIS Admin object, and contains the methods and read-only properties for the object.

Parent Class

CIM_LogicalElement (WMI)

Properties

The table below lists properties other than those that are inherited from parent classes.

Property Name | Data Type | Description
Name | String | The Name property defines the label by which the object is known. When subclassed, the Name property can be overridden to be a Key property.
ServerState | SINT32 | See ServerState in the Metabase Property Reference.
NntpServiceVersion | SINT32 | See NntpServiceVersion in the Metabase Property Reference.
SSLCertHash[] | array of uint8 | See SSLCertHash in the Metabase Property Reference.
Related Topics
  • For more information about the IIS WMI Provider, see Using the IIS WMI Provider.
  • For detailed examples of scripts that use the properties and methods of the Windows WMI provider to access the IIS WMI provider, see Module 3: Writing Administration Scripts that Use WMI of the IIS WMI Provider Tutorial.
  • For basic examples in VBScript, JScript, and Perl, see Code Examples to Configure Metabase Properties.
  • Your installation of IIS 6.0 includes command-line administration scripts that manage IIS. See Using Command-Line Administration Scripts.


IIsNntpSessions (WMI)

This class corresponds to the IIsNntpSessions IIS Admin object, and contains the methods and read-only properties for the object.

Parent Class

CIM_LogicalElement (WMI)

Properties

The table below lists properties other than those that are inherited from parent classes.

Property Name | Data Type | Description
Name | String | The Name property defines the label by which the object is known. When subclassed, the Name property can be overridden to be a Key property.
Related Topics
  • For more information about the IIS WMI Provider, see Using the IIS WMI Provider.
  • For detailed examples of scripts that use the properties and methods of the Windows WMI provider to access the IIS WMI provider, see Module 3: Writing Administration Scripts that Use WMI of the IIS WMI Provider Tutorial.
  • For basic examples in VBScript, JScript, and Perl, see Code Examples to Configure Metabase Properties.
  • Your installation of IIS 6.0 includes command-line administration scripts that manage IIS. See Using Command-Line Administration Scripts.


IIsNntpVirtualDir (WMI)

This class corresponds to the IIsNntpVirtualDir IIS Admin object, and contains the methods and read-only properties for the object.

Parent Class

CIM_LogicalElement (WMI)

Properties

The table below lists properties other than those that are inherited from parent classes.

Property Name | Data Type | Description
Name | String | The Name property defines the label by which the object is known. When subclassed, the Name property can be overridden to be a Key property.
Related Topics
  • For more information about the IIS WMI Provider, see Using the IIS WMI Provider.
  • For detailed examples of scripts that use the properties and methods of the Windows WMI provider to access the IIS WMI provider, see Module 3: Writing Administration Scripts that Use WMI of the IIS WMI Provider Tutorial.
  • For basic examples in VBScript, JScript, and Perl, see Code Examples to Configure Metabase Properties.
  • Your installation of IIS 6.0 includes command-line administration scripts that manage IIS. See Using Command-Line Administration Scripts.


IIsObject (WMI)

This class corresponds to the IIsObject IIS Admin object, and contains the methods and read-only properties for the object.

Parent Class

CIM_LogicalElement (WMI)

Properties

The table below lists properties other than those that are inherited from parent classes.

Property Name | Data Type | Description
Name | String | The Name property defines the label by which the object is known. When subclassed, the Name property can be overridden to be a Key property.
Related Topics
  • For more information about the IIS WMI Provider, see Using the IIS WMI Provider.
  • For detailed examples of scripts that use the properties and methods of the Windows WMI provider to access the IIS WMI provider, see Module 3: Writing Administration Scripts that Use WMI of the IIS WMI Provider Tutorial.
  • For basic examples in VBScript, JScript, and Perl, see Code Examples to Configure Metabase Properties.
  • Your installation of IIS 6.0 includes command-line administration scripts that manage IIS. See Using Command-Line Administration Scripts.


IIsPop3Info (WMI)

This class corresponds to the IIsPop3Info IIS Admin object, and contains the methods and read-only properties for the object.

Parent Class

CIM_LogicalElement (WMI)

Properties

The table below lists properties other than those that are inherited from parent classes.

Property Name | Data Type | Description
Name | String | The Name property defines the label by which the object is known. When subclassed, the Name property can be overridden to be a Key property.
Related Topics
  • For more information about the IIS WMI Provider, see Using the IIS WMI Provider.
  • For detailed examples of scripts that use the properties and methods of the Windows WMI provider to access the IIS WMI provider, see Module 3: Writing Administration Scripts that Use WMI of the IIS WMI Provider Tutorial.
  • For basic examples in VBScript, JScript, and Perl, see Code Examples to Configure Metabase Properties.
  • Your installation of IIS 6.0 includes command-line administration scripts that manage IIS. See Using Command-Line Administration Scripts.


IIsPop3RoutingSource (WMI)

This class corresponds to the IIsPop3RoutingSource IIS Admin object, and contains the methods and read-only properties for the object.

Parent Class

CIM_LogicalElement (WMI)

Properties

The table below lists properties other than those that are inherited from parent classes.

Property Name | Data Type | Description
Name | String | The Name property defines the label by which the object is known. When subclassed, the Name property can be overridden to be a Key property.
Related Topics
  • For more information about the IIS WMI Provider, see Using the IIS WMI Provider.
  • For detailed examples of scripts that use the properties and methods of the Windows WMI provider to access the IIS WMI provider, see Module 3: Writing Administration Scripts that Use WMI of the IIS WMI Provider Tutorial.
  • For basic examples in VBScript, JScript, and Perl, see Code Examples to Configure Metabase Properties.
  • Your installation of IIS 6.0 includes command-line administration scripts that manage IIS. See Using Command-Line Administration Scripts.


IIsPop3Server (WMI)

This class corresponds to the IIsPop3Server IIS Admin object, and contains the methods and read-only properties for the object.

Parent Class

CIM_LogicalElement (WMI)

Properties

The table below lists properties other than those that are inherited from parent classes.

Property Name | Data Type | Description
Name | String | The Name property defines the label by which the object is known. When subclassed, the Name property can be overridden to be a Key property.
ServerState | SINT32 | See ServerState in the Metabase Property Reference.
Pop3ServiceVersion | SINT32 | See Pop3ServiceVersion in the Metabase Property Reference.
Pop3RoutingSources[] | array of String | See Pop3RoutingSources in the Metabase Property Reference.
SSLCertHash[] | array of uint8 | See SSLCertHash in the Metabase Property Reference.
Related Topics
  • For more information about the IIS WMI Provider, see Using the IIS WMI Provider.
  • For detailed examples of scripts that use the properties and methods of the Windows WMI provider to access the IIS WMI provider, see Module 3: Writing Administration Scripts that Use WMI of the IIS WMI Provider Tutorial.
  • For basic examples in VBScript, JScript, and Perl, see Code Examples to Configure Metabase Properties.
  • Your installation of IIS 6.0 includes command-line administration scripts that manage IIS. See Using Command-Line Administration Scripts.


IIsPop3Sessions (WMI)

This class corresponds to the IIsPop3Sessions IIS Admin object, and contains the methods and read-only properties for the object.

Parent Class

CIM_LogicalElement (WMI)

Properties

The table below lists properties other than those that are inherited from parent classes.

Property Name | Data Type | Description
Name | String | The Name property defines the label by which the object is known. When subclassed, the Name property can be overridden to be a Key property.
Related Topics
  • For more information about the IIS WMI Provider, see Using the IIS WMI Provider.
  • For detailed examples of scripts that use the properties and methods of the Windows WMI provider to access the IIS WMI provider, see Module 3: Writing Administration Scripts that Use WMI of the IIS WMI Provider Tutorial.
  • For basic examples in VBScript, JScript, and Perl, see Code Examples to Configure Metabase Properties.
  • Your installation of IIS 6.0 includes command-line administration scripts that manage IIS. See Using Command-Line Administration Scripts.


IIsPop3VirtualDir (WMI)

This class corresponds to the IIsPop3VirtualDir IIS Admin object, and contains the methods and read-only properties for the object.

Parent Class

CIM_LogicalElement (WMI)

Properties

The table below lists properties other than those that are inherited from parent classes.

Property Name | Data Type | Description
Name | String | The Name property defines the label by which the object is known. When subclassed, the Name property can be overridden to be a Key property.
Related Topics
  • For more information about the IIS WMI Provider, see Using the IIS WMI Provider.
  • For detailed examples of scripts that use the properties and methods of the Windows WMI provider to access the IIS WMI provider, see Module 3: Writing Administration Scripts that Use WMI of the IIS WMI Provider Tutorial.
  • For basic examples in VBScript, JScript, and Perl, see Code Examples to Configure Metabase Properties.
  • Your installation of IIS 6.0 includes command-line administration scripts that manage IIS. See Using Command-Line Administration Scripts.


IIsSmtpAlias (WMI)

This class corresponds to the IIsSmtpAlias IIS Admin object, and contains the methods and read-only properties for the object.

Parent Class

CIM_LogicalElement (WMI)

Properties

The table below lists properties other than those that are inherited from parent classes.

Property Name | Data Type | Description
Name | String | The Name property defines the label by which the object is known. When subclassed, the Name property can be overridden to be a Key property.
Related Topics
  • For more information about the IIS WMI Provider, see Using the IIS WMI Provider.
  • For detailed examples of scripts that use the properties and methods of the Windows WMI provider to access the IIS WMI provider, see Module 3: Writing Administration Scripts that Use WMI of the IIS WMI Provider Tutorial.
  • For basic examples in VBScript, JScript, and Perl, see Code Examples to Configure Metabase Properties.
  • Your installation of IIS 6.0 includes command-line administration scripts that manage IIS. See Using Command-Line Administration Scripts.


IIsSmtpDL (WMI)

This class corresponds to the IIsSmtpDL IIS Admin object, and contains the methods and read-only properties for the object.

Parent Class

CIM_LogicalElement (WMI)

Properties

The table below lists properties other than those that are inherited from parent classes.

Property Name | Data Type | Description
Name | String | The Name property defines the label by which the object is known. When subclassed, the Name property can be overridden to be a Key property.
Related Topics
  • For more information about the IIS WMI Provider, see Using the IIS WMI Provider.
  • For detailed examples of scripts that use the properties and methods of the Windows WMI provider to access the IIS WMI provider, see Module 3: Writing Administration Scripts that Use WMI of the IIS WMI Provider Tutorial.
  • For basic examples in VBScript, JScript, and Perl, see Code Examples to Configure Metabase Properties.
  • Your installation of IIS 6.0 includes command-line administration scripts that manage IIS. See Using Command-Line Administration Scripts.


IIsSmtpDomain (WMI)

This class corresponds to the IIsSmtpDomain IIS Admin object, and contains the methods and read-only properties for the object.

Parent Class

CIM_LogicalElement (WMI)

Properties

The table below lists properties other than those that are inherited from parent classes.

Property Name | Data Type | Description
Name | String | The Name property defines the label by which the object is known. When subclassed, the Name property can be overridden to be a Key property.
Related Topics
  • For more information about the IIS WMI Provider, see Using the IIS WMI Provider.
  • For detailed examples of scripts that use the properties and methods of the Windows WMI provider to access the IIS WMI provider, see Module 3: Writing Administration Scripts that Use WMI of the IIS WMI Provider Tutorial.
  • For basic examples in VBScript, JScript, and Perl, see Code Examples to Configure Metabase Properties.
  • Your installation of IIS 6.0 includes command-line administration scripts that manage IIS. See Using Command-Line Administration Scripts.


IIsSmtpInfo (WMI)

This class corresponds to the IIsSmtpInfo IIS Admin object, and contains the methods and read-only properties for the object.

Parent Class

CIM_LogicalElement (WMI)

Properties

The table below lists properties other than those that are inherited from parent classes.

Property Name | Data Type | Description
MajorIIsVersionNumber | SINT32 | See MajorIIsVersionNumber in the Metabase Property Reference.
MinorIIsVersionNumber | SINT32 | See MinorIIsVersionNumber in the Metabase Property Reference.
Name | String | The Name property defines the label by which the object is known. When subclassed, the Name property can be overridden to be a Key property.
Related Topics
  • For more information about the IIS WMI Provider, see Using the IIS WMI Provider.
  • For detailed examples of scripts that use the properties and methods of the Windows WMI provider to access the IIS WMI provider, see Module 3: Writing Administration Scripts that Use WMI of the IIS WMI Provider Tutorial.
  • For basic examples in VBScript, JScript, and Perl, see Code Examples to Configure Metabase Properties.
  • Your installation of IIS 6.0 includes command-line administration scripts that manage IIS. See Using Command-Line Administration Scripts.


IIsSmtpRoutingSource (WMI)

This class corresponds to the IIsSmtpRoutingSource IIS Admin object, and contains the methods and read-only properties for the object.

Parent Class

CIM_LogicalElement (WMI)

Properties

The table below lists properties other than those that are inherited from parent classes.

Property Name | Data Type | Description
Name | String | The Name property defines the label by which the object is known. When subclassed, the Name property can be overridden to be a Key property.
Related Topics
  • For more information about the IIS WMI Provider, see Using the IIS WMI Provider.
  • For detailed examples of scripts that use the properties and methods of the Windows WMI provider to access the IIS WMI provider, see Module 3: Writing Administration Scripts that Use WMI of the IIS WMI Provider Tutorial.
  • For basic examples in VBScript, JScript, and Perl, see Code Examples to Configure Metabase Properties.
  • Your installation of IIS 6.0 includes command-line administration scripts that manage IIS. See Using Command-Line Administration Scripts.


IIsSmtpServer (WMI)

This class corresponds to the IIsSmtpServer IIS Admin object, and contains the methods and read-only properties for the object.

Parent Class

CIM_LogicalElement (WMI)

Properties

The table below lists properties other than those that are inherited from parent classes.

Property Name | Data Type | Description
ServerState | SINT32 | See ServerState in the Metabase Property Reference.
SmtpServiceVersion | SINT32 | See SmtpServiceVersion in the Metabase Property Reference.
RoutingSources[] | array of String | See RoutingSources in the Metabase Property Reference.
DomainRouting[] | array of String | See DomainRouting in the Metabase Property Reference.
PostmasterName | String | See PostmasterName in the Metabase Property Reference.
PostmasterEmail | String | See PostmasterEmail in the Metabase Property Reference.
LocalDomains[] | array of String | See LocalDomains in the Metabase Property Reference.
SSLCertHash[] | array of uint8 | See SSLCertHash in the Metabase Property Reference.
Name | String | The Name property defines the label by which the object is known. When subclassed, the Name property can be overridden to be a Key property.
Related Topics
  • For more information about the IIS WMI Provider, see Using the IIS WMI Provider.
  • For detailed examples of scripts that use the properties and methods of the Windows WMI provider to access the IIS WMI provider, see Module 3: Writing Administration Scripts that Use WMI of the IIS WMI Provider Tutorial.
  • For basic examples in VBScript, JScript, and Perl, see Code Examples to Configure Metabase Properties.
  • Your installation of IIS 6.0 includes command-line administration scripts that manage IIS. See Using Command-Line Administration Scripts.


IIsSmtpSessions (WMI)

This class corresponds to the IIsSmtpSessions IIS Admin object, and contains the methods and read-only properties for the object.

Parent Class

CIM_LogicalElement (WMI)

Properties

The table below lists properties other than those that are inherited from parent classes.

Property Name | Data Type | Description
Name | String | The Name property defines the label by which the object is known. When subclassed, the Name property can be overridden to be a Key property.
Related Topics
  • For more information about the IIS WMI Provider, see Using the IIS WMI Provider.
  • For detailed examples of scripts that use the properties and methods of the Windows WMI provider to access the IIS WMI provider, see Module 3: Writing Administration Scripts that Use WMI of the IIS WMI Provider Tutorial.
  • For basic examples in VBScript, JScript, and Perl, see Code Examples to Configure Metabase Properties.
  • Your installation of IIS 6.0 includes command-line administration scripts that manage IIS. See Using Command-Line Administration Scripts.


IIsSmtpUser (WMI)

This class corresponds to the IIsSmtpUser IIS Admin object, and contains the methods and read-only properties for the object.

Parent Class

CIM_LogicalElement (WMI)

Properties

The table below lists properties other than those that are inherited from parent classes.

Property Name | Data Type | Description
Name | String | The Name property defines the label by which the object is known. When subclassed, the Name property can be overridden to be a Key property.
Related Topics
  • For more information about the IIS WMI Provider, see Using the IIS WMI Provider.
  • For detailed examples of scripts that use the properties and methods of the Windows WMI provider to access the IIS WMI provider, see Module 3: Writing Administration Scripts that Use WMI of the IIS WMI Provider Tutorial.
  • For basic examples in VBScript, JScript, and Perl, see Code Examples to Configure Metabase Properties.
  • Your installation of IIS 6.0 includes command-line administration scripts that manage IIS. See Using Command-Line Administration Scripts.


IIsSmtpVirtualDir (WMI)

This class corresponds to the IIsSmtpVirtualDir IIS Admin object, and contains the methods and read-only properties for the object.

Parent Class

CIM_LogicalElement (WMI)

Properties

The table below lists properties other than those that are inherited from parent classes.

Property Name | Data Type | Description
Name | String | The Name property defines the label by which the object is known. When subclassed, the Name property can be overridden to be a Key property.
Related Topics
  • For more information about the IIS WMI Provider, see Using the IIS WMI Provider.
  • For detailed examples of scripts that use the properties and methods of the Windows WMI provider to access the IIS WMI provider, see Module 3: Writing Administration Scripts that Use WMI of the IIS WMI Provider Tutorial.
  • For basic examples in VBScript, JScript, and Perl, see Code Examples to Configure Metabase Properties.
  • Your installation of IIS 6.0 includes command-line administration scripts that manage IIS. See Using Command-Line Administration Scripts.


IIsUserDefinedLogicalElement (WMI)

This is an abstract regular class that must be implemented in a custom class to make use of the inherited properties.

Parent Class

CIM_LogicalElement (WMI)

Properties

This class inherits only properties from the parent classes.

Related Topics
  • For more information about the IIS WMI Provider, see Using the IIS WMI Provider.
  • For detailed examples of scripts that use the properties and methods of the Windows WMI provider to access the IIS WMI provider, see Module 3: Writing Administration Scripts that Use WMI of the IIS WMI Provider Tutorial.
  • For basic examples in VBScript, JScript, and Perl, see Code Examples to Configure Metabase Properties.
  • Your installation of IIS 6.0 includes command-line administration scripts that manage IIS. See Using Command-Line Administration Scripts.


IIsWebInfo (WMI)

This class corresponds to the IIsWebInfo IIS Admin object, and contains the methods and read-only properties for the object.

Parent Class

CIM_LogicalElement (WMI)

Properties

The table below lists properties other than those that are inherited from parent classes.

Property Name | Data Type | Description
MajorIIsVersionNumber | SINT32 | See MajorIIsVersionNumber in the Metabase Property Reference.
MinorIIsVersionNumber | SINT32 | See MinorIIsVersionNumber in the Metabase Property Reference.
Name | String | The Name property defines the label by which the object is known. When subclassed, the Name property can be overridden to be a Key property.
Related Topics
  • For more information about the IIS WMI Provider, see Using the IIS WMI Provider.
  • For detailed examples of scripts that use the properties and methods of the Windows WMI provider to access the IIS WMI provider, see Module 3: Writing Administration Scripts that Use WMI of the IIS WMI Provider Tutorial.
  • For basic examples in VBScript, JScript, and Perl, see Code Examples to Configure Metabase Properties.
  • Your installation of IIS 6.0 includes command-line administration scripts that manage IIS. See Using Command-Line Administration Scripts.


IIsWebServer (WMI)

This class corresponds to the IIsWebServer IIS Admin object, and contains the methods and read-only properties for the object.

Parent Class

CIM_LogicalElement (WMI)

Methods

The table below lists the methods for this class.

Method Name | Return Data Type | Description
IIsWebServer.Start (WMI) | void | The Start method starts the Web site that is referenced by the object.
IIsWebServer.Stop (WMI) | void | The Stop method stops the Web site that is referenced by the object.
IIsWebServer.Continue (WMI) | void | The Continue method continues the paused Web site that is referenced by the object.
IIsWebServer.Pause (WMI) | void | The Pause method pauses the Web site that is referenced by the object.
Properties

The table below lists properties other than those that are inherited from parent classes.

Property Name | Data Type | Description
ServerState | SINT32 | See ServerState in the Metabase Property Reference.
AppRoot | String | See AppRoot in the Metabase Property Reference.
AppIsolated | SINT32 | See AppIsolated in the Metabase Property Reference.
AppPackageID | String | See AppPackageID in the Metabase Property Reference.
AppPackageName | String | See AppPackageName in the Metabase Property Reference.
SSLCertHash[] | array of uint8 | See SSLCertHash in the Metabase Property Reference.
Name | String | The Name property defines the label by which the object is known. When subclassed, the Name property can be overridden to be a Key property.
Related Topics
  • For more information about the IIS WMI Provider, see Using the IIS WMI Provider.
  • For detailed examples of scripts that use the properties and methods of the Windows WMI provider to access the IIS WMI provider, see Module 3: Writing Administration Scripts that Use WMI of the IIS WMI Provider Tutorial.
  • For basic examples in VBScript, JScript, and Perl, see Code Examples to Configure Metabase Properties.
  • Your installation of IIS 6.0 includes command-line administration scripts that manage IIS. See Using Command-Line Administration Scripts.


IIsWebServer.Continue (WMI)

The Continue method of the IIsWebServer (WMI) object continues the paused Web site that is referenced by the object.

Syntax

return_value = object.Continue

Parameters

There are no parameters for this method.

Related Topics
  • For more information about the IIS WMI Provider, see Using the IIS WMI Provider.
  • For detailed examples of scripts that use the properties and methods of the Windows WMI provider to access the IIS WMI provider, see Module 3: Writing Administration Scripts that Use WMI of the IIS WMI Provider Tutorial.
  • For basic examples in VBScript, JScript, and Perl, see Code Examples to Configure Metabase Properties.
  • Your installation of IIS 6.0 includes command-line administration scripts that manage IIS. See Using Command-Line Administration Scripts.


IIsWebServer.Pause (WMI)

The Pause method of the IIsWebServer (WMI) object pauses the Web site that is referenced by the object.

Syntax

return_value = object.Pause

Parameters

There are no parameters for this method.

Related Topics
  • For more information about the IIS WMI Provider, see Using the IIS WMI Provider.
  • For detailed examples of scripts that use the properties and methods of the Windows WMI provider to access the IIS WMI provider, see Module 3: Writing Administration Scripts that Use WMI of the IIS WMI Provider Tutorial.
  • For basic examples in VBScript, JScript, and Perl, see Code Examples to Configure Metabase Properties.
  • Your installation of IIS 6.0 includes command-line administration scripts that manage IIS. See Using Command-Line Administration Scripts.


IIsWebServer.Start (WMI)

The Start method of the IIsWebServer (WMI) object starts the Web site that is referenced by the object.

Syntax

return_value = object.Start

Parameters

There are no parameters for this method.

Related Topics
  • For more information about the IIS WMI Provider, see Using the IIS WMI Provider.
  • For detailed examples of scripts that use the properties and methods of the Windows WMI provider to access the IIS WMI provider, see Module 3: Writing Administration Scripts that Use WMI of the IIS WMI Provider Tutorial.
  • For basic examples in VBScript, JScript, and Perl, see Code Examples to Configure Metabase Properties.
  • Your installation of IIS 6.0 includes command-line administration scripts that manage IIS. See Using Command-Line Administration Scripts.


IIsWebServer.Stop (WMI)

The Stop method of the IIsWebServer (WMI) object stops the Web site that is referenced by the object.

Syntax

return_value = object.Stop

Parameters

There are no parameters for this method.

Related Topics
  • For more information about the IIS WMI Provider, see Using the IIS WMI Provider.
  • For detailed examples of scripts that use the properties and methods of the Windows WMI provider to access the IIS WMI provider, see Module 3: Writing Administration Scripts that Use WMI of the IIS WMI Provider Tutorial.
  • For basic examples in VBScript, JScript, and Perl, see Code Examples to Configure Metabase Properties.
  • Your installation of IIS 6.0 includes command-line administration scripts that manage IIS. See Using Command-Line Administration Scripts.


CIM_Setting (WMI)

For each IIS Admin object type listed in KeyType in the Metabase Property Reference, there exists an element class and a setting class. The elements in the CIM_ManagedSystemElement class contain the methods and the read-only properties for the IIS Admin object type. The elements in the CIM_Setting class contain all the read-write properties for the IIS Admin object type.

For example, the IIsWebServer object type in the metabase is represented by the IIsWebServer element in the CIM_ManagedSystemElement class, and it is also represented by the IIsWebServerSetting element in the CIM_Setting class. The IIsWebServer element contains all the methods that can be applied on a web server and all the read-only properties for the Web server. IIsWebServerSetting contains all the read-write properties for the Web server.

Each IIS Admin object type is represented in the Metabase Schema file. When you create an instance of an element in the CIM_ManagedSystemElement class or the CIM_Setting class, the created object represents a node in the Metabase Configuration File.

Properties

The table below lists the properties for this class.

Property Name | Data Type | Description
SettingID | String | The SettingID property specifies the identifier by which the CIM_Setting object is known.
Caption | String | The Caption property provides a short textual description (one-line String) of the CIM_Setting object.
Description | String | The Description property provides a textual description of the CIM_Setting object.
Related Topics
  • For more information about the IIS WMI Provider, see Using the IIS WMI Provider.
  • For detailed examples of scripts that use the properties and methods of the Windows WMI provider to access the IIS WMI provider, see Module 3: Writing Administration Scripts that Use WMI of the IIS WMI Provider Tutorial.
  • For basic examples in VBScript, JScript, and Perl, see Code Examples to Configure Metabase Properties.
  • Your installation of IIS 6.0 includes command-line administration scripts that manage IIS. See Using Command-Line Administration Scripts.


IIsSetting (WMI)

The IIsSetting class allows you to query for a setting without knowing its type. A query for IIsSetting = 'W3SVC/1' returns any instance of a subclass under CIM_Setting that has its Name property set to 'W3SVC/1', or in other words, any CIM_Setting subclass that is associated with 'W3SVC/1'.

Parent Class

CIM_Setting (WMI)

Properties

The table below lists properties other than those that are inherited from parent classes.

Property Name | Data Type | Description
Name | String | The Name property defines the label by which the object is known. When subclassed, the Name property can be overridden to be a Key property.
Code Example

The following JScript code illustrates how to use the IIsSetting class to enumerate all possible setting classes for a given metabase node.

o = getobj("winmgmts:/root/microsoftiisv2")
nodes = o.ExecQuery("select * from IIsWebServerSetting where name='w3svc/1'")
e = new Enumerator(nodes)
for(; ! e.atEnd(); e.moveNext()) {
  WScript.Echo(e.item().Name + " (" + e.item().Path_.Class + ")")
}
// The output should be:
//   w3svc/1 (IIsWebServerSetting)

nodes = o.ExecQuery("select * from IIsSetting where name='w3svc/1'")
e = new Enumerator(nodes)
for(; ! e.atEnd(); e.moveNext()) {
  WScript.Echo(e.item().Name + " (" + e.item().Path_.Class + ")")
}
// The output should be:
//   w3svc/1 (IIsIPSecuritySetting)
//   w3svc/1 (IIsWebServerSetting)
Related Topics
  • For more information about the IIS WMI Provider, see Using the IIS WMI Provider.
  • For detailed examples of scripts that use the properties and methods of the Windows WMI provider to access the IIS WMI provider, see Module 3: Writing Administration Scripts that Use WMI of the IIS WMI Provider Tutorial.
  • For basic examples in VBScript, JScript, and Perl, see Code Examples to Configure Metabase Properties.
  • Your installation of IIS 6.0 includes command-line administration scripts that manage IIS. See Using Command-Line Administration Scripts.


IIsApplicationPoolSetting (WMI)

This class corresponds to the IIsApplicationPool IIS Admin object, and contains the read-write properties for the object.

Parent Class

IIsSetting (WMI)

Properties

The table below lists properties other than those that are inherited from parent classes.

Property Name | Data Type | Description
PeriodicRestartPrivateMemory | SINT32 | See PeriodicRestartPrivateMemory in the Metabase Property Reference.
AppPoolRecyclePrivateMemory | Boolean | See LogEventOnRecycle in the Metabase Property Reference.
AdminACLBin[] | array of uint8 | See AdminACLBin in the Metabase Property Reference.
Name | String | The Name property defines the label by which the object is known. When subclassed, the Name property can be overridden to be a Key property.
PeriodicRestartTime | SINT32 | See PeriodicRestartTime in the Metabase Property Reference.
PeriodicRestartRequests | SINT32 | See PeriodicRestartRequests in the Metabase Property Reference.
MaxProcesses | SINT32 | See MaxProcesses in the Metabase Property Reference.
PingingEnabled | Boolean | See PingingEnabled in the Metabase Property Reference.
IdleTimeout | SINT32 | See IdleTimeout in the Metabase Property Reference.
RapidFailProtection | Boolean | See RapidFailProtection in the Metabase Property Reference.
SMPAffinitized | Boolean | See SMPAffinitized in the Metabase Property Reference.
SMPProcessorAffinityMask | SINT32 | See SMPProcessorAffinityMask in the Metabase Property Reference.
StartupTimeLimit | SINT32 | See StartupTimeLimit in the Metabase Property Reference.
ShutdownTimeLimit | SINT32 | See ShutdownTimeLimit in the Metabase Property Reference.
PingInterval | SINT32 | See PingInterval in the Metabase Property Reference.
PingResponseTime | SINT32 | See PingResponseTime in the Metabase Property Reference.
DisallowOverlappingRotation | Boolean | See DisallowOverlappingRotation in the Metabase Property Reference.
DisallowRotationOnConfigChange | Boolean | See DisallowRotationOnConfigChange in the Metabase Property Reference.
OrphanWorkerProcess | Boolean | See OrphanWorkerProcess in the Metabase Property Reference.
AppPoolQueueLength | SINT32 | See AppPoolQueueLength in the Metabase Property Reference.
CPUAction | SINT32 | See CPUAction in the Metabase Property Reference.
CPULimit | SINT32 | See CPULimit in the Metabase Property Reference.
CPUResetInterval | SINT32 | See CPUResetInterval in the Metabase Property Reference.
AppPoolIdentityType | SINT32 | See AppPoolIdentityType in the Metabase Property Reference.
WAMUserName | String | See WAMUserName in the Metabase Property Reference.
WAMUserPass | String | See WAMUserPass in the Metabase Property Reference.
LogonMethod | SINT32 | See LogonMethod in the Metabase Property Reference.
PeriodicRestartMemory | SINT32 | See PeriodicRestartMemory in the Metabase Property Reference.
AppPoolCommand | SINT32 | See AppPoolCommand in the Metabase Property Reference.
AppPoolState | SINT32 | See AppPoolState in the Metabase Property Reference.
AppPoolAutoStart | Boolean | See AppPoolAutoStart in the Metabase Property Reference.
PeriodicRestartSchedule[] | array of String | See PeriodicRestartSchedule in the Metabase Property Reference.
RapidFailProtectionInterval | SINT32 | See RapidFailProtectionInterval in the Metabase Property Reference.
RapidFailProtectionMaxCrashes | SINT32 | See RapidFailProtectionMaxCrashes in the Metabase Property Reference.
Win32Error | SINT32 | See Win32Error in the Metabase Property Reference.
OrphanActionExe | String | See OrphanActionExe in the Metabase Property Reference.
OrphanActionParams | String | See OrphanActionParams in the Metabase Property Reference.
LoadBalancerCapabilities | SINT32 | See LoadBalancerCapabilities in the Metabase Property Reference.
AutoShutdownAppPoolExe | String | See AutoShutdownAppPoolExe in the Metabase Property Reference.
AutoShutdownAppPoolParams | String | See AutoShutdownAppPoolParams in the Metabase Property Reference.
LogEventOnRecycle | SINT32 | See LogEventOnRecycle in the Metabase Property Reference.
AppPoolRecycleTime | Boolean | See LogEventOnRecycle in the Metabase Property Reference.
AppPoolRecycleRequests | Boolean | See LogEventOnRecycle in the Metabase Property Reference.
AppPoolRecycleSchedule | Boolean | See LogEventOnRecycle in the Metabase Property Reference.
AppPoolRecycleMemory | Boolean | See LogEventOnRecycle in the Metabase Property Reference.
AppPoolRecycleIsapiUnhealthy | Boolean | See LogEventOnRecycle in the Metabase Property Reference.
AppPoolRecycleOnDemand | Boolean | See LogEventOnRecycle in the Metabase Property Reference.
AppPoolRecycleConfigChange | Boolean | See LogEventOnRecycle in the Metabase Property Reference.
Related Topics
  • For more information about the IIS WMI Provider, see Using the IIS WMI Provider.
  • For detailed examples of scripts that use the properties and methods of the Windows WMI provider to access the IIS WMI provider, see Module 3: Writing Administration Scripts that Use WMI of the IIS WMI Provider Tutorial.
  • For basic examples in VBScript, JScript, and Perl, see Code Examples to Configure Metabase Properties.
  • Your installation of IIS 6.0 includes command-line administration scripts that manage IIS. See Using Command-Line Administration Scripts.


IIsApplicationPoolsSetting (WMI)

This class corresponds to the IIsApplicationPools IIS Admin object, and contains the read-write properties for the object.

Parent Class

IIsSetting (WMI)

Properties

The table below lists properties other than those that are inherited from parent classes.

Property Name | Data Type | Description
PeriodicRestartPrivateMemory | SINT32 | See PeriodicRestartPrivateMemory in the Metabase Property Reference.
AppPoolRecyclePrivateMemory | Boolean | See LogEventOnRecycle in the Metabase Property Reference.
AdminACLBin[] | array of uint8 | See AdminACLBin in the Metabase Property Reference.
Name | String | The Name property defines the label by which the object is known. When subclassed, the Name property can be overridden to be a Key property.
PeriodicRestartTime | SINT32 | See PeriodicRestartTime in the Metabase Property Reference.
PeriodicRestartRequests | SINT32 | See PeriodicRestartRequests in the Metabase Property Reference.
MaxProcesses | SINT32 | See MaxProcesses in the Metabase Property Reference.
PingingEnabled | Boolean | See PingingEnabled in the Metabase Property Reference.
IdleTimeout | SINT32 | See IdleTimeout in the Metabase Property Reference.
RapidFailProtection | Boolean | See RapidFailProtection in the Metabase Property Reference.
SMPAffinitized | Boolean | See SMPAffinitized in the Metabase Property Reference.
SMPProcessorAffinityMask | SINT32 | See SMPProcessorAffinityMask in the Metabase Property Reference.
StartupTimeLimit | SINT32 | See StartupTimeLimit in the Metabase Property Reference.
ShutdownTimeLimit | SINT32 | See ShutdownTimeLimit in the Metabase Property Reference.
PingInterval | SINT32 | See PingInterval in the Metabase Property Reference.
PingResponseTime | SINT32 | See PingResponseTime in the Metabase Property Reference.
DisallowOverlappingRotation | Boolean | See DisallowOverlappingRotation in the Metabase Property Reference.
DisallowRotationOnConfigChange | Boolean | See DisallowRotationOnConfigChange in the Metabase Property Reference.
OrphanWorkerProcess | Boolean | See OrphanWorkerProcess in the Metabase Property Reference.
AppPoolQueueLength | SINT32 | See AppPoolQueueLength in the Metabase Property Reference.
CPUAction | SINT32 | See CPUAction in the Metabase Property Reference.
CPULimit | SINT32 | See CPULimit in the Metabase Property Reference.
CPUResetInterval | SINT32 | See CPUResetInterval in the Metabase Property Reference.
AppPoolIdentityType | SINT32 | See AppPoolIdentityType in the Metabase Property Reference.
WAMUserName | String | See WAMUserName in the Metabase Property Reference.
WAMUserPass | String | See WAMUserPass in the Metabase Property Reference.
LogonMethod | SINT32 | See LogonMethod in the Metabase Property Reference.
PeriodicRestartMemory | SINT32 | See PeriodicRestartMemory in the Metabase Property Reference.
AppPoolCommand | SINT32 | See AppPoolCommand in the Metabase Property Reference.
AppPoolState | SINT32 | See AppPoolState in the Metabase Property Reference.
AppPoolAutoStart | Boolean | See AppPoolAutoStart in the Metabase Property Reference.
PeriodicRestartSchedule[] | array of String | See PeriodicRestartSchedule in the Metabase Property Reference.
RapidFailProtectionInterval | SINT32 | See RapidFailProtectionInterval in the Metabase Property Reference.
RapidFailProtectionMaxCrashes | SINT32 | See RapidFailProtectionMaxCrashes in the Metabase Property Reference.
Win32Error | SINT32 | See Win32Error in the Metabase Property Reference.
OrphanActionExe | String | See OrphanActionExe in the Metabase Property Reference.
OrphanActionParams | String | See OrphanActionParams in the Metabase Property Reference.
LoadBalancerCapabilities | SINT32 | See LoadBalancerCapabilities in the Metabase Property Reference.
AutoShutdownAppPoolExe | String | See AutoShutdownAppPoolExe in the Metabase Property Reference.
AutoShutdownAppPoolParams | String | See AutoShutdownAppPoolParams in the Metabase Property Reference.
LogEventOnRecycle | SINT32 | See LogEventOnRecycle in the Metabase Property Reference.
AppPoolRecycleTime | Boolean | See LogEventOnRecycle in the Metabase Property Reference.
AppPoolRecycleRequests | Boolean | See LogEventOnRecycle in the Metabase Property Reference.
AppPoolRecycleSchedule | Boolean | See LogEventOnRecycle in the Metabase Property Reference.
AppPoolRecycleMemory | Boolean | See LogEventOnRecycle in the Metabase Property Reference.
AppPoolRecycleIsapiUnhealthy | Boolean | See LogEventOnRecycle in the Metabase Property Reference.
AppPoolRecycleOnDemand | Boolean | See LogEventOnRecycle in the Metabase Property Reference.
AppPoolRecycleConfigChange | Boolean | See LogEventOnRecycle in the Metabase Property Reference.
Related Topics
  • For more information about the IIS WMI Provider, see Using the IIS WMI Provider.
  • For detailed examples of scripts that use the properties and methods of the Windows WMI provider to access the IIS WMI provider, see Module 3: Writing Administration Scripts that Use WMI of the IIS WMI Provider Tutorial.
  • For basic examples in VBScript, JScript, and Perl, see Code Examples to Configure Metabase Properties.
  • Your installation of IIS 6.0 includes command-line administration scripts that manage IIS. See Using Command-Line Administration Scripts.


IIsCertMapperSetting (WMI)

The IIsCertMapperSetting class corresponds to the IIsCertMapper IIS Admin object, and contains the read-write properties for the object.

Parent Class

IIsSetting (WMI)

Properties

The table below lists properties other than those that are inherited from parent classes.

Property Name | Data Type | Description
Name | String | The Name property defines the label by which the object is known. When subclassed, the Name property can be overridden to be a Key property.
Related Topics
  • For more information about the IIS WMI Provider, see Using the IIS WMI Provider.
  • For detailed examples of scripts that use the properties and methods of the Windows WMI provider to access the IIS WMI provider, see Module 3: Writing Administration Scripts that Use WMI of the IIS WMI Provider Tutorial.
  • For basic examples in VBScript, JScript, and Perl, see Code Examples to Configure Metabase Properties.
  • Your installation of IIS 6.0 includes command-line administration scripts that manage IIS. See Using Command-Line Administration Scripts.


IIsCompressionSchemeSetting (WMI)

This class corresponds to the IIsCompressionScheme IIS Admin object, and contains the read-write properties for the object.

Parent Class

IIsSetting (WMI)

Properties

The table below lists properties other than those that are inherited from parent classes.

Property Name | Data Type | Description
Name | String | The Name property defines the label by which the object is known. When subclassed, the Name property can be overridden to be a Key property.
HcDoDynamicCompression | Boolean | See HcDoDynamicCompression in the Metabase Property Reference.
HcDoStaticCompression | Boolean | See HcDoStaticCompression in the Metabase Property Reference.
HcDoOnDemandCompression | Boolean | See HcDoOnDemandCompression in the Metabase Property Reference.
HcCompressionDll | String | See HcCompressionDll in the Metabase Property Reference.
HcFileExtensions[] | array of String | See HcFileExtensions in the Metabase Property Reference.
HcScriptFileExtensions[] | array of String | See HcScriptFileExtensions in the Metabase Property Reference.
HcPriority | SINT32 | See HcPriority in the Metabase Property Reference.
HcDynamicCompressionLevel | SINT32 | See HcDynamicCompressionLevel in the Metabase Property Reference.
HcOnDemandCompLevel | SINT32 | See HcOnDemandCompLevel in the Metabase Property Reference.
HcCreateFlags | SINT32 | See HcCreateFlags in the Metabase Property Reference.
Related Topics
  • For more information about the IIS WMI Provider, see Using the IIS WMI Provider.
  • For detailed examples of scripts that use the properties and methods of the Windows WMI provider to access the IIS WMI provider, see Module 3: Writing Administration Scripts that Use WMI of the IIS WMI Provider Tutorial.
  • For basic examples in VBScript, JScript, and Perl, see Code Examples to Configure Metabase Properties.
  • Your installation of IIS 6.0 includes command-line administration scripts that manage IIS. See Using Command-Line Administration Scripts.


IIsCompressionSchemesSetting (WMI)

This class corresponds to the IIsCompressionSchemes IIS Admin object, and contains the read-write properties for the object.

Parent Class

IIsSetting (WMI)

Properties

The table below lists properties other than those that are inherited from parent classes.

Property Name | Data Type | Description
HcCompressionDirectory | String | See HcCompressionDirectory in the Metabase Property Reference.
HcCacheControlHeader | String | See HcCacheControlHeader in the Metabase Property Reference.
HcExpiresHeader | String | See HcExpiresHeader in the Metabase Property Reference.
HcDoDynamicCompression | Boolean | See HcDoDynamicCompression in the Metabase Property Reference.
HcDoStaticCompression | Boolean | See HcDoStaticCompression in the Metabase Property Reference.
HcDoOnDemandCompression | Boolean | See HcDoOnDemandCompression in the Metabase Property Reference.
HcDoDiskSpaceLimiting | Boolean | See HcDoDiskSpaceLimiting in the Metabase Property Reference.
HcNoCompressionForHttp10 | Boolean | See HcNoCompressionForHttp10 in the Metabase Property Reference.
HcNoCompressionForProxies | Boolean | See HcNoCompressionForProxies in the Metabase Property Reference.
HcNoCompressionForRange | Boolean | See HcNoCompressionForRange in the Metabase Property Reference.
HcSendCacheHeaders | Boolean | See HcSendCacheHeaders in the Metabase Property Reference.
HcMaxDiskSpaceUsage | SINT32 | See HcMaxDiskSpaceUsage in the Metabase Property Reference.
HcIoBufferSize | SINT32 | See HcIoBufferSize in the Metabase Property Reference.
HcCompressionBufferSize | SINT32 | See HcCompressionBufferSize in the Metabase Property Reference.
HcMaxQueueLength | SINT32 | See HcMaxQueueLength in the Metabase Property Reference.
HcFilesDeletedPerDiskFree | SINT32 | See HcFilesDeletedPerDiskFree in the Metabase Property Reference.
HcMinFileSizeForComp | SINT32 | See HcMinFileSizeForComp in the Metabase Property Reference.
Name | String | The Name property defines the label by which the object is known. When subclassed, the Name property can be overridden to be a Key property.
Related Topics
  • For more information about the IIS WMI Provider, see Using the IIS WMI Provider.
  • For detailed examples of scripts that use the properties and methods of the Windows WMI provider to access the IIS WMI provider, see Module 3: Writing Administration Scripts that Use WMI of the IIS WMI Provider Tutorial.
  • For basic examples in VBScript, JScript, and Perl, see Code Examples to Configure Metabase Properties.
  • Your installation of IIS 6.0 includes command-line administration scripts that manage IIS. See Using Command-Line Administration Scripts.


IIsComputerSetting (WMI)

This class corresponds to the IIsComputer IIS Admin object, and contains the read-write properties for the object.

Parent Class

IIsSetting (WMI)

Properties

The table below lists properties other than those that are inherited from parent classes.

Property Name | Data Type | Description
MaxBandwidth | SINT32 | See MaxBandwidth in the Metabase Property Reference.
MaxBandwidthBlocked | SINT32 | See MaxBandwidthBlocked in the Metabase Property Reference.
MimeMap[] | array of MimeMap | See MimeMap in the Metabase Property Reference.
EnableHistory | SINT32 | See EnableHistory in the Metabase Property Reference.
MaxHistoryFiles | SINT32 | See MaxHistoryFiles in the Metabase Property Reference.
EnableEditWhileRunning | SINT32 | See EnableEditWhileRunning in the Metabase Property Reference.
MaxErrorFiles | SINT32 | See MaxErrorFiles in the Metabase Property Reference.
Name | String | The Name property defines the label by which the object is known. When subclassed, the Name property can be overridden to be a Key property.
Related Topics
  • For more information about the IIS WMI Provider, see Using the IIS WMI Provider.
  • For detailed examples of scripts that use the properties and methods of the Windows WMI provider to access the IIS WMI provider, see Module 3: Writing Administration Scripts that Use WMI of the IIS WMI Provider Tutorial.
  • For basic examples in VBScript, JScript, and Perl, see Code Examples to Configure Metabase Properties.
  • Your installation of IIS 6.0 includes command-line administration scripts that manage IIS. See Using Command-Line Administration Scripts.


IIsCustomLogModuleSetting (WMI)

This class corresponds to the IIsCustomLogModule IIS Admin object, and contains the read-write properties for the object.

Parent Class

IIsSetting (WMI)

Properties

The table below lists properties other than those that are inherited from parent classes.

Property Name | Data Type | Description
Name | String | The Name property defines the label by which the object is known. When subclassed, the Name property can be overridden to be a Key property.
LogCustomPropertyName | String | See LogCustomPropertyName in the Metabase Property Reference.
LogCustomPropertyHeader | String | See LogCustomPropertyHeader in the Metabase Property Reference.
LogCustomPropertyID | SINT32 | See LogCustomPropertyID in the Metabase Property Reference.
LogCustomPropertyMask | SINT32 | See LogCustomPropertyMask in the Metabase Property Reference.
LogCustomPropertyDataType | SINT32 | See LogCustomPropertyDataType in the Metabase Property Reference.
LogCustomPropertyServicesString[] | array of String | See LogCustomPropertyServicesString in the Metabase Property Reference.
LogCustomPropertyNodeID | SINT32 | See LogCustomPropertyNodeID in the Metabase Property Reference.
Related Topics
  • For more information about the IIS WMI Provider, see Using the IIS WMI Provider.
  • For detailed examples of scripts that use the properties and methods of the Windows WMI provider to access the IIS WMI provider, see Module 3: Writing Administration Scripts that Use WMI of the IIS WMI Provider Tutorial.
  • For basic examples in VBScript, JScript, and Perl, see Code Examples to Configure Metabase Properties.
  • Your installation of IIS 6.0 includes command-line administration scripts that manage IIS. See Using Command-Line Administration Scripts.


IIsFilterSetting (WMI)

This class corresponds to the IIsFilter IIS Admin object, and contains the read-write properties for the object.

Parent Class

IIsSetting (WMI)

Properties

The table below lists properties other than those that are inherited from parent classes.

Property Name | Data Type | Description
FilterPath | String | See FilterPath in the Metabase Property Reference.
FilterDescription | String | See FilterDescription in the Metabase Property Reference.
FilterFlags | SINT32 | See FilterFlags in the Metabase Property Reference.
FilterState | SINT32 | See FilterState in the Metabase Property Reference.
FilterEnabled | Boolean | See FilterEnabled in the Metabase Property Reference.
FilterEnableCache | Boolean | See FilterEnableCache in the Metabase Property Reference.
Win32Error | SINT32 | See Win32Error in the Metabase Property Reference.
NotifySecurePort | Boolean | See FilterFlags in the Metabase Property Reference.
NotifyNonSecurePort | Boolean | See FilterFlags in the Metabase Property Reference.
NotifySendResponse | Boolean | See FilterFlags in the Metabase Property Reference.
NotifyEndOfRequest | Boolean | See FilterFlags in the Metabase Property Reference.
NotifyEndOfNetSession | Boolean | See FilterFlags in the Metabase Property Reference.
NotifyLog | Boolean | See FilterFlags in the Metabase Property Reference.
NotifySendRawData | Boolean | See FilterFlags in the Metabase Property Reference.
NotifyAccessDenied | Boolean | See FilterFlags in the Metabase Property Reference.
NotifyUrlMap | Boolean | See FilterFlags in the Metabase Property Reference.
NotifyAuthentication | Boolean | See FilterFlags in the Metabase Property Reference.
NotifyPreProcHeaders | Boolean | See FilterFlags in the Metabase Property Reference.
NotifyReadRawData | Boolean | See FilterFlags in the Metabase Property Reference.
NotifyOrderLow | Boolean | See FilterFlags in the Metabase Property Reference.
NotifyOrderMedium | Boolean | See FilterFlags in the Metabase Property Reference.
NotifyOrderHigh | Boolean | See FilterFlags in the Metabase Property Reference.
NotifyExtensionTrigger | Boolean | See FilterFlags in the Metabase Property Reference.
NotifyAuthComplete | Boolean | See FilterFlags in the Metabase Property Reference.
Name | String | The Name property defines the label by which the object is known. When subclassed, the Name property can be overridden to be a Key property.
Related Topics
  • For more information about the IIS WMI Provider, see Using the IIS WMI Provider.
  • For detailed examples of scripts that use the properties and methods of the Windows WMI provider to access the IIS WMI provider, see Module 3: Writing Administration Scripts that Use WMI of the IIS WMI Provider Tutorial.
  • For basic examples in VBScript, JScript, and Perl, see Code Examples to Configure Metabase Properties.
  • Your installation of IIS 6.0 includes command-line administration scripts that manage IIS. See Using Command-Line Administration Scripts.


IIsFiltersSetting (WMI)

This class corresponds to the IIsFilters IIS Admin object, and contains the read-write properties for the object.

Parent Class

IIsSetting (WMI)

Properties

The table below lists properties other than those that are inherited from parent classes.

Property Name | Data Type | Description
Name | String | The Name property defines the label by which the object is known. When subclassed, the Name property can be overridden to be a Key property.
FilterLoadOrder | String | See FilterLoadOrder in the Metabase Property Reference.
Related Topics
  • For more information about the IIS WMI Provider, see Using the IIS WMI Provider.
  • For detailed examples of scripts that use the properties and methods of the Windows WMI provider to access the IIS WMI provider, see Module 3: Writing Administration Scripts that Use WMI of the IIS WMI Provider Tutorial.
  • For basic examples in VBScript, JScript, and Perl, see Code Examples to Configure Metabase Properties.
  • Your installation of IIS 6.0 includes command-line administration scripts that manage IIS. See Using Command-Line Administration Scripts.


IIsFtpInfoSetting (WMI)

This class corresponds to the IIsFtpInfo IIS Admin object, and contains the read-write properties for the object.

Parent Class

IIsSetting (WMI)

Properties

The table below lists properties other than those that are inherited from parent classes.

Property Name | Data Type | Description
AdminACLBin[] | array of uint8 | See AdminACLBin in the Metabase Property Reference.
Name | String | The Name property defines the label by which the object is known. When subclassed, the Name property can be overridden to be a Key property.
LogModuleList | String | See LogModuleList in the Metabase Property Reference.
Related Topics
  • For more information about the IIS WMI Provider, see Using the IIS WMI Provider.
  • For detailed examples of scripts that use the properties and methods of the Windows WMI provider to access the IIS WMI provider, see Module 3: Writing Administration Scripts that Use WMI of the IIS WMI Provider Tutorial.
  • For basic examples in VBScript, JScript, and Perl, see Code Examples to Configure Metabase Properties.
  • Your installation of IIS 6.0 includes command-line administration scripts that manage IIS. See Using Command-Line Administration Scripts.


IIsFtpServerSetting (WMI)

This class corresponds to the IIsFtpServer IIS Admin object, and contains the read-write properties for the object.

Parent Class

IIsSetting (WMI)

Properties

The table below lists properties other than those that are inherited from parent classes.

Property Name | Data Type | Description
Name | String | The Name property defines the label by which the object is known. When subclassed, the Name property can be overridden to be a Key property.
MaxConnections | SINT32 | See MaxConnections in the Metabase Property Reference.
AnonymousUserName | String | See AnonymousUserName in the Metabase Property Reference.
AnonymousUserPass | String | See AnonymousUserPass in the Metabase Property Reference.
ServerListenBacklog | SINT32 | See ServerListenBacklog in the Metabase Property Reference.
DisableSocketPooling | Boolean | See DisableSocketPooling in the Metabase Property Reference.
LogAnonymous | Boolean | See LogAnonymous in the Metabase Property Reference.
LogNonAnonymous | Boolean | See LogNonAnonymous in the Metabase Property Reference.
ServerComment | String | See ServerComment in the Metabase Property Reference.
ServerBindings[] | array of ServerBinding | See ServerBindings in the Metabase Property Reference.
ConnectionTimeout | SINT32 | See ConnectionTimeout in the Metabase Property Reference.
ServerListenTimeout | SINT32 | See ServerListenTimeout in the Metabase Property Reference.
MaxEndpointConnections | SINT32 | See MaxEndpointConnections in the Metabase Property Reference.
ServerAutoStart | Boolean | See ServerAutoStart in the Metabase Property Reference.
ExitMessage | String | See ExitMessage in the Metabase Property Reference.
GreetingMessage[] | array of String | See GreetingMessage in the Metabase Property Reference.
MaxClientsMessage | String | See MaxClientsMessage in the Metabase Property Reference.
AnonymousOnly | Boolean | See AnonymousOnly in the Metabase Property Reference.
MSDOSDirOutput | Boolean | See MSDOSDirOutput in the Metabase Property Reference.
ServerSize | SINT32 | See ServerSize in the Metabase Property Reference.
AnonymousPasswordSync | Boolean | See AnonymousPasswordSync in the Metabase Property Reference.
AllowAnonymous | Boolean | See AllowAnonymous in the Metabase Property Reference.
DefaultLogonDomain | String | See DefaultLogonDomain in the Metabase Property Reference.
AdminACLBin[] | array of uint8 | See AdminACLBin in the Metabase Property Reference.
DontLog | Boolean | See DontLog in the Metabase Property Reference.
Realm | String | See Realm in the Metabase Property Reference.
ClusterEnabled | Boolean | See ClusterEnabled in the Metabase Property Reference.
LogType | SINT32 | See LogType in the Metabase Property Reference.
LogPluginClsid | String | See LogPluginClsid in the Metabase Property Reference.
LogFileDirectory | String | See LogFileDirectory in the Metabase Property Reference.
LogFilePeriod | SINT32 | See LogFilePeriod in the Metabase Property Reference.
LogFileLocaltimeRollover | Boolean | See LogFileLocaltimeRollover in the Metabase Property Reference.
LogFileTruncateSize | SINT32 | See LogFileTruncateSize in the Metabase Property Reference.
LogExtFileFlags | SINT32 | See LogExtFileFlags in the Metabase Property Reference.
LogOdbcDataSource | String | See LogOdbcDataSource in the Metabase Property Reference.
LogOdbcTableName | String | See LogOdbcTableName in the Metabase Property Reference.
LogOdbcUserName | String | See LogOdbcUserName in the Metabase Property Reference.
LogOdbcPassword | String | See LogOdbcPassword in the Metabase Property Reference.
AccessFlags | SINT32 | See AccessFlags in the Metabase Property Reference.
Win32Error | SINT32 | See Win32Error in the Metabase Property Reference.
FtpDirBrowseShowLongDate | Boolean | See FtpDirBrowseShowLongDate in the Metabase Property Reference.
BannerMessage[] | array of String | See BannerMessage in the Metabase Property Reference.
UserIsolationMode | SINT32 | See UserIsolationMode in the Metabase Property Reference.
FtpLogInUtf8 | Boolean | See FtpLogInUtf8 in the Metabase Property Reference.
ADConnectionsUserName | String | See ADConnectionsUserName in the Metabase Property Reference.
ADConnectionsPassword | String | See ADConnectionsPassword in the Metabase Property Reference.
ServerCommand | SINT32 | See ServerCommand in the Metabase Property Reference.
LogExtFileDate | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileTime | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileClientIp | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileUserName | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileSiteName | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileComputerName | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileServerIp | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileMethod | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileUriStem | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileUriQuery | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileHttpStatus | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileWin32Status | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileBytesSent | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileBytesRecv | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileTimeTaken | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileServerPort | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileUserAgent | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileCookie | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileReferer | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileProtocolVersion | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileHost | Boolean | See LogExtFileFlags in the Metabase Property Reference.
AccessRead | Boolean | See AccessFlags in the Metabase Property Reference.
AccessWrite | Boolean | See AccessFlags in the Metabase Property Reference.
AccessExecute | Boolean | See AccessFlags in the Metabase Property Reference.
AccessSource | Boolean | See AccessFlags in the Metabase Property Reference.
AccessScript | Boolean | See AccessFlags in the Metabase Property Reference.
AccessNoRemoteWrite | Boolean | See AccessFlags in the Metabase Property Reference.
AccessNoRemoteExecute | Boolean | See AccessFlags in the Metabase Property Reference.
AccessNoRemoteRead | Boolean | See AccessFlags in the Metabase Property Reference.
AccessNoRemoteScript | Boolean | See AccessFlags in the Metabase Property Reference.
Related Topics
  • For more information about the IIS WMI Provider, see Using the IIS WMI Provider.
  • For detailed examples of scripts that use the properties and methods of the Windows WMI provider to access the IIS WMI provider, see Module 3: Writing Administration Scripts that Use WMI of the IIS WMI Provider Tutorial.
  • For basic examples in VBScript, JScript, and Perl, see Code Examples to Configure Metabase Properties.
  • Your installation of IIS 6.0 includes command-line administration scripts that manage IIS. See Using Command-Line Administration Scripts.


IIsFtpServiceSetting (WMI)

This class corresponds to the IIsFtpService IIS Admin object, and contains the read-write properties for the object.

Parent Class

IIsSetting (WMI)

Properties

The table below lists properties other than those that are inherited from parent classes.

Property Name | Data Type | Description
PassivePortRange | String | See PassivePortRange in the Metabase Property Reference.
Name | String | The Name property defines the label by which the object is known. When subclassed, the Name property can be overridden to be a Key property.
MaxConnections | SINT32 | See MaxConnections in the Metabase Property Reference.
AnonymousUserName | String | See AnonymousUserName in the Metabase Property Reference.
AnonymousUserPass | String | See AnonymousUserPass in the Metabase Property Reference.
ServerListenBacklog | SINT32 | See ServerListenBacklog in the Metabase Property Reference.
LogAnonymous | Boolean | See LogAnonymous in the Metabase Property Reference.
LogNonAnonymous | Boolean | See LogNonAnonymous in the Metabase Property Reference.
ServerComment | String | See ServerComment in the Metabase Property Reference.
ServerBindings[] | array of ServerBinding | See ServerBindings in the Metabase Property Reference.
ConnectionTimeout | SINT32 | See ConnectionTimeout in the Metabase Property Reference.
ServerListenTimeout | SINT32 | See ServerListenTimeout in the Metabase Property Reference.
MaxEndpointConnections | SINT32 | See MaxEndpointConnections in the Metabase Property Reference.
ServerAutoStart | Boolean | See ServerAutoStart in the Metabase Property Reference.
ExitMessage | String | See ExitMessage in the Metabase Property Reference.
GreetingMessage[] | array of String | See GreetingMessage in the Metabase Property Reference.
MaxClientsMessage | String | See MaxClientsMessage in the Metabase Property Reference.
AnonymousOnly | Boolean | See AnonymousOnly in the Metabase Property Reference.
MSDOSDirOutput | Boolean | See MSDOSDirOutput in the Metabase Property Reference.
ServerSize | SINT32 | See ServerSize in the Metabase Property Reference.
DisableSocketPooling | Boolean | See DisableSocketPooling in the Metabase Property Reference.
AnonymousPasswordSync | Boolean | See AnonymousPasswordSync in the Metabase Property Reference.
AllowAnonymous | Boolean | See AllowAnonymous in the Metabase Property Reference.
DefaultLogonDomain | String | See DefaultLogonDomain in the Metabase Property Reference.
AdminACLBin[] | array of uint8 | See AdminACLBin in the Metabase Property Reference.
DontLog | Boolean | See DontLog in the Metabase Property Reference.
DirectoryLevelsToScan | SINT32 | See DirectoryLevelsToScan in the Metabase Property Reference.
Realm | String | See Realm in the Metabase Property Reference.
LogType | SINT32 | See LogType in the Metabase Property Reference.
LogFilePeriod | SINT32 | See LogFilePeriod in the Metabase Property Reference.
LogFileLocaltimeRollover | Boolean | See LogFileLocaltimeRollover in the Metabase Property Reference.
LogPluginClsid | String | See LogPluginClsid in the Metabase Property Reference.
LogModuleList | String | See LogModuleList in the Metabase Property Reference.
LogFileDirectory | String | See LogFileDirectory in the Metabase Property Reference.
LogFileTruncateSize | SINT32 | See LogFileTruncateSize in the Metabase Property Reference.
LogExtFileFlags | SINT32 | See LogExtFileFlags in the Metabase Property Reference.
LogOdbcDataSource | String | See LogOdbcDataSource in the Metabase Property Reference.
LogOdbcTableName | String | See LogOdbcTableName in the Metabase Property Reference.
LogOdbcUserName | String | See LogOdbcUserName in the Metabase Property Reference.
LogOdbcPassword | String | See LogOdbcPassword in the Metabase Property Reference.
FtpDirBrowseShowLongDate | Boolean | See FtpDirBrowseShowLongDate in the Metabase Property Reference.
AccessFlags | SINT32 | See AccessFlags in the Metabase Property Reference.
DownlevelAdminInstance | SINT32 | See DownlevelAdminInstance in the Metabase Property Reference.
BannerMessage[] | array of String | See BannerMessage in the Metabase Property Reference.
UserIsolationMode | SINT32 | See UserIsolationMode in the Metabase Property Reference.
FtpLogInUtf8 | Boolean | See FtpLogInUtf8 in the Metabase Property Reference.
ADConnectionsUserName | String | See ADConnectionsUserName in the Metabase Property Reference.
ADConnectionsPassword | String | See ADConnectionsPassword in the Metabase Property Reference.
ServerCommand | SINT32 | See ServerCommand in the Metabase Property Reference.
LogExtFileDate | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileTime | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileClientIp | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileUserName | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileSiteName | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileComputerName | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileServerIp | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileMethod | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileUriStem | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileUriQuery | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileHttpStatus | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileWin32Status | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileBytesSent | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileBytesRecv | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileTimeTaken | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileServerPort | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileUserAgent | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileCookie | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileReferer | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileProtocolVersion | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileHost | Boolean | See LogExtFileFlags in the Metabase Property Reference.
AccessRead | Boolean | See AccessFlags in the Metabase Property Reference.
AccessWrite | Boolean | See AccessFlags in the Metabase Property Reference.
AccessExecute | Boolean | See AccessFlags in the Metabase Property Reference.
AccessSource | Boolean | See AccessFlags in the Metabase Property Reference.
AccessScript | Boolean | See AccessFlags in the Metabase Property Reference.
AccessNoRemoteWrite | Boolean | See AccessFlags in the Metabase Property Reference.
AccessNoRemoteExecute | Boolean | See AccessFlags in the Metabase Property Reference.
AccessNoRemoteRead | Boolean | See AccessFlags in the Metabase Property Reference.
AccessNoRemoteScript | Boolean | See AccessFlags in the Metabase Property Reference.
Related Topics
  • For more information about the IIS WMI Provider, see Using the IIS WMI Provider.
  • For detailed examples of scripts that use the properties and methods of the Windows WMI provider to access the IIS WMI provider, see Module 3: Writing Administration Scripts that Use WMI of the IIS WMI Provider Tutorial.
  • For basic examples in VBScript, JScript, and Perl, see Code Examples to Configure Metabase Properties.
  • Your installation of IIS 6.0 includes command-line administration scripts that manage IIS. See Using Command-Line Administration Scripts.


IIsFtpVirtualDirSetting (WMI)

This class corresponds to the IIsFtpVirtualDir IIS Admin object, and contains the read-write properties for the object.

Parent Class

IIsSetting (WMI)

Properties

The table below lists properties other than those that are inherited from parent classes.

Property Name | Data Type | Description
Name | String | The Name property defines the label by which the object is known. When subclassed, the Name property can be overridden to be a Key property.
AdminACLBin[] | array of uint8 | See AdminACLBin in the Metabase Property Reference.
Path | String | See Path in the Metabase Property Reference.
UNCUserName | String | See UNCUserName in the Metabase Property Reference.
UNCPassword | String | See UNCPassword in the Metabase Property Reference.
AccessFlags | SINT32 | See AccessFlags in the Metabase Property Reference.
DontLog | Boolean | See DontLog in the Metabase Property Reference.
FtpDirBrowseShowLongDate | Boolean | See FtpDirBrowseShowLongDate in the Metabase Property Reference.
Win32Error | SINT32 | See Win32Error in the Metabase Property Reference.
AccessRead | Boolean | See AccessFlags in the Metabase Property Reference.
AccessWrite | Boolean | See AccessFlags in the Metabase Property Reference.
AccessExecute | Boolean | See AccessFlags in the Metabase Property Reference.
AccessSource | Boolean | See AccessFlags in the Metabase Property Reference.
AccessScript | Boolean | See AccessFlags in the Metabase Property Reference.
AccessNoRemoteWrite | Boolean | See AccessFlags in the Metabase Property Reference.
AccessNoRemoteExecute | Boolean | See AccessFlags in the Metabase Property Reference.
AccessNoRemoteRead | Boolean | See AccessFlags in the Metabase Property Reference.
AccessNoRemoteScript | Boolean | See AccessFlags in the Metabase Property Reference.
Related Topics
  • For more information about the IIS WMI Provider, see Using the IIS WMI Provider.
  • For detailed examples of scripts that use the properties and methods of the Windows WMI provider to access the IIS WMI provider, see Module 3: Writing Administration Scripts that Use WMI of the IIS WMI Provider Tutorial.
  • For basic examples in VBScript, JScript, and Perl, see Code Examples to Configure Metabase Properties.
  • Your installation of IIS 6.0 includes command-line administration scripts that manage IIS. See Using Command-Line Administration Scripts.


IIsImapInfoSetting (WMI)

This class corresponds to the IIsImapInfo IIS Admin object, and contains the read-write properties for the object.

Parent Class

IIsSetting (WMI)

Properties

The table below lists properties other than those that are inherited from parent classes.

Property Name | Data Type | Description
Name | String | The Name property defines the label by which the object is known. When subclassed, the Name property can be overridden to be a Key property.
LogModuleList | String | See LogModuleList in the Metabase Property Reference.
Related Topics
  • For more information about the IIS WMI Provider, see Using the IIS WMI Provider.
  • For detailed examples of scripts that use the properties and methods of the Windows WMI provider to access the IIS WMI provider, see Module 3: Writing Administration Scripts that Use WMI of the IIS WMI Provider Tutorial.
  • For basic examples in VBScript, JScript, and Perl, see Code Examples to Configure Metabase Properties.
  • Your installation of IIS 6.0 includes command-line administration scripts that manage IIS. See Using Command-Line Administration Scripts.


IIsImapRoutingSourceSetting (WMI)

This class corresponds to the IIsImapRoutingSource IIS Admin object, and contains the read-write properties for the object.

Parent Class

IIsSetting (WMI)

Properties

The table below lists properties other than those that are inherited from parent classes.

Property Name | Data Type | Description
ImapRoutingTableType | String | See ImapRoutingTableType in the Metabase Property Reference.
ImapDsDataDirectory | String | See ImapDsDataDirectory in the Metabase Property Reference.
ImapDsDefaultMailRoot | String | See ImapDsDefaultMailRoot in the Metabase Property Reference.
ImapDsBindType | String | See ImapDsBindType in the Metabase Property Reference.
ImapDsSchemaType | String | See ImapDsSchemaType in the Metabase Property Reference.
ImapDsHost | String | See ImapDsHost in the Metabase Property Reference.
ImapDsNamingContext | String | See ImapDsNamingContext in the Metabase Property Reference.
ImapDsAccount | String | See ImapDsAccount in the Metabase Property Reference.
ImapDsPassword | String | See ImapDsPassword in the Metabase Property Reference.
Name | String | The Name property defines the label by which the object is known. When subclassed, the Name property can be overridden to be a Key property.
Related Topics
  • For more information about the IIS WMI Provider, see Using the IIS WMI Provider.
  • For detailed examples of scripts that use the properties and methods of the Windows WMI provider to access the IIS WMI provider, see Module 3: Writing Administration Scripts that Use WMI of the IIS WMI Provider Tutorial.
  • For basic examples in VBScript, JScript, and Perl, see Code Examples to Configure Metabase Properties.
  • Your installation of IIS 6.0 includes command-line administration scripts that manage IIS. See Using Command-Line Administration Scripts.


IIsImapServerSetting (WMI)

This class corresponds to the IIsImapServer IIS Admin object, and contains the read-write properties for the object.

Parent Class

IIsSetting (WMI)

Properties

The table below lists properties other than those that are inherited from parent classes.

Property Name | Data Type | Description
Name | String | The Name property defines the label by which the object is known. When subclassed, the Name property can be overridden to be a Key property.
AzEnable | Boolean | See AzEnable in the Metabase Property Reference.
AzImpersonationLevel | SINT32 | See AzImpersonationLevel in the Metabase Property Reference.
AzStoreName | String | See AzStoreName in the Metabase Property Reference.
AzScopeName | String | See AzScopeName in the Metabase Property Reference.
MaxBandwidth | SINT32 | See MaxBandwidth in the Metabase Property Reference.
MaxConnections | SINT32 | See MaxConnections in the Metabase Property Reference.
ServerComment | String | See ServerComment in the Metabase Property Reference.
ConnectionTimeout | SINT32 | See ConnectionTimeout in the Metabase Property Reference.
ServerListenTimeout | SINT32 | See ServerListenTimeout in the Metabase Property Reference.
MaxEndpointConnections | SINT32 | See MaxEndpointConnections in the Metabase Property Reference.
ServerAutoStart | Boolean | See ServerAutoStart in the Metabase Property Reference.
ServerBindings[] | array of ServerBinding | See ServerBindings in the Metabase Property Reference.
SecureBindings[] | array of SecureBinding | See SecureBindings in the Metabase Property Reference.
AdminACLBin[] | array of uint8 | See AdminACLBin in the Metabase Property Reference.
DontLog | Boolean | See DontLog in the Metabase Property Reference.
AuthFlags | SINT32 | See AuthFlags in the Metabase Property Reference.
DefaultLogonDomain | String | See DefaultLogonDomain in the Metabase Property Reference.
NTAuthenticationProviders | String | See NTAuthenticationProviders in the Metabase Property Reference.
AccessFlags | SINT32 | See AccessFlags in the Metabase Property Reference.
AccessSSLFlags | SINT32 | See AccessSSLFlags in the Metabase Property Reference.
LogType | SINT32 | See LogType in the Metabase Property Reference.
LogPluginClsid | String | See LogPluginClsid in the Metabase Property Reference.
LogFileDirectory | String | See LogFileDirectory in the Metabase Property Reference.
LogFilePeriod | SINT32 | See LogFilePeriod in the Metabase Property Reference.
LogFileTruncateSize | SINT32 | See LogFileTruncateSize in the Metabase Property Reference.
LogExtFileFlags | SINT32 | See LogExtFileFlags in the Metabase Property Reference.
LogOdbcDataSource | String | See LogOdbcDataSource in the Metabase Property Reference.
LogOdbcTableName | String | See LogOdbcTableName in the Metabase Property Reference.
LogOdbcUserName | String | See LogOdbcUserName in the Metabase Property Reference.
LogOdbcPassword | String | See LogOdbcPassword in the Metabase Property Reference.
ServerListenBacklog | SINT32 | See ServerListenBacklog in the Metabase Property Reference.
Win32Error | SINT32 | See Win32Error in the Metabase Property Reference.
ImapExpireMail | SINT32 | See ImapExpireMail in the Metabase Property Reference.
ImapExpireDelay | SINT32 | See ImapExpireDelay in the Metabase Property Reference.
ImapExpireStart | SINT32 | See ImapExpireStart in the Metabase Property Reference.
ImapMailExpirationTime | SINT32 | See ImapMailExpirationTime in the Metabase Property Reference.
ImapClearTextProvider | String | See ImapClearTextProvider in the Metabase Property Reference.
ImapDefaultDomain | String | See ImapDefaultDomain in the Metabase Property Reference.
ImapRoutingDll | String | See ImapRoutingDll in the Metabase Property Reference.
AuthAnonymous | Boolean | See AuthFlags in the Metabase Property Reference.
AuthBasic | Boolean | See AuthFlags in the Metabase Property Reference.
AuthNTLM | Boolean | See AuthFlags in the Metabase Property Reference.
AuthMD5 | Boolean | See AuthFlags in the Metabase Property Reference.
AuthPassport | Boolean | See AuthFlags in the Metabase Property Reference.
AccessRead | Boolean | See AccessFlags in the Metabase Property Reference.
AccessWrite | Boolean | See AccessFlags in the Metabase Property Reference.
AccessExecute | Boolean | See AccessFlags in the Metabase Property Reference.
AccessSource | Boolean | See AccessFlags in the Metabase Property Reference.
AccessScript | Boolean | See AccessFlags in the Metabase Property Reference.
AccessNoRemoteExecute | Boolean | See AccessFlags in the Metabase Property Reference.
AccessNoRemoteWrite | Boolean | See AccessFlags in the Metabase Property Reference.
AccessNoRemoteRead | Boolean | See AccessFlags in the Metabase Property Reference.
AccessNoRemoteScript | Boolean | See AccessFlags in the Metabase Property Reference.
AccessSSL | Boolean | See AccessSSLFlags in the Metabase Property Reference.
AccessSSLNegotiateCert | Boolean | See AccessSSLFlags in the Metabase Property Reference.
AccessSSLRequireCert | Boolean | See AccessSSLFlags in the Metabase Property Reference.
AccessSSLMapCert | Boolean | See AccessSSLFlags in the Metabase Property Reference.
AccessSSL128 | Boolean | See AccessSSLFlags in the Metabase Property Reference.
LogExtFileDate | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileTime | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileClientIp | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileUserName | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileSiteName | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileComputerName | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileServerIp | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileMethod | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileUriStem | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileUriQuery | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileHttpStatus | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileWin32Status | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileBytesSent | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileBytesRecv | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileTimeTaken | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileServerPort | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileUserAgent | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileCookie | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileReferer | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileProtocolVersion | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileHost | Boolean | See LogExtFileFlags in the Metabase Property Reference.
Related Topics
  • For more information about the IIS WMI Provider, see Using the IIS WMI Provider.
  • For detailed examples of scripts that use the properties and methods of the Windows WMI provider to access the IIS WMI provider, see Module 3: Writing Administration Scripts that Use WMI of the IIS WMI Provider Tutorial.
  • For basic examples in VBScript, JScript, and Perl, see Code Examples to Configure Metabase Properties.
  • Your installation of IIS 6.0 includes command-line administration scripts that manage IIS. See Using Command-Line Administration Scripts.


IIsImapServiceSetting (WMI)

This class corresponds to the IIsImapService IIS Admin object, and contains the read-write properties for the object.

Parent Class

IIsSetting (WMI)

Properties

The table below lists properties other than those that are inherited from parent classes.

Property Name | Data Type | Description
AzEnable | Boolean | See AzEnable in the Metabase Property Reference.
AzImpersonationLevel | SINT32 | See AzImpersonationLevel in the Metabase Property Reference.
AzStoreName | String | See AzStoreName in the Metabase Property Reference.
AzScopeName | String | See AzScopeName in the Metabase Property Reference.
MaxBandwidth | SINT32 | See MaxBandwidth in the Metabase Property Reference.
MaxConnections | SINT32 | See MaxConnections in the Metabase Property Reference.
ServerComment | String | See ServerComment in the Metabase Property Reference.
ConnectionTimeout | SINT32 | See ConnectionTimeout in the Metabase Property Reference.
ServerListenTimeout | SINT32 | See ServerListenTimeout in the Metabase Property Reference.
MaxEndpointConnections | SINT32 | See MaxEndpointConnections in the Metabase Property Reference.
ServerAutoStart | Boolean | See ServerAutoStart in the Metabase Property Reference.
AdminACLBin[] | array of uint8 | See AdminACLBin in the Metabase Property Reference.
DontLog | Boolean | See DontLog in the Metabase Property Reference.
AuthFlags | SINT32 | See AuthFlags in the Metabase Property Reference.
ServerListenBacklog | SINT32 | See ServerListenBacklog in the Metabase Property Reference.
DefaultLogonDomain | String | See DefaultLogonDomain in the Metabase Property Reference.
NTAuthenticationProviders | String | See NTAuthenticationProviders in the Metabase Property Reference.
AccessFlags | SINT32 | See AccessFlags in the Metabase Property Reference.
AccessSSLFlags | SINT32 | See AccessSSLFlags in the Metabase Property Reference.
LogType | SINT32 | See LogType in the Metabase Property Reference.
LogFilePeriod | SINT32 | See LogFilePeriod in the Metabase Property Reference.
LogPluginClsid | String | See LogPluginClsid in the Metabase Property Reference.
LogModuleList | String | See LogModuleList in the Metabase Property Reference.
LogFileDirectory | String | See LogFileDirectory in the Metabase Property Reference.
LogFileTruncateSize | SINT32 | See LogFileTruncateSize in the Metabase Property Reference.
LogExtFileFlags | SINT32 | See LogExtFileFlags in the Metabase Property Reference.
LogOdbcDataSource | String | See LogOdbcDataSource in the Metabase Property Reference.
LogOdbcTableName | String | See LogOdbcTableName in the Metabase Property Reference.
LogOdbcUserName | String | See LogOdbcUserName in the Metabase Property Reference.
LogOdbcPassword | String | See LogOdbcPassword in the Metabase Property Reference.
ImapExpireMail | SINT32 | See ImapExpireMail in the Metabase Property Reference.
ImapExpireDelay | SINT32 | See ImapExpireDelay in the Metabase Property Reference.
ImapExpireStart | SINT32 | See ImapExpireStart in the Metabase Property Reference.
ImapMailExpirationTime | SINT32 | See ImapMailExpirationTime in the Metabase Property Reference.
ImapClearTextProvider | String | See ImapClearTextProvider in the Metabase Property Reference.
ImapDefaultDomain | String | See ImapDefaultDomain in the Metabase Property Reference.
ImapRoutingDll | String | See ImapRoutingDll in the Metabase Property Reference.
Name | String | The Name property defines the label by which the object is known. When subclassed, the Name property can be overridden to be a Key property.
AuthAnonymous | Boolean | See AuthFlags in the Metabase Property Reference.
AuthBasic | Boolean | See AuthFlags in the Metabase Property Reference.
AuthNTLM | Boolean | See AuthFlags in the Metabase Property Reference.
AuthMD5 | Boolean | See AuthFlags in the Metabase Property Reference.
AuthPassport | Boolean | See AuthFlags in the Metabase Property Reference.
AccessRead | Boolean | See AccessFlags in the Metabase Property Reference.
AccessWrite | Boolean | See AccessFlags in the Metabase Property Reference.
AccessExecute | Boolean | See AccessFlags in the Metabase Property Reference.
AccessSource | Boolean | See AccessFlags in the Metabase Property Reference.
AccessScript | Boolean | See AccessFlags in the Metabase Property Reference.
AccessNoRemoteExecute | Boolean | See AccessFlags in the Metabase Property Reference.
AccessNoRemoteWrite | Boolean | See AccessFlags in the Metabase Property Reference.
AccessNoRemoteRead | Boolean | See AccessFlags in the Metabase Property Reference.
AccessNoRemoteScript | Boolean | See AccessFlags in the Metabase Property Reference.
AccessSSL | Boolean | See AccessSSLFlags in the Metabase Property Reference.
AccessSSLNegotiateCert | Boolean | See AccessSSLFlags in the Metabase Property Reference.
AccessSSLRequireCert | Boolean | See AccessSSLFlags in the Metabase Property Reference.
AccessSSLMapCert | Boolean | See AccessSSLFlags in the Metabase Property Reference.
AccessSSL128 | Boolean | See AccessSSLFlags in the Metabase Property Reference.
LogExtFileDate | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileTime | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileClientIp | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileUserName | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileSiteName | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileComputerName | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileServerIp | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileMethod | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileUriStem | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileUriQuery | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileHttpStatus | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileWin32Status | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileBytesSent | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileBytesRecv | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileTimeTaken | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileServerPort | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileUserAgent | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileCookie | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileReferer | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileProtocolVersion | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileHost | Boolean | See LogExtFileFlags in the Metabase Property Reference.
Related Topics
  • For more information about the IIS WMI Provider, see Using the IIS WMI Provider.
  • For detailed examples of scripts that use the properties and methods of the Windows WMI provider to access the IIS WMI provider, see Module 3: Writing Administration Scripts that Use WMI of the IIS WMI Provider Tutorial.
  • For basic examples in VBScript, JScript, and Perl, see Code Examples to Configure Metabase Properties.
  • Your installation of IIS 6.0 includes command-line administration scripts that manage IIS. See Using Command-Line Administration Scripts.


IIsImapSessionsSetting (WMI)

This class corresponds to the IIsImapSessions IIS Admin object, and contains the read-write properties for the object.

Parent Class

IIsSetting (WMI)

Properties

The table below lists properties other than those that are inherited from parent classes.

Property Name | Data Type | Description
Name | String | The Name property defines the label by which the object is known. When subclassed, the Name property can be overridden to be a Key property.
Related Topics
  • For more information about the IIS WMI Provider, see Using the IIS WMI Provider.
  • For detailed examples of scripts that use the properties and methods of the Windows WMI provider to access the IIS WMI provider, see Module 3: Writing Administration Scripts that Use WMI of the IIS WMI Provider Tutorial.
  • For basic examples in VBScript, JScript, and Perl, see Code Examples to Configure Metabase Properties.
  • Your installation of IIS 6.0 includes command-line administration scripts that manage IIS. See Using Command-Line Administration Scripts.


IIsImapVirtualDirSetting (WMI)

This class corresponds to the IIsImapVirtualDir IIS Admin object, and contains the read-write properties for the object.

Parent Class

IIsSetting (WMI)

Properties

The table below lists properties other than those that are inherited from parent classes.

Property Name | Data Type | Description
Name | String | The Name property defines the label by which the object is known. When subclassed, the Name property can be overridden to be a Key property.
Path | String | See Path in the Metabase Property Reference.
UNCUserName | String | See UNCUserName in the Metabase Property Reference.
UNCPassword | String | See UNCPassword in the Metabase Property Reference.
Win32Error | SINT32 | See Win32Error in the Metabase Property Reference.
DontLog | Boolean | See DontLog in the Metabase Property Reference.
AccessFlags | SINT32 | See AccessFlags in the Metabase Property Reference.
AccessSSLFlags | SINT32 | See AccessSSLFlags in the Metabase Property Reference.
ImapExpireMail | SINT32 | See ImapExpireMail in the Metabase Property Reference.
ImapMailExpirationTime | SINT32 | See ImapMailExpirationTime in the Metabase Property Reference.
AccessRead | Boolean | See AccessFlags in the Metabase Property Reference.
AccessWrite | Boolean | See AccessFlags in the Metabase Property Reference.
AccessExecute | Boolean | See AccessFlags in the Metabase Property Reference.
AccessSource | Boolean | See AccessFlags in the Metabase Property Reference.
AccessScript | Boolean | See AccessFlags in the Metabase Property Reference.
AccessNoRemoteExecute | Boolean | See AccessFlags in the Metabase Property Reference.
AccessNoRemoteWrite | Boolean | See AccessFlags in the Metabase Property Reference.
AccessNoRemoteRead | Boolean | See AccessFlags in the Metabase Property Reference.
AccessNoRemoteScript | Boolean | See AccessFlags in the Metabase Property Reference.
AccessSSL | Boolean | See AccessSSLFlags in the Metabase Property Reference.
AccessSSLNegotiateCert | Boolean | See AccessSSLFlags in the Metabase Property Reference.
AccessSSLRequireCert | Boolean | See AccessSSLFlags in the Metabase Property Reference.
AccessSSLMapCert | Boolean | See AccessSSLFlags in the Metabase Property Reference.
AccessSSL128 | Boolean | See AccessSSLFlags in the Metabase Property Reference.
Related Topics
  • For more information about the IIS WMI Provider, see Using the IIS WMI Provider.
  • For detailed examples of scripts that use the properties and methods of the Windows WMI provider to access the IIS WMI provider, see Module 3: Writing Administration Scripts that Use WMI of the IIS WMI Provider Tutorial.
  • For basic examples in VBScript, JScript, and Perl, see Code Examples to Configure Metabase Properties.
  • Your installation of IIS 6.0 includes command-line administration scripts that manage IIS. See Using Command-Line Administration Scripts.


IIsIPSecuritySetting (WMI)

This class corresponds to the IIsIPSecurity IIS Admin object. You can use this class to set access permissions by IP address and domain address.

Parent Class

IIsSetting (WMI)

Properties

The table below lists properties other than those that are inherited from parent classes.

Property Name | Data Type | Description
Name | String | The Name property defines the label by which the object is known. When subclassed, the Name property can be overridden to be a Key property.
IPDeny[] | array of String | The IPDeny property contains an array of IP addresses that are denied access. IPDeny is only valid if GrantByDefault is set to true.
IPGrant[] | array of String | The IPGrant property contains an array of IP addresses that are denied access. IPGrant is only valid if GrantByDefault is set to false.
DomainDeny[] | array of String | The DomainDeny property contains an array of domains that are denied access. DomainDeny is only valid if GrantByDefault is set to true.
DomainGrant[] | array of String | The DomainGrant property contains an array of domains that are granted access. DomainGrant is only valid if GrantByDefault is set to false.
GrantByDefault | Boolean | The GrantByDefault property determines if access by users is granted or denied by default. If GrantByDefault is set to true, all IP addresses and Internet domains are granted access, except those you specify to be denied. Use IPDeny and DomainDeny to deny access to specific IP addresses and domains. If GrantByDefault is set to false, all IP addresses and domains are denied access by default, except those you specify to be granted access. Use IPGrant and DomainGrant to grant access to specific IP addresses and domains.
Related Topics
  • For more information about the IIS WMI Provider, see Using the IIS WMI Provider.
  • For detailed examples of scripts that use the properties and methods of the Windows WMI provider to access the IIS WMI provider, see Module 3: Writing Administration Scripts that Use WMI of the IIS WMI Provider Tutorial.
  • For basic examples in VBScript, JScript, and Perl, see Code Examples to Configure Metabase Properties.
  • Your installation of IIS 6.0 includes command-line administration scripts that manage IIS. See Using Command-Line Administration Scripts.


IIsLogModuleSetting (WMI)

This class corresponds to the IIsLogModule IIS Admin object, and contains the read-write properties for the object.

Parent Class

IIsSetting (WMI)

Properties

The table below lists properties other than those that are inherited from parent classes.

Property Name | Data Type | Description
Name | String | The Name property defines the label by which the object is known. When subclassed, the Name property can be overridden to be a Key property.
LogModuleId | String | See LogModuleId in the Metabase Property Reference.
LogModuleUiId | String | See LogModuleUiId in the Metabase Property Reference.
Related Topics
  • For more information about the IIS WMI Provider, see Using the IIS WMI Provider.
  • For detailed examples of scripts that use the properties and methods of the Windows WMI provider to access the IIS WMI provider, see Module 3: Writing Administration Scripts that Use WMI of the IIS WMI Provider Tutorial.
  • For basic examples in VBScript, JScript, and Perl, see Code Examples to Configure Metabase Properties.
  • Your installation of IIS 6.0 includes command-line administration scripts that manage IIS. See Using Command-Line Administration Scripts.


IIsLogModulesSetting (WMI)

This class corresponds to the IIsLogModules IIS Admin object, and contains the read-write properties for the object. You can use the IIsLogModules object to manage log modules at the computer level (IIsComputer).

Parent Class

IIsSetting (WMI)

Properties

The table below lists properties other than those that are inherited from parent classes.

Property Name | Data Type | Description
AdminACLBin[] | array of uint8 | See AdminACLBin in the Metabase Property Reference.
Name | String | The Name property defines the label by which the object is known. When subclassed, the Name property can be overridden to be a Key property.
Related Topics
  • For more information about the IIS WMI Provider, see Using the IIS WMI Provider.
  • For detailed examples of scripts that use the properties and methods of the Windows WMI provider to access the IIS WMI provider, see Module 3: Writing Administration Scripts that Use WMI of the IIS WMI Provider Tutorial.
  • For basic examples in VBScript, JScript, and Perl, see Code Examples to Configure Metabase Properties.
  • Your installation of IIS 6.0 includes command-line administration scripts that manage IIS. See Using Command-Line Administration Scripts.


IIsMimeMapSetting (WMI)

This class corresponds to the IIsMimeMap IIS Admin object, and contains the read-write properties for the object.

Parent Class

IIsSetting (WMI)

Properties

The table below lists properties other than those that are inherited from parent classes.

Property Name | Data Type | Description
Name | String | The Name property defines the label by which the object is known. When subclassed, the Name property can be overridden to be a Key property.
MimeMap[] | array of MimeMap | See MimeMap in the Metabase Property Reference.
Related Topics
  • For more information about the IIS WMI Provider, see Using the IIS WMI Provider.
  • For detailed examples of scripts that use the properties and methods of the Windows WMI provider to access the IIS WMI provider, see Module 3: Writing Administration Scripts that Use WMI of the IIS WMI Provider Tutorial.
  • For basic examples in VBScript, JScript, and Perl, see Code Examples to Configure Metabase Properties.
  • Your installation of IIS 6.0 includes command-line administration scripts that manage IIS. See Using Command-Line Administration Scripts.


IIsNntpExpirationSetting (WMI)

This class corresponds to the IIsNntpExpiration IIS Admin object, and contains the read-write properties for the object.

Parent Class

IIsSetting (WMI)

Properties

The table below lists properties other than those that are inherited from parent classes.

Property Name | Data Type | Description
Name | String | The Name property defines the label by which the object is known. When subclassed, the Name property can be overridden to be a Key property.
Related Topics
  • For more information about the IIS WMI Provider, see Using the IIS WMI Provider.
  • For detailed examples of scripts that use the properties and methods of the Windows WMI provider to access the IIS WMI provider, see Module 3: Writing Administration Scripts that Use WMI of the IIS WMI Provider Tutorial.
  • For basic examples in VBScript, JScript, and Perl, see Code Examples to Configure Metabase Properties.
  • Your installation of IIS 6.0 includes command-line administration scripts that manage IIS. See Using Command-Line Administration Scripts.


IIsNntpExpireSetting (WMI)

This class corresponds to the IIsNntpExpire IIS Admin object, and contains the read-write properties for the object.

Parent Class

IIsSetting (WMI)

Properties

The table below lists properties other than those that are inherited from parent classes.

Property Name | Data Type | Description
Name | String | The Name property defines the label by which the object is known. When subclassed, the Name property can be overridden to be a Key property.
ExpireSpace | SINT32 | See ExpireSpace in the Metabase Property Reference.
ExpireTime | SINT32 | See ExpireTime in the Metabase Property Reference.
ExpireNewsgroups[] | array of String | See ExpireNewsgroups in the Metabase Property Reference.
ExpirePolicyName | String | See ExpirePolicyName in the Metabase Property Reference.
Related Topics
  • For more information about the IIS WMI Provider, see Using the IIS WMI Provider.
  • For detailed examples of scripts that use the properties and methods of the Windows WMI provider to access the IIS WMI provider, see Module 3: Writing Administration Scripts that Use WMI of the IIS WMI Provider Tutorial.
  • For basic examples in VBScript, JScript, and Perl, see Code Examples to Configure Metabase Properties.
  • Your installation of IIS 6.0 includes command-line administration scripts that manage IIS. See Using Command-Line Administration Scripts.


IIsNntpFeedSetting (WMI)

This class corresponds to the IIsNntpFeed IIS Admin object, and contains the read-write properties for the object.

Parent Class

IIsSetting (WMI)

Properties

The table below lists properties other than those that are inherited from parent classes.

Property Name | Data Type | Description
FeedServerName | String | See FeedServerName in the Metabase Property Reference.
FeedType | SINT32 | See FeedType in the Metabase Property Reference.
FeedNewsgroups[] | array of String | See FeedNewsgroups in the Metabase Property Reference.
FeedSecurityType | SINT32 | See FeedSecurityType in the Metabase Property Reference.
FeedAuthenticationType | SINT32 | See FeedAuthenticationType in the Metabase Property Reference.
FeedAccountName | String | See FeedAccountName in the Metabase Property Reference.
FeedPassword | String | See FeedPassword in the Metabase Property Reference.
FeedStartTimeHigh | SINT32 | See FeedStartTimeHigh in the Metabase Property Reference.
FeedStartTimeLow | SINT32 | See FeedStartTimeLow in the Metabase Property Reference.
FeedInterval | SINT32 | See FeedInterval in the Metabase Property Reference.
FeedAllowControlMsgs | SINT32 | See FeedAllowControlMsgs in the Metabase Property Reference.
FeedCreateAutomatically | SINT32 | See FeedCreateAutomatically in the Metabase Property Reference.
FeedDisabled | SINT32 | See FeedDisabled in the Metabase Property Reference.
FeedDistribution[] | array of String | See FeedDistribution in the Metabase Property Reference.
FeedConcurrentSessions | SINT32 | See FeedConcurrentSessions in the Metabase Property Reference.
FeedMaxConnectionAttempts | SINT32 | See FeedMaxConnectionAttempts in the Metabase Property Reference.
FeedUucpName | String | See FeedUucpName in the Metabase Property Reference.
FeedTempDirectory | String | See FeedTempDirectory in the Metabase Property Reference.
FeedNextPullHigh | SINT32 | See FeedNextPullHigh in the Metabase Property Reference.
FeedNextPullLow | SINT32 | See FeedNextPullLow in the Metabase Property Reference.
FeedPeerTempDirectory | String | See FeedPeerTempDirectory in the Metabase Property Reference.
FeedPeerGapSize | SINT32 | See FeedPeerGapSize in the Metabase Property Reference.
FeedOutgoingPort | SINT32 | See FeedOutgoingPort in the Metabase Property Reference.
FeedFeedpairId | SINT32 | See FeedFeedpairId in the Metabase Property Reference.
FeedHandshake | SINT32 | See FeedHandshake in the Metabase Property Reference.
FeedAdminError | SINT32 | See FeedAdminError in the Metabase Property Reference.
FeedErrParmMask | SINT32 | See FeedErrParmMask in the Metabase Property Reference.
Name | String | The Name property defines the label by which the object is known. When subclassed, the Name property can be overridden to be a Key property.
Related Topics
  • For more information about the IIS WMI Provider, see Using the IIS WMI Provider.
  • For detailed examples of scripts that use the properties and methods of the Windows WMI provider to access the IIS WMI provider, see Module 3: Writing Administration Scripts that Use WMI of the IIS WMI Provider Tutorial.
  • For basic examples in VBScript, JScript, and Perl, see Code Examples to Configure Metabase Properties.
  • Your installation of IIS 6.0 includes command-line administration scripts that manage IIS. See Using Command-Line Administration Scripts.


IIsNntpFeedsSetting (WMI)

This class corresponds to the IIsNntpFeeds IIS Admin object, and contains the read-write properties for the object.

Parent Class

IIsSetting (WMI)

Properties

The table below lists properties other than those that are inherited from parent classes.

Property Name | Data Type | Description
Name | String | The Name property defines the label by which the object is known. When subclassed, the Name property can be overridden to be a Key property.
FeedPeerTempDirectory | String | See FeedPeerTempDirectory in the Metabase Property Reference.
Related Topics
  • For more information about the IIS WMI Provider, see Using the IIS WMI Provider.
  • For detailed examples of scripts that use the properties and methods of the Windows WMI provider to access the IIS WMI provider, see Module 3: Writing Administration Scripts that Use WMI of the IIS WMI Provider Tutorial.
  • For basic examples in VBScript, JScript, and Perl, see Code Examples to Configure Metabase Properties.
  • Your installation of IIS 6.0 includes command-line administration scripts that manage IIS. See Using Command-Line Administration Scripts.


IIsNntpGroupsSetting (WMI)

This class corresponds to the IIsNntpGroups IIS Admin object, and contains the read-write properties for the object.

Parent Class

IIsSetting (WMI)

Properties

The table below lists properties other than those that are inherited from parent classes.

Property Name | Data Type | Description
Name | String | The Name property defines the label by which the object is known. When subclassed, the Name property can be overridden to be a Key property.
Related Topics
  • For more information about the IIS WMI Provider, see Using the IIS WMI Provider.
  • For detailed examples of scripts that use the properties and methods of the Windows WMI provider to access the IIS WMI provider, see Module 3: Writing Administration Scripts that Use WMI of the IIS WMI Provider Tutorial.
  • For basic examples in VBScript, JScript, and Perl, see Code Examples to Configure Metabase Properties.
  • Your installation of IIS 6.0 includes command-line administration scripts that manage IIS. See Using Command-Line Administration Scripts.


IIsNntpInfoSetting (WMI)

This class corresponds to the IIsNntpInfo IIS Admin object, and contains the read-write properties for the object.

Parent Class

IIsSetting (WMI)

Properties

The table below lists properties other than those that are inherited from parent classes.

Property Name | Data Type | Description
Name | String | The Name property defines the label by which the object is known. When subclassed, the Name property can be overridden to be a Key property.
LogModuleList | String | See LogModuleList in the Metabase Property Reference.
Related Topics
  • For more information about the IIS WMI Provider, see Using the IIS WMI Provider.
  • For detailed examples of scripts that use the properties and methods of the Windows WMI provider to access the IIS WMI provider, see Module 3: Writing Administration Scripts that Use WMI of the IIS WMI Provider Tutorial.
  • For basic examples in VBScript, JScript, and Perl, see Code Examples to Configure Metabase Properties.
  • Your installation of IIS 6.0 includes command-line administration scripts that manage IIS. See Using Command-Line Administration Scripts.


IIsNntpRebuildSetting (WMI)

This class corresponds to the IIsNntpRebuild IIS Admin object, and contains the read-write properties for the object.

Parent Class

IIsSetting (WMI)

Properties

The table below lists properties other than those that are inherited from parent classes.

Property Name | Data Type | Description
Name | String | The Name property defines the label by which the object is known. When subclassed, the Name property can be overridden to be a Key property.
Related Topics
  • For more information about the IIS WMI Provider, see Using the IIS WMI Provider.
  • For detailed examples of scripts that use the properties and methods of the Windows WMI provider to access the IIS WMI provider, see Module 3: Writing Administration Scripts that Use WMI of the IIS WMI Provider Tutorial.
  • For basic examples in VBScript, JScript, and Perl, see Code Examples to Configure Metabase Properties.
  • Your installation of IIS 6.0 includes command-line administration scripts that manage IIS. See Using Command-Line Administration Scripts.


IIsNntpServerSetting (WMI)

This class corresponds to the IIsNntpServer IIS Admin object, and contains the read-write properties for the object.

Parent Class

IIsSetting (WMI)

Properties

The table below lists properties other than those that are inherited from parent classes.

Property Name | Data Type | Description
AzEnable | Boolean | See AzEnable in the Metabase Property Reference.
AzImpersonationLevel | SINT32 | See AzImpersonationLevel in the Metabase Property Reference.
AzStoreName | String | See AzStoreName in the Metabase Property Reference.
AzScopeName | String | See AzScopeName in the Metabase Property Reference.
Name | String | The Name property defines the label by which the object is known. When subclassed, the Name property can be overridden to be a Key property.
MaxBandwidth | SINT32 | See MaxBandwidth in the Metabase Property Reference.
MaxConnections | SINT32 | See MaxConnections in the Metabase Property Reference.
AnonymousUserName | String | See AnonymousUserName in the Metabase Property Reference.
AnonymousUserPass | String | See AnonymousUserPass in the Metabase Property Reference.
ServerComment | String | See ServerComment in the Metabase Property Reference.
ConnectionTimeout | SINT32 | See ConnectionTimeout in the Metabase Property Reference.
ServerListenTimeout | SINT32 | See ServerListenTimeout in the Metabase Property Reference.
MaxEndpointConnections | SINT32 | See MaxEndpointConnections in the Metabase Property Reference.
ServerAutoStart | Boolean | See ServerAutoStart in the Metabase Property Reference.
ServerBindings[] | array of ServerBinding | See ServerBindings in the Metabase Property Reference.
SecureBindings[] | array of SecureBinding | See SecureBindings in the Metabase Property Reference.
ClusterEnabled | Boolean | See ClusterEnabled in the Metabase Property Reference.
AnonymousPasswordSync | Boolean | See AnonymousPasswordSync in the Metabase Property Reference.
AdminACLBin[] | array of uint8 | See AdminACLBin in the Metabase Property Reference.
DontLog | Boolean | See DontLog in the Metabase Property Reference.
ContentIndexed | Boolean | See ContentIndexed in the Metabase Property Reference.
AuthFlags | SINT32 | See AuthFlags in the Metabase Property Reference.
ServerListenBacklog | SINT32 | See ServerListenBacklog in the Metabase Property Reference.
Win32Error | SINT32 | See Win32Error in the Metabase Property Reference.
HonorClientMsgIds | Boolean | See HonorClientMsgIds in the Metabase Property Reference.
SmtpServer | String | See SmtpServer in the Metabase Property Reference.
AdminEmail | String | See AdminEmail in the Metabase Property Reference.
AdminName | String | See AdminName in the Metabase Property Reference.
AllowClientPosts | Boolean | See AllowClientPosts in the Metabase Property Reference.
AllowFeedPosts | Boolean | See AllowFeedPosts in the Metabase Property Reference.
AllowControlMsgs | Boolean | See AllowControlMsgs in the Metabase Property Reference.
DefaultModeratorDomain | String | See DefaultModeratorDomain in the Metabase Property Reference.
NntpCommandLogMask | SINT32 | See NntpCommandLogMask in the Metabase Property Reference.
DisableNewNews | Boolean | See DisableNewNews in the Metabase Property Reference.
ClientPostHardLimit | SINT32 | See ClientPostHardLimit in the Metabase Property Reference.
ClientPostSoftLimit | SINT32 | See ClientPostSoftLimit in the Metabase Property Reference.
FeedPostHardLimit | SINT32 | See FeedPostHardLimit in the Metabase Property Reference.
FeedPostSoftLimit | SINT32 | See FeedPostSoftLimit in the Metabase Property Reference.
NewsPickupDirectory | String | See NewsPickupDirectory in the Metabase Property Reference.
NewsFailedPickupDirectory | String | See NewsFailedPickupDirectory in the Metabase Property Reference.
NewsDropDirectory | String | See NewsDropDirectory in the Metabase Property Reference.
LogType | SINT32 | See LogType in the Metabase Property Reference.
LogPluginClsid | String | See LogPluginClsid in the Metabase Property Reference.
LogFileDirectory | String | See LogFileDirectory in the Metabase Property Reference.
LogFilePeriod | SINT32 | See LogFilePeriod in the Metabase Property Reference.
LogFileTruncateSize | SINT32 | See LogFileTruncateSize in the Metabase Property Reference.
LogExtFileFlags | SINT32 | See LogExtFileFlags in the Metabase Property Reference.
LogOdbcDataSource | String | See LogOdbcDataSource in the Metabase Property Reference.
LogOdbcTableName | String | See LogOdbcTableName in the Metabase Property Reference.
LogOdbcUserName | String | See LogOdbcUserName in the Metabase Property Reference.
LogOdbcPassword | String | See LogOdbcPassword in the Metabase Property Reference.
FeedReportPeriod | SINT32 | See FeedReportPeriod in the Metabase Property Reference.
MaxSearchResults | SINT32 | See MaxSearchResults in the Metabase Property Reference.
NntpUucpName | String | See NntpUucpName in the Metabase Property Reference.
AccessSSLFlags | SINT32 | See AccessSSLFlags in the Metabase Property Reference.
AccessFlags | SINT32 | See AccessFlags in the Metabase Property Reference.
GroupHelpFile | String | See GroupHelpFile in the Metabase Property Reference.
GroupListFile | String | See GroupListFile in the Metabase Property Reference.
ArticleTableFile | String | See ArticleTableFile in the Metabase Property Reference.
HistoryTableFile | String | See HistoryTableFile in the Metabase Property Reference.
ListFile | String | See ListFile in the Metabase Property Reference.
ModeratorFile | String | See ModeratorFile in the Metabase Property Reference.
XoverTableFile | String | See XoverTableFile in the Metabase Property Reference.
PrettyNamesFile | String | See PrettyNamesFile in the Metabase Property Reference.
GroupVarListFile | String | See GroupvarListFile in the Metabase Property Reference.
ArticleTimeLimit | SINT32 | See ArticleTimeLimit in the Metabase Property Reference.
HistoryExpiration | SINT32 | See HistoryExpiration in the Metabase Property Reference.
NewsCrawlerTime | SINT32 | See NewsCrawlerTime in the Metabase Property Reference.
ShutdownLatency | SINT32 | See ShutdownLatency in the Metabase Property Reference.
NntpOrganization | String | See NntpOrganization in the Metabase Property Reference.
NntpClearTextProvider | String | See NntpClearTextProvider in the Metabase Property Reference.
NTAuthenticationProviders | String | See NTAuthenticationProviders in the Metabase Property Reference.
AuthAnonymous | Boolean | See AuthFlags in the Metabase Property Reference.
AuthBasic | Boolean | See AuthFlags in the Metabase Property Reference.
AuthNTLM | Boolean | See AuthFlags in the Metabase Property Reference.
AuthMD5 | Boolean | See AuthFlags in the Metabase Property Reference.
AuthPassport | Boolean | See AuthFlags in the Metabase Property Reference.
LogExtFileDate | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileTime | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileClientIp | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileUserName | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileSiteName | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileComputerName | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileServerIp | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileMethod | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileUriStem | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileUriQuery | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileHttpStatus | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileWin32Status | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileBytesSent | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileBytesRecv | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileTimeTaken | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileServerPort | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileUserAgent | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileCookie | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileReferer | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileProtocolVersion | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileHost | Boolean | See LogExtFileFlags in the Metabase Property Reference.
AccessSSL | Boolean | See AccessSSLFlags in the Metabase Property Reference.
AccessSSLNegotiateCert | Boolean | See AccessSSLFlags in the Metabase Property Reference.
AccessSSLRequireCert | Boolean | See AccessSSLFlags in the Metabase Property Reference.
AccessSSLMapCert | Boolean | See AccessSSLFlags in the Metabase Property Reference.
AccessSSL128 | Boolean | See AccessSSLFlags in the Metabase Property Reference.
AccessRead | Boolean | See AccessFlags in the Metabase Property Reference.
AccessWrite | Boolean | See AccessFlags in the Metabase Property Reference.
AccessExecute | Boolean | See AccessFlags in the Metabase Property Reference.
AccessSource | Boolean | See AccessFlags in the Metabase Property Reference.
AccessScript | Boolean | See AccessFlags in the Metabase Property Reference.
AccessNoRemoteExecute | Boolean | See AccessFlags in the Metabase Property Reference.
AccessNoRemoteWrite | Boolean | See AccessFlags in the Metabase Property Reference.
AccessNoRemoteRead | Boolean | See AccessFlags in the Metabase Property Reference.
AccessNoRemoteScript | Boolean | See AccessFlags in the Metabase Property Reference.
Related Topics
  • For more information about the IIS WMI Provider, see Using the IIS WMI Provider.
  • For detailed examples of scripts that use the properties and methods of the Windows WMI provider to access the IIS WMI provider, see Module 3: Writing Administration Scripts that Use WMI of the IIS WMI Provider Tutorial.
  • For basic examples in VBScript, JScript, and Perl, see Code Examples to Configure Metabase Properties.
  • Your installation of IIS 6.0 includes command-line administration scripts that manage IIS. See Using Command-Line Administration Scripts.


IIsNntpServiceSetting (WMI)

This class corresponds to the IIsNntpService IIS Admin object, and contains the read-write properties for the object.

Parent Class

IIsSetting (WMI)

Properties

The table below lists properties other than those that are inherited from parent classes.

Property Name | Data Type | Description
AzEnable | Boolean | See AzEnable in the Metabase Property Reference.
AzImpersonationLevel | SINT32 | See AzImpersonationLevel in the Metabase Property Reference.
AzStoreName | String | See AzStoreName in the Metabase Property Reference.
AzScopeName | String | See AzScopeName in the Metabase Property Reference.
Name | String | The Name property defines the label by which the object is known. When subclassed, the Name property can be overridden to be a Key property.
MaxBandwidth | SINT32 | See MaxBandwidth in the Metabase Property Reference.
MaxConnections | SINT32 | See MaxConnections in the Metabase Property Reference.
AnonymousUserName | String | See AnonymousUserName in the Metabase Property Reference.
AnonymousUserPass | String | See AnonymousUserPass in the Metabase Property Reference.
ServerComment | String | See ServerComment in the Metabase Property Reference.
ConnectionTimeout | SINT32 | See ConnectionTimeout in the Metabase Property Reference.
ServerListenTimeout | SINT32 | See ServerListenTimeout in the Metabase Property Reference.
MaxEndpointConnections | SINT32 | See MaxEndpointConnections in the Metabase Property Reference.
ServerAutoStart | Boolean | See ServerAutoStart in the Metabase Property Reference.
ServerBindings[] | array of ServerBinding | See ServerBindings in the Metabase Property Reference.
SecureBindings[] | array of SecureBinding | See SecureBindings in the Metabase Property Reference.
ClusterEnabled | Boolean | See ClusterEnabled in the Metabase Property Reference.
AnonymousPasswordSync | Boolean | See AnonymousPasswordSync in the Metabase Property Reference.
AdminACLBin[] | array of uint8 | See AdminACLBin in the Metabase Property Reference.
DontLog | Boolean | See DontLog in the Metabase Property Reference.
ContentIndexed | Boolean | See ContentIndexed in the Metabase Property Reference.
AuthFlags | SINT32 | See AuthFlags in the Metabase Property Reference.
ServerListenBacklog | SINT32 | See ServerListenBacklog in the Metabase Property Reference.
Win32Error | SINT32 | See Win32Error in the Metabase Property Reference.
HonorClientMsgIds | Boolean | See HonorClientMsgIds in the Metabase Property Reference.
SmtpServer | String | See SmtpServer in the Metabase Property Reference.
AdminEmail | String | See AdminEmail in the Metabase Property Reference.
AdminName | String | See AdminName in the Metabase Property Reference.
AllowClientPosts | Boolean | See AllowClientPosts in the Metabase Property Reference.
AllowFeedPosts | Boolean | See AllowFeedPosts in the Metabase Property Reference.
AllowControlMsgs | Boolean | See AllowControlMsgs in the Metabase Property Reference.
DefaultModeratorDomain | String | See DefaultModeratorDomain in the Metabase Property Reference.
NntpCommandLogMask | SINT32 | See NntpCommandLogMask in the Metabase Property Reference.
DisableNewNews | Boolean | See DisableNewNews in the Metabase Property Reference.
ClientPostHardLimit | SINT32 | See ClientPostHardLimit in the Metabase Property Reference.
ClientPostSoftLimit | SINT32 | See ClientPostSoftLimit in the Metabase Property Reference.
FeedPostHardLimit | SINT32 | See FeedPostHardLimit in the Metabase Property Reference.
FeedPostSoftLimit | SINT32 | See FeedPostSoftLimit in the Metabase Property Reference.
NewsPickupDirectory | String | See NewsPickupDirectory in the Metabase Property Reference.
NewsFailedPickupDirectory | String | See NewsFailedPickupDirectory in the Metabase Property Reference.
NewsDropDirectory | String | See NewsDropDirectory in the Metabase Property Reference.
LogType | SINT32 | See LogType in the Metabase Property Reference.
LogPluginClsid | String | See LogPluginClsid in the Metabase Property Reference.
LogFileDirectory | String | See LogFileDirectory in the Metabase Property Reference.
LogFilePeriod | SINT32 | See LogFilePeriod in the Metabase Property Reference.
LogFileTruncateSize | SINT32 | See LogFileTruncateSize in the Metabase Property Reference.
LogExtFileFlags | SINT32 | See LogExtFileFlags in the Metabase Property Reference.
LogOdbcDataSource | String | See LogOdbcDataSource in the Metabase Property Reference.
LogOdbcTableName | String | See LogOdbcTableName in the Metabase Property Reference.
LogOdbcUserName | String | See LogOdbcUserName in the Metabase Property Reference.
LogOdbcPassword | String | See LogOdbcPassword in the Metabase Property Reference.
FeedReportPeriod | SINT32 | See FeedReportPeriod in the Metabase Property Reference.
MaxSearchResults | SINT32 | See MaxSearchResults in the Metabase Property Reference.
NntpUucpName | String | See NntpUucpName in the Metabase Property Reference.
AccessSSLFlags | SINT32 | See AccessSSLFlags in the Metabase Property Reference.
AccessFlags | SINT32 | See AccessFlags in the Metabase Property Reference.
GroupHelpFile | String | See GroupHelpFile in the Metabase Property Reference.
GroupListFile | String | See GroupListFile in the Metabase Property Reference.
ArticleTableFile | String | See ArticleTableFile in the Metabase Property Reference.
HistoryTableFile | String | See HistoryTableFile in the Metabase Property Reference.
ListFile | String | See ListFile in the Metabase Property Reference.
ModeratorFile | String | See ModeratorFile in the Metabase Property Reference.
XoverTableFile | String | See XoverTableFile in the Metabase Property Reference.
PrettyNamesFile | String | See PrettyNamesFile in the Metabase Property Reference.
GroupVarListFile | String | See GroupvarListFile in the Metabase Property Reference.
ArticleTimeLimit | SINT32 | See ArticleTimeLimit in the Metabase Property Reference.
HistoryExpiration | SINT32 | See HistoryExpiration in the Metabase Property Reference.
NewsCrawlerTime | SINT32 | See NewsCrawlerTime in the Metabase Property Reference.
ShutdownLatency | SINT32 | See ShutdownLatency in the Metabase Property Reference.
NntpOrganization | String | See NntpOrganization in the Metabase Property Reference.
NntpClearTextProvider | String | See NntpClearTextProvider in the Metabase Property Reference.
NTAuthenticationProviders | String | See NTAuthenticationProviders in the Metabase Property Reference.
AuthAnonymous | Boolean | See AuthFlags in the Metabase Property Reference.
AuthBasic | Boolean | See AuthFlags in the Metabase Property Reference.
AuthNTLM | Boolean | See AuthFlags in the Metabase Property Reference.
AuthMD5 | Boolean | See AuthFlags in the Metabase Property Reference.
AuthPassport | Boolean | See AuthFlags in the Metabase Property Reference.
LogExtFileDate | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileTime | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileClientIp | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileUserName | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileSiteName | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileComputerName | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileServerIp | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileMethod | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileUriStem | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileUriQuery | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileHttpStatus | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileWin32Status | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileBytesSent | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileBytesRecv | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileTimeTaken | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileServerPort | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileUserAgent | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileCookie | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileReferer | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileProtocolVersion | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileHost | Boolean | See LogExtFileFlags in the Metabase Property Reference.
AccessSSL | Boolean | See AccessSSLFlags in the Metabase Property Reference.
AccessSSLNegotiateCert | Boolean | See AccessSSLFlags in the Metabase Property Reference.
AccessSSLRequireCert | Boolean | See AccessSSLFlags in the Metabase Property Reference.
AccessSSLMapCert | Boolean | See AccessSSLFlags in the Metabase Property Reference.
AccessSSL128 | Boolean | See AccessSSLFlags in the Metabase Property Reference.
AccessRead | Boolean | See AccessFlags in the Metabase Property Reference.
AccessWrite | Boolean | See AccessFlags in the Metabase Property Reference.
AccessExecute | Boolean | See AccessFlags in the Metabase Property Reference.
AccessSource | Boolean | See AccessFlags in the Metabase Property Reference.
AccessScript | Boolean | See AccessFlags in the Metabase Property Reference.
AccessNoRemoteExecute | Boolean | See AccessFlags in the Metabase Property Reference.
AccessNoRemoteWrite | Boolean | See AccessFlags in the Metabase Property Reference.
AccessNoRemoteRead | Boolean | See AccessFlags in the Metabase Property Reference.
AccessNoRemoteScript | Boolean | See AccessFlags in the Metabase Property Reference.
Related Topics
  • For more information about the IIS WMI Provider, see Using the IIS WMI Provider.
  • For detailed examples of scripts that use the properties and methods of the Windows WMI provider to access the IIS WMI provider, see Module 3: Writing Administration Scripts that Use WMI of the IIS WMI Provider Tutorial.
  • For basic examples in VBScript, JScript, and Perl, see Code Examples to Configure Metabase Properties.
  • Your installation of IIS 6.0 includes command-line administration scripts that manage IIS. See Using Command-Line Administration Scripts.


IIsNntpSessionsSetting (WMI)

This class corresponds to the IIsNntpSessions IIS Admin object, and contains the read-write properties for the object.

Parent Class

IIsSetting (WMI)

Properties

The table below lists properties other than those that are inherited from parent classes.

Property Name | Data Type | Description
Name | String | The Name property defines the label by which the object is known. When subclassed, the Name property can be overridden to be a Key property.
Related Topics
  • For more information about the IIS WMI Provider, see Using the IIS WMI Provider.
  • For detailed examples of scripts that use the properties and methods of the Windows WMI provider to access the IIS WMI provider, see Module 3: Writing Administration Scripts that Use WMI of the IIS WMI Provider Tutorial.
  • For basic examples in VBScript, JScript, and Perl, see Code Examples to Configure Metabase Properties.
  • Your installation of IIS 6.0 includes command-line administration scripts that manage IIS. See Using Command-Line Administration Scripts.


IIsNntpVirtualDirSetting (WMI)

This class corresponds to the IIsNntpVirtualDir IIS Admin object, and contains the read-write properties for the object.

Parent Class

IIsSetting (WMI)

Properties

The table below lists properties other than those that are inherited from parent classes.

Property Name | Data Type | Description
Path | String | See Path in the Metabase Property Reference.
UNCUserName | String | See UNCUserName in the Metabase Property Reference.
UNCPassword | String | See UNCPassword in the Metabase Property Reference.
Win32Error | SINT32 | See Win32Error in the Metabase Property Reference.
ContentIndexed | Boolean | See ContentIndexed in the Metabase Property Reference.
AccessSSLFlags | SINT32 | See AccessSSLFlags in the Metabase Property Reference.
AccessFlags | SINT32 | See AccessFlags in the Metabase Property Reference.
VrDoExpire | Boolean | See VrDoExpire in the Metabase Property Reference.
VrUseAccount | SINT32 | See VrUseAccount in the Metabase Property Reference.
VrOwnModerator | Boolean | See VrOwnModerator in the Metabase Property Reference.
VrDriverProgid | String | See VrDriverProgid in the Metabase Property Reference.
FsPropertyPath | String | See FsPropertyPath in the Metabase Property Reference.
ExMdbGuid | String | See ExMdbGuid in the Metabase Property Reference.
DontLog | Boolean | See DontLog in the Metabase Property Reference.
VrDriverClsid | String | See VrDriverClsid in the Metabase Property Reference.
AccessSSL | Boolean | See AccessSSLFlags in the Metabase Property Reference.
AccessSSLNegotiateCert | Boolean | See AccessSSLFlags in the Metabase Property Reference.
AccessSSLRequireCert | Boolean | See AccessSSLFlags in the Metabase Property Reference.
AccessSSLMapCert | Boolean | See AccessSSLFlags in the Metabase Property Reference.
AccessSSL128 | Boolean | See AccessSSLFlags in the Metabase Property Reference.
AccessRead | Boolean | See AccessFlags in the Metabase Property Reference.
AccessWrite | Boolean | See AccessFlags in the Metabase Property Reference.
AccessExecute | Boolean | See AccessFlags in the Metabase Property Reference.
AccessSource | Boolean | See AccessFlags in the Metabase Property Reference.
AccessScript | Boolean | See AccessFlags in the Metabase Property Reference.
AccessNoRemoteExecute | Boolean | See AccessFlags in the Metabase Property Reference.
AccessNoRemoteWrite | Boolean | See AccessFlags in the Metabase Property Reference.
AccessNoRemoteRead | Boolean | See AccessFlags in the Metabase Property Reference.
AccessNoRemoteScript | Boolean | See AccessFlags in the Metabase Property Reference.
Name | String | The Name property defines the label by which the object is known. When subclassed, the Name property can be overridden to be a Key property.
Related Topics
  • For more information about the IIS WMI Provider, see Using the IIS WMI Provider.
  • For detailed examples of scripts that use the properties and methods of the Windows WMI provider to access the IIS WMI provider, see Module 3: Writing Administration Scripts that Use WMI of the IIS WMI Provider Tutorial.
  • For basic examples in VBScript, JScript, and Perl, see Code Examples to Configure Metabase Properties.
  • Your installation of IIS 6.0 includes command-line administration scripts that manage IIS. See Using Command-Line Administration Scripts.


IIsObjectSetting (WMI)

This class corresponds to the IIsObject IIS Admin object, and contains the read-write properties for the object.

Parent Class

IIsSetting (WMI)

Properties

The table below lists properties other than those that are inherited from parent classes.

Property Name | Data Type | Description
Name | String | The Name property defines the label by which the object is known. When subclassed, the Name property can be overridden to be a Key property.
KeyType | String | See KeyType in the Metabase Property Reference.
Related Topics
  • For more information about the IIS WMI Provider, see Using the IIS WMI Provider.
  • For detailed examples of scripts that use the properties and methods of the Windows WMI provider to access the IIS WMI provider, see Module 3: Writing Administration Scripts that Use WMI of the IIS WMI Provider Tutorial.
  • For basic examples in VBScript, JScript, and Perl, see Code Examples to Configure Metabase Properties.
  • Your installation of IIS 6.0 includes command-line administration scripts that manage IIS. See Using Command-Line Administration Scripts.


IIsPop3InfoSetting (WMI)

This class corresponds to the IIsPop3Info IIS Admin object, and contains the read-write properties for the object.

Parent Class

IIsSetting (WMI)

Properties

The table below lists properties other than those that are inherited from parent classes.

Property Name | Data Type | Description
LogModuleList | String | See LogModuleList in the Metabase Property Reference.
Name | String | The Name property defines the label by which the object is known. When subclassed, the Name property can be overridden to be a Key property.
Related Topics
  • For more information about the IIS WMI Provider, see Using the IIS WMI Provider.
  • For detailed examples of scripts that use the properties and methods of the Windows WMI provider to access the IIS WMI provider, see Module 3: Writing Administration Scripts that Use WMI of the IIS WMI Provider Tutorial.
  • For basic examples in VBScript, JScript, and Perl, see Code Examples to Configure Metabase Properties.
  • Your installation of IIS 6.0 includes command-line administration scripts that manage IIS. See Using Command-Line Administration Scripts.


IIsPop3RoutingSourceSetting (WMI)

This class corresponds to the IIsPop3RoutingSource IIS Admin object, and contains the read-write properties for the object.

Parent Class

IIsSetting (WMI)

Properties

The table below lists properties other than those that are inherited from parent classes.

Property Name | Data Type | Description
Pop3RoutingTableType | String | See Pop3RoutingTableType in the Metabase Property Reference.
Name | String | The Name property defines the label by which the object is known. When subclassed, the Name property can be overridden to be a Key property.
Pop3DsDataDirectory | String | See Pop3DsDataDirectory in the Metabase Property Reference.
Pop3DsDefaultMailRoot | String | See Pop3DsDefaultMailRoot in the Metabase Property Reference.
Pop3DsBindType | String | See Pop3DsBindType in the Metabase Property Reference.
Pop3DsSchemaType | String | See Pop3DsSchemaType in the Metabase Property Reference.
Pop3DsHost | String | See Pop3DsHost in the Metabase Property Reference.
Pop3DsNamingContext | String | See Pop3DsNamingContext in the Metabase Property Reference.
Pop3DsAccount | String | See Pop3DsAccount in the Metabase Property Reference.
Pop3DsPassword | String | See Pop3DsPassword in the Metabase Property Reference.
Related Topics
  • For more information about the IIS WMI Provider, see Using the IIS WMI Provider.
  • For detailed examples of scripts that use the properties and methods of the Windows WMI provider to access the IIS WMI provider, see Module 3: Writing Administration Scripts that Use WMI of the IIS WMI Provider Tutorial.
  • For basic examples in VBScript, JScript, and Perl, see Code Examples to Configure Metabase Properties.
  • Your installation of IIS 6.0 includes command-line administration scripts that manage IIS. See Using Command-Line Administration Scripts.


IIsPop3ServerSetting (WMI)

This class corresponds to the IIsPop3Server IIS Admin object, and contains the read-write properties for the object.

Parent Class

IIsSetting (WMI)

Properties

The table below lists properties other than those that are inherited from parent classes.

Property Name | Data Type | Description
AzEnable | Boolean | See AzEnable in the Metabase Property Reference.
AzImpersonationLevel | SINT32 | See AzImpersonationLevel in the Metabase Property Reference.
AzStoreName | String | See AzStoreName in the Metabase Property Reference.
AzScopeName | String | See AzScopeName in the Metabase Property Reference.
MaxBandwidth | SINT32 | See MaxBandwidth in the Metabase Property Reference.
MaxConnections | SINT32 | See MaxConnections in the Metabase Property Reference.
ServerComment | String | See ServerComment in the Metabase Property Reference.
ConnectionTimeout | SINT32 | See ConnectionTimeout in the Metabase Property Reference.
ServerListenTimeout | SINT32 | See ServerListenTimeout in the Metabase Property Reference.
MaxEndpointConnections | SINT32 | See MaxEndpointConnections in the Metabase Property Reference.
ServerAutoStart | Boolean | See ServerAutoStart in the Metabase Property Reference.
AdminACLBin[] | array of uint8 | See AdminACLBin in the Metabase Property Reference.
DontLog | Boolean | See DontLog in the Metabase Property Reference.
AuthFlags | SINT32 | See AuthFlags in the Metabase Property Reference.
ServerListenBacklog | SINT32 | See ServerListenBacklog in the Metabase Property Reference.
DefaultLogonDomain | String | See DefaultLogonDomain in the Metabase Property Reference.
NTAuthenticationProviders | String | See NTAuthenticationProviders in the Metabase Property Reference.
AccessFlags | SINT32 | See AccessFlags in the Metabase Property Reference.
AccessSSLFlags | SINT32 | See AccessSSLFlags in the Metabase Property Reference.
LogType | SINT32 | See LogType in the Metabase Property Reference.
LogFilePeriod | SINT32 | See LogFilePeriod in the Metabase Property Reference.
LogPluginClsid | String | See LogPluginClsid in the Metabase Property Reference.
LogModuleList | String | See LogModuleList in the Metabase Property Reference.
LogFileDirectory | String | See LogFileDirectory in the Metabase Property Reference.
LogFileTruncateSize | SINT32 | See LogFileTruncateSize in the Metabase Property Reference.
LogExtFileFlags | SINT32 | See LogExtFileFlags in the Metabase Property Reference.
LogOdbcDataSource | String | See LogOdbcDataSource in the Metabase Property Reference.
LogOdbcTableName | String | See LogOdbcTableName in the Metabase Property Reference.
LogOdbcUserName | String | See LogOdbcUserName in the Metabase Property Reference.
LogOdbcPassword | String | See LogOdbcPassword in the Metabase Property Reference.
ImapExpireMail | SINT32 | See ImapExpireMail in the Metabase Property Reference.
ImapExpireDelay | SINT32 | See ImapExpireDelay in the Metabase Property Reference.
ImapExpireStart | SINT32 | See ImapExpireStart in the Metabase Property Reference.
ImapMailExpirationTime | SINT32 | See ImapMailExpirationTime in the Metabase Property Reference.
ImapClearTextProvider | String | See ImapClearTextProvider in the Metabase Property Reference.
ImapDefaultDomain | String | See ImapDefaultDomain in the Metabase Property Reference.
ImapRoutingDll | String | See ImapRoutingDll in the Metabase Property Reference.
Name | String | The Name property defines the label by which the object is known. When subclassed, the Name property can be overridden to be a Key property.
AuthAnonymous | Boolean | See AuthFlags in the Metabase Property Reference.
AuthBasic | Boolean | See AuthFlags in the Metabase Property Reference.
AuthNTLM | Boolean | See AuthFlags in the Metabase Property Reference.
AuthMD5 | Boolean | See AuthFlags in the Metabase Property Reference.
AuthPassport | Boolean | See AuthFlags in the Metabase Property Reference.
AccessRead | Boolean | See AccessFlags in the Metabase Property Reference.
AccessWrite | Boolean | See AccessFlags in the Metabase Property Reference.
AccessExecute | Boolean | See AccessFlags in the Metabase Property Reference.
AccessSource | Boolean | See AccessFlags in the Metabase Property Reference.
AccessScript | Boolean | See AccessFlags in the Metabase Property Reference.
AccessNoRemoteExecute | Boolean | See AccessFlags in the Metabase Property Reference.
AccessNoRemoteWrite | Boolean | See AccessFlags in the Metabase Property Reference.
AccessNoRemoteRead | Boolean | See AccessFlags in the Metabase Property Reference.
AccessNoRemoteScript | Boolean | See AccessFlags in the Metabase Property Reference.
AccessSSL | Boolean | See AccessSSLFlags in the Metabase Property Reference.
AccessSSLNegotiateCert | Boolean | See AccessSSLFlags in the Metabase Property Reference.
AccessSSLRequireCert | Boolean | See AccessSSLFlags in the Metabase Property Reference.
AccessSSLMapCert | Boolean | See AccessSSLFlags in the Metabase Property Reference.
AccessSSL128 | Boolean | See AccessSSLFlags in the Metabase Property Reference.
LogExtFileDate | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileTime | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileClientIp | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileUserName | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileSiteName | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileComputerName | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileServerIp | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileMethod | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileUriStem | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileUriQuery | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileHttpStatus | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileWin32Status | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileBytesSent | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileBytesRecv | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileTimeTaken | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileServerPort | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileUserAgent | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileCookie | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileReferer | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileProtocolVersion | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileHost | Boolean | See LogExtFileFlags in the Metabase Property Reference.
Name | String | The Name property defines the label by which the object is known. When subclassed, the Name property can be overridden to be a Key property.
Related Topics
  • For more information about the IIS WMI Provider, see Using the IIS WMI Provider.
  • For detailed examples of scripts that use the properties and methods of the Windows WMI provider to access the IIS WMI provider, see Module 3: Writing Administration Scripts that Use WMI of the IIS WMI Provider Tutorial.
  • For basic examples in VBScript, JScript, and Perl, see Code Examples to Configure Metabase Properties.
  • Your installation of IIS 6.0 includes command-line administration scripts that manage IIS. See Using Command-Line Administration Scripts.


IIsPop3ServiceSetting (WMI)

This class corresponds to the IIsPop3Service IIS Admin object, and contains the read-write properties for the object.

Parent Class

IIsSetting (WMI)

Properties

The table below lists properties other than those that are inherited from parent classes.

Property Name | Data Type | Description
AzEnable | Boolean | See AzEnable in the Metabase Property Reference.
AzImpersonationLevel | SINT32 | See AzImpersonationLevel in the Metabase Property Reference.
AzStoreName | String | See AzStoreName in the Metabase Property Reference.
AzScopeName | String | See AzScopeName in the Metabase Property Reference.
MaxBandwidth | SINT32 | See MaxBandwidth in the Metabase Property Reference.
MaxConnections | SINT32 | See MaxConnections in the Metabase Property Reference.
ServerComment | String | See ServerComment in the Metabase Property Reference.
ConnectionTimeout | SINT32 | See ConnectionTimeout in the Metabase Property Reference.
ServerListenTimeout | SINT32 | See ServerListenTimeout in the Metabase Property Reference.
MaxEndpointConnections | SINT32 | See MaxEndpointConnections in the Metabase Property Reference.
ServerAutoStart | Boolean | See ServerAutoStart in the Metabase Property Reference.
AdminACLBin[] | array of uint8 | See AdminACLBin in the Metabase Property Reference.
DontLog | Boolean | See DontLog in the Metabase Property Reference.
AuthFlags | SINT32 | See AuthFlags in the Metabase Property Reference.
ServerListenBacklog | SINT32 | See ServerListenBacklog in the Metabase Property Reference.
DefaultLogonDomain | String | See DefaultLogonDomain in the Metabase Property Reference.
NTAuthenticationProviders | String | See NTAuthenticationProviders in the Metabase Property Reference.
AccessFlags | SINT32 | See AccessFlags in the Metabase Property Reference.
AccessSSLFlags | SINT32 | See AccessSSLFlags in the Metabase Property Reference.
LogType | SINT32 | See LogType in the Metabase Property Reference.
LogFilePeriod | SINT32 | See LogFilePeriod in the Metabase Property Reference.
LogPluginClsid | String | See LogPluginClsid in the Metabase Property Reference.
LogModuleList | String | See LogModuleList in the Metabase Property Reference.
LogFileDirectory | String | See LogFileDirectory in the Metabase Property Reference.
LogFileTruncateSize | SINT32 | See LogFileTruncateSize in the Metabase Property Reference.
LogExtFileFlags | SINT32 | See LogExtFileFlags in the Metabase Property Reference.
LogOdbcDataSource | String | See LogOdbcDataSource in the Metabase Property Reference.
LogOdbcTableName | String | See LogOdbcTableName in the Metabase Property Reference.
LogOdbcUserName | String | See LogOdbcUserName in the Metabase Property Reference.
LogOdbcPassword | String | See LogOdbcPassword in the Metabase Property Reference.
ImapExpireMail | SINT32 | See ImapExpireMail in the Metabase Property Reference.
ImapExpireDelay | SINT32 | See ImapExpireDelay in the Metabase Property Reference.
ImapExpireStart | SINT32 | See ImapExpireStart in the Metabase Property Reference.
ImapMailExpirationTime | SINT32 | See ImapMailExpirationTime in the Metabase Property Reference.
ImapClearTextProvider | String | See ImapClearTextProvider in the Metabase Property Reference.
ImapDefaultDomain | String | See ImapDefaultDomain in the Metabase Property Reference.
ImapRoutingDll | String | See ImapRoutingDll in the Metabase Property Reference.
Name | String | The Name property defines the label by which the object is known. When subclassed, the Name property can be overridden to be a Key property.
AuthAnonymous | Boolean | See AuthFlags in the Metabase Property Reference.
AuthBasic | Boolean | See AuthFlags in the Metabase Property Reference.
AuthNTLM | Boolean | See AuthFlags in the Metabase Property Reference.
AuthMD5 | Boolean | See AuthFlags in the Metabase Property Reference.
AuthPassport | Boolean | See AuthFlags in the Metabase Property Reference.
AccessRead | Boolean | See AccessFlags in the Metabase Property Reference.
AccessWrite | Boolean | See AccessFlags in the Metabase Property Reference.
AccessExecute | Boolean | See AccessFlags in the Metabase Property Reference.
AccessSource | Boolean | See AccessFlags in the Metabase Property Reference.
AccessScript | Boolean | See AccessFlags in the Metabase Property Reference.
AccessNoRemoteExecute | Boolean | See AccessFlags in the Metabase Property Reference.
AccessNoRemoteWrite | Boolean | See AccessFlags in the Metabase Property Reference.
AccessNoRemoteRead | Boolean | See AccessFlags in the Metabase Property Reference.
AccessNoRemoteScript | Boolean | See AccessFlags in the Metabase Property Reference.
AccessSSL | Boolean | See AccessSSLFlags in the Metabase Property Reference.
AccessSSLNegotiateCert | Boolean | See AccessSSLFlags in the Metabase Property Reference.
AccessSSLRequireCert | Boolean | See AccessSSLFlags in the Metabase Property Reference.
AccessSSLMapCert | Boolean | See AccessSSLFlags in the Metabase Property Reference.
AccessSSL128 | Boolean | See AccessSSLFlags in the Metabase Property Reference.
LogExtFileDate | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileTime | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileClientIp | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileUserName | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileSiteName | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileComputerName | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileServerIp | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileMethod | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileUriStem | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileUriQuery | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileHttpStatus | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileWin32Status | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileBytesSent | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileBytesRecv | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileTimeTaken | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileServerPort | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileUserAgent | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileCookie | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileReferer | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileProtocolVersion | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileHost | Boolean | See LogExtFileFlags in the Metabase Property Reference.
Name | String | The Name property defines the label by which the object is known. When subclassed, the Name property can be overridden to be a Key property.
Related Topics
  • For more information about the IIS WMI Provider, see Using the IIS WMI Provider.
  • For detailed examples of scripts that use the properties and methods of the Windows WMI provider to access the IIS WMI provider, see Module 3: Writing Administration Scripts that Use WMI of the IIS WMI Provider Tutorial.
  • For basic examples in VBScript, JScript, and Perl, see Code Examples to Configure Metabase Properties.
  • Your installation of IIS 6.0 includes command-line administration scripts that manage IIS. See Using Command-Line Administration Scripts.


IIsPop3SessionsSetting (WMI)

This class corresponds to the IIsPop3Sessions IIS Admin object, and contains the read-write properties for the object.

Parent Class

IIsSetting (WMI)

Properties

The table below lists properties other than those that are inherited from parent classes.

Property Name | Data Type | Description
Name | String | The Name property defines the label by which the object is known. When subclassed, the Name property can be overridden to be a Key property.
Related Topics
  • For more information about the IIS WMI Provider, see Using the IIS WMI Provider.
  • For detailed examples of scripts that use the properties and methods of the Windows WMI provider to access the IIS WMI provider, see Module 3: Writing Administration Scripts that Use WMI of the IIS WMI Provider Tutorial.
  • For basic examples in VBScript, JScript, and Perl, see Code Examples to Configure Metabase Properties.
  • Your installation of IIS 6.0 includes command-line administration scripts that manage IIS. See Using Command-Line Administration Scripts.


IIsPop3VirtualDirSetting (WMI)

This class corresponds to the IIsPop3VirtualDir IIS Admin object, and contains the read-write properties for the object.

Parent Class

IIsSetting (WMI)

Properties

The table below lists properties other than those that are inherited from parent classes.

Property Name | Data Type | Description
Path | String | See Path in the Metabase Property Reference.
UNCUserName | String | See UNCUserName in the Metabase Property Reference.
UNCPassword | String | See UNCPassword in the Metabase Property Reference.
Win32Error | SINT32 | See Win32Error in the Metabase Property Reference.
DontLog | Boolean | See DontLog in the Metabase Property Reference.
AccessFlags | SINT32 | See AccessFlags in the Metabase Property Reference.
AccessSSLFlags | SINT32 | See AccessSSLFlags in the Metabase Property Reference.
Pop3ExpireMail | SINT32 | See Pop3ExpireMail in the Metabase Property Reference.
Pop3MailExpirationTime | SINT32 | See Pop3MailExpirationTime in the Metabase Property Reference.
Name | String | The Name property defines the label by which the object is known. When subclassed, the Name property can be overridden to be a Key property.
AccessRead | Boolean | See AccessFlags in the Metabase Property Reference.
AccessWrite | Boolean | See AccessFlags in the Metabase Property Reference.
AccessExecute | Boolean | See AccessFlags in the Metabase Property Reference.
AccessSource | Boolean | See AccessFlags in the Metabase Property Reference.
AccessScript | Boolean | See AccessFlags in the Metabase Property Reference.
AccessNoRemoteExecute | Boolean | See AccessFlags in the Metabase Property Reference.
AccessNoRemoteWrite | Boolean | See AccessFlags in the Metabase Property Reference.
AccessNoRemoteRead | Boolean | See AccessFlags in the Metabase Property Reference.
AccessNoRemoteScript | Boolean | See AccessFlags in the Metabase Property Reference.
AccessSSL | Boolean | See AccessSSLFlags in the Metabase Property Reference.
AccessSSLNegotiateCert | Boolean | See AccessSSLFlags in the Metabase Property Reference.
AccessSSLRequireCert | Boolean | See AccessSSLFlags in the Metabase Property Reference.
AccessSSLMapCert | Boolean | See AccessSSLFlags in the Metabase Property Reference.
AccessSSL128 | Boolean | See AccessSSLFlags in the Metabase Property Reference.
Related Topics
  • For more information about the IIS WMI Provider, see Using the IIS WMI Provider.
  • For detailed examples of scripts that use the properties and methods of the Windows WMI provider to access the IIS WMI provider, see Module 3: Writing Administration Scripts that Use WMI of the IIS WMI Provider Tutorial.
  • For basic examples in VBScript, JScript, and Perl, see Code Examples to Configure Metabase Properties.
  • Your installation of IIS 6.0 includes command-line administration scripts that manage IIS. See Using Command-Line Administration Scripts.


IIsSmtpAliasSetting (WMI)

This class corresponds to the IIsSmtpAlias IIS Admin object, and contains the read-write properties for the object.

Parent Class

IIsSetting (WMI)

Properties

The table below lists properties other than those that are inherited from parent classes.

Property Name | Data Type | Description
Name | String | The Name property defines the label by which the object is known. When subclassed, the Name property can be overridden to be a Key property.
Related Topics
  • For more information about the IIS WMI Provider, see Using the IIS WMI Provider.
  • For detailed examples of scripts that use the properties and methods of the Windows WMI provider to access the IIS WMI provider, see Module 3: Writing Administration Scripts that Use WMI of the IIS WMI Provider Tutorial.
  • For basic examples in VBScript, JScript, and Perl, see Code Examples to Configure Metabase Properties.
  • Your installation of IIS 6.0 includes command-line administration scripts that manage IIS. See Using Command-Line Administration Scripts.


IIsSmtpDLSetting (WMI)

This class corresponds to the IIsSmtpDL IIS Admin object, and contains the read-write properties for the object.

Parent Class

IIsSetting (WMI)

Properties

The table below lists properties other than those that are inherited from parent classes.

Property Name | Data Type | Description
Name | String | The Name property defines the label by which the object is known. When subclassed, the Name property can be overridden to be a Key property.
Related Topics
  • For more information about the IIS WMI Provider, see Using the IIS WMI Provider.
  • For detailed examples of scripts that use the properties and methods of the Windows WMI provider to access the IIS WMI provider, see Module 3: Writing Administration Scripts that Use WMI of the IIS WMI Provider Tutorial.
  • For basic examples in VBScript, JScript, and Perl, see Code Examples to Configure Metabase Properties.
  • Your installation of IIS 6.0 includes command-line administration scripts that manage IIS. See Using Command-Line Administration Scripts.


IIsSmtpDomainSetting (WMI)

This class corresponds to the IIsSmtpDomain IIS Admin object, and contains the read-write properties for the object.

Parent Class

IIsSetting (WMI)

Properties

The table below lists properties other than those that are inherited from parent classes.

Property Name | Data Type | Description
Name | String | The Name property defines the label by which the object is known. When subclassed, the Name property can be overridden to be a Key property.
RouteAction | SINT32 | See RouteAction in the Metabase Property Reference.
RouteActionString | String | See RouteActionString in the Metabase Property Reference.
RouteUserName | String | See RouteUserName in the Metabase Property Reference.
RoutePassword | String | See RoutePassword in the Metabase Property Reference.
RelayIpList[] | array of uint8 | See RelayIpList in the Metabase Property Reference.
RelayForAuth | SINT32 | See RelayForAuth in the Metabase Property Reference.
AuthTurnList[] | array of String | See AuthTurnList in the Metabase Property Reference.
CSideEtrnDomains | String | See CSideEtrnDomains in the Metabase Property Reference.
Related Topics
  • For more information about the IIS WMI Provider, see Using the IIS WMI Provider.
  • For detailed examples of scripts that use the properties and methods of the Windows WMI provider to access the IIS WMI provider, see Module 3: Writing Administration Scripts that Use WMI of the IIS WMI Provider Tutorial.
  • For basic examples in VBScript, JScript, and Perl, see Code Examples to Configure Metabase Properties.
  • Your installation of IIS 6.0 includes command-line administration scripts that manage IIS. See Using Command-Line Administration Scripts.


IIsSmtpInfoSetting (WMI)

This class corresponds to the IIsSmtpInfo IIS Admin object, and contains the read-write properties for the object.

Parent Class

IIsSetting (WMI)

Properties

The table below lists properties other than those that are inherited from parent classes.

Property Name | Data Type | Description
LogModuleList | String | See LogModuleList in the Metabase Property Reference.
Name | String | The Name property defines the label by which the object is known. When subclassed, the Name property can be overridden to be a Key property.
Related Topics
  • For more information about the IIS WMI Provider, see Using the IIS WMI Provider.
  • For detailed examples of scripts that use the properties and methods of the Windows WMI provider to access the IIS WMI provider, see Module 3: Writing Administration Scripts that Use WMI of the IIS WMI Provider Tutorial.
  • For basic examples in VBScript, JScript, and Perl, see Code Examples to Configure Metabase Properties.
  • Your installation of IIS 6.0 includes command-line administration scripts that manage IIS. See Using Command-Line Administration Scripts.


IIsSmtpRoutingSourceSetting (WMI)

This class corresponds to the IIsSmtpRoutingSource IIS Admin object, and contains the read-write properties for the object.

Parent Class

IIsSetting (WMI)

Properties

The table below lists properties other than those that are inherited from parent classes.

Property Name | Data Type | Description
SmtpRoutingTableType | String | See SmtpRoutingTableType in the Metabase Property Reference.
SmtpDsDataDirectory | String | See SmtpDsDataDirectory in the Metabase Property Reference.
SmtpDsDefaultMailRoot | String | See SmtpDsDefaultMailRoot in the Metabase Property Reference.
SmtpDsBindType | String | See SmtpDsBindType in the Metabase Property Reference.
SmtpDsSchemaType | String | See SmtpDsSchemaType in the Metabase Property Reference.
SmtpDsHost | String | See SmtpDsHost in the Metabase Property Reference.
SmtpDsNamingContext | String | See SmtpDsNamingContext in the Metabase Property Reference.
SmtpDsAccount | String | See SmtpDsAccount in the Metabase Property Reference.
SmtpDsPassword | String | See SmtpDsPassword in the Metabase Property Reference.
SmtpDsUseCat | SINT32 | See SmtpDsUseCat in the Metabase Property Reference.
SmtpDsPort | SINT32 | See SmtpDsPort in the Metabase Property Reference.
SmtpDsDomain | String | See SmtpDsDomain in the Metabase Property Reference.
SmtpDsFlags | SINT32 | See SmtpDsFlags in the Metabase Property Reference.
Name | String | The Name property defines the label by which the object is known. When subclassed, the Name property can be overridden to be a Key property.
Related Topics
  • For more information about the IIS WMI Provider, see Using the IIS WMI Provider.
  • For detailed examples of scripts that use the properties and methods of the Windows WMI provider to access the IIS WMI provider, see Module 3: Writing Administration Scripts that Use WMI of the IIS WMI Provider Tutorial.
  • For basic examples in VBScript, JScript, and Perl, see Code Examples to Configure Metabase Properties.
  • Your installation of IIS 6.0 includes command-line administration scripts that manage IIS. See Using Command-Line Administration Scripts.


IIsSmtpServerSetting (WMI)

This class corresponds to the IIsSmtpServer IIS Admin object, and contains the read-write properties for the object.

Parent Class

IIsSetting (WMI)

Properties

The table below lists properties other than those that are inherited from parent classes.

Property Name | Data Type | Description
AzEnable | Boolean | See AzEnable in the Metabase Property Reference.
AzImpersonationLevel | SINT32 | See AzImpersonationLevel in the Metabase Property Reference.
AzStoreName | String | See AzStoreName in the Metabase Property Reference.
AzScopeName | String | See AzScopeName in the Metabase Property Reference.
MaxBandwidth | SINT32 | See MaxBandwidth in the Metabase Property Reference.
MaxConnections | SINT32 | See MaxConnections in the Metabase Property Reference.
ServerComment | String | See ServerComment in the Metabase Property Reference.
ConnectionTimeout | SINT32 | See ConnectionTimeout in the Metabase Property Reference.
ServerListenTimeout | SINT32 | See ServerListenTimeout in the Metabase Property Reference.
MaxEndpointConnections | SINT32 | See MaxEndpointConnections in the Metabase Property Reference.
ServerAutoStart | Boolean | See ServerAutoStart in the Metabase Property Reference.
AdminACLBin[] | array of uint8 | See AdminACLBin in the Metabase Property Reference.
DontLog | Boolean | See DontLog in the Metabase Property Reference.
AuthFlags | SINT32 | See AuthFlags in the Metabase Property Reference.
ServerListenBacklog | SINT32 | See ServerListenBacklog in the Metabase Property Reference.
DefaultLogonDomain | String | See DefaultLogonDomain in the Metabase Property Reference.
NTAuthenticationProviders | String | See NTAuthenticationProviders in the Metabase Property Reference.
AccessFlags | SINT32 | See AccessFlags in the Metabase Property Reference.
AccessSSLFlags | SINT32 | See AccessSSLFlags in the Metabase Property Reference.
LogType | SINT32 | See LogType in the Metabase Property Reference.
LogFilePeriod | SINT32 | See LogFilePeriod in the Metabase Property Reference.
LogPluginClsid | String | See LogPluginClsid in the Metabase Property Reference.
LogModuleList | String | See LogModuleList in the Metabase Property Reference.
LogFileDirectory | String | See LogFileDirectory in the Metabase Property Reference.
LogFileTruncateSize | SINT32 | See LogFileTruncateSize in the Metabase Property Reference.
LogExtFileFlags | SINT32 | See LogExtFileFlags in the Metabase Property Reference.
LogOdbcDataSource | String | See LogOdbcDataSource in the Metabase Property Reference.
LogOdbcTableName | String | See LogOdbcTableName in the Metabase Property Reference.
LogOdbcUserName | String | See LogOdbcUserName in the Metabase Property Reference.
LogOdbcPassword | String | See LogOdbcPassword in the Metabase Property Reference.
ImapExpireMail | SINT32 | See ImapExpireMail in the Metabase Property Reference.
ImapExpireDelay | SINT32 | See ImapExpireDelay in the Metabase Property Reference.
ImapExpireStart | SINT32 | See ImapExpireStart in the Metabase Property Reference.
ImapMailExpirationTime | SINT32 | See ImapMailExpirationTime in the Metabase Property Reference.
ImapClearTextProvider | String | See ImapClearTextProvider in the Metabase Property Reference.
ImapDefaultDomain | String | See ImapDefaultDomain in the Metabase Property Reference.
ImapRoutingDll | String | See ImapRoutingDll in the Metabase Property Reference.
Name | String | The Name property defines the label by which the object is known. When subclassed, the Name property can be overridden to be a Key property.
AuthAnonymous | Boolean | See AuthFlags in the Metabase Property Reference.
AuthBasic | Boolean | See AuthFlags in the Metabase Property Reference.
AuthNTLM | Boolean | See AuthFlags in the Metabase Property Reference.
AuthMD5 | Boolean | See AuthFlags in the Metabase Property Reference.
AuthPassport | Boolean | See AuthFlags in the Metabase Property Reference.
AccessRead | Boolean | See AccessFlags in the Metabase Property Reference.
AccessWrite | Boolean | See AccessFlags in the Metabase Property Reference.
AccessExecute | Boolean | See AccessFlags in the Metabase Property Reference.
AccessSource | Boolean | See AccessFlags in the Metabase Property Reference.
AccessScript | Boolean | See AccessFlags in the Metabase Property Reference.
AccessNoRemoteExecute | Boolean | See AccessFlags in the Metabase Property Reference.
AccessNoRemoteWrite | Boolean | See AccessFlags in the Metabase Property Reference.
AccessNoRemoteRead | Boolean | See AccessFlags in the Metabase Property Reference.
AccessNoRemoteScript | Boolean | See AccessFlags in the Metabase Property Reference.
AccessSSL | Boolean | See AccessSSLFlags in the Metabase Property Reference.
AccessSSLNegotiateCert | Boolean | See AccessSSLFlags in the Metabase Property Reference.
AccessSSLRequireCert | Boolean | See AccessSSLFlags in the Metabase Property Reference.
AccessSSLMapCert | Boolean | See AccessSSLFlags in the Metabase Property Reference.
AccessSSL128 | Boolean | See AccessSSLFlags in the Metabase Property Reference.
LogExtFileDate | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileTime | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileClientIp | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileUserName | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileSiteName | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileComputerName | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileServerIp | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileMethod | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileUriStem | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileUriQuery | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileHttpStatus | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileWin32Status | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileBytesSent | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileBytesRecv | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileTimeTaken | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileServerPort | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileUserAgent | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileCookie | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileReferer | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileProtocolVersion | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileHost | Boolean | See LogExtFileFlags in the Metabase Property Reference.
Name | String | The Name property defines the label by which the object is known. When subclassed, the Name property can be overridden to be a Key property.
Related Topics
  • For more information about the IIS WMI Provider, see Using the IIS WMI Provider.
  • For detailed examples of scripts that use the properties and methods of the Windows WMI provider to access the IIS WMI provider, see Module 3: Writing Administration Scripts that Use WMI of the IIS WMI Provider Tutorial.
  • For basic examples in VBScript, JScript, and Perl, see Code Examples to Configure Metabase Properties.
  • Your installation of IIS 6.0 includes command-line administration scripts that manage IIS. See Using Command-Line Administration Scripts.


IIsSmtpServiceSetting (WMI)

This class corresponds to the IIsSmtpService IIS Admin object, and contains the read-write properties for the object.

Parent Class

IIsSetting (WMI)

Properties

The table below lists properties other than those that are inherited from parent classes.

Property Name | Data Type | Description
AzEnable | Boolean | See AzEnable in the Metabase Property Reference.
AzImpersonationLevel | SINT32 | See AzImpersonationLevel in the Metabase Property Reference.
AzStoreName | String | See AzStoreName in the Metabase Property Reference.
AzScopeName | String | See AzScopeName in the Metabase Property Reference.
MaxBandwidth | SINT32 | See MaxBandwidth in the Metabase Property Reference.
MaxConnections | SINT32 | See MaxConnections in the Metabase Property Reference.
ServerComment | String | See ServerComment in the Metabase Property Reference.
ConnectionTimeout | SINT32 | See ConnectionTimeout in the Metabase Property Reference.
ServerListenTimeout | SINT32 | See ServerListenTimeout in the Metabase Property Reference.
MaxEndpointConnections | SINT32 | See MaxEndpointConnections in the Metabase Property Reference.
ServerAutoStart | Boolean | See ServerAutoStart in the Metabase Property Reference.
AdminACLBin[] | array of uint8 | See AdminACLBin in the Metabase Property Reference.
DontLog | Boolean | See DontLog in the Metabase Property Reference.
AuthFlags | SINT32 | See AuthFlags in the Metabase Property Reference.
ServerListenBacklog | SINT32 | See ServerListenBacklog in the Metabase Property Reference.
DefaultLogonDomain | String | See DefaultLogonDomain in the Metabase Property Reference.
NTAuthenticationProviders | String | See NTAuthenticationProviders in the Metabase Property Reference.
AccessFlags | SINT32 | See AccessFlags in the Metabase Property Reference.
AccessSSLFlags | SINT32 | See AccessSSLFlags in the Metabase Property Reference.
LogType | SINT32 | See LogType in the Metabase Property Reference.
LogFilePeriod | SINT32 | See LogFilePeriod in the Metabase Property Reference.
LogPluginClsid | String | See LogPluginClsid in the Metabase Property Reference.
LogModuleList | String | See LogModuleList in the Metabase Property Reference.
LogFileDirectory | String | See LogFileDirectory in the Metabase Property Reference.
LogFileTruncateSize | SINT32 | See LogFileTruncateSize in the Metabase Property Reference.
LogExtFileFlags | SINT32 | See LogExtFileFlags in the Metabase Property Reference.
LogOdbcDataSource | String | See LogOdbcDataSource in the Metabase Property Reference.
LogOdbcTableName | String | See LogOdbcTableName in the Metabase Property Reference.
LogOdbcUserName | String | See LogOdbcUserName in the Metabase Property Reference.
LogOdbcPassword | String | See LogOdbcPassword in the Metabase Property Reference.
ImapExpireMail | SINT32 | See ImapExpireMail in the Metabase Property Reference.
ImapExpireDelay | SINT32 | See ImapExpireDelay in the Metabase Property Reference.
ImapExpireStart | SINT32 | See ImapExpireStart in the Metabase Property Reference.
ImapMailExpirationTime | SINT32 | See ImapMailExpirationTime in the Metabase Property Reference.
ImapClearTextProvider | String | See ImapClearTextProvider in the Metabase Property Reference.
ImapDefaultDomain | String | See ImapDefaultDomain in the Metabase Property Reference.
ImapRoutingDll | String | See ImapRoutingDll in the Metabase Property Reference.
Name | String | The Name property defines the label by which the object is known. When subclassed, the Name property can be overridden to be a Key property.
AuthAnonymous | Boolean | See AuthFlags in the Metabase Property Reference.
AuthBasic | Boolean | See AuthFlags in the Metabase Property Reference.
AuthNTLM | Boolean | See AuthFlags in the Metabase Property Reference.
AuthMD5 | Boolean | See AuthFlags in the Metabase Property Reference.
AuthPassport | Boolean | See AuthFlags in the Metabase Property Reference.
AccessRead | Boolean | See AccessFlags in the Metabase Property Reference.
AccessWrite | Boolean | See AccessFlags in the Metabase Property Reference.
AccessExecute | Boolean | See AccessFlags in the Metabase Property Reference.
AccessSource | Boolean | See AccessFlags in the Metabase Property Reference.
AccessScript | Boolean | See AccessFlags in the Metabase Property Reference.
AccessNoRemoteExecute | Boolean | See AccessFlags in the Metabase Property Reference.
AccessNoRemoteWrite | Boolean | See AccessFlags in the Metabase Property Reference.
AccessNoRemoteRead | Boolean | See AccessFlags in the Metabase Property Reference.
AccessNoRemoteScript | Boolean | See AccessFlags in the Metabase Property Reference.
AccessSSL | Boolean | See AccessSSLFlags in the Metabase Property Reference.
AccessSSLNegotiateCert | Boolean | See AccessSSLFlags in the Metabase Property Reference.
AccessSSLRequireCert | Boolean | See AccessSSLFlags in the Metabase Property Reference.
AccessSSLMapCert | Boolean | See AccessSSLFlags in the Metabase Property Reference.
AccessSSL128 | Boolean | See AccessSSLFlags in the Metabase Property Reference.
LogExtFileDate | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileTime | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileClientIp | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileUserName | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileSiteName | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileComputerName | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileServerIp | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileMethod | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileUriStem | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileUriQuery | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileHttpStatus | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileWin32Status | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileBytesSent | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileBytesRecv | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileTimeTaken | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileServerPort | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileUserAgent | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileCookie | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileReferer | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileProtocolVersion | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileHost | Boolean | See LogExtFileFlags in the Metabase Property Reference.
Related Topics
  • For more information about the IIS WMI Provider, see Using the IIS WMI Provider.
  • For detailed examples of scripts that use the properties and methods of the Windows WMI provider to access the IIS WMI provider, see Module 3: Writing Administration Scripts that Use WMI of the IIS WMI Provider Tutorial.
  • For basic examples in VBScript, JScript, and Perl, see Code Examples to Configure Metabase Properties.
  • Your installation of IIS 6.0 includes command-line administration scripts that manage IIS. See Using Command-Line Administration Scripts.


IIsSmtpSessionsSetting (WMI)

This class corresponds to the IIsSmtpSessions IIS Admin object, and contains the read-write properties for the object.

Parent Class

IIsSetting (WMI)

Properties

The table below lists properties other than those that are inherited from parent classes.

Property Name | Data Type | Description
Name | String | The Name property defines the label by which the object is known. When subclassed, the Name property can be overridden to be a Key property.
Related Topics
  • For more information about the IIS WMI Provider, see Using the IIS WMI Provider.
  • For detailed examples of scripts that use the properties and methods of the Windows WMI provider to access the IIS WMI provider, see Module 3: Writing Administration Scripts that Use WMI of the IIS WMI Provider Tutorial.
  • For basic examples in VBScript, JScript, and Perl, see Code Examples to Configure Metabase Properties.
  • Your installation of IIS 6.0 includes command-line administration scripts that manage IIS. See Using Command-Line Administration Scripts.


IIsSmtpUserSetting (WMI)

This class corresponds to the IIsSmtpUser IIS Admin object, and contains the read-write properties for the object.

Parent Class

IIsSetting (WMI)

Properties

The table below lists properties other than those that are inherited from parent classes.

Property Name | Data Type | Description
Name | String | The Name property defines the label by which the object is known. When subclassed, the Name property can be overridden to be a Key property.
Related Topics
  • For more information about the IIS WMI Provider, see Using the IIS WMI Provider.
  • For detailed examples of scripts that use the properties and methods of the Windows WMI provider to access the IIS WMI provider, see Module 3: Writing Administration Scripts that Use WMI of the IIS WMI Provider Tutorial.
  • For basic examples in VBScript, JScript, and Perl, see Code Examples to Configure Metabase Properties.
  • Your installation of IIS 6.0 includes command-line administration scripts that manage IIS. See Using Command-Line Administration Scripts.


IIsSmtpVirtualDirSetting (WMI)

This class corresponds to the IIsSmtpVirtualDir IIS Admin object, and contains the read-write properties for the object.

Parent Class

IIsSetting (WMI)

Properties

The table below lists properties other than those that are inherited from parent classes.

Property Name | Data Type | Description
Path | String | See Path in the Metabase Property Reference.
UNCUserName | String | See UNCUserName in the Metabase Property Reference.
UNCPassword | String | See UNCPassword in the Metabase Property Reference.
Win32Error | SINT32 | See Win32Error in the Metabase Property Reference.
DontLog | Boolean | See DontLog in the Metabase Property Reference.
AccessFlags | SINT32 | See AccessFlags in the Metabase Property Reference.
AccessSSLFlags | SINT32 | See AccessSSLFlags in the Metabase Property Reference.
AccessRead | Boolean | See AccessFlags in the Metabase Property Reference.
AccessWrite | Boolean | See AccessFlags in the Metabase Property Reference.
AccessExecute | Boolean | See AccessFlags in the Metabase Property Reference.
AccessSource | Boolean | See AccessFlags in the Metabase Property Reference.
AccessScript | Boolean | See AccessFlags in the Metabase Property Reference.
AccessNoRemoteExecute | Boolean | See AccessFlags in the Metabase Property Reference.
AccessNoRemoteWrite | Boolean | See AccessFlags in the Metabase Property Reference.
AccessNoRemoteRead | Boolean | See AccessFlags in the Metabase Property Reference.
AccessNoRemoteScript | Boolean | See AccessFlags in the Metabase Property Reference.
AccessSSL | Boolean | See AccessSSLFlags in the Metabase Property Reference.
AccessSSLNegotiateCert | Boolean | See AccessSSLFlags in the Metabase Property Reference.
AccessSSLRequireCert | Boolean | See AccessSSLFlags in the Metabase Property Reference.
AccessSSLMapCert | Boolean | See AccessSSLFlags in the Metabase Property Reference.
AccessSSL128 | Boolean | See AccessSSLFlags in the Metabase Property Reference.
Name | String | The Name property defines the label by which the object is known. When subclassed, the Name property can be overridden to be a Key property.
Related Topics
  • For more information about the IIS WMI Provider, see Using the IIS WMI Provider.
  • For detailed examples of scripts that use the properties and methods of the Windows WMI provider to access the IIS WMI provider, see Module 3: Writing Administration Scripts that Use WMI of the IIS WMI Provider Tutorial.
  • For basic examples in VBScript, JScript, and Perl, see Code Examples to Configure Metabase Properties.
  • Your installation of IIS 6.0 includes command-line administration scripts that manage IIS. See Using Command-Line Administration Scripts.


IIsUserDefinedSetting (WMI)

This class corresponds to the IIsUserDefined IIS Admin object, and contains the read-write properties for the object.

Parent Class

IIsSetting (WMI)

Properties

This class inherits only properties from the parent classes.

Related Topics
  • For more information about the IIS WMI Provider, see Using the IIS WMI Provider.
  • For detailed examples of scripts that use the properties and methods of the Windows WMI provider to access the IIS WMI provider, see Module 3: Writing Administration Scripts that Use WMI of the IIS WMI Provider Tutorial.
  • For basic examples in VBScript, JScript, and Perl, see Code Examples to Configure Metabase Properties.
  • Your installation of IIS 6.0 includes command-line administration scripts that manage IIS. See Using Command-Line Administration Scripts.


IIsWebDirectorySetting (WMI)

The IIsWebDirectorySetting class corresponds to the IIsWebDirectory IIS Admin object, and contains the read-write properties for the object.

Parent Class

IIsSetting (WMI)

Properties

The table below lists properties other than those that are inherited from parent classes.

Property Name | Data Type | Description
AzEnable | Boolean | See AzEnable in the Metabase Property Reference.
AzImpersonationLevel | SINT32 | See AzImpersonationLevel in the Metabase Property Reference.
AzStoreName | String | See AzStoreName in the Metabase Property Reference.
AzScopeName | String | See AzScopeName in the Metabase Property Reference.
AspCalcLineNumber | Boolean | See Metabase Property Reference in the Metabase Property Reference.
AdminACLBin[] | array of uint8 | See AdminACLBin in the Metabase Property Reference.
AspMaxRequestEntityAllowed | SINT32 | See AspMaxRequestEntityAllowed in the Metabase Property Reference.
MaxRequestEntityAllowed | SINT32 | See MaxRequestEntityAllowed in the Metabase Property Reference.
AnonymousUserName | String | See AnonymousUserName in the Metabase Property Reference.
AnonymousUserPass | String | See AnonymousUserPass in the Metabase Property Reference.
AnonymousPasswordSync | Boolean | See AnonymousPasswordSync in the Metabase Property Reference.
UseDigestSSP | Boolean | See UseDigestSSP in the Metabase Property Reference.
AppFriendlyName | String | See AppFriendlyName in the Metabase Property Reference.
AppOopRecoverLimit | SINT32 | See AppOopRecoverLimit in the Metabase Property Reference.
CacheISAPI | Boolean | See CacheISAPI in the Metabase Property Reference.
AppAllowDebugging | Boolean | See AppAllowDebugging in the Metabase Property Reference.
AppAllowClientDebug | Boolean | See AppAllowClientDebug in the Metabase Property Reference.
DefaultLogonDomain | String | See DefaultLogonDomain in the Metabase Property Reference.
LogonMethod | SINT32 | See LogonMethod in the Metabase Property Reference.
CGITimeout | SINT32 | See CGITimeout in the Metabase Property Reference.
Realm | String | See Realm in the Metabase Property Reference.
DontLog | Boolean | See DontLog in the Metabase Property Reference.
HttpExpires | String | See HttpExpires in the Metabase Property Reference.
HttpPics[] | array of String | See HttpPics in the Metabase Property Reference.
HttpCustomHeaders[] | array of HttpCustomHeader | See HttpCustomHeaders in the Metabase Property Reference.
HttpErrors[] | array of HttpError | See HttpErrors in the Metabase Property Reference.
EnableDocFooter | Boolean | See EnableDocFooter in the Metabase Property Reference.
DefaultDocFooter | String | See DefaultDocFooter in the Metabase Property Reference.
HttpRedirect | String | See HttpRedirect in the Metabase Property Reference.
DefaultDoc | String | See DefaultDoc in the Metabase Property Reference.
ContentIndexed | Boolean | See ContentIndexed in the Metabase Property Reference.
CacheControlMaxAge | SINT32 | See CacheControlMaxAge in the Metabase Property Reference.
CacheControlNoCache | Boolean | See CacheControlNoCache in the Metabase Property Reference.
CacheControlCustom | String | See CacheControlCustom in the Metabase Property Reference.
CreateProcessAsUser | Boolean | See CreateProcessAsUser in the Metabase Property Reference.
PoolIdcTimeout | SINT32 | See PoolIdcTimeout in the Metabase Property Reference.
RedirectHeaders | String | See RedirectHeaders in the Metabase Property Reference.
UploadReadAheadSize | SINT32 | See UploadReadAheadSize in the Metabase Property Reference.
FrontPageWeb | Boolean | See FrontPageWeb in the Metabase Property Reference.
AppWamClsid | String | See AppWamClsid in the Metabase Property Reference.
AuthPersistence | SINT32 | See AuthPersistence in the Metabase Property Reference.
AccessFlags | SINT32 | See AccessFlags in the Metabase Property Reference.
AccessSSLFlags | SINT32 | See AccessSSLFlags in the Metabase Property Reference.
ScriptMaps[] | array of ScriptMap | See ScriptMaps in the Metabase Property Reference.
SSIExecDisable | Boolean | See SSIExecDisable in the Metabase Property Reference.
EnableReverseDns | Boolean | See EnableReverseDns in the Metabase Property Reference.
CreateCGIWithNewConsole | Boolean | See CreateCGIWithNewConsole in the Metabase Property Reference.
AspBufferingOn | Boolean | See AspBufferingOn in the Metabase Property Reference.
AspLogErrorRequests | Boolean | See AspLogErrorRequests in the Metabase Property Reference.
AspScriptErrorSentToBrowser | Boolean | See AspScriptErrorSentToBrowser in the Metabase Property Reference.
AspScriptErrorMessage | String | See AspScriptErrorMessage in the Metabase Property Reference.
AspAllowOutOfProcComponents | Boolean | See AspAllowOutOfProcComponents in the Metabase Property Reference.
AspScriptFileCacheSize | SINT32 | See AspScriptFileCacheSize in the Metabase Property Reference.
AspDiskTemplateCacheDirectory | String | See AspDiskTemplateCacheDirectory in the Metabase Property Reference.
AspMaxDiskTemplateCacheFiles | SINT32 | See AspMaxDiskTemplateCacheFiles in the Metabase Property Reference.
AspScriptEngineCacheMax | SINT32 | See AspScriptEngineCacheMax in the Metabase Property Reference.
AspScriptTimeout | SINT32 | See AspScriptTimeout in the Metabase Property Reference.
AspSessionTimeout | SINT32 | See AspSessionTimeout in the Metabase Property Reference.
AspEnableParentPaths | Boolean | See AspEnableParentPaths in the Metabase Property Reference.
AspAllowSessionState | Boolean | See AspAllowSessionState in the Metabase Property Reference.
AspScriptLanguage | String | See AspScriptLanguage in the Metabase Property Reference.
AspExceptionCatchEnable | Boolean | See AspExceptionCatchEnable in the Metabase Property Reference.
AspCodepage | SINT32 | See AspCodepage in the Metabase Property Reference.
AspLCID | SINT32 | See AspLCID in the Metabase Property Reference.
MimeMap[] | array of MimeMap | See MimeMap in the Metabase Property Reference.
AspQueueTimeout | SINT32 | See AspQueueTimeout in the Metabase Property Reference.
AspEnableAspHtmlFallback | Boolean | See AspEnableAspHtmlFallback in the Metabase Property Reference.
AspEnableChunkedEncoding | Boolean | See AspEnableChunkedEncoding in the Metabase Property Reference.
AspEnableTypelibCache | Boolean | See AspEnableTypelibCache in the Metabase Property Reference.
AspErrorsToNTLog | Boolean | See AspErrorsToNTLog in the Metabase Property Reference.
AspProcessorThreadMax | SINT32 | See AspProcessorThreadMax in the Metabase Property Reference.
AspTrackThreadingModel | Boolean | See AspTrackThreadingModel in the Metabase Property Reference.
AspRequestQueueMax | SINT32 | See AspRequestQueueMax in the Metabase Property Reference.
AspEnableApplicationRestart | Boolean | See AspEnableApplicationRestart in the Metabase Property Reference.
AspQueueConnectionTestTime | SINT32 | See AspQueueConnectionTestTime in the Metabase Property Reference.
AspSessionMax | SINT32 | See AspSessionMax in the Metabase Property Reference.
ShutdownTimeLimit | SINT32 | See ShutdownTimeLimit in the Metabase Property Reference.
DirBrowseFlags | SINT32 | See DirBrowseFlags in the Metabase Property Reference.
AuthFlags | SINT32 | See AuthFlags in the Metabase Property Reference.
AppPoolId | String | See AppPoolId in the Metabase Property Reference.
DoStaticCompression | Boolean | See DoStaticCompression in the Metabase Property Reference.
DoDynamicCompression | Boolean | See DoDynamicCompression in the Metabase Property Reference.
AspPartitionID | String | See AspPartitionID in the Metabase Property Reference.
AspSxsName | String | See AspSxsName in the Metabase Property Reference.
AspAppServiceFlags | SINT32 | See AspAppServiceFlags in the Metabase Property Reference.
AspKeepSessionIDSecure | SINT32 | See AspKeepSessionIDSecure in the Metabase Property Reference.
AspExecuteInMTA | SINT32 | See AspExecuteInMTA in the Metabase Property Reference.
AspRunOnEndAnonymously | Boolean | See AspRunOnEndAnonymously in the Metabase Property Reference.
AspBufferingLimit | SINT32 | See AspBufferingLimit in the Metabase Property Reference.
AuthPersistSingleRequest | Boolean | See AuthPersistence in the Metabase Property Reference.
AccessRead | Boolean | See AccessFlags in the Metabase Property Reference.
AccessWrite | Boolean | See AccessFlags in the Metabase Property Reference.
AccessExecute | Boolean | See AccessFlags in the Metabase Property Reference.
AccessSource | Boolean | See AccessFlags in the Metabase Property Reference.
AccessScript | Boolean | See AccessFlags in the Metabase Property Reference.
AccessNoRemoteExecute | Boolean | See AccessFlags in the Metabase Property Reference.
AccessNoRemoteWrite | Boolean | See AccessFlags in the Metabase Property Reference.
AccessNoRemoteRead | Boolean | See AccessFlags in the Metabase Property Reference.
AccessNoRemoteScript | Boolean | See AccessFlags in the Metabase Property Reference.
AccessSSL | Boolean | See AccessSSLFlags in the Metabase Property Reference.
AccessSSLNegotiateCert | Boolean | See AccessSSLFlags in the Metabase Property Reference.
AccessSSLRequireCert | Boolean | See AccessSSLFlags in the Metabase Property Reference.
AccessSSLMapCert | Boolean | See AccessSSLFlags in the Metabase Property Reference.
AccessSSL128 | Boolean | See AccessSSLFlags in the Metabase Property Reference.
DirBrowseShowDate | Boolean | See DirBrowseFlags in the Metabase Property Reference.
DirBrowseShowTime | Boolean | See DirBrowseFlags in the Metabase Property Reference.
DirBrowseShowSize | Boolean | See DirBrowseFlags in the Metabase Property Reference.
DirBrowseShowExtension | Boolean | See DirBrowseFlags in the Metabase Property Reference.
DirBrowseShowLongDate | Boolean | See DirBrowseFlags in the Metabase Property Reference.
EnableDefaultDoc | Boolean | See DirBrowseFlags in the Metabase Property Reference.
EnableDirBrowsing | Boolean | See DirBrowseFlags in the Metabase Property Reference.
AuthAnonymous | Boolean | See AuthFlags in the Metabase Property Reference.
AuthBasic | Boolean | See AuthFlags in the Metabase Property Reference.
AuthNTLM | Boolean | See AuthFlags in the Metabase Property Reference.
AuthMD5 | Boolean | See AuthFlags in the Metabase Property Reference.
AuthPassport | Boolean | See AuthFlags in the Metabase Property Reference.
AspEnableTracker | Boolean | See AspAppServiceFlags in the Metabase Property Reference.
AspEnableSxs | Boolean | See AspAppServiceFlags in the Metabase Property Reference.
AspUsePartition | Boolean | See AspAppServiceFlags in the Metabase Property Reference.
Name | String | The Name property defines the label by which the object is known. When subclassed, the Name property can be overridden to be a Key property.
Related Topics
  • For more information about the IIS WMI Provider, see Using the IIS WMI Provider.
  • For detailed examples of scripts that use the properties and methods of the Windows WMI provider to access the IIS WMI provider, see Module 3: Writing Administration Scripts that Use WMI of the IIS WMI Provider Tutorial.
  • For basic examples in VBScript, JScript, and Perl, see Code Examples to Configure Metabase Properties.
  • Your installation of IIS 6.0 includes command-line administration scripts that manage IIS. See Using Command-Line Administration Scripts.


IIsWebFileSetting (WMI)

This class corresponds to the IIsWebFile IIS Admin object, and contains the read-write properties for the object.

Parent Class

IIsSetting (WMI)

Properties

The table below lists properties other than those that are inherited from parent classes.

Property Name | Data Type | Description
AnonymousUserName | String | See AnonymousUserName in the Metabase Property Reference.
AnonymousUserPass | String | See AnonymousUserPass in the Metabase Property Reference.
AnonymousPasswordSync | Boolean | See AnonymousPasswordSync in the Metabase Property Reference.
UseDigestSSP | Boolean | See UseDigestSSP in the Metabase Property Reference.
CGITimeout | SINT32 | See CGITimeout in the Metabase Property Reference.
DefaultLogonDomain | String | See DefaultLogonDomain in the Metabase Property Reference.
LogonMethod | SINT32 | See LogonMethod in the Metabase Property Reference.
Realm | String | See Realm in the Metabase Property Reference.
MimeMap[] | array of MimeMap | See MimeMap in the Metabase Property Reference.
DontLog | Boolean | See DontLog in the Metabase Property Reference.
HttpExpires | String | See HttpExpires in the Metabase Property Reference.
HttpPics[] | array of String | See HttpPics in the Metabase Property Reference.
HttpCustomHeaders[] | array of HttpCustomHeader | See HttpCustomHeaders in the Metabase Property Reference.
HttpErrors[] | array of HttpError | See HttpErrors in the Metabase Property Reference.
AdminACLBin[] | array of uint8 | See AdminACLBin in the Metabase Property Reference.
MaxRequestEntityAllowed | SINT32 | See MaxRequestEntityAllowed in the Metabase Property Reference.
EnableDocFooter | Boolean | See EnableDocFooter in the Metabase Property Reference.
DefaultDocFooter | String | See DefaultDocFooter in the Metabase Property Reference.
HttpRedirect | String | See HttpRedirect in the Metabase Property Reference.
CacheControlMaxAge | SINT32 | See CacheControlMaxAge in the Metabase Property Reference.
CacheControlNoCache | Boolean | See CacheControlNoCache in the Metabase Property Reference.
CacheControlCustom | String | See CacheControlCustom in the Metabase Property Reference.
CreateProcessAsUser | Boolean | See CreateProcessAsUser in the Metabase Property Reference.
PoolIdcTimeout | SINT32 | See PoolIdcTimeout in the Metabase Property Reference.
RedirectHeaders | String | See RedirectHeaders in the Metabase Property Reference.
UploadReadAheadSize | SINT32 | See UploadReadAheadSize in the Metabase Property Reference.
AuthFlags | SINT32 | See AuthFlags in the Metabase Property Reference.
AuthPersistence | SINT32 | See AuthPersistence in the Metabase Property Reference.
AccessFlags | SINT32 | See AccessFlags in the Metabase Property Reference.
AccessSSLFlags | SINT32 | See AccessSSLFlags in the Metabase Property Reference.
ScriptMaps[] | array of ScriptMap | See ScriptMaps in the Metabase Property Reference.
SSIExecDisable | Boolean | See SSIExecDisable in the Metabase Property Reference.
EnableReverseDns | Boolean | See EnableReverseDns in the Metabase Property Reference.
CreateCGIWithNewConsole | Boolean | See CreateCGIWithNewConsole in the Metabase Property Reference.
DoStaticCompression | Boolean | See DoStaticCompression in the Metabase Property Reference.
DoDynamicCompression | Boolean | See DoDynamicCompression in the Metabase Property Reference.
Name | String | The Name property defines the label by which the object is known. When subclassed, the Name property can be overridden to be a Key property.
AuthAnonymous | Boolean | See AuthFlags in the Metabase Property Reference.
AuthBasic | Boolean | See AuthFlags in the Metabase Property Reference.
AuthNTLM | Boolean | See AuthFlags in the Metabase Property Reference.
AuthMD5 | Boolean | See AuthFlags in the Metabase Property Reference.
AuthPassport | Boolean | See AuthFlags in the Metabase Property Reference.
AuthPersistSingleRequest | Boolean | See AuthPersistence in the Metabase Property Reference.
AccessRead | Boolean | See AccessFlags in the Metabase Property Reference.
AccessWrite | Boolean | See AccessFlags in the Metabase Property Reference.
AccessExecute | Boolean | See AccessFlags in the Metabase Property Reference.
AccessSource | Boolean | See AccessFlags in the Metabase Property Reference.
AccessScript | Boolean | See AccessFlags in the Metabase Property Reference.
AccessNoRemoteExecute | Boolean | See AccessFlags in the Metabase Property Reference.
AccessNoRemoteWrite | Boolean | See AccessFlags in the Metabase Property Reference.
AccessNoRemoteRead | Boolean | See AccessFlags in the Metabase Property Reference.
AccessNoRemoteScript | Boolean | See AccessFlags in the Metabase Property Reference.
AccessSSL | Boolean | See AccessSSLFlags in the Metabase Property Reference.
AccessSSLNegotiateCert | Boolean | See AccessSSLFlags in the Metabase Property Reference.
AccessSSLRequireCert | Boolean | See AccessSSLFlags in the Metabase Property Reference.
AccessSSLMapCert | Boolean | See AccessSSLFlags in the Metabase Property Reference.
AccessSSL128 | Boolean | See AccessSSLFlags in the Metabase Property Reference.
AzEnable | Boolean | See AzEnable in the Metabase Property Reference.
AzImpersonationLevel | SINT32 | See AzImpersonationLevel in the Metabase Property Reference.
AzStoreName | String | See AzStoreName in the Metabase Property Reference.
AzScopeName | String | See AzScopeName in the Metabase Property Reference.
Related Topics
  • For more information about the IIS WMI Provider, see Using the IIS WMI Provider.
  • For detailed examples of scripts that use the properties and methods of the Windows WMI provider to access the IIS WMI provider, see Module 3: Writing Administration Scripts that Use WMI of the IIS WMI Provider Tutorial.
  • For basic examples in VBScript, JScript, and Perl, see Code Examples to Configure Metabase Properties.
  • Your installation of IIS 6.0 includes command-line administration scripts that manage IIS. See Using Command-Line Administration Scripts.


IIsWebInfoSetting (WMI)

This class corresponds to the IIsWebInfo IIS Admin object, and contains the read-write properties for the object.

Parent Class

IIsSetting (WMI)

Properties

The table below lists properties other than those that are inherited from parent classes.

Property Name | Data Type | Description
AdminACLBin[] | array of uint8 | See AdminACLBin in the Metabase Property Reference.
Name | String | The Name property defines the label by which the object is known. When subclassed, the Name property can be overridden to be a Key property.
ServerConfigFlags | SINT32 | See ServerConfigFlags in the Metabase Property Reference.
CustomErrorDescriptions[] | array of CustomErrorDescription | See CustomErrorDescriptions in the Metabase Property Reference.
AdminServer | String | See AdminServer in the Metabase Property Reference.
LogModuleList | String | See LogModuleList in the Metabase Property Reference.
ServerConfigSSL40 | Boolean | See ServerConfigFlags in the Metabase Property Reference.
ServerConfigSSL128 | Boolean | See ServerConfigFlags in the Metabase Property Reference.
ServerConfigSSLAllowEncrypt | Boolean | See ServerConfigFlags in the Metabase Property Reference.
ServerConfigAutoPWSync | Boolean | See ServerConfigFlags in the Metabase Property Reference.
Related Topics
  • For more information about the IIS WMI Provider, see Using the IIS WMI Provider.
  • For detailed examples of scripts that use the properties and methods of the Windows WMI provider to access the IIS WMI provider, see Module 3: Writing Administration Scripts that Use WMI of the IIS WMI Provider Tutorial.
  • For basic examples in VBScript, JScript, and Perl, see Code Examples to Configure Metabase Properties.
  • Your installation of IIS 6.0 includes command-line administration scripts that manage IIS. See Using Command-Line Administration Scripts.


IIsWebServerSetting (WMI)

This class corresponds to the IIsWebServer IIS Admin object, and contains the read-write properties for the object.

Parent Class

IIsSetting (WMI)

Properties

The table below lists properties other than those that are inherited from parent classes.

Property Name | Data Type | Description
AzEnable | Boolean | See AzEnable in the Metabase Property Reference.
AzImpersonationLevel | SINT32 | See AzImpersonationLevel in the Metabase Property Reference.
AzStoreName | String | See AzStoreName in the Metabase Property Reference.
AzScopeName | String | See AzScopeName in the Metabase Property Reference.
AspCalcLineNumber | Boolean | See AspCalcLineNumber in the Metabase Property Reference.
AspMaxRequestEntityAllowed | SINT32 | See AspMaxRequestEntityAllowed in the Metabase Property Reference.
MaxRequestEntityAllowed | SINT32 | See MaxRequestEntityAllowed in the Metabase Property Reference.
ContentIndexed | Boolean | See ContentIndexed in the Metabase Property Reference.
ServerComment | String | See ServerComment in the Metabase Property Reference.
MaxBandwidth | SINT32 | See MaxBandwidth in the Metabase Property Reference.
ServerAutoStart | Boolean | See ServerAutoStart in the Metabase Property Reference.
ServerSize | SINT32 | See ServerSize in the Metabase Property Reference.
DisableSocketPooling | Boolean | See DisableSocketPooling in the Metabase Property Reference.
ServerListenBacklog | SINT32 | See ServerListenBacklog in the Metabase Property Reference.
ServerListenTimeout | SINT32 | See ServerListenTimeout in the Metabase Property Reference.
ServerBindings[] | array of ServerBinding | See ServerBindings in the Metabase Property Reference.
SecureBindings[] | array of SecureBinding | See SecureBindings in the Metabase Property Reference.
MaxConnections | SINT32 | See MaxConnections in the Metabase Property Reference.
ConnectionTimeout | SINT32 | See ConnectionTimeout in the Metabase Property Reference.
AllowKeepAlive | Boolean | See AllowKeepAlive in the Metabase Property Reference.
CGITimeout | SINT32 | See CGITimeout in the Metabase Property Reference.
MaxEndpointConnections | SINT32 | See MaxEndpointConnections in the Metabase Property Reference.
UseDigestSSP | Boolean | See UseDigestSSP in the Metabase Property Reference.
CacheISAPI | Boolean | See CacheISAPI in the Metabase Property Reference.
MimeMap[] | array of MimeMap | See MimeMap in the Metabase Property Reference.
AnonymousUserName | String | See AnonymousUserName in the Metabase Property Reference.
AnonymousUserPass | String | See AnonymousUserPass in the Metabase Property Reference.
FrontPageWeb | Boolean | See FrontPageWeb in the Metabase Property Reference.
AnonymousPasswordSync | Boolean | See AnonymousPasswordSync in the Metabase Property Reference.
DefaultLogonDomain | String | See DefaultLogonDomain in the Metabase Property Reference.
AdminACLBin[] | array of uint8 | See AdminACLBin in the Metabase Property Reference.
DontLog | Boolean | See DontLog in the Metabase Property Reference.
Realm | String | See Realm in the Metabase Property Reference.
DefaultDoc | String | See DefaultDoc in the Metabase Property Reference.
HttpExpires | String | See HttpExpires in the Metabase Property Reference.
HttpPics[] | array of String | See HttpPics in the Metabase Property Reference.
HttpCustomHeaders[] | array of HttpCustomHeader | See HttpCustomHeaders in the Metabase Property Reference.
HttpErrors[] | array of HttpError | See HttpErrors in the Metabase Property Reference.
EnableDocFooter | Boolean | See EnableDocFooter in the Metabase Property Reference.
DefaultDocFooter | String | See DefaultDocFooter in the Metabase Property Reference.
LogonMethod | SINT32 | See LogonMethod in the Metabase Property Reference.
NTAuthenticationProviders | String | See NTAuthenticationProviders in the Metabase Property Reference.
CertCheckMode | SINT32 | See CertCheckMode in the Metabase Property Reference.
AspBufferingOn | Boolean | See AspBufferingOn in the Metabase Property Reference.
AspLogErrorRequests | Boolean | See AspLogErrorRequests in the Metabase Property Reference.
AspScriptErrorSentToBrowser | Boolean | See AspScriptErrorSentToBrowser in the Metabase Property Reference.
AspScriptErrorMessage | String | See AspScriptErrorMessage in the Metabase Property Reference.
AspAllowOutOfProcComponents | Boolean | See AspAllowOutOfProcComponents in the Metabase Property Reference.
AspScriptFileCacheSize | SINT32 | See AspScriptFileCacheSize in the Metabase Property Reference.
AspDiskTemplateCacheDirectory | String | See AspDiskTemplateCacheDirectory in the Metabase Property Reference.
AspMaxDiskTemplateCacheFiles | SINT32 | See AspMaxDiskTemplateCacheFiles in the Metabase Property Reference.
AspScriptEngineCacheMax | SINT32 | See AspScriptEngineCacheMax in the Metabase Property Reference.
AspScriptTimeout | SINT32 | See AspScriptTimeout in the Metabase Property Reference.
AspEnableParentPaths | Boolean | See AspEnableParentPaths in the Metabase Property Reference.
AspAllowSessionState | Boolean | See AspAllowSessionState in the Metabase Property Reference.
AspScriptLanguage | String | See AspScriptLanguage in the Metabase Property Reference.
AspExceptionCatchEnable | Boolean | See AspExceptionCatchEnable in the Metabase Property Reference.
AspCodepage | SINT32 | See AspCodepage in the Metabase Property Reference.
AspLCID | SINT32 | See AspLCID in the Metabase Property Reference.
AspSessionTimeout | SINT32 | See AspSessionTimeout in the Metabase Property Reference.
AspQueueTimeout | SINT32 | See AspQueueTimeout in the Metabase Property Reference.
AspEnableAspHtmlFallback | Boolean | See AspEnableAspHtmlFallback in the Metabase Property Reference.
AspEnableChunkedEncoding | Boolean | See AspEnableChunkedEncoding in the Metabase Property Reference.
AspEnableTypelibCache | Boolean | See AspEnableTypelibCache in the Metabase Property Reference.
AspErrorsToNTLog | Boolean | See AspErrorsToNTLog in the Metabase Property Reference.
AspProcessorThreadMax | SINT32 | See AspProcessorThreadMax in the Metabase Property Reference.
AspTrackThreadingModel | Boolean | See AspTrackThreadingModel in the Metabase Property Reference.
AspRequestQueueMax | SINT32 | See AspRequestQueueMax in the Metabase Property Reference.
AspEnableApplicationRestart | Boolean | See AspEnableApplicationRestart in the Metabase Property Reference.
AspQueueConnectionTestTime | SINT32 | See AspQueueConnectionTestTime in the Metabase Property Reference.
AspSessionMax | SINT32 | See AspSessionMax in the Metabase Property Reference.
AppFriendlyName | String | See AppFriendlyName in the Metabase Property Reference.
AppOopRecoverLimit | SINT32 | See AppOopRecoverLimit in the Metabase Property Reference.
AppAllowDebugging | Boolean | See AppAllowDebugging in the Metabase Property Reference.
AppAllowClientDebug | Boolean | See AppAllowClientDebug in the Metabase Property Reference.
ClusterEnabled | Boolean | See ClusterEnabled in the Metabase Property Reference.
CacheControlMaxAge | SINT32 | See CacheControlMaxAge in the Metabase Property Reference.
CacheControlNoCache | Boolean | See CacheControlNoCache in the Metabase Property Reference.
CacheControlCustom | String | See CacheControlCustom in the Metabase Property Reference.
CreateProcessAsUser | Boolean | See CreateProcessAsUser in the Metabase Property Reference.
PoolIdcTimeout | SINT32 | See PoolIdcTimeout in the Metabase Property Reference.
RedirectHeaders | String | See RedirectHeaders in the Metabase Property Reference.
UploadReadAheadSize | SINT32 | See UploadReadAheadSize in the Metabase Property Reference.
PasswordExpirePrenotifyDays | SINT32 | See PasswordExpirePrenotifyDays in the Metabase Property Reference.
PasswordCacheTTL | SINT32 | See PasswordCacheTTL in the Metabase Property Reference.
PasswordChangeFlags | SINT32 | See PasswordChangeFlags in the Metabase Property Reference.
MaxBandwidthBlocked | SINT32 | See MaxBandwidthBlocked in the Metabase Property Reference.
AppWamClsid | String | See AppWamClsid in the Metabase Property Reference.
DirBrowseFlags | SINT32 | See DirBrowseFlags in the Metabase Property Reference.
AuthFlags | SINT32 | See AuthFlags in the Metabase Property Reference.
AuthPersistence | SINT32 | See AuthPersistence in the Metabase Property Reference.
AccessFlags | SINT32 | See AccessFlags in the Metabase Property Reference.
AccessSSLFlags | SINT32 | See AccessSSLFlags in the Metabase Property Reference.
ScriptMaps[] | array of ScriptMap | See ScriptMaps in the Metabase Property Reference.
SSIExecDisable | Boolean | See SSIExecDisable in the Metabase Property Reference.
EnableReverseDns | Boolean | See EnableReverseDns in the Metabase Property Reference.
CreateCGIWithNewConsole | Boolean | See CreateCGIWithNewConsole in the Metabase Property Reference.
LogType | SINT32 | See LogType in the Metabase Property Reference.
LogPluginClsid | String | See LogPluginClsid in the Metabase Property Reference.
LogFileDirectory | String | See LogFileDirectory in the Metabase Property Reference.
LogFilePeriod | SINT32 | See LogFilePeriod in the Metabase Property Reference.
LogFileLocaltimeRollover | Boolean | See LogFileLocaltimeRollover in the Metabase Property Reference.
LogFileTruncateSize | SINT32 | See LogFileTruncateSize in the Metabase Property Reference.
LogExtFileFlags | SINT32 | See LogExtFileFlags in the Metabase Property Reference.
LogOdbcDataSource | String | See LogOdbcDataSource in the Metabase Property Reference.
LogOdbcTableName | String | See LogOdbcTableName in the Metabase Property Reference.
LogOdbcUserName | String | See LogOdbcUserName in the Metabase Property Reference.
LogOdbcPassword | String | See LogOdbcPassword in the Metabase Property Reference.
CPUResetInterval | SINT32 | See CPUResetInterval in the Metabase Property Reference.
NotDeletable | Boolean | See NotDeletable in the Metabase Property Reference.
ShutdownTimeLimit | SINT32 | See ShutdownTimeLimit in the Metabase Property Reference.
SSLStoreName | String | See SSLStoreName in the Metabase Property Reference.
ProcessNTCRIfLoggedOn | Boolean | See ProcessNTCRIfLoggedOn in the Metabase Property Reference.
AllowPathInfoForScriptMappings | Boolean | See AllowPathInfoForScriptMappings in the Metabase Property Reference.
ServerCommand | SINT32 | See ServerCommand in the Metabase Property Reference.
Win32Error | SINT32 | See Win32Error in the Metabase Property Reference.
AppPoolId | String | See AppPoolId in the Metabase Property Reference.
DoStaticCompression | Boolean | See DoStaticCompression in the Metabase Property Reference.
DoDynamicCompression | Boolean | See DoDynamicCompression in the Metabase Property Reference.
AspPartitionID | String | See AspPartitionID in the Metabase Property Reference.
AspSxsName | String | See AspSxsName in the Metabase Property Reference.
AspAppServiceFlags | SINT32 | See AspAppServiceFlags in the Metabase Property Reference.
AspKeepSessionIDSecure | SINT32 | See AspKeepSessionIDSecure in the Metabase Property Reference.
RevocationFreshnessTime | SINT32 | See RevocationFreshnessTime in the Metabase Property Reference.
RevocationURLRetrievalTimeout | SINT32 | See RevocationURLRetrievalTimeout in the Metabase Property Reference.
AspExecuteInMTA | SINT32 | See AspExecuteInMTA in the Metabase Property Reference.
AspRunOnEndAnonymously | Boolean | See AspRunOnEndAnonymously in the Metabase Property Reference.
AspBufferingLimit | SINT32 | See AspBufferingLimit in the Metabase Property Reference.
AuthChangeUnsecure | Boolean | See PasswordChangeFlags in the Metabase Property Reference.
AuthChangeDisable | Boolean | See PasswordChangeFlags in the Metabase Property Reference.
AuthAdvNotifyDisable | Boolean | See PasswordChangeFlags in the Metabase Property Reference.
DirBrowseShowDate | Boolean | See DirBrowseFlags in the Metabase Property Reference.
DirBrowseShowTime | Boolean | See DirBrowseFlags in the Metabase Property Reference.
DirBrowseShowSize | Boolean | See DirBrowseFlags in the Metabase Property Reference.
DirBrowseShowExtension | Boolean | See DirBrowseFlags in the Metabase Property Reference.
DirBrowseShowLongDate | Boolean | See DirBrowseFlags in the Metabase Property Reference.
EnableDefaultDoc | Boolean | See DirBrowseFlags in the Metabase Property Reference.
EnableDirBrowsing | Boolean | See DirBrowseFlags in the Metabase Property Reference.
AuthAnonymous | Boolean | See AuthFlags in the Metabase Property Reference.
AuthBasic | Boolean | See AuthFlags in the Metabase Property Reference.
AuthNTLM | Boolean | See AuthFlags in the Metabase Property Reference.
AuthMD5 | Boolean | See AuthFlags in the Metabase Property Reference.
AuthPassport | Boolean | See AuthFlags in the Metabase Property Reference.
AuthPersistSingleRequest | Boolean | See AuthPersistence in the Metabase Property Reference.
AccessRead | Boolean | See AccessFlags in the Metabase Property Reference.
AccessWrite | Boolean | See AccessFlags in the Metabase Property Reference.
AccessExecute | Boolean | See AccessFlags in the Metabase Property Reference.
AccessSource | Boolean | See AccessFlags in the Metabase Property Reference.
AccessScript | Boolean | See AccessFlags in the Metabase Property Reference.
AccessNoRemoteExecute | Boolean | See AccessFlags in the Metabase Property Reference.
AccessNoRemoteWrite | Boolean | See AccessFlags in the Metabase Property Reference.
AccessNoRemoteRead | Boolean | See AccessFlags in the Metabase Property Reference.
AccessNoRemoteScript | Boolean | See AccessFlags in the Metabase Property Reference.
AccessSSL | Boolean | See AccessSSLFlags in the Metabase Property Reference.
AccessSSLNegotiateCert | Boolean | See AccessSSLFlags in the Metabase Property Reference.
AccessSSLRequireCert | Boolean | See AccessSSLFlags in the Metabase Property Reference.
AccessSSLMapCert | Boolean | See AccessSSLFlags in the Metabase Property Reference.
AccessSSL128 | Boolean | See AccessSSLFlags in the Metabase Property Reference.
LogExtFileDate | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileTime | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileClientIp | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileUserName | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileSiteName | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileComputerName | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileServerIp | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileMethod | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileUriStem | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileUriQuery | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileHttpStatus | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileWin32Status | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileBytesSent | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileBytesRecv | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileTimeTaken | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileServerPort | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileUserAgent | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileCookie | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileReferer | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileProtocolVersion | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileHost | Boolean | See LogExtFileFlags in the Metabase Property Reference.
AspEnableTracker | Boolean | See AspAppServiceFlags in the Metabase Property Reference.
AspEnableSxs | Boolean | See AspAppServiceFlags in the Metabase Property Reference.
AspUsePartition | Boolean | See AspAppServiceFlags in the Metabase Property Reference.
Name | String | The Name property defines the label by which the object is known. When subclassed, the Name property can be overridden to be a Key property.
Related Topics
  • For more information about the IIS WMI Provider, see Using the IIS WMI Provider.
  • For detailed examples of scripts that use the properties and methods of the Windows WMI provider to access the IIS WMI provider, see Module 3: Writing Administration Scripts that Use WMI of the IIS WMI Provider Tutorial.
  • For basic examples in VBScript, JScript, and Perl, see Code Examples to Configure Metabase Properties.
  • Your installation of IIS 6.0 includes command-line administration scripts that manage IIS. See Using Command-Line Administration Scripts.


IIsWebServiceSetting (WMI)

This class corresponds to the IIsWebService IIS Admin object, and contains the read-write properties for the object.

Parent Class

IIsSetting (WMI)

Properties

The table below lists properties other than those that are inherited from parent classes:

Property Name | Data Type | Description
AzEnable | Boolean | See AzEnable in the Metabase Property Reference.
AzImpersonationLevel | SINT32 | See AzImpersonationLevel in the Metabase Property Reference.
AzStoreName | String | See AzStoreName in the Metabase Property Reference.
AzScopeName | String | See AzScopeName in the Metabase Property Reference.
AspCalcLineNumber | Boolean | See AspCalcLineNumber in the Metabase Property Reference.
ApplicationDependencies[] | array of ApplicationDependency | See ApplicationDependencies in the Metabase Property Reference.
WebSvcExtRestrictionList[] | array of WebSvcExtRestrictionList | See WebSvcExtRestrictionList in the Metabase Property Reference.
AspMaxRequestEntityAllowed | SINT32 | See AspMaxRequestEntityAllowed in the Metabase Property Reference.
MaxRequestEntityAllowed | SINT32 | See MaxRequestEntityAllowed in the Metabase Property Reference.
DemandStartThreshold | SINT32 | See DemandStartThreshold in the Metabase Property Reference.
Name | String | The Name property defines the label by which the object is known. When subclassed, the Name property can be overridden to be a Key property.
MaxBandwidth | SINT32 | See MaxBandwidth in the Metabase Property Reference.
MaxConnections | SINT32 | See MaxConnections in the Metabase Property Reference.
MimeMap[] | array of MimeMap | See MimeMap in the Metabase Property Reference.
AnonymousUserName | String | See AnonymousUserName in the Metabase Property Reference.
AnonymousUserPass | String | See AnonymousUserPass in the Metabase Property Reference.
UseDigestSSP | Boolean | See UseDigestSSP in the Metabase Property Reference.
ServerListenBacklog | SINT32 | See ServerListenBacklog in the Metabase Property Reference.
ServerComment | String | See ServerComment in the Metabase Property Reference.
ServerBindings[] | array of ServerBinding | See ServerBindings in the Metabase Property Reference.
ConnectionTimeout | SINT32 | See ConnectionTimeout in the Metabase Property Reference.
ServerListenTimeout | SINT32 | See ServerListenTimeout in the Metabase Property Reference.
MaxEndpointConnections | SINT32 | See MaxEndpointConnections in the Metabase Property Reference.
ServerAutoStart | Boolean | See ServerAutoStart in the Metabase Property Reference.
AllowKeepAlive | Boolean | See AllowKeepAlive in the Metabase Property Reference.
ServerSize | SINT32 | See ServerSize in the Metabase Property Reference.
DisableSocketPooling | Boolean | See DisableSocketPooling in the Metabase Property Reference.
AnonymousPasswordSync | Boolean | See AnonymousPasswordSync in the Metabase Property Reference.
DefaultLogonDomain | String | See DefaultLogonDomain in the Metabase Property Reference.
AdminACLBin[] | array of uint8 | See AdminACLBin in the Metabase Property Reference.
DontLog | Boolean | See DontLog in the Metabase Property Reference.
Realm | String | See Realm in the Metabase Property Reference.
DefaultDoc | String | See DefaultDoc in the Metabase Property Reference.
HttpExpires | String | See HttpExpires in the Metabase Property Reference.
HttpPics[] | array of String | See HttpPics in the Metabase Property Reference.
HttpCustomHeaders[] | array of HttpCustomHeader | See HttpCustomHeaders in the Metabase Property Reference.
HttpErrors[] | array of HttpError | See HttpErrors in the Metabase Property Reference.
EnableDocFooter | Boolean | See EnableDocFooter in the Metabase Property Reference.
DefaultDocFooter | String | See DefaultDocFooter in the Metabase Property Reference.
LogonMethod | SINT32 | See LogonMethod in the Metabase Property Reference.
CacheISAPI | Boolean | See CacheISAPI in the Metabase Property Reference.
CGITimeout | SINT32 | See CGITimeout in the Metabase Property Reference.
DirectoryLevelsToScan | SINT32 | See DirectoryLevelsToScan in the Metabase Property Reference.
ContentIndexed | Boolean | See ContentIndexed in the Metabase Property Reference.
NTAuthenticationProviders | String | See NTAuthenticationProviders in the Metabase Property Reference.
CertCheckMode | SINT32 | See CertCheckMode in the Metabase Property Reference.
DownlevelAdminInstance | SINT32 | See DownlevelAdminInstance in the Metabase Property Reference.
AspBufferingOn | Boolean | See AspBufferingOn in the Metabase Property Reference.
AspLogErrorRequests | Boolean | See AspLogErrorRequests in the Metabase Property Reference.
AspScriptErrorSentToBrowser | Boolean | See AspScriptErrorSentToBrowser in the Metabase Property Reference.
AspScriptErrorMessage | String | See AspScriptErrorMessage in the Metabase Property Reference.
AspAllowOutOfProcComponents | Boolean | See AspAllowOutOfProcComponents in the Metabase Property Reference.
AspScriptFileCacheSize | SINT32 | See AspScriptFileCacheSize in the Metabase Property Reference.
AspDiskTemplateCacheDirectory | String | See AspDiskTemplateCacheDirectory in the Metabase Property Reference.
AspMaxDiskTemplateCacheFiles | SINT32 | See AspMaxDiskTemplateCacheFiles in the Metabase Property Reference.
AspScriptEngineCacheMax | SINT32 | See AspScriptEngineCacheMax in the Metabase Property Reference.
AspScriptTimeout | SINT32 | See AspScriptTimeout in the Metabase Property Reference.
AspSessionTimeout | SINT32 | See AspSessionTimeout in the Metabase Property Reference.
AspEnableParentPaths | Boolean | See AspEnableParentPaths in the Metabase Property Reference.
AspAllowSessionState | Boolean | See AspAllowSessionState in the Metabase Property Reference.
AspScriptLanguage | String | See AspScriptLanguage in the Metabase Property Reference.
AspExceptionCatchEnable | Boolean | See AspExceptionCatchEnable in the Metabase Property Reference.
AspCodepage | SINT32 | See AspCodepage in the Metabase Property Reference.
AspLCID | SINT32 | See AspLCID in the Metabase Property Reference.
AspQueueTimeout | SINT32 | See AspQueueTimeout in the Metabase Property Reference.
AspEnableAspHtmlFallback | Boolean | See AspEnableAspHtmlFallback in the Metabase Property Reference.
AspEnableChunkedEncoding | Boolean | See AspEnableChunkedEncoding in the Metabase Property Reference.
AspEnableTypelibCache | Boolean | See AspEnableTypelibCache in the Metabase Property Reference.
AspErrorsToNTLog | Boolean | See AspErrorsToNTLog in the Metabase Property Reference.
AspProcessorThreadMax | SINT32 | See AspProcessorThreadMax in the Metabase Property Reference.
AspTrackThreadingModel | Boolean | See AspTrackThreadingModel in the Metabase Property Reference.
AspRequestQueueMax | SINT32 | See AspRequestQueueMax in the Metabase Property Reference.
AspEnableApplicationRestart | Boolean | See AspEnableApplicationRestart in the Metabase Property Reference.
AspQueueConnectionTestTime | SINT32 | See AspQueueConnectionTestTime in the Metabase Property Reference.
AspSessionMax | SINT32 | See AspSessionMax in the Metabase Property Reference.
AppFriendlyName | String | See AppFriendlyName in the Metabase Property Reference.
AppAllowDebugging | Boolean | See AppAllowDebugging in the Metabase Property Reference.
AppAllowClientDebug | Boolean | See AppAllowClientDebug in the Metabase Property Reference.
CacheControlMaxAge | SINT32 | See CacheControlMaxAge in the Metabase Property Reference.
CacheControlNoCache | Boolean | See CacheControlNoCache in the Metabase Property Reference.
CacheControlCustom | String | See CacheControlCustom in the Metabase Property Reference.
CreateProcessAsUser | Boolean | See CreateProcessAsUser in the Metabase Property Reference.
PoolIdcTimeout | SINT32 | See PoolIdcTimeout in the Metabase Property Reference.
RedirectHeaders | String | See RedirectHeaders in the Metabase Property Reference.
UploadReadAheadSize | SINT32 | See UploadReadAheadSize in the Metabase Property Reference.
PasswordExpirePrenotifyDays | SINT32 | See PasswordExpirePrenotifyDays in the Metabase Property Reference.
PasswordCacheTTL | SINT32 | See PasswordCacheTTL in the Metabase Property Reference.
PasswordChangeFlags | SINT32 | See PasswordChangeFlags in the Metabase Property Reference.
AppWamClsid | String | See AppWamClsid in the Metabase Property Reference.
DirBrowseFlags | SINT32 | See DirBrowseFlags in the Metabase Property Reference.
AuthFlags | SINT32 | See AuthFlags in the Metabase Property Reference.
AuthPersistence | SINT32 | See AuthPersistence in the Metabase Property Reference.
AccessFlags | SINT32 | See AccessFlags in the Metabase Property Reference.
AccessSSLFlags | SINT32 | See AccessSSLFlags in the Metabase Property Reference.
ScriptMaps[] | array of ScriptMap | See ScriptMaps in the Metabase Property Reference.
SSIExecDisable | Boolean | See SSIExecDisable in the Metabase Property Reference.
EnableReverseDns | Boolean | See EnableReverseDns in the Metabase Property Reference.
CreateCGIWithNewConsole | Boolean | See CreateCGIWithNewConsole in the Metabase Property Reference.
ProcessNTCRIfLoggedOn | Boolean | See ProcessNTCRIfLoggedOn in the Metabase Property Reference.
AllowPathInfoForScriptMappings | Boolean | See AllowPathInfoForScriptMappings in the Metabase Property Reference.
InProcessIsapiApps[] | array of String | See InProcessIsapiApps in the Metabase Property Reference.
LogType | SINT32 | See LogType in the Metabase Property Reference.
LogFilePeriod | SINT32 | See LogFilePeriod in the Metabase Property Reference.
LogFileLocaltimeRollover | Boolean | See LogFileLocaltimeRollover in the Metabase Property Reference.
LogPluginClsid | String | See LogPluginClsid in the Metabase Property Reference.
LogModuleList | String | See LogModuleList in the Metabase Property Reference.
LogFileDirectory | String | See LogFileDirectory in the Metabase Property Reference.
LogFileTruncateSize | SINT32 | See LogFileTruncateSize in the Metabase Property Reference.
LogExtFileFlags | SINT32 | See LogExtFileFlags in the Metabase Property Reference.
LogOdbcDataSource | String | See LogOdbcDataSource in the Metabase Property Reference.
LogOdbcTableName | String | See LogOdbcTableName in the Metabase Property Reference.
LogOdbcUserName | String | See LogOdbcUserName in the Metabase Property Reference.
LogOdbcPassword | String | See LogOdbcPassword in the Metabase Property Reference.
CPUResetInterval | SINT32 | See CPUResetInterval in the Metabase Property Reference.
SslUseDsMapper | Boolean | See SslUseDsMapper in the Metabase Property Reference.
WAMUserName | String | See WAMUserName in the Metabase Property Reference.
WAMUserPass | String | See WAMUserPass in the Metabase Property Reference.
ShutdownTimeLimit | SINT32 | See ShutdownTimeLimit in the Metabase Property Reference.
SSLStoreName | String | See SSLStoreName in the Metabase Property Reference.
AdminServer | String | See AdminServer in the Metabase Property Reference.
AppPoolId | String | See AppPoolId in the Metabase Property Reference.
DoStaticCompression | Boolean | See DoStaticCompression in the Metabase Property Reference.
DoDynamicCompression | Boolean | See DoDynamicCompression in the Metabase Property Reference.
IIs5IsolationModeEnabled | Boolean | See IIs5IsolationModeEnabled in the Metabase Property Reference.
MaxGlobalBandwidth | SINT32 | See MaxGlobalBandwidth in the Metabase Property Reference.
HeaderWaitTimeout | SINT32 | See HeaderWaitTimeout in the Metabase Property Reference.
RapidFailProtectionInterval | SINT32 | See RapidFailProtectionInterval in the Metabase Property Reference.
RapidFailProtectionMaxCrashes | SINT32 | See RapidFailProtectionMaxCrashes in the Metabase Property Reference.
AspPartitionID | String | See AspPartitionID in the Metabase Property Reference.
AspSxsName | String | See AspSxsName in the Metabase Property Reference.
AspAppServiceFlags | SINT32 | See AspAppServiceFlags in the Metabase Property Reference.
AspKeepSessionIDSecure | SINT32 | See AspKeepSessionIDSecure in the Metabase Property Reference.
RevocationFreshnessTime | SINT32 | See RevocationFreshnessTime in the Metabase Property Reference.
RevocationURLRetrievalTimeout | SINT32 | See RevocationURLRetrievalTimeout in the Metabase Property Reference.
SecuritySetupRequired | Boolean | See SecuritySetupRequired in the Metabase Property Reference.
AspExecuteInMTA | SINT32 | See AspExecuteInMTA in the Metabase Property Reference.
CentralbinaryLoggingEnabled | Boolean | See CentralBinaryLoggingEnabled in the Metabase Property Reference.
AspRunOnEndAnonymously | Boolean | See AspRunOnEndAnonymously in the Metabase Property Reference.
AspBufferingLimit | SINT32 | See AspBufferingLimit in the Metabase Property Reference.
AuthChangeUnsecure | Boolean | See PasswordChangeFlags in the Metabase Property Reference.
AuthChangeDisable | Boolean | See PasswordChangeFlags in the Metabase Property Reference.
AuthAdvNotifyDisable | Boolean | See PasswordChangeFlags in the Metabase Property Reference.
DirBrowseShowDate | Boolean | See DirBrowseFlags in the Metabase Property Reference.
DirBrowseShowTime | Boolean | See DirBrowseFlags in the Metabase Property Reference.
DirBrowseShowSize | Boolean | See DirBrowseFlags in the Metabase Property Reference.
DirBrowseShowExtension | Boolean | See DirBrowseFlags in the Metabase Property Reference.
DirBrowseShowLongDate | Boolean | See DirBrowseFlags in the Metabase Property Reference.
EnableDefaultDoc | Boolean | See DirBrowseFlags in the Metabase Property Reference.
EnableDirBrowsing | Boolean | See DirBrowseFlags in the Metabase Property Reference.
AuthAnonymous | Boolean | See AuthFlags in the Metabase Property Reference.
AuthBasic | Boolean | See AuthFlags in the Metabase Property Reference.
AuthNTLM | Boolean | See AuthFlags in the Metabase Property Reference.
AuthMD5 | Boolean | See AuthFlags in the Metabase Property Reference.
AuthPassport | Boolean | See AuthFlags in the Metabase Property Reference.
AuthPersistSingleRequest | Boolean | See AuthPersistence in the Metabase Property Reference.
AccessRead | Boolean | See AccessFlags in the Metabase Property Reference.
AccessWrite | Boolean | See AccessFlags in the Metabase Property Reference.
AccessExecute | Boolean | See AccessFlags in the Metabase Property Reference.
AccessSource | Boolean | See AccessFlags in the Metabase Property Reference.
AccessScript | Boolean | See AccessFlags in the Metabase Property Reference.
AccessNoRemoteExecute | Boolean | See AccessFlags in the Metabase Property Reference.
AccessNoRemoteWrite | Boolean | See AccessFlags in the Metabase Property Reference.
AccessNoRemoteRead | Boolean | See AccessFlags in the Metabase Property Reference.
AccessNoRemoteScript | Boolean | See AccessFlags in the Metabase Property Reference.
AccessSSL | Boolean | See AccessSSLFlags in the Metabase Property Reference.
AccessSSLNegotiateCert | Boolean | See AccessSSLFlags in the Metabase Property Reference.
AccessSSLRequireCert | Boolean | See AccessSSLFlags in the Metabase Property Reference.
AccessSSLMapCert | Boolean | See AccessSSLFlags in the Metabase Property Reference.
AccessSSL128 | Boolean | See AccessSSLFlags in the Metabase Property Reference.
LogExtFileDate | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileTime | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileClientIp | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileUserName | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileSiteName | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileComputerName | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileServerIp | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileMethod | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileUriStem | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileUriQuery | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileHttpStatus | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileWin32Status | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileBytesSent | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileBytesRecv | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileTimeTaken | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileServerPort | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileUserAgent | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileCookie | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileReferer | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileProtocolVersion | Boolean | See LogExtFileFlags in the Metabase Property Reference.
LogExtFileHost | Boolean | See LogExtFileFlags in the Metabase Property Reference.
AspEnableTracker | Boolean | See AspAppServiceFlags in the Metabase Property Reference.
AspEnableSxs | Boolean | See AspAppServiceFlags in the Metabase Property Reference.
AspUsePartition | Boolean | See AspAppServiceFlags in the Metabase Property Reference.
Related Topics
  • For more information about the IIS WMI Provider, see Using the IIS WMI Provider.
  • For detailed examples of scripts that use the properties and methods of the Windows WMI provider to access the IIS WMI provider, see Module 3: Writing Administration Scripts that Use WMI of the IIS WMI Provider Tutorial.
  • For basic examples in VBScript, JScript, and Perl, see Code Examples to Configure Metabase Properties.
  • Your installation of IIS 6.0 includes command-line administration scripts that manage IIS. See Using Command-Line Administration Scripts.


IIsWebVirtualDirSetting (WMI)

This class corresponds to the IIsWebVirtualDir IIS Admin object, and contains the read-write properties for the object.

Parent Class

IIsSetting (WMI)

Properties

The table below lists properties other than those that are inherited from parent classes.

Property Name | Data Type | Description
AzEnable | Boolean | See AzEnable in the Metabase Property Reference.
AzImpersonationLevel | SINT32 | See AzImpersonationLevel in the Metabase Property Reference.
AzStoreName | String | See AzStoreName in the Metabase Property Reference.
AzScopeName | String | See AzScopeName in the Metabase Property Reference.
AspCalcLineNumber | Boolean | See Metabase Property Reference in the Metabase Property Reference.
AdminACLBin[] | array of uint8 | See AdminACLBin in the Metabase Property Reference.
AspMaxRequestEntityAllowed | SINT32 | See AspMaxRequestEntityAllowed in the Metabase Property Reference.
MaxRequestEntityAllowed | SINT32 | See MaxRequestEntityAllowed in the Metabase Property Reference.
AnonymousUserName | String | See AnonymousUserName in the Metabase Property Reference.
AnonymousUserPass | String | See AnonymousUserPass in the Metabase Property Reference.
AnonymousPasswordSync | Boolean | See AnonymousPasswordSync in the Metabase Property Reference.
UseDigestSSP | Boolean | See UseDigestSSP in the Metabase Property Reference.
AppFriendlyName | String | See AppFriendlyName in the Metabase Property Reference.
AppOopRecoverLimit | SINT32 | See AppOopRecoverLimit in the Metabase Property Reference.
CacheISAPI | Boolean | See CacheISAPI in the Metabase Property Reference.
AppAllowDebugging | Boolean | See AppAllowDebugging in the Metabase Property Reference.
AppAllowClientDebug | Boolean | See AppAllowClientDebug in the Metabase Property Reference.
DefaultLogonDomain | String | See DefaultLogonDomain in the Metabase Property Reference.
LogonMethod | SINT32 | See LogonMethod in the Metabase Property Reference.
CGITimeout | SINT32 | See CGITimeout in the Metabase Property Reference.
Realm | String | See Realm in the Metabase Property Reference.
DontLog | Boolean | See DontLog in the Metabase Property Reference.
HttpExpires | String | See HttpExpires in the Metabase Property Reference.
HttpPics[] | array of String | See HttpPics in the Metabase Property Reference.
HttpCustomHeaders[] | array of HttpCustomHeader | See HttpCustomHeaders in the Metabase Property Reference.
HttpErrors[] | array of HttpError | See HttpErrors in the Metabase Property Reference.
EnableDocFooter | Boolean | See EnableDocFooter in the Metabase Property Reference.
DefaultDocFooter | String | See DefaultDocFooter in the Metabase Property Reference.
HttpRedirect | String | See HttpRedirect in the Metabase Property Reference.
DefaultDoc | String | See DefaultDoc in the Metabase Property Reference.
ContentIndexed | Boolean | See ContentIndexed in the Metabase Property Reference.
CacheControlMaxAge | SINT32 | See CacheControlMaxAge in the Metabase Property Reference.
CacheControlNoCache | Boolean | See CacheControlNoCache in the Metabase Property Reference.
CacheControlCustom | String | See CacheControlCustom in the Metabase Property Reference.
CreateProcessAsUser | Boolean | See CreateProcessAsUser in the Metabase Property Reference.
PoolIdcTimeout | SINT32 | See PoolIdcTimeout in the Metabase Property Reference.
RedirectHeaders | String | See RedirectHeaders in the Metabase Property Reference.
UploadReadAheadSize | SINT32 | See UploadReadAheadSize in the Metabase Property Reference.
FrontPageWeb | Boolean | See FrontPageWeb in the Metabase Property Reference.
AppWamClsid | String | See AppWamClsid in the Metabase Property Reference.
AuthPersistence | SINT32 | See AuthPersistence in the Metabase Property Reference.
AccessFlags | SINT32 | See AccessFlags in the Metabase Property Reference.
AccessSSLFlags | SINT32 | See AccessSSLFlags in the Metabase Property Reference.
ScriptMaps[] | array of ScriptMap | See ScriptMaps in the Metabase Property Reference.
SSIExecDisable | Boolean | See SSIExecDisable in the Metabase Property Reference.
EnableReverseDns | Boolean | See EnableReverseDns in the Metabase Property Reference.
CreateCGIWithNewConsole | Boolean | See CreateCGIWithNewConsole in the Metabase Property Reference.
AspBufferingOn | Boolean | See AspBufferingOn in the Metabase Property Reference.
AspLogErrorRequests | Boolean | See AspLogErrorRequests in the Metabase Property Reference.
AspScriptErrorSentToBrowser | Boolean | See AspScriptErrorSentToBrowser in the Metabase Property Reference.
AspScriptErrorMessage | String | See AspScriptErrorMessage in the Metabase Property Reference.
AspAllowOutOfProcComponents | Boolean | See AspAllowOutOfProcComponents in the Metabase Property Reference.
AspScriptFileCacheSize | SINT32 | See AspScriptFileCacheSize in the Metabase Property Reference.
AspDiskTemplateCacheDirectory | String | See AspDiskTemplateCacheDirectory in the Metabase Property Reference.
AspMaxDiskTemplateCacheFiles | SINT32 | See AspMaxDiskTemplateCacheFiles in the Metabase Property Reference.
AspScriptEngineCacheMax | SINT32 | See AspScriptEngineCacheMax in the Metabase Property Reference.
AspScriptTimeout | SINT32 | See AspScriptTimeout in the Metabase Property Reference.
AspSessionTimeout | SINT32 | See AspSessionTimeout in the Metabase Property Reference.
AspEnableParentPaths | Boolean | See AspEnableParentPaths in the Metabase Property Reference.
AspAllowSessionState | Boolean | See AspAllowSessionState in the Metabase Property Reference.
AspScriptLanguage | String | See AspScriptLanguage in the Metabase Property Reference.
AspExceptionCatchEnable | Boolean | See AspExceptionCatchEnable in the Metabase Property Reference.
AspCodepage | SINT32 | See AspCodepage in the Metabase Property Reference.
AspLCID | SINT32 | See AspLCID in the Metabase Property Reference.
MimeMap[] | array of MimeMap | See MimeMap in the Metabase Property Reference.
AspQueueTimeout | SINT32 | See AspQueueTimeout in the Metabase Property Reference.
AspEnableAspHtmlFallback | Boolean | See AspEnableAspHtmlFallback in the Metabase Property Reference.
AspEnableChunkedEncoding | Boolean | See AspEnableChunkedEncoding in the Metabase Property Reference.
AspEnableTypelibCache | Boolean | See AspEnableTypelibCache in the Metabase Property Reference.
AspErrorsToNTLog | Boolean | See AspErrorsToNTLog in the Metabase Property Reference.
AspProcessorThreadMax | SINT32 | See AspProcessorThreadMax in the Metabase Property Reference.
AspTrackThreadingModel | Boolean | See AspTrackThreadingModel in the Metabase Property Reference.
AspRequestQueueMax | SINT32 | See AspRequestQueueMax in the Metabase Property Reference.
AspEnableApplicationRestart | Boolean | See AspEnableApplicationRestart in the Metabase Property Reference.
AspQueueConnectionTestTime | SINT32 | See AspQueueConnectionTestTime in the Metabase Property Reference.
AspSessionMax | SINT32 | See AspSessionMax in the Metabase Property Reference.
ShutdownTimeLimit | SINT32 | See ShutdownTimeLimit in the Metabase Property Reference.
DirBrowseFlags | SINT32 | See DirBrowseFlags in the Metabase Property Reference.
AuthFlags | SINT32 | See AuthFlags in the Metabase Property Reference.
AppPoolId | String | See AppPoolId in the Metabase Property Reference.
DoStaticCompression | Boolean | See DoStaticCompression in the Metabase Property Reference.
DoDynamicCompression | Boolean | See DoDynamicCompression in the Metabase Property Reference.
AspPartitionID | String | See AspPartitionID in the Metabase Property Reference.
AspSxsName | String | See AspSxsName in the Metabase Property Reference.
AspAppServiceFlags | SINT32 | See AspAppServiceFlags in the Metabase Property Reference.
AspKeepSessionIDSecure | SINT32 | See AspKeepSessionIDSecure in the Metabase Property Reference.
AspExecuteInMTA | SINT32 | See AspExecuteInMTA in the Metabase Property Reference.
AspRunOnEndAnonymously | Boolean | See AspRunOnEndAnonymously in the Metabase Property Reference.
AspBufferingLimit | SINT32 | See AspBufferingLimit in the Metabase Property Reference.
AuthPersistSingleRequest | Boolean | See AuthPersistence in the Metabase Property Reference.
AccessRead | Boolean | See AccessFlags in the Metabase Property Reference.
AccessWrite | Boolean | See AccessFlags in the Metabase Property Reference.
AccessExecute | Boolean | See AccessFlags in the Metabase Property Reference.
AccessSource | Boolean | See AccessFlags in the Metabase Property Reference.
AccessScript | Boolean | See AccessFlags in the Metabase Property Reference.
AccessNoRemoteExecute | Boolean | See AccessFlags in the Metabase Property Reference.
AccessNoRemoteWrite | Boolean | See AccessFlags in the Metabase Property Reference.
AccessNoRemoteRead | Boolean | See AccessFlags in the Metabase Property Reference.
AccessNoRemoteScript | Boolean | See AccessFlags in the Metabase Property Reference.
AccessSSL | Boolean | See AccessSSLFlags in the Metabase Property Reference.
AccessSSLNegotiateCert | Boolean | See AccessSSLFlags in the Metabase Property Reference.
AccessSSLRequireCert | Boolean | See AccessSSLFlags in the Metabase Property Reference.
AccessSSLMapCert | Boolean | See AccessSSLFlags in the Metabase Property Reference.
AccessSSL128 | Boolean | See AccessSSLFlags in the Metabase Property Reference.
DirBrowseShowDate | Boolean | See DirBrowseFlags in the Metabase Property Reference.
DirBrowseShowTime | Boolean | See DirBrowseFlags in the Metabase Property Reference.
DirBrowseShowSize | Boolean | See DirBrowseFlags in the Metabase Property Reference.
DirBrowseShowExtension | Boolean | See DirBrowseFlags in the Metabase Property Reference.
DirBrowseShowLongDate | Boolean | See DirBrowseFlags in the Metabase Property Reference.
EnableDefaultDoc | Boolean | See DirBrowseFlags in the Metabase Property Reference.
EnableDirBrowsing | Boolean | See DirBrowseFlags in the Metabase Property Reference.
AuthAnonymous | Boolean | See AuthFlags in the Metabase Property Reference.
AuthBasic | Boolean | See AuthFlags in the Metabase Property Reference.
AuthNTLM | Boolean | See AuthFlags in the Metabase Property Reference.
AuthMD5 | Boolean | See AuthFlags in the Metabase Property Reference.
AuthPassport | Boolean | See AuthFlags in the Metabase Property Reference.
AspEnableTracker | Boolean | See AspAppServiceFlags in the Metabase Property Reference.
AspEnableSxs | Boolean | See AspAppServiceFlags in the Metabase Property Reference.
AspUsePartition | Boolean | See AspAppServiceFlags in the Metabase Property Reference.
Name | String | The Name property defines the label by which the object is known. When subclassed, the Name property can be overridden to be a Key property.
Related Topics
  • For more information about the IIS WMI Provider, see Using the IIS WMI Provider.
  • For detailed examples of scripts that use the properties and methods of the Windows WMI provider to access the IIS WMI provider, see Module 3: Writing Administration Scripts that Use WMI of the IIS WMI Provider Tutorial.
  • For basic examples in VBScript, JScript, and Perl, see Code Examples to Configure Metabase Properties.
  • Your installation of IIS 6.0 includes command-line administration scripts that manage IIS. See Using Command-Line Administration Scripts.


IIsStructuredDataClass (WMI)

This is a unique class that contains elements whose data is represented in a complicated ADSI format. For example, the ServerBindings property in ADSI is a String whose format must be IP:Port:Hostname. If the parts are out of order or missing colons, an error occurs. In WMI, an element class was created called ServerBinding with three properties corresponding to the IP address, port number, the host name. Instances of these elements are considered objects. In WMI, elements such as the IIsWebServerSetting element of the CIM_Setting class can contain a property called ServerBindings which is an array of ServerBinding objects.

Related Topics
  • For more information about the IIS WMI Provider, see Using the IIS WMI Provider.
  • For detailed examples of scripts that use the properties and methods of the Windows WMI provider to access the IIS WMI provider, see Module 3: Writing Administration Scripts that Use WMI of the IIS WMI Provider Tutorial.
  • For basic examples in VBScript, JScript, and Perl, see Code Examples to Configure Metabase Properties.
  • Your installation of IIS 6.0 includes command-line administration scripts that manage IIS. See Using Command-Line Administration Scripts.


ApplicationDependency (WMI)

The ApplicationDependency class contains data about a single application dependeny on the Web server. An application dependency can be added using the IIsWebService.AddDependency method, and can be removed using the IIsWebService.RemoveDependency method. The WebSvcExtRestrictionList class corresponds to the ApplicationDependencies metabase property, which contains a multi-string list of all application dependencies for the Web service.

Parent Class

IIsStructuredDataClass (WMI)

Properties

The table below lists the properties for this class:

Property Name | Data Type | Description
AppName | String | The AppName property contains the name of the application to which the dependency is added.
Extensions | String | The Extensions property is a non-localizable string used to identify groups of extensions. For example, "ASP", "HTTPODBC", or "SSINC", and so on.
Related Topics
  • For more information about the IIS WMI Provider, see Using the IIS WMI Provider.
  • For detailed examples of scripts that use the properties and methods of the Windows WMI provider to access the IIS WMI provider, see Module 3: Writing Administration Scripts that Use WMI of the IIS WMI Provider Tutorial.
  • For basic examples in VBScript, JScript, and Perl, see Code Examples to Configure Metabase Properties.
  • Your installation of IIS 6.0 includes command-line administration scripts that manage IIS. See Using Command-Line Administration Scripts.


CustomErrorDescription (WMI)

This class corresponds to the CustomErrorDescriptions property in the metabase which provides a list of custom error messages.

Parent Class

IIsStructuredDataClass (WMI)

Properties

The table below lists the properties for this class.

Property Name | Data Type | Description
ErrorCode | String | The ErrorCode property specifies the error code, for example, "401". Error 401 is a server or DNS error.
ErrorSubCode | String | The ErrorSubCode property specifies the error subcode, for example,"5". Error 401-5 is a failure to authorize by an ISAPI or CGI application.
ErrorText | String | The ErrorText property specifies the text that you want displayed which corresponds to the error code.
ErrorSubcodeText | String | The ErrorSubcodeText property specifies the text that you want displayed which corresponds to the error subcode.
FileSupportOnly | String | The FileSupportOnly property specifies the type of file support. Specify a "1" for file support only. Specify a "0" for file and URL support.
Related Topics
  • For more information about the IIS WMI Provider, see Using the IIS WMI Provider.
  • For detailed examples of scripts that use the properties and methods of the Windows WMI provider to access the IIS WMI provider, see Module 3: Writing Administration Scripts that Use WMI of the IIS WMI Provider Tutorial.
  • For basic examples in VBScript, JScript, and Perl, see Code Examples to Configure Metabase Properties.
  • Your installation of IIS 6.0 includes command-line administration scripts that manage IIS. See Using Command-Line Administration Scripts.


HttpCustomHeader (WMI)

This class corresponds to the HttpCustomHeaders property in the metabase which are headers sent to the client, in addition to the default header of the HTML file. If you send a custom header that is already sent by default, the default header is not overwritten. Both values are sent.

Parent Class

IIsStructuredDataClass (WMI)

Properties

The table below lists the properties for this class.

Property Name | Data Type | Description
Keyname | String | The Keyname property specifies the custom header key, for example, "HTTP_ACCEPT_LANGUAGE" is a header that is sent by default on all responses.
Value | String | The Value property specifies the value for the custom header, for example, "en" states that English is accepted.
Related Topics
  • For more information about the IIS WMI Provider, see Using the IIS WMI Provider.
  • For detailed examples of scripts that use the properties and methods of the Windows WMI provider to access the IIS WMI provider, see Module 3: Writing Administration Scripts that Use WMI of the IIS WMI Provider Tutorial.
  • For basic examples in VBScript, JScript, and Perl, see Code Examples to Configure Metabase Properties.
  • Your installation of IIS 6.0 includes command-line administration scripts that manage IIS. See Using Command-Line Administration Scripts.


HttpError (WMI)

This class corresponds to the HttpErrors property in the metabase which specifies the custom error String sent to clients in response to HTTP 1.1 errors.

Parent Class

IIsStructuredDataClass (WMI)

Properties

The table below lists the properties for this class.

Property Name | Data Type | Description
HttpErrorCode | String | The HttpErrorCode property specifies the HTTP error code, for example, "401". Error 401 is a server or DNS error.
HttpErrorSubcode | String | The HttpErrorSubcode property specifies the HTTP error subcode, for example, "5". Error 401-5 is a failure to authorize by an ISAPI or CGI application.
HandlerType | String | The HandlerType property specifies whether the error page is a "FILE" or a "URL".
HandlerLocation | String | The HandlerLocation property specifies the location of the error page. If HandlerType is a file, then HandlerLocation must be the absolute or relative path to the file. If HandlerType is a URL, then HandlerLocation must be the absolute or relative URL for the Web page.
Related Topics
  • For more information about the IIS WMI Provider, see Using the IIS WMI Provider.
  • For detailed examples of scripts that use the properties and methods of the Windows WMI provider to access the IIS WMI provider, see Module 3: Writing Administration Scripts that Use WMI of the IIS WMI Provider Tutorial.
  • For basic examples in VBScript, JScript, and Perl, see Code Examples to Configure Metabase Properties.
  • Your installation of IIS 6.0 includes command-line administration scripts that manage IIS. See Using Command-Line Administration Scripts.


MimeMap (WMI)

This class corresponds to the MimeMap property in the metabase which provides a list of the file name extensions for Multipurpose Internet Mail Extensions (MIME) mappings. The MimeMap key at the local machine level of the metabase establishes the default list, which can be overridden at the World Wide Web Publishing Service (WWW service) and Web server level keys. See the IIsMimeMap (ADSI) object for details on managing this property.

Parent Class

IIsStructuredDataClass (WMI)

Properties

The table below lists the properties for this class.

Property Name | Data Type | Description
Extension | String | The Extension property specifies the file name extension, for example, ".asx".
MimeType | String | The MimeType property specifies the MIME type, for example, "video/x-ms-asf".
Related Topics
  • For more information about the IIS WMI Provider, see Using the IIS WMI Provider.
  • For detailed examples of scripts that use the properties and methods of the Windows WMI provider to access the IIS WMI provider, see Module 3: Writing Administration Scripts that Use WMI of the IIS WMI Provider Tutorial.
  • For basic examples in VBScript, JScript, and Perl, see Code Examples to Configure Metabase Properties.
  • Your installation of IIS 6.0 includes command-line administration scripts that manage IIS. See Using Command-Line Administration Scripts.


ScriptMap (WMI)

This class corresponds to the ScriptMaps property in the metabase which specifies what script processor is mapped to what file name extensions. For example, on a default installation, the .asp file name extension of is mapped to the asp.dll ISAPI DLL.

Parent Class

IIsStructuredDataClass (WMI)

Properties

The table below lists the properties for this class.

Property Name | Data Type | Description
Extensions | String | The Extensions property specifies the file name extension, such as .htm. IIS allows an "*" in place of the file name extension, which effectively routes all requests though the designated ScriptProcessor. This feature is useful when applying a custom ISAPI extension that will handle requests from all file types.
ScriptProcessor | String | The ScriptProcessor property specifies the full path to the DLL to which the extension is mapped.
Flags | String | The Flags property specifies the requested behavior. See the Bitmask Table in ScriptMaps.
IncludedVerbs | String | The IncludedVerbs property specifies a list of the verbs that a particular script processor DLL handles, for example, "GET, POST, HEAD".
Related Topics
  • For more information about the IIS WMI Provider, see Using the IIS WMI Provider.
  • For detailed examples of scripts that use the properties and methods of the Windows WMI provider to access the IIS WMI provider, see Module 3: Writing Administration Scripts that Use WMI of the IIS WMI Provider Tutorial.
  • For basic examples in VBScript, JScript, and Perl, see Code Examples to Configure Metabase Properties.
  • Your installation of IIS 6.0 includes command-line administration scripts that manage IIS. See Using Command-Line Administration Scripts.


SecureBinding (WMI)

This class corresponds to the SecureBindings property in the metabase which is used by IIS to determine which secure network endpoints are used by the server instance.

Parent Class

IIsStructuredDataClass (WMI)

Properties

The table below lists the properties for this class.

Property Name | Data Type | Description
IP | String | The IP property specifies the IP address associated with the secure Web site that is accessed by a client using Secure Sockets Layer (SSL).
Port | String | The Port property specifies the port number associated with the secure Web site that is accessed by a client using Secure Sockets Layer (SSL).
Related Topics
  • For more information about the IIS WMI Provider, see Using the IIS WMI Provider.
  • For detailed examples of scripts that use the properties and methods of the Windows WMI provider to access the IIS WMI provider, see Module 3: Writing Administration Scripts that Use WMI of the IIS WMI Provider Tutorial.
  • For basic examples in VBScript, JScript, and Perl, see Code Examples to Configure Metabase Properties.
  • Your installation of IIS 6.0 includes command-line administration scripts that manage IIS. See Using Command-Line Administration Scripts.


ServerBinding (WMI)

This class corresponds to the ServerBindings property in the metabase which IIS uses to determine what network endpoints are used by the server instance. Both the IP and Hostname properties of the String are optional. Any unspecified parameters default to an all-inclusive wildcard.

For more information about your options for this setting, see Domain Name Resolution .

Parent Class

IIsStructuredDataClass (WMI)

Properties

The table below lists the properties for this class.

Property Name | Data Type | Description
IP | String | The IP property specifies the IP address associated with the Web site.
Port | String | The Port property specifies the port number associated with the Web site.
Hostname | String | The Hostname property specifies the host name associated with the Web site.
Related Topics
  • For more information about the IIS WMI Provider, see Using the IIS WMI Provider.
  • For detailed examples of scripts that use the properties and methods of the Windows WMI provider to access the IIS WMI provider, see Module 3: Writing Administration Scripts that Use WMI of the IIS WMI Provider Tutorial.
  • For basic examples in VBScript, JScript, and Perl, see Code Examples to Configure Metabase Properties.
  • Your installation of IIS 6.0 includes command-line administration scripts that manage IIS. See Using Command-Line Administration Scripts.


WebSvcExtRestrictionList (WMI)

The WebSvcExtRestrictionList class contains data about a single ISAPI or CGI that is used by applications on the Web server. The data specifies the location, description, and status of the extension. The WebSvcExtRestrictionList class corresponds to the WebSvcExtRestrictionList metabase property, which contains a multi-string list of all ISAPIs and CGIs that are used by applications on the Web server.

Parent Class

IIsStructuredDataClass (WMI)

Properties

The table below lists the properties for this class:

Property Name | Data Type | Description
Access | String | The Access property is "0" if the extension is not accessible or "1" if the extension is accessible.
FilePath | String | The FilePath property contains the full path to the extension. If the last four characters of the physical path are ".dll" (case insensitive), then the extension is an ISAPI, otherwise it is a CGI. In the case of CGI script mappings, the physical path must contain the physical path from the mapping (i.e. "c:\windows\system32\cmd.exe %s %s").
ServerExtension | String | The ServerExtension property is a non-localizable string used to identify groups of extensions. For example, "ASP", "HTTPODBC", or "SSINC", and so on. You can make your application dependent upon the status of this group by using the IIsWebService.AddDependency method.
Deletable | String | The Deletable property is "1" if the server administrator is allowed to delete the extension from IIS Manager or "0" if the server administrator is not allowed to delete it from IIS Manager.
Description | String | The Description property is a localizable description of the extension.
Related Topics
  • For more information about the IIS WMI Provider, see Using the IIS WMI Provider.
  • For detailed examples of scripts that use the properties and methods of the Windows WMI provider to access the IIS WMI provider, see Module 3: Writing Administration Scripts that Use WMI of the IIS WMI Provider Tutorial.
  • For basic examples in VBScript, JScript, and Perl, see Code Examples to Configure Metabase Properties.
  • Your installation of IIS 6.0 includes command-line administration scripts that manage IIS. See Using Command-Line Administration Scripts.


CIM_Component (WMI)

For each IIS Admin object type listed in KeyType in the Metabase Property Reference, there exists an element class and a setting class. The elements in the CIM_ManagedSystemElement class contain the methods and the read-only properties for the IIS Admin object type. The elements in the CIM_Setting class contain all the read-write properties for the IIS Admin object type.

Each element in the CIM_Component association class connects an element in the CIM_ManagedSystemElement class to another element in the CIM_ManagedSystemElement class, modeling ADSI containment.

The properties of the elements in this class are references to the two associated elements. Every possible association between elements in the CIM_ManagedSystemElement class is represented.

Typically, a user does not need to ask for an instance of this association class. Instead a user can get an instance of a regular class, such as IIsWebServer, and ask for the associators. Internally, WMI examines all the association classes that contain IIsWebServer as one of the associated classes, then returns the corresponding instances of the other associated classes. This is useful for tasks such as enumerating all the virtual directories under another virtual directory.

Lesson 6: Using Associations to Find Metabase Elements in the IIS WMI Provider Tutorial contains a complete code example.

Properties

The table below lists the properties for this class.

Property Name | Data Type | Description
GroupComponent | CIM_ManagedSystemElement | The GroupComponent property indicates the CIM_ManagedSystemElement (WMI) element of this association which acts as the parent of the PartComponent.
PartComponent | CIM_ManagedSystemElement | The PartComponentproperty indicates the CIM_ManagedSystemElement (WMI) element of this association which acts as the child of the GroupComponent.
Related Topics
  • For more information about the IIS WMI Provider, see Using the IIS WMI Provider.
  • For detailed examples of scripts that use the properties and methods of the Windows WMI provider to access the IIS WMI provider, see Module 3, Lesson 6 of the IIS WMI Provider Tutorial.
  • For basic examples in VBScript, JScript, and Perl, see Code Examples to Configure Metabase Properties.
  • Your installation of IIS 6.0 includes command-line administration scripts that manage IIS. See Using Command-Line Administration Scripts.


CIM_ElementSetting (WMI)

For each IIS Admin object type listed in KeyType in the Metabase Property Reference, there exists an element class and a setting class. The elements in the CIM_ManagedSystemElement class contain the methods and the read-only properties for the IIS Admin object type. The elements in the CIM_Setting class contain all the read-write properties for the IIS Admin object type.

Each element in the CIM_ElementSetting association class connects an element in the CIM_ManagedSystemElement class to an element in the CIM_Setting class.

The properties of the elements in this class are references to the two associated elements. Every possible association between elements in the CIM_ManagedSystemElement class and elements in the CIM_Setting class is represented.

Typically, a user does not need to ask for an instance of this association class. Instead a user can get an instance of a regular class, such as IIsWebServer, and ask for the associators. Internally, WMI examines all the association classes that contain IIsWebServer as one of the associated classes, then returns the corresponding instances of the other associated classes.

Properties

The table below lists the properties for this class.

Property Name | Data Type | Description
Element | CIM_ManagedSystemElement | The Element property indicates the element of this association which comes from the CIM_ManagedSystemElement (WMI) class.
Setting | CIM_Setting | The Setting property indicates the element of this association which comes from the CIM_Setting (WMI) class.
Related Topics
  • For more information about the IIS WMI Provider, see Using the IIS WMI Provider.
  • For detailed examples of scripts that use the properties and methods of the Windows WMI provider to access the IIS WMI provider, see Module 3: Writing Administration Scripts that Use WMI of the IIS WMI Provider Tutorial.
  • For basic examples in VBScript, JScript, and Perl, see Code Examples to Configure Metabase Properties.
  • Your installation of IIS 6.0 includes command-line administration scripts that manage IIS. See Using Command-Line Administration Scripts.


Windows WMI Reference

Any script or code that uses Windows Management Instrumentation (WMI) needs to use some basic Windows WMI interfaces. For example, to use WMI in a command-line script, you must make a connection to the WbemScripting object before you can access objects in individual WMI providers, such as the IIS WMI provider. The WMI interfaces also include methods which are frequently used. For example, the Get method of the SWbemServices object and the Set_ method of the SWbemObject object allow you to change properties in a data store, such as the IIS metabase. When writing scripts and code that use WMI, it saves time to open an online reference to the Windows WMI interfaces.

The objects, properties, and methods of the Windows WMI interfaces are already documented in the WMI SDK which is downloadable from MSDN Downloads - Windows Management Instrumentation (WMI) SDK, and available online at Windows Management Instrumentation Platform SDK.

Related Topics

  • For more information about the IIS WMI Provider, see Using the IIS WMI Provider.
  • For examples of scripts that use the properties and methods of the Windows WMI provider to access the IIS WMI provider, see Module 3: Writing Administration Scripts that Use WMI of the IIS WMI Provider Tutorial.
  • For more examples of WMI scripts that manage IIS, see Using Command-Line Administration Scripts.


IIS ADSI Provider Reference

This topic contains a reference page for each of the IIS Active Directory® Service Interfaces (ADSI) objects. Each page includes ADSI container information, the ADsPath for the object, the metabase properties accessible by the object, and any additional methods specific to the object.

Each IIS ADSI object has the KeyType property, which specifies exactly what type of IIS Administrative Object it represents. If the key type is not available or is not valid, IIS assigns the generic type IIsObject. You can use KeyType to change the ADSI object to a valid object and gain access to other IIS-specific properties and methods.

ADSI Object | Description
IIsCertMapper (ADSI) | Maps certificates to Microsoft® Windows® accounts.
IIsCompressionSchemes (ADSI) | Establishes global settings for HTTP 1.1 compression schemes.
IIsCompressionScheme (ADSI) | Establishes settings for individual compression schemes.
IIsComputer (ADSI) | Establishes global settings for IIS configuration.
IIsCustomLogModule (ADSI) | Sets properties for custom logging information field nodes.
IIsFilter (ADSI) | Provides information about a specific filter.
IIsFilters (ADSI) | Manages filters.
IIsFtpInfo (ADSI) | Establishes configuration properties for FTP servers in addition to those set at IIsFtpService.
IIsFtpServer (ADSI) | Establishes configuration properties for a single FTP server.
IIsFtpService (ADSI) | Establishes configuration properties common to all FTP servers.
IIsFtpVirtualDir (ADSI) | Sets properties for an individual FTP virtual directory.
IIsIPSecurity (ADSI) | Sets access permissions by IP address and domain address.
IIsLogModule (ADSI) | Contains information about a specific logging module.
IIsLogModules (ADSI) | Maintains information about installed logging modules.
IIsMimeMap (ADSI) | Manages Multipurpose Internet Mail Extension (MIME) mappings.
IIsMimeType (ADSI) | Manipulates the list of valid MIME types.
IIsWebDirectory (ADSI) | Sets properties for an individual Web directory.
IIsWebFile (ADSI) | Sets properties for an individual Web file.
IIsWebInfo (ADSI) | Establishes configuration properties for Web servers in addition to those set at IIsWebService.
IIsWebServer (ADSI) | Establishes configuration properties for a single Web server.
IIsWebService (ADSI) | Establishes configuration properties common to all Web servers.
IIsWebVirtualDir (ADSI) | Sets properties for an individual Web virtual directory.

Related Topics
  • For a list of constants used with IIS Admin Objects, see Constants used by the IIS ADSI Provider.


IIsApplicationPool (ADSI)

The IIsApplicationPool class corresponds to the IIsApplicationPool IIS Admin object, and contains the methods and read-only properties for the object.

ADsPath
IIS://MachineName/W3SVC/N/IIsApplicationPool

where MachineName can be any name or LocalHost.

Syntax

varReturn= IIsApplicationPool. Method

Parameters
varReturn
A variable that receives the return value from the method.
Method
The object method chosen.
Methods
IIsApplicationPool.EnumAppsInPool (ADSI) | The EnumAppsInPool method populates an array of strings with the applications in the application pool that is specified by the object variable, which must be an instance of the IIsApplicationPool class.
IIsApplicationPool.Recycle (ADSI) | The Recycle method recycles the application pool that is specified by the object variable, which must be an instance of the IIsApplicationPool class. When recycling occurs, the worker process currently serving the application pool terminates and the World Wide Web Publishing Service (W3SVC) restarts a new worker process to replace it. .
IIsApplicationPool.Start (ADSI) | The Start method starts the application pool that is specified by the object variable, which must be an instance of the IIsApplicationPool class.
IIsApplicationPool.Stop (ADSI) | The Stop method stops the application pool that is specified by the object variable, which must be an instance of the IIsApplicationPool class.
Related Topics
  • For information on standard methods for ADSI objects, see Windows ADSI Object Methods.


IIsApplicationPool.EnumAppsInPool (ADSI)

The EnumAppsInPool method of the IIsApplicationPool (ADSI) object populates an array of strings with the applications in the application pool that is specified by the object variable, which must be an instance of the IIsApplicationPool class.

Syntax

return_value = object.EnumAppsInPool(string Applications[])

Parameters

Applications[] [out]

Related Topics
  • For information on other methods in the IIsApplicationPool object, see IIsApplicationPool (ADSI).


IIsApplicationPool.Recycle (ADSI)

The Recycle method of the IIsApplicationPool (ADSI) object recycles the application pool that is specified by the object variable, which must be an instance of the IIsApplicationPool class. When recycling occurs, the worker process currently serving the application pool terminates and the World Wide Web Publishing Service (W3SVC) restarts a new worker process to replace it.

Syntax

return_value = object.Recycle

Parameters

There are no parameters for this method.

Related Topics
    <
  • For information on other methods in the IIsApplicationPool object, see IIsApplicationPool (ADSI).


IIsApplicationPool.Start (ADSI)

The Start method of the IIsApplicationPool (ADSI) object starts the application pool that is specified by the object variable, which must be an instance of the IIsApplicationPool class.

Syntax

return_value = object.Start

Parameters

There are no parameters for this method.

Related Topics
  • For information on other methods in the IIsApplicationPool object, see IIsApplicationPool (ADSI).


IIsApplicationPool.Stop (ADSI)

The Stop method of the IIsApplicationPool (ADSI) object Stops the application pool that is specified by the object variable, which must be an instance of the IIsApplicationPool class.

Syntax

return_value = object.Stop

Parameters

There are no parameters for this method.

Related Topics
  • For information on other methods in the IIsApplicationPool object, see IIsApplicationPool (ADSI).


IIsCertMapper (ADSI)

The IIsCertMapper object maps client certificates to Windows user accounts. IIsCertMapper is an ADSI object, but not an ADSI container object.

ADsPath
IIS://MachineName/W3SVC/N/IIsCertMapper

where MachineName can be any name or LocalHost.

Syntax

varReturn= IIsCertMapper. Method

Parameters
varReturn
A variable that receives the return value from the method.
Method
The object method chosen.
Methods
IIsCertMapper.CreateMapping (ADSI) | Maps a certificate to a Windows account.
IIsCertMapper.DeleteMapping (ADSI) | Deletes an existing certificate mapping.
IIsCertMapper.GetMapping (ADSI) | Retrieves an existing certificate mapping.
IIsCertMapper.SetAcct (ADSI) | Sets a new value for the Windows account string in an existing certificate mapping.
IIsCertMapper.SetEnabled (ADSI) | Enables or disables an existing certificate mapping.
IIsCertMapper.SetName (ADSI) | Sets a new value for the name string in an existing certificate mapping.
IIsCertMapper.SetPwd (ADSI) | Sets a new value for the Windows password string in an existing certificate mapping.

Related Topics
  • For information on standard methods for ADSI objects, see Windows ADSI Object Methods.


IIsCertMapper.CreateMapping (ADSI)

The CreateMapping method of the IIsCertMapper (ADSI) object maps a certificate to a Windows account.

Syntax

IIsCertMapper.CreateMapping vCert, NtAcct, NtPwd, strName, IEnabled

Parameters
vCert
Contains the certificate. The certificate is either a string or an array of bytes, usually obtained from the ClientCertificate collection of the built-in ASP Request Object.
NtAcct
Contains the Windows account string.
NtPwd
Contains the password string for NtAcct.
strName
Contains the friendly name for the account.
IEnabled
Specifies TRUE to enable the mapping, FALSE to disable the mapping.
Code Example
<%
  Dim CertObj, vCert
  vCert = Request.ClientCertificate("CERTIFICATE")
  Set CertObj = GetObject("IIS://..path../IIsCertMapper")
  CertObj.CreateMapping vCert, "MYACCT", "MYPASS", "My Name", True
%>
Related Topics
  • For information on other methods in the IIsCertMapper object, see IIsCertMapper (ADSI).


IIsCertMapper.DeleteMapping (ADSI)

The DeleteMapping method of the IIsCertMapper (ADSI) object deletes an existing certificate mapping. Four seek methods are available to search for the mapping: by certificate, by name, by Windows account, and by numeric string index.

Syntax

IIsCertMapper.DeleteMapping IMethod, vKey

Parameters
IMethod
Specifies the seek method to use for searching the mappings. Valid seek methods are 1, 2, 3, or 4. Seek method 1 specifies search by certificate, seek method 2 searches by name, method 3 searches by Windows account, and method 4 searches by a 1-based numeric string index (for example "1," "2," and so on).
vKey
Specifies the key to use in the search specified by IMethod. For seek method 1, vKey specifies a certificate. For seek method 2, vKey specifies a name. For seek method 3, vKey specifies a Windows account. For seek method 4, vKey specifies a numeric string index (for example, "1," "2," and so on).
Code Example
<%
  Dim CertObj
  Set CertObj = GetObject("IIS://..path../IIsCertMapper")
  'Search by Windows account.
  CertObj.DeleteMapping 3, "MYACCT"
%>
Related Topics
  • For information on other methods in the IIsCertMapper object, see IIsCertMapper (ADSI).


IIsCertMapper.GetMapping (ADSI)

The GetMapping method of the IIsCertMapper (ADSI) object retrieves a certificate and the mapping data from an existing certificate mapping. Four seek methods are available to search for the mapping: by certificate, by name, by Windows account, and by numeric string index. The retrieved mapping is returned in parameter variables that you provide.

Syntax

IIsCertMapper.GetMapping IMethod, vKey, vCert, NtAcct, NtPwd, strName, IEnabled

Parameters
IMethod
Specifies the seek method to use for searching the mappings. Valid seek methods are 1, 2, 3, or 4. Seek method 1 specifies search by certificate, seek method 2 searches by name, method 3 searches by Windows account, and method 4 searches by a 1-based numeric string index (for example, "1," "2," and so on).
vKey
Specifies the key to use in the search specified by IMethod. For seek method 1, vKey specifies a certificate. For seek method 2, vKey specifies a name. For seek method 3, vKey specifies a Windows account. For seek method 4, vKey specifies a numeric string index (for example, "1," "2," and so on).
vCert
Receives the returned certificate.
NtAcct
Receives the returned Windows account.
NtPwd
Receives the returned Windows account password.
strName
Receives the returned Windows account friendly name.
IEnabled
Receives the returned value TRUE for an enabled mapping, or FALSE for a disabled mapping.
Code Example
<%
  Dim CertObj, vCert, NtAcct, NtPwd, strName, IEnabled
  Set CertObj = GetObject("IIS://..path../IIsCertMapper")
  'Search by Windows account.
  CertObj.GetMapping 3, "MYACCT", vCert, NtAcct, NtPwd, strName, IEnabled
%>
Related Topics
  • For information on other methods in the IIsCertMapper object, see IIsCertMapper (ADSI).


IIsCertMapper.SetAcct (ADSI)

The SetAcct method of the IIsCertMapper (ADSI) object sets a new value for the Windows account string in an existing certificate mapping. Four seek methods are available to search for the mapping: by certificate, by name, by Windows account, and by numeric string index.

Syntax

IIsCertMapper.SetAcct IMethod, vKey, NTAcct

Parameters
IMethod
Specifies the seek method to use for searching the mappings. Valid seek methods are 1, 2, 3, or 4. Seek method 1 specifies search by certificate, seek method 2 searches by name, method 3 searches by Windows account, and method 4 searches by a 1-based numeric string index (for example, "1," "2," and so on).
vKey
Specifies the key to use in the search specified by IMethod. For seek method 1, vKey specifies a certificate. For seek method 2, vKey specifies a name. For seek method 3, vKey specifies a Windows account. For seek method 4, vKey specifies a numeric string index (for example, "1," "2," and so on).
NTAcct
Specifies a new value for the Windows account string.
Code Example
<%
  Dim CertObj
  Set CertObj = GetObject("IIS://..path../IIsCertMapper")
  'Search by Windows account.
  CertObj.SetAcct 3, "MYACCT", "NewAccount"
%>
Related Topics
  • For information on other methods in the IIsCertMapper object, see IIsCertMapper (ADSI).


IIsCertMapper.SetEnabled (ADSI)

The SetEnabled method of the IIsCertMapper (ADSI) object enables or disables an existing certificate mapping. Four seek methods are available to search for the mapping: by certificate, by name, by Windows account, and by numeric string index.

Syntax

IIsCertMapper.SetEnabled IMethod, vKey, IEnabled

Parameters
IMethod
Specifies the seek method to use for searching the mappings. Valid seek methods are 1, 2, 3, or 4. Seek method 1 specifies search by certificate, seek method 2 searches by name, method 3 searches by Windows account, and method 4 searches by a 1-based numeric string index (for example, "1," "2," and so on).
vKey
Specifies the key to use in the search specified by IMethod. For seek method 1, vKey specifies a certificate. For seek method 2, vKey specifies a name. For seek method 3, vKey specifies a Windows account. For seek method 4, vKey specifies a numeric string index (for example, "1," "2," and so on).
IEnabled
Specifies TRUE to enable the mapping, FALSE to disable the mapping.
Code Example
<%
  Dim CertObj
  Set CertObj = GetObject("IIS://..path../IIsCertMapper")
  'Search by Windows account.
  CertObj.SetEnabled 3, "MYACCT", True
%>
Related Topics
  • For information on other methods in the IIsCertMapper object, see IIsCertMapper (ADSI).


IIsCertMapper.SetName (ADSI)

The SetName method of the IIsCertMapper (ADSI) object sets a new value for the name string in an existing certificate mapping. Four seek methods are available to search for the mapping: by certificate, by name, by Windows account, and by numeric string index.

Syntax

IIsCertMapper.SetName IMethod, vKey, strName

Parameters
IMethod
Specifies the seek method to use for searching the mappings. Valid seek methods are 1, 2, 3, or 4. Seek method 1 specifies search by certificate, seek method 2 searches by name, method 3 searches by Windows account, and method 4 searches by a 1-based numeric string index (for example, "1", "2", and so on).
vKey
Specifies the key to use in the search specified by IMethod. For seek method 1, vKey specifies a certificate. For seek method 2, vKey specifies a name. For seek method 3, vKey specifies a Windows account. For seek method 4, vKey specifies a numeric string index (for example, "1," "2," and so on).
strName
Specifies a new value for the name string.
Code Example
<%
  Dim CertObj
  Set CertObj = GetObject("IIS://..path../IIsCertMapper")
  'Search by Windows account.
  CertObj.SetName 3, "MYACCT", "NewName"
%>
Related Topics
  • For information on other methods in the IIsCertMapper object, see IIsCertMapper (ADSI).


IIsCertMapper.SetPwd (ADSI)

The SetPwd method of the IIsCertMapper (ADSI) object sets a new value for the Windows password string in an existing certificate mapping. Four seek methods are available to search for the mapping: by certificate, by name, by Windows account, and by numeric string index.

Syntax

IIsCertMapper.SetPwd IMethod, vKey, NTPwd

Parameters
IMethod
Specifies the seek method to use for searching the mappings. Valid seek methods are 1, 2, 3, or 4. Seek method 1 specifies search by certificate, seek method 2 searches by name, method 3 searches by Windows account, and method 4 searches by a 1-based numeric string index (for example, "1," "2," and so on).
vKey
Specifies the key to use in the search specified by IMethod. For seek method 1, vKey specifies a certificate. For seek method 2, vKey specifies a name. For seek method 3, vKey specifies a Windows account. For seek method 4, vKey specifies a numeric string index (for example, "1," "2," and so on).
strPwd
Specifies a new value for the Windows password string.
Code Example
<%
  Dim CertObj
  Set CertObj = GetObject("IIS://..path../IIsCertMapper")
  'Search by Windows account.
  CertObj.SetPwd 3, "MYACCT", "NewPassword"
%>
Related Topics
  • For information on other methods in the IIsCertMapper object, see IIsCertMapper (ADSI).


IIsCompressionSchemes (ADSI)

IIsCompressionSchemes is an ADSI container object that contains the individual HTTP 1.1 compression schemes that are available to IIS, represented by the ADSI object IIsCompressionScheme (ADSI). In addition, all global compression settings for the IIS installation are stored in the IIsCompressionSchemes object.

ADsPath
IIS://MachineName/W3SVC/Filters/Compression/Parameters

where MachineName can be any name or LocalHost.

Syntax

varReturn= object.Method

varReturn= object.Property

Parameters
varReturn
A variable that receives the return value from the method.
object
A variable that refers to the IIsCompressionSchemes object, usually as a result of a previous GetObject operation.
Method or Property
The particular object method or property that you want to use.
Can Contain
IIsCompressionScheme (ADSI)

Properties
Windows ADSI Object Properties Windows ADSI Container Object Properties

Metabase Properties
HcCacheControlHeader | HcIoBufferSize
HcCompressionBufferSize | HcMaxDiskSpaceUsage
HcCompressionDirectory | HcMaxQueueLength
HcDoDiskSpaceLimiting | HcMinFileSizeForComp
HcDoDynamicCompression | HcNoCompressionForHttp10
HcDoOnDemandCompression | HcNoCompressionForProxies
HcDoStaticCompression | HcNoCompressionForRange
HcExpiresHeader | HcSendCacheHeaders
HcFilesDeletedPerDiskFree |

Methods
Windows ADSI Object Methods | Standard methods for ADSI objects.
Windows ADSI Container Object Methods | Standard methods for ADSI container objects.


IIsCompressionScheme (ADSI)

The IIsCompressionScheme IIS ADSI Object contains configuration information about an individual compression scheme. All instances of the IIsCompressionScheme object are contained within the IIsCompressionSchemes (ADSI) object.

ADsPath
IIS://MachineName/W3SVC/Filters/Compression/Scheme

where MachineName can be any name or LocalHost.

Syntax

varReturn= object.Method

varReturn= object.Property

Parameters
varReturn
A variable that receives the return value from the method.
object
A variable that refers to the IIsCompressionScheme object, usually as a result of a previous GetObject operation.
Method or Property
The particular object method or property that you want to use.
Properties
Windows ADSI Object Properties

Metabase Properties
HcCompressionDll | HcFileExtensions
HcCreateFlags |
HcDoDynamicCompression | HcOnDemandCompLevel
HcDoStaticCompression | HcPriority
HcDoOnDemandCompression | HcScriptFileExtensions
HcDynamicCompressionLevel |

Methods
Windows ADSI Object Methods Standard methods for ADSI objects.


IIsComputer (ADSI)

You can use the IIsComputer object to set values of global metabase properties that determine how IIS operates. The IIsComputer object also provides methods to manage metabase backups. You can use these methods to store multiple backup versions in long-term storage, to restore the metabase from a backup version of your choice, and to enumerate and delete backups.

The IIsComputer object is an ADSI container object.

ADsPath
IIS://MachineName

where MachineName can be any name or LocalHost.

Syntax

varReturn= object. Method

Parameters
varReturn
A variable that receives the return value from the method.
object
A variable that contains the IIsComputer object, usually as a result of a previous GetObject operation.
Method
The object method chosen.
Can Contain
IIsFtpService (ADSI) | IIsMimeMap (ADSI)
IIsLogModules (ADSI) | IIsWebService (ADSI)

Properties
Windows ADSI Object Properties Standard properties for ADSI objects.

Metabase Properties
MaxBandwidth | MimeMap
MaxBandwidthBlocked |

Methods
IIsComputer.Backup (ADSI) | Saves the metabase to long-term storage.
IIsComputer.BackupWithPassword (ADSI) | Saves the metabase to long-term storage with an optionally supplied password.
IIsComputer.DeleteBackup (ADSI) | Deletes a metabase backup from long-term storage.
IIsComputer.EnumBackups (ADSI) | Enumerates metabase backups in long-term storage.
IIsComputer.Restore (ADSI) | Restores a metabase backup from long-term storage.
IIsComputer.RestoreWithPassword (ADSI) | Restores a metabase backup using the same optionally supplied password given when the BackupWithPassword method was used.

Related Topics
Windows ADSI Object Methods | Standard methods for ADSI objects.
Windows ADSI Container Object Methods | Standard methods for ADSI container objects.


IIsComputer.Backup (ADSI)

You can use the Backup method of the IIsComputer (ADSI) object to back up the metabase to a location you specify by providing a backup location name of up to 100 characters in length. Multiple metabase backups can be stored in a backup location.

Syntax

IIsComputer.Backup BackupLocation, BackupVersion, BackupFlags

Parameters
BackupLocation
A string of up to 100 characters that specifies the backup location. The storage mechanism is determined by IIS. If an empty string is specified, the backup will be stored in the default location.
BackupVersion
Specifies the version number to be assigned to the backup. Must be less than or equal to MD_BACKUP_MAX_VERSION. Can be set to one of the following values.
MD_BACKUP_HIGHEST_VERSION | Overwrite the highest existing backup version in the specified backup location.
MD_BACKUP_NEXT_VERSION | Use the next backup version number available in the specified backup location.
BackupFlags
One or more of the following flags.
MD_BACKUP_FORCE_BACKUP | Force the backup even if the SaveData operation specified by MD_BACKUP_SAVE_FIRST fails.
MD_BACKUP_OVERWRITE | Back up even if a backup of the same name and version exists in the specified backup location, overwriting if necessary.
MD_BACKUP_SAVE_FIRST | Perform a SaveData operation before the backup. Default if no flags are specified.

Remarks

IIS determines the backup storage mechanism, so the backup location name you provide does not necessarily translate to a particular directory, file, or database storage mechanism. As implemented in this release, metabase backups are stored as files in the System32\Inetsrv\MetaBack directory.

important Important The metabase backup and restore functionality exists for versioning purposes, not for cross-computer replication. However, you are not necessarily restricted to backing up and restoring the computer from which you initiate the process. For more information about backing up the metabase, see Restoring the Metabase from Backup Files.

Code Example
<%
  Dim ComputerObj, iFlags
  Set ComputerObj = GetObject("IIS://LocalHost")
  'Backup to next available version number.
  'Set flags to save the metabase first and
  'force the backup even if save fails.
  iFlags = (MD_BACKUP_SAVE_FIRST or MD_BACKUP_FORCE_BACKUP)
  ComputerObj.Backup "MyBackups", MD_BACKUP_NEXT_VERSION, iFlags
%>
Related Topics
  • For information on other methods in the IIsComputer object, see IIsComputer (ADSI).


IIsComputer.BackupWithPassword (ADSI)

You can use the BackupWithPassword method of the IIsComputer (ADSI) object to back up the metabase to a location you specify by providing a backup location name of up to 100 characters in length and a password valid for the targeted computer. Multiple metabase backups can be stored in a backup location.

Syntax

IIsComputer.BackupWithPassword BackupLocation, BackupVersion, BackupFlags, BackupPassword

Parameters
BackupLocation
A string of up to 100 characters that specifies the backup location. The storage mechanism will be determined by IIS. If an empty string is specified, the backup will be stored in the default location.
BackupVersion
Specifies the version number to be assigned to the backup. Must be less than or equal to MD_BACKUP_MAX_VERSION. Can be set to one of the following values.
MD_BACKUP_HIGHEST_VERSION | Overwrite the highest existing backup version in the specified backup location.
MD_BACKUP_NEXT_VERSION | Use the next backup version number available in the specified backup location.
BackupFlags
One or more of the following flags.
MD_BACKUP_FORCE_BACKUP | Force the backup even if the SaveData operation specified by MD_BACKUP_SAVE_FIRST fails.
MD_BACKUP_OVERWRITE | Back up even if a backup of the same name and version exists in the specified backup location, overwriting if necessary.
MD_BACKUP_SAVE_FIRST | Perform a SaveData operation before the backup. Default if no flags are specified.
BackupPassword

Optional. Unencrypted valid password.

Remarks

IIS determines the backup storage mechanism, so the backup location name you provide does not necessarily translate to a particular directory, file, or database storage mechanism. Metabase backups are stored as files in the system32\inetsrv\MetaBack directory.

important Important The metabase backup and restore functionality exists for versioning purposes, not for cross-machine replication. However, you are not necessarily restricted to backing up and restoring the computer from which you initiate the process. For more information about restoring from a back up, see Restoring the Metabase from Backup Files.

Code Example
<%
  Dim ComputerObj, iFlags
  Set ComputerObj = GetObject("IIS://LocalHost")
  'Backup to next available version number.
  'Set flags to save the metabase first and
  'force the backup even if save fails.
  iFlags = (MD_BACKUP_SAVE_FIRST or MD_BACKUP_FORCE_BACKUP)
  ComputerObj.BackupWithPassword "MyBackups", MD_BACKUP_NEXT_VERSION, iFlags, "MyP@ssWOrd"
%>
Related Topics
  • For information on other methods in the IIsComputer object, see IIsComputer (ADSI).


IIsComputer.DeleteBackup (ADSI)

You can use the DeleteBackup method of the IIsComputer (ADSI) object to delete a metabase backup from a backup location.

Syntax

IIsComputer.DeleteBackup BackupLocation, BackupVersion

Parameters
BackupLocation
A string of up to 100 characters that specifies the backup location. If an empty string is specified, the backup will be deleted from the default location.
BackupVersion
Specifies the version number of the backup to be deleted from the backup location, or it can be the following constant.
MD_BACKUP_HIGHEST_VERSION Delete the highest existing backup version in the specified backup location.

Code Example
<%
  Dim ComputerObj
  Set ComputerObj = GetObject("IIS://LocalHost")
  'Delete version 1 backup.
  ComputerObj.DeleteBackup "MyBackups", 1
%>
Related Topics
  • For information on other methods in the IIsComputer object, see IIsComputer (ADSI).


IIsComputer.EnumBackups (ADSI)

You can use the EnumBackups method of the IIsComputer (ADSI) object to enumerate metabase backups stored in one or more backup locations, retrieving the location, version number, and date of each backup.

Syntax

IIsComputer.EnumBackups BkupLocIn, IndexIn, BkupVerOut, BkupLocOut, BkupDateTimeOut

Parameters
BkupLocIn
A string of up to 100 characters that specifies the backup location. If an empty string is specified, all backup locations will be searched.
IndexIn
Specifies the index of the backup to enumerate. Start the index at 0 and increment by 1 until MD_ERROR_DATA_NOT_FOUND is returned.
BkupVerOut
Receives the version number of the backup enumerated.
BkupLocOut
Receives the backup location of the backup enumerated.
BkupDateTimeOut
Receives the date and time of the backup, in Coordinated Universal Time (UTC), formerly GMT (Greenwich Mean Time).
Code Example
<%@ LANGUAGE=VBScript %>
<SCRIPT LANGUAGE = "JScript" RUNAT = SERVER>
  var TempDate = new Date();
  TempDif = TempDate.getTimezoneOffset();
  Session("sTempDif") = TempDif;
</SCRIPT>
<%
  Dim CompObj, Index, Version, Location, GMTDate, LocDate, MinDif
  MinDif = Session("sTempDif")
  On Error Resume Next
  Set CompObj = GetObject("IIS://LocalHost")
  Index = 0
' Iterate until method returns an error.
  Do While True
    ' Empty location input string means enumerate all locations.
    CompObj.EnumBackups "", Index, Version, Location, GMTDate
    If Err.Number <> 0 Then
      ' If error returned, no more backups to enumerate.
      Exit Do
    End If
    Response.Write Version & ", "
    Response.Write Location & ", "
    Response.Write GMTDate & ", "
    ' Convert to server local date and time.
    LocDate = DateAdd("n", (-MinDif), GMTDate)
    Response.Write "(" & LocDate & ")"
    Response.Write "<BR>"
    Index = Index + 1
  Loop
%>
Related Topics
  • For information on other methods in the IIsComputer object, see IIsComputer (ADSI).


IIsComputer.Export (ADSI)

The Export method exports a section of the IIS metabase to a file for importing to the same IIS server or to a different IIS server. Please see About Metabase Import and Export for more information on how to select sections of the metabase, and see Machine-Specific and System-Specific Information for a list of properties to clear from your export file.

Syntax

IIsComputer.Export Passwd, FileName, SourcePath, MDFlags

Parameters
Passwd
Encrypts the export file with the specified password. You can use any string as the password. The /d parameter creates a secure export file by encrypting the session key and secure properties with the specified password. You must provide the password to use the file in an /import operation.

If you omit this parameter or omit the password argument, then the export file is encrypted with a blank password. As a result, only the secure properties are encrypted and any administrator can use the export file to import a metabase configuration.

FileName
Required. Specifies a unique name and location for the export file. If you specify an existing file or if the directories in the path you specify do not exist, the method fails. Also, the file path must be local. When exporting a file from a remote computer, the FileName parameter refers to a path on the remote computer.
SourcePath
Required. Specifies the metabase keys to export. Enter a metabase path, including /LM/ROOT, to indicate the selected keys.
MDFlags
A constant that specifies what inherit and merge flags to set. The constant can be one or more of the following.
IMPORT_EXPORT_INHERITED Adds the inherited properties of the exported keys to the export file. Without this flag, the export file does not include properties inherited from higher-level keys. If you use this flag, the Export method adds the inherited properties of the exported keys to an IIsInheritedProperties key in the export file. When you import keys from this file, you can elect to import the inherited properties with the keys.

When inherited properties are imported, the imported keys retain the properties they inherited in the exporting configuration. If inherited properties are not imported, the keys inherit the properties of the importing configuration.

IMPORT_EXPORT_NODE_ONLY Prevents the subkeys of the specified key from being added to the export file.
Code Example
<%
  Dim ComputerObj
  Const IMPORT_EXPORT_INHERITED = 1
  Const IMPORT_EXPORT_NODE_ONLY = 2
  Const IMPORT_EXPORT_MERGE     = 4

  Set ComputerObj = GetObject("IIS://LocalHost")
  'Create an export of the W3SVC/1/Root/vdir1 metabase keys.
  ComputerObj.Export "Pa55W0rd", "C:\MyExports\DefaultVRoot.xml",  "/LM/W3SVC/1/ROOT/Vdir1", IMPORT_EXPORT_INHERITED
%>
Related Topics
  • For information on other methods in the IIsComputer object, see IIsComputer (ADSI).


IIsComputer.Import (ADSI)

The Import method imports a section of an IIS metabase from an export file that has been created on the same IIS server or on a different IIS server. Please see About Metabase Import and Export for more information about how to select sections of the metabase, and see Machine-Specific and System-Specific Information for a list of properties to clear from your export file before importing it.

Syntax

IIsComputer.DeleteBackup Passwd, FileName, SourcePath, DestPath, MDFlags

Parameters
Passwd
Required only when the export file was encrypted when it was created. Specifies the password that was used to encrypt the export file.
FileName
Required. Specifies the path and file name of the Extensible Markup Language (XML) source file.
SourcePath
Required. Specifies the location in the XML file of the keys that are being imported. Enter the metabase path as it appears in the XML file. To import all of the keys in the source file, enter the metabase path of the root key.
DestPath
Required. Specifies the metabase path into which the keys are placed. Enter the metabase path as it appears in the XML file.

The imported key must be of the type expected in its new position in the metabase path. If the key is not of the expected type, the configuration will not operate properly. For example, do not import the event logging configuration (/LM/Logging) to a Web site configuration path, such as /LM/W3SVC/3. If you specify a path that already exists in the metabase, the imported keys overwrite and replace the keys that are currently in that metabase path, without warning.

MDFlags
A constant that specifies what inherit and merge flags to set. The constant can be one of the following.
IMPORT_EXPORT_INHERITED | Imports the inherited properties of the keys. This parameter is only effective when the source file includes inherited properties.
IMPORT_EXPORT_NODE_ONLY | Prevents the subkeys of the specified key from being imported.
IMPORT_EXPORT_MERGE | Combines keys in the XML file with the existing metabase keys. Without this parameter, the keys in the XML file replace existing keys in the same metabase path. The IMPORT_EXPORT_MERGE flag adds keys to the metabase that appear only in the XML file, retains keys in the metabase that are not in the XML file, and applies the values in the XML file when a key appears in both the XML file and the metabase.
Code Example
<%
  Dim ComputerObj
  Const IMPORT_EXPORT_INHERITED = 1
  Const IMPORT_EXPORT_NODE_ONLY = 2
  Const IMPORT_EXPORT_MERGE     = 4

  Set ComputerObj = GetObject("IIS://LocalHost")
  'Import the W3SVC/1/Root/Vdir1 metabase keys from an export file to a different virtual directory.
  ComputerObj.Import "Pa55W0rd", "C:\MyExports\DefaultVRoot.xml",  "/LM/W3SVC/1/ROOT/Vdir2", IMPORT_EXPORT_INHERITED
%>
Related Topics
  • For information on other methods in the IIsComputer object, see IIsComputer (ADSI) .


IIsComputer.Restore (ADSI)

You can use the Restore method of the IIsComputer (ADSI) object to restore the metabase from a backup. The restore operation stops all services dependent on IISAdmin (including all servers) until the restore has completed, then restarts all services. Because of this, if you are restoring the metabase by using a script in an ASP page, you must specify a computer name other than the one on which your script is executing. You cannot use LocalHost as the name. You should be careful to plan for this service interruption when restoring the metabase from a backup.

Syntax

IIsComputer.Restore BackupLocation, BackupVersion, BackupFlags

Parameters
BackupLocation
A string of up to 100 characters that specifies the backup location. If an empty string is specified, the backup will be retrieved from the default location.
BackupVersion
Specifies the version number of the backup to be restored from the backup location, or it can be the following constant.
MD_BACKUP_HIGHEST_VERSION Restore from the highest existing backup version in the specified backup location.
BackupFlags
Reserved. Must be zero.
Code Example
<%
  Dim ComputerObj, ComputerName
  'Restore metabase on a different computer.
  ComputerName = "MyOtherComputer"
  'You can use LocalHost if running under Windows Script Host.
  Set ComputerObj = GetObject("IIS://" & ComputerName)
  'Restore the highest number version in MyBackups.
  ComputerObj.Restore "MyBackups", MD_BACKUP_HIGHEST_VERSION, 0
%>
Remarks

You can use the Restore method with LocalHost in scripts running in a command prompt by using Cscript.exe. For more information, search for "Windows Script Host" topics in Windows Help.

important Important The metabase backup and restore functionality exists for versioning purposes, not for cross-computer replication. However, you are not necessarily restricted to restoring the computer from which you initiate the process. For more information about restoring from a back up, see Restoring the Metabase from Backup Files.

Related Topics
  • For information on other methods in the IIsComputer object, see IIsComputer (ADSI).


IIsComputer.RestoreWithPassword (ADSI)

You can use the RestoreWithPassword method of the IIsComputer (ADSI) object to restore the metabase from a backup and require a valid password (but only if one was used when the IIsComputer.BackupWithPassword (ADSI) method was invoked). The restore operation stops all services dependent on the IIS Admin service (including all servers) until the restore has completed; then it restarts all services. Because of this, if you are restoring the metabase by using a script in an ASP page, you must specify a machine name (and the associated password) other than the one on which your script is executing. You cannot use LocalHost as the machine name. You should be careful to plan for this service interruption when restoring the metabase from a backup.

Syntax

IIsComputer.RestoreWithPassword BackupLocation, BackupVersion, BackupFlags, BackupPassword

Parameters
BackupLocation
A string of up to 100 characters that specifies the backup location. If an empty string is specified, the backup is retrieved from the default location.
BackupVersion
Specifies the version number of the backup to be restored from the backup location or can be the following constant.
MD_BACKUP_HIGHEST_VERSION Restore from the highest existing backup version in the specified backup location.
BackupFlags
Reserved. Must be zero.
BackupPassword
Optional. Unencrypted valid password for targeted computer. This password must be the same as the one used when the BackupWithPassword method was invoked.
Code Example
<%
  Dim ComputerObj, ComputerName
  'Restore metabase on a different computer.
  ComputerName = "MyOtherComputer"
  'You can use LocalHost if running under Windows Script Host.
  Set ComputerObj = GetObject("IIS://" & ComputerName)
  'Restore the highest number version in MyBackups.
  ComputerObj.RestoreWithPassword "MyBackups", MD_BACKUP_HIGHEST_VERSION, 0, "MyP@ssWOrd"
%>
Remarks

You can use the RestoreWithPassword method with LocalHost in scripts running in a command prompt by using Cscript.exe. For more information, search for "Windows Script Host" in Windows Help.

important Important The metabase backup and restore functionality exists for versioning purposes, not for cross-machine replication. However, you are not necessarily restricted to restoring the computer from which you initiate the process. For more information about restoring from a back up, see Restoring the Metabase from Backup Files.

Related Topics
  • For information on other methods in the IIsComputer object, see IIsComputer (ADSI).


IIsCustomLogModule (ADSI)

You can use the IIsCustomLogModule object to configure custom logging information fields. For more information about custom logging fields, see Setting Metabase Properties for Logging in the Platform SDK.

ADsPath

IIS://MachineName/Logging/CustomLogging

IIS://MachineName/Logging/CustomLogging/Field

IIS://MachineName/Logging/CustomLogging/FieldGroup

IIS://MachineName/Logging/CustomLogging/FieldGroup/Field

where MachineName can be any name or LocalHost.

Syntax

varReturn= object.Method

Parameters
varReturn
A variable that receives the return value from the method.
object
A variable that contains the IIsComputer object, usually as a result of a previous GetObject operation.
Method
The object method chosen.
Properties
Windows ADSI Object Properties
Metabase Properties
LogCustomPropertyDataType | LogCustomPropertyMask
LogCustomPropertyHeader | LogCustomPropertyName
LogCustomPropertyID | LogCustomPropertyServicesString
Methods
Windows ADSI Object Methods Standard methods for ADSI objects.


IIsFilter (ADSI)

You can use the IIsFilter object to set metabase properties that affect the operation of ISAPI filters. You can set filter properties at the World Wide Web Publishing Service (WWW service) level or for an individual Web server.

The IIsFilter object is an ADSI object but not an ADSI container object.

ADsPath
IIS://MachineName/W3SVC/Filters/FilterName

where MachineName can be any name or LocalHost.

or

IIS://MachineName/W3SVC/N/Filters/FilterName

where MachineName can be any name or LocalHost, and N is the number of a Web server.

Syntax

varReturn= object.Method

Parameters
varReturn
A variable that receives the return value from the method.
object
A variable that contains the IIsFilter object, usually as a result of a previous GetObject operation.
Method
The object method chosen.
Properties
Windows ADSI Object Properties
Metabase Properties
FilterDescription | FilterPath
FilterEnabled | FilterState
FilterFlags |
Methods
Windows ADSI Object Methods Standard methods for ADSI objects.


IIsFilters (ADSI)

The IIsFilters object is an ADSI container object that contains the collection of IIsFilter (ADSI) objects. You can use the IIsFilters object to set the FilterLoadOrder property to specify the sequence in which filters are to be loaded, and to enumerate through filters. You can use the IIsFilters object to manage filters at the World Wide Web Publishing Service (WWW service) level or at an individual Web server.

The IIsFilters object is an ADSI container object.

ADsPath
IIS://MachineName/W3SVC/Filters

where MachineName can be any name or LocalHost.

or

IIS://MachineName/W3SVC/N/Filters

where MachineName can be any name or LocalHost, and N is the number of a Web server.

Syntax

varReturn= object.Method

Parameters
varReturn
A variable that receives the return value from the method.
object
A variable that contains the IIsFilters object, usually as a result of a previous GetObject operation.
Method
The object method chosen.
Can Contain
IIsFilter (ADSI)
Properties
Windows ADSI Object Properties
Metabase Properties
FilterLoadOrder
Methods
Windows ADSI Object Methods | Standard methods for ADSI objects.
Windows ADSI Container Object Methods | Standard methods for ADSI container objects.


IIsFtpInfo (ADSI)

Some metabase properties associated with the FTP service are stored at the Info subkey of the MSFTPSVC key. You can use the IIsFtpInfo object to set values for these properties.

The IIsFtpInfo object is an ADSI object but not an ADSI container object.

ADsPath
IIS://MachineName/MSFTPSVC/Info

where MachineName can be any name or LocalHost.

Syntax

varReturn= object.Method

Parameters
varReturn
A variable that receives the return value from the method.
object
A variable that contains the IIsFtpInfo object, usually as a result of a previous GetObject operation.
Method
The object method chosen.
Properties
Windows ADSI Object Properties

Metabase Properties
LogModuleList

Methods
Windows ADSI Object Methods Standard methods for ADSI objects.


IIsFtpServer (ADSI)

You can use the IIsFtpServer object to set metabase properties that apply to a specific FTP server and to set inheritable metabase properties for FTP virtual directories. Specific methods are also available to control server operation. FTP servers are identified in the metabase by their index numbers. The first FTP server is number 1, the second is number 2, and so on.

The IIsFtpServer object is an ADSI container object.

ADsPath
IIS://MachineName/MSFTPSVC/N

where MachineName can be any name or LocalHost.

Syntax

varReturn= object.Method

Parameters
varReturn
A variable that receives the return value from the method.
object
A variable that contains the IIsFtpServer object, usually as a result of a previous GetObject operation.
Method
The object method chosen.
Can Contain
IIsFtpVirtualDir (ADSI)
Properties
Windows ADSI Object Properties
Metabase Properties
A -I |
AccessFlags | ConnectionTimeout
AdminACL | DefaultLogonDomain
AllowAnonymous | DisableSocketPooling
AnonymousOnly | DontLog
AnonymousPasswordSync | ExitMessage
AnonymousUserName | FtpDirBrowseShowLongDate
AnonymousUserPass | GreetingMessage
IPSecurity |
Log... |
LogAnonymous | LogExtFileFlags
LogFileDirectory | LogFileLocaltimeRollover
LogFilePeriod | LogFilePeriod
LogFileTruncateSize | LogNonAnonymous
LogOdbcDataSource | LogOdbcPassword
LogOdbcTableName | LogOdbcUserName
LogPluginClsid | LogType
M-S |
MaxClientsMessage | ServerBindings
MaxConnections | ServerComment
MaxEndpointConnections | ServerListenBacklog
MSDOSDirOutput | ServerListenTimeout
Realm | ServerSize
ServerAutoStart | ServerState
Methods
IIsFtpServer.Continue (ADSI) | Resumes the server.
IIsFtpServer.Pause (ADSI) | Pauses the server.
IIsFtpServer.Start (ADSI) | Starts the server.
IIsFtpServer.Status (ADSI) | Retrieves the current status of the server.
IIsFtpServer.Stop (ADSI) | Stops the server.
Related Topics
Windows ADSI Object Methods | Standard methods for ADSI objects.
Windows ADSI Container Object Methods | Standard methods for ADSI container objects.


IIsFtpServer.Continue (ADSI)

The Continue method of the IIsFtpServer (ADSI) object continues the server operation after it has been paused.

Syntax

IIsFtpServer.Continue

Code Example
<%
  Dim ServerObj
  'Continue the second FTP server.
  Set ServerObj = GetObject("IIS://LocalHost/MSFTPSVC/2")
  ServerObj.Continue
%>
Related Topics
  • For information on other methods in the IIsFtpServer object, see IIsFtpServer (ADSI).


IIsFtpServer.Pause (ADSI)

The Pause method of the IIsFtpServer (ADSI) object pauses the server operation.

Syntax

IIsFtpServer.Pause

Code Example
<%
  Dim ServerObj
  'Pause the second FTP server.
  Set ServerObj = GetObject("IIS://LocalHost/MSFTPSVC/2")
  ServerObj.Pause
%>
Related Topics
  • For information on other methods in the IIsFtpServer object, see IIsFtpServer (ADSI).


IIsFtpServer.Start (ADSI)

The Start method of the IIsFtpServer (ADSI) object starts the server operation.

Syntax

IIsFtpServer.Start

Code Example
<%
  Dim ServerObj
  'Start the second FTP server.
  Set ServerObj = GetObject("IIS://LocalHost/MSFTPSVC/2")
  ServerObj.Start
%>
Related Topics
  • For information on other methods in the IIsFtpServer object, see IIsFtpServer (ADSI).


IIsFtpServer.Status (ADSI)

The Status method of the IIsFtpServer (ADSI) object returns an integer that indicates the current status of the server. The possible values are 1 (starting), 2 (started), 3 (stopping), 4 (stopped), 5 (pausing), 6 (paused), or 7 (continuing).

Syntax

IIsFtpServer.Status

Related Topics
  • For information on other methods in the IIsFtpServer object, see IIsFtpServer (ADSI).


IIsFtpServer.Stop (ADSI)

The Stop method of the IIsFtpServer (ADSI) object stops the server operation.

Syntax

IIsFtpServer.Stop

Code Example
<%
  Dim ServerObj
  'Stop the second FTP server.
  Set ServerObj = GetObject("IIS://LocalHost/MSFTPSVC/2")
  ServerObj.Stop
%>
Related Topics
  • For information on other methods in the IIsFtpServer object, see IIsFtpServer (ADSI).


IIsFtpService (ADSI)

You can use the IIsFtpService object to set the metabase property values that control FTP sites and FTP virtual directories. The IIsFtpService object is an ADSI container object.

ADsPath
IIS://MachineName/MSFTPSVC

where MachineName can be any name or LocalHost.

Syntax

varReturn= object.Method

Parameters
varReturn
A variable that receives the return value from the method.
object
A variable that contains the IIsFtpService object, usually as a result of a previous GetObject operation.
Method
The object method chosen.
Can Contain
IIsFtpServer (ADSI) IIsFtpInfo (ADSI)
Properties
Windows ADSI Object Properties
Metabase Properties
AccessFlags | DirectoryLevelsToScan
AdminACL | DisableSocketPooling
AllowAnonymous | DontLog
AnonymousOnly | ExitMessage
AnonymousPasswordSync | FtpDirBrowseShowLongDate
AnonymousUserName | GreetingMessage
AnonymousUserPass | IPSecurity
ConnectionTimeout |
Log... |
LogExtFileFlags | LogOdbcDataSource
LogAnonymous | LogOdbcPassword
LogFileDirectory | LogOdbcTableName
LogFileLocaltimeRollover | LogOdbcUserName
LogFilePeriod | LogPluginClsid
LogFileTruncateSize | LogType
LogNonAnonymous |
M-S |
MaxClientsMessage | ServerBindings
MaxConnections | ServerComment
MaxEndpointConnections | ServerListenBacklog
MSDOSDirOutput | ServerListenTimeout
Realm | ServerSize
ServerAutoStart |
Methods
Windows ADSI Object Methods | Standard methods for ADSI objects.
Windows ADSI Container Object methods | Standard methods for ADSI container objects.


IIsFtpVirtualDir (ADSI)

You can use the IIsFtpVirtualDir object to set metabase properties that apply to one or all FTP virtual directories for an FTP server. If you use this object at the server's root virtual directory (for example, .../MSFTPSVC/2/ROOT), inheritable property values will apply to all FTP virtual subdirectories of the root virtual directory of the second FTP server. You can set properties for a specific FTP virtual directory by using the IIsFtpVirtualDir object for a specific virtual directory (for example, .../MSFTPSVC/2/ROOT/AVDir).

The IIsFtpVirtualDir object is an ADSI container object.

ADsPath

For the server's root virtual directory,

IIS://MachineName/MSFTPSVC/N/ROOT

where MachineName can be any name or LocalHost.

For a specific virtual directory,

IIS://MachineName/MSFTPSVC/N/ROOT/vdirName

where MachineName can be any name or LocalHost.

Syntax

varReturn= object.Method

Parameters
varReturn
A variable that receives the return value from the method.
object
A variable that contains the IIsFtpVirtualDir object, usually as a result of a previous GetObject operation.
Method
The object method chosen.
Can Contain
IIsFtpVirtualDir
Properties
Windows ADSI Object Properties
Metabase Properties
AccessFlags | Path
DontLog | UNCPassword
FtpDirBrowseShowLongDate | UNCUserName
IPSecurity |
Methods
Windows ADSI Object Methods | Standard methods for ADSI objects.
Windows ADSI Container Object Methods | Standard methods for ADSI container objects.


IIsIPSecurity (ADSI)

The IIsIPSecurity object is a custom ADSI object that you can use to set access permissions by IP address and domain address.

The IIsIPSecurity Boolean property, GrantByDefault, determines if access by users is granted or denied by default.

If GrantByDefault is set to TRUE, all IP addresses and Internet domains are granted access, except those you specify to be denied. Use IPDeny and DomainDeny to deny access to specific IP addresses and domains.

note Note IPDeny and DomainDeny are only valid if GrantByDefault is set to TRUE.

If GrantByDefault is set to FALSE, all IP addresses and domains are denied access by default, except those you specify to be granted access. Use IPGrant and DomainGrant to grant access to specific IP addresses and domains.

Also note that IPGrant and DomainGrant are only valid if GrantByDefault is set to FALSE.

ADsPath

For the server's root virtual directory,

IIS://MachineName/W3SVVC/N/ROOT

where MachineName can be any name or LocalHost.

For a specific virtual directory,

IIS://MachineName/W3SVC/N/ROOT/vdirName

where MachineName can be any name or LocalHost.

Syntax

varReturn= object.Method

Parameters
varReturn
A variable that receives the return value from the method.
object
A variable that contains the IIsIPSecurity object, usually as a result of a previous GetObject operation.
Method
The object method chosen.
Valid Locations
Key Type | Metabase Path
IIsWebService (ADSI) | /LM/W3SVC/
IIsWebServer (ADSI) | /LM/W3SVC/1
IIsWebFile (ADSI) | /LM/W3SVC/1/ROOT/vdirName/text.htm
IIsWebDirectory (ADSI) | /LM/W3SVC/1/ROOT/vdirName/subdirectory
IIsFtpVirtualDir (ADSI) | /LM/SMFTPSVC/1/ROOT/vdirName
IIsFtpService (ADSI) | /LM/SMFTPSVC/
IIsFtpServer (ADSI) | /LM/SMFTPSVC/1
IIsWebVirtualDir (ADSI) | /LM/W3SVC/1/ROOT/Samples

IIsIPSecurity Properties
IIsIPSecurity.IPDeny (ADSI) | This method accesses an array of IP addresses that are not allowed access to the server.
IIsIPSecurity.IPGrant (ADSI) | This method accesses an array of IP addresses that are allowed access to the server.
IIsIPSecurity.DomainDeny (ADSI) | This method accesses an array of domains that are not allowed access to the server.
IIsIPSecurity.DomainGrant (ADSI) | This method accesses an array of domains that are allowed access to the server.
IIsIPSecurity.GrantByDefault (ADSI) | This Boolean property determines if access is granted by default. If GrantByDefault is set to TRUE, you can use IPDeny and DomainDeny to deny access by specific IP addresses and domains. If GrantByDefault is set to FALSE, you can use IPGrant and DomainGrant to grant access by specific IP addresses and domains. note Note This property is valid only when used in the context of the IIsIPSecurity object.

Metabase Properties
Windows ADSI Object Properties | A list of properties valid at multiple objects.
IPSecurity | This property specifies the IP access restrictions for a URL. It can be used to grant or deny access to client browsers based on either their IP address or DNS host name.


IIsIPSecurity.IPDeny (ADSI)

You can use the IPDeny property of the IIsIPSecurity (ADSI) object to edit lists of IP addresses, held in an array, that are not allowed access to the server.

Syntax

SecObj.IPDeny = "IPAddress,SubnetMask"

varIPDeny = SecObj.IPDeny

Parameters
SecObj
An IIS ADSI Object of type IIsIPSecurity.
IPAddress
A specific IP address that you want to deny access to the server.
SubnetMask
The subnet mask for the specified IP address.
Code Example
<%
  ' Remember to enable Integrated Windows authentication and
  ' disable Anonymous Access or you will get a Server 500 error.
  Dim SecObj
  Dim MyIPSec
  Dim IPList

  ' Get the IIS object that holds the info for the default site.
  ' This could be any site root/vdir, or IIS://LocalHost/W3SVC for global
  ' properties.
  Set SecObj = GetObject("IIS://LocalHost/W3SVC/1/Root")

  ' Get the IIsIPSecurity object.
  Set MyIPSec = SecObj.IPSecurity
  ' Make sure GrantByDefault=TRUE or your changes will not count.
  If (FALSE = MyIPSec.GrantByDefault) Then
Response.Write
  "<BR>GrantByDefault was not TRUE. Setting to TRUE.<BR>"
MyIPSec.GrantByDefault = TRUE
  End If
  ' Get the Deny list as an array, and add your new restricted IP address.
  IPList = MyIPSec.IPDeny
  Redim IPList (Ubound(IPList)+1)
  IPList (Ubound(IPList)) = "123.0.0.1,255.255.255.0"

  ' Set the new lists back in the metabase in two stages, and then set
  ' the metabase.
  MyIPSec.IPDeny = IPList
  SecObj.IPSecurity = MyIPSec
  SecObj.Setinfo
  Response.Write "The IPRestriction has been set<BR>"
%>
Related Topics
  • For information on other methods in the IIsIPSecurity object, see IIsIPSecurity (ADSI).


IIsIPSecurity.IPGrant (ADSI)

You can use the IPGrant property of the IIsIPSecurity (ADSI) object to edit lists of IP addresses, in an array, that are not allowed access to the server.

Syntax

SecObj.IPGrant = "IPAddress,SubnetMask"

varIPGrant = SecObj.IPGrant

Parameters
SecObj
An IIS ADSI Object of type IIsIPSecurity.
IPAddress
A specific IP address that you want to grant access to the server.
SubnetMask
The subnet mask for the specified IP address.
Code Example

<%

  ' Remember to enable Integrated Windows authentication and

  ' disable Anonymous Access, or you will get a Server 500 error.

  Dim SecObj

  Dim MyIPSec

  Dim IPList

  ' Get the IIS object that holds the info for the default site.

  ' This could be any site root/vdir, or IIS://LocalHost/W3SVC for global

  ' properties.

  Set SecObj = GetObject("IIS://LocalHost/W3SVC/1/Root")

  ' Get the IIsIPSecurity object.

  Set MyIPSec = SecObj.IPSecurity

  ' Make sure GrantByDefault=FALSE or your changes will not count.

  If (TRUE = MyIPSec.GrantByDefault) Then

Response.Write

  "<BR>GrantByDefault was not FALSE.  Setting to FALSE.<BR>"

MyIPSec.GrantByDefault = FALSE

  End If

  ' Get the Grant list as an array, and add your newly allowed IP address

  IPList = MyIPSec.IPGrant

  Redim IPList (Ubound(IPList)+1)

  IPList (Ubound(IPList)) = "123.0.0.1,255.255.255.0"

  ' Set the new lists back in the metabase in two stages, and then set

  ' the metabase.

  MyIPSec.IPGrant = IPList

  SecObj.IPSecurity = MyIPSec

  SecObj.Setinfo

  Response.Write "The IPRestriction has been set<BR>"

%>

Related Topics
  • For information on other methods in the IIsIPSecurity object, see IIsIPSecurity (ADSI).


IIsIPSecurity.DomainDeny (ADSI)

You can use the DomainDeny property of the IIsIPSecurity (ADSI) object to edit lists of domains that are not allowed access to the server.

Syntax

SecObj.DomainDeny = Domain

VarDomainDeny = SecObj.DomainDeny

Parameters
SecObj
An IIS ADSI Object of type IIsIPSecurity.
Domain
The domain that you want denied access to the server.
Code Example

<%

  ' Remember to enable Integrated Windows authentication and

  ' disable Anonymous Access, or you will get a Server 500 error.

  Dim SecObj

  Dim MyIPSec

  Dim DomainList

  ' Get the IIS object that holds the info for the default site.

  ' This could be any site root/vdir, or IIS://LocalHost/W3SVC for global

  ' properties.

  Set SecObj = GetObject("IIS://LocalHost/W3SVC/1/Root")

  ' Get the IIsIPSecurity object.

  Set MyIPSec = SecObj.IPSecurity

  ' Make sure GrantByDefault=TRUE, or your changes will not count.

  If (FALSE = MyIPSec.GrantByDefault) Then

Response.Write

  "<BR>GrantByDefault was not TRUE.  Setting to TRUE.<BR>"

MyIPSec.GrantByDefault = TRUE

  End If

  ' Get the Deny list as an array, and add your new restricted domain.

  DomainList = MyIPSec.DomainDeny

  Redim DomainList (Ubound(DomainList)+1)

  DomainList (Ubound(DomainList)) = "somedomain.com"

  ' Set the new lists back in the metabase in two stages, and then set

  ' the metabase.

  MyIPSec.DomainDeny = DomainList

  SecObj.Setinfo

  Response.Write "The IPRestriction has been set<BR>"

%>

Related Topics
  • For information on other methods in the IIsIPSecurity object, see IIsIPSecurity (ADSI).


IIsIPSecurity.DomainGrant (ADSI)

You can use the DomainGrant property of the IIsIPSecurity (ADSI) object to edit lists of domains that are allowed access to the server.

Syntax

SecObj.DomainGrant = Domain

varDomainGrant = SecObj.DomainGrant

Parameters
SecObj
An IIS ADSI Object of type IIsIPSecurity.
Domain
The domain you want granted access to the server.
Code Example

<%

  ' Remember to enable Integrated Windows authentication and

  ' disable Anonymous Access, or you will get a Server 500 error.

  Dim SecObj

  Dim MyIPSec

  Dim DomainList

  ' Get the IIS object that holds the info for the default site.

  ' This could be any site root/vdir, or IIS://LocalHost/W3SVC for global

  ' properties.

  Set SecObj = GetObject("IIS://LocalHost/W3SVC/1/Root")

  ' Get the IIsIPSecurity object.

  Set MyIPSec = SecObj.IPSecurity

  ' Make sure GrantByDefault=FALSE, or your changes will not count.

  If (TRUE = MyIPSec.GrantByDefault) Then

Response.Write

  "<BR>GrantByDefault was not FALSE.  Setting to FALSE.<BR>"

MyIPSec.GrantByDefault = FALSE

  End If

  ' Get the Grant list as an array, and add your newly allowed domain.

  DomainList = MyIPSec.DomainGrant

  Redim DomainList (Ubound(DomainList)+1)

  DomainList (Ubound(DomainList)) = "somedomain.com"

  ' Set the new lists back in the metabase in two stages, and then set

  ' the metabase.

  MyIPSec.DomainGrant = DomainList

  SecObj.Setinfo

  Response.Write "The IPRestriction has been set<BR>"

%>

Related Topics
  • For information on other methods in the IIsIPSecurity object, see IIsIPSecurity (ADSI).


IIsIPSecurity.GrantByDefault (ADSI)

You can use the GrantByDefault property of the IIsIPSecurity (ADSI) object to set how you want to specify server access. GrantByDefault is a Boolean property that determines whether the default setting is grant all with exceptions or deny all with exceptions. If GrantByDefault is TRUE, all IP addresses and domains are granted access to the server (with the exception of the list entries of the DomainDeny and IPDeny methods). If GrantByDefault is FALSE, all IP addresses and domains are denied access to the server (with the exception of the list entries of the DomainGrant and IPGrant methods).

Syntax

SecObj.GrantByDefault = Boolean

Parameters
SecObj
An IIS ADSI Object of type IIsIPSecurity.
Boolean
A value of TRUE or FALSE.
Code Example

<%

  ' Remember to enable Integrated Windows authentication and

  ' disable Anonymous Access, or you will get a Server 500 error.

  Dim SecObj

  Dim MyIPSec

  ' Get the IIS object that holds the info for the default site.

  ' This could be any site root/vdir, or IIS://LocalHost/W3SVC for global

  ' properties.

  Set SecObj = GetObject("IIS://LocalHost/W3SVC/1/Root")

  ' Get the IIsIPSecurity object.

  Set MyIPSec = SecObj.IPSecurity

  If (TRUE = MyIPSec.GrantByDefault) Then

Response.Write

  "<BR>GrantByDefault was set to TRUE.  Setting to FALSE.<BR>"

MyIPSec.GrantByDefault = FALSE

  Else 'If (FALSE = MyIPSec.GrantByDefault) Then

Response.Write

  "<BR>GrantByDefault was set to FALSE.  Setting to TRUE.<BR>"

MyIPSec.GrantByDefault = TRUE

  End If

  ' Set the info in the database

  SecObj.IPSecurity = MyIPSec

  SecObj.Setinfo

%>

Related Topics
  • For information on other methods in the IIsIPSecurity object, see IIsIPSecurity (ADSI).


IIsLogModule (ADSI)

You can use the IIsLogModule object to set metabase properties that affect the operation of logging modules. You can set filter properties at the computer level (IIsComputer), at the FTP and World Wide Web Publishing Service (WWW service) level, or for an individual FTP or Web server.

The IIsLogModule object is an ADSI object but not an ADSI container object.

ADsPath
IIS://MachineName/LOGGING/LogModuleName

where MachineName can be any name or LocalHost, and LogModuleName is the name of a log module.

Syntax

varReturn= object.Method

Parameters
varReturn
A variable that receives the return value from the method.
object
A variable that contains the IIsLogModule object, usually as a result of a previous GetObject operation.
Method
The object method chosen.
Properties
Windows ADSI Object Properties
Metabase Properties
LogModuleId LogModuleUiId
Methods
Windows ADSI Object Methods Standard methods for ADSI objects.


IIsLogModules (ADSI)

The IIsLogModules object is an ADSI container object that contains the collection of IIsLogModule objects. You can use the IIsLogModules object to manage log modules at the computer level (IIsComputer).

The IIsLogModules object is an ADSI container object.

ADsPath
IIS://MachineName/LOGGING

where MachineName can be any name or LocalHost.

Syntax

varReturn= object.Method

Parameters
varReturn
A variable that receives the return value from the method.
object
A variable that contains the IIsLogModules object, usually as a result of a previous GetObject operation.
Method
The object method chosen.
Can Contain
IIsLogModule (ADSI)

Properties
Windows ADSI Object Properties

Methods
Windows ADSI Object Methods | Standard methods for ADSI objects.
Windows ADSI Container Object Methods | Standard methods for ADSI container objects.

Code Example
<%
'Get log properties for a log module at a server.
  Dim LoggingModules, CurrentObj
'Get the object for the first Web server.
  Set CurrentObj = GetObject("IIS://LocalHost/W3SVC/1")
'Access the log modules at the computer level.
  Set LoggingModules = GetObject("IIS://LocalHost/logging")
'Loop through the installed modules to find the currently
'selected module at this server.
  If CurrentObj.LogPluginClsid <> "" Then
    For Each LogModule in LoggingModules
      If LogModule.LogModuleID = CurrentObj.LogPluginClsid Then
      Response.Write LogModule.Name & "<BR>"
      End If
    Next
  'Display a property of the current module.
  Response.Write CurrentObj.LogFileDate
  End If
%>


IIsMimeMap (ADSI)

You can use the IIsMimeMap object to set the inherited Multipurpose Internet Mail Extensions (MIME) mappings used by the Web servers.

The IIsMimeMap object is an ADSI object but not an ADSI container object.

ADsPath
IIS://MachineName/MIMEMAP

where MachineName can be any name or LocalHost.

Syntax

varReturn= object.Method

Parameters
varReturn
A variable that receives the return value from the method.
object
A variable that contains the IIsMimeMap object, usually as a result of a previous GetObject operation.
Method
The object method chosen.
Properties
Windows ADSI Object Properties
Metabase Properties
MimeMap
Methods
Windows ADSI Object Methods Standard methods for ADSI objects.
Code Example
<%
  Dim MimeMapObj, aMimeMap, MMType, MMExtension, i, aMimeMapNew()
  Const ADS_PROPERTY_UPDATE = 2
'Get the mimemap object.
  Set MimeMapObj = GetObject("IIS://LocalHost/MimeMap")
'Get the mappings from the MimeMap property.
  aMimeMap = MimeMapObj.GetEx("MimeMap")
' Display the mappings.
  ShowMM(MimeMapObj)
' Add a new mapping.
  i = UBound(aMimeMap) + 1
  Redim Preserve aMimeMap(i)
  Set aMimeMap(i) = CreateObject("MimeMap")
  aMimeMap(i).Extension = ".jnq"
  aMimeMap(i).MimeType = "junque/my-junque"
  MimeMapObj.PutEx ADS_PROPERTY_UPDATE, "MimeMap", aMimeMap
  MimeMapObj.SetInfo
' Display the mappings.
  ShowMM(MimeMapObj)
'Delete a mapping by copying to a new map array.
  i = 0
  For Each MMItem in aMimeMap
    If MMItem.Extension <> ".jnq" Then
      Redim Preserve aMimeMapNew(i)
      Set aMimeMapNew(i) = CreateObject("MimeMap")
      aMimeMapNew(i).Extension = MMItem.Extension
      aMimeMapNew(i).MimeType = MMItem.MimeType
      i = i + 1
    End If
  Next
  MimeMapObj.PutEx ADS_PROPERTY_UPDATE, "MimeMap", aMimeMapNew
  MimeMapObj.SetInfo
'Display the mappings.
  ShowMM(MimeMapObj)
'Subroutine to display the mappings in a table.
  Sub ShowMM(MMObj)
  aMM = MMObj.GetEx("MimeMap")
'Set up table to display mappings.
  Response.Write "<HR><TABLE BORDER><CAPTION><B>MIME Maps</B></CAPTION>"
  Response.Write "<TR><TH>Type</TH><TH>Extension</TH>"
'Display the mappings in the table.
  For Each MM in aMM
    Response.Write "<TR><TD>" & MM.MimeType & "</TD>"
    Response.Write "<TD>" & MM.Extension & "</TD></TR>"
  Next
  Response.Write "</TABLE>"
  End Sub
%>


IIsMimeType (ADSI)

The MimeMap property contains an array of IISMimeType objects. To add to the array, create a new IISMimeType object, set its MimeType, create the Extension, add the element to the MimeMap array, and set it in ADSI.

The IIsMimeType object is a custom ADSI Automation object.

Syntax

varMimeMap= object.MimeMap

Set objMimeType = aMimeMap(0)

Parameters
aMimeMap
A variable that receives the list of IIsMimeType objects.
object
A variable that supports the MimeType property, usually as a result of a previous GetObject operation.
objMimeType
An object variable that receives the IIsMimeType object.
Can Contain

This object cannot contain any other objects.

Properties

Windows ADSI Object Properties

Metabase Properties
MimeMap This property provides a list of the file name extensions for Multipurpose Internet Mail Extensions (MIME) mappings. MimeMap is an array of IISMimeType objects.
Object Properties
IIsMimeType.MimeType (ADSI) | This property can be used to GET and PUT the MimeType for the object.
IIsMimeType.Extension (ADSI) | This property can be used to GET and PUT the file name extension assigned to the object.
Related Topics

IIsMimeMap (ADSI), MimeMap


IIsMimeType.MimeType (ADSI)

You can use the MimeType property of the IIsMimeType (ADSI) object to GET and PUT the MIME types for objects of type IISMimeType.

Syntax

DirObj.MimeType=string

Parameters
DirObj
An IIS ADSI Object of type IIsMimeType.
string
A string that specifies the MIME type for the object.
Code Example
<%
Dim MimeMapObj
Dim MimeMapList
Const ADS_PROPERTY_UPDATE = 2
Dim NewMimeMapSize

' Use GetEx to retrieve the MimeMap Array
Set MimeMapObj = GetObject("IIS://localhost/MimeMap")
MimeMapList = MimeMapObj.GetEx("MimeMap")

' Create a new item in the array
NewMimeMapSize = UBound(MimeMapList) + 1
Redim preserve MimeMapList (NewMimeMapSize)

' Create our new MimeType item
Set MimeMapList(NewMimeMapSize) = CreateObject("MimeMap")
MimeMapList(NewMimeMapSize).Extension = ".log"
MimeMapList(NewMimeMapSize).MimeType = "text/plain"

' Use PutEx to UPDATE the MimeMap array with our new array
MimeMapObj.PutEx ADS_PROPERTY_UPDATE, "MimeMap", MimeMapList
MimeMapObj.SetInfo
%>
Related Topics
  • For information on other methods in the IIsMimeType object, see IIsMimeType (ADSI).


IIsMimeType.Extension (ADSI)

You can use the Extension property of the IIsMimeType (ADSI) object to specify the MIME type of the file name extension.

Syntax

DirObj.Extension = String

Parameters
DirObj
An IIS ADSI Object of type IIsMimeType.
String
The specific file name extension associated with the MIME type specified in the IIsMimeType.MimeType (ADSI) property.
Code Example
<%
Dim MimeMapObj
Dim MimeMapList
Const ADS_PROPERTY_UPDATE = 2
Dim NewMimeMapSize

' Use GetEx to retrieve the MimeMap Array
Set MimeMapObj = GetObject("IIS://localhost/MimeMap")
MimeMapList = MimeMapObj.GetEx("MimeMap")

' Create a new item in the array
NewMimeMapSize = UBound(MimeMapList) + 1
Redim preserve MimeMapList (NewMimeMapSize)

' Create our new MimeType item
Set MimeMapList(NewMimeMapSize) = CreateObject("MimeMap")
MimeMapList(NewMimeMapSize).Extension = ".log"
MimeMapList(NewMimeMapSize).MimeType = "text/plain"

' Use PutEx to UPDATE the MimeMap array with our new array
MimeMapObj.PutEx ADS_PROPERTY_UPDATE, "MimeMap", MimeMapList
MimeMapObj.SetInfo
%>
Related Topics
  • For information on other methods in the IIsMimeType object, see IIsMimeType (ADSI).


IIsWebDirectory (ADSI)

The IIsWebDirectory object is used to set metabase properties that apply to one or more Web directories for a Web server. When you use the IIsWebDirectory object to set metabase properties for a Web directory, inheritable properties will apply to all subdirectories and files.

You also can use IIsWebDirectory methods to create and manage Web applications in Web directories and subdirectories. Applications can also be defined and managed in virtual directories by using IIsWebVirtualDir (ADSI).

The IIsWebDirectory object is an ADSI container object.

ADsPath
IIS://MachineName/W3SVC/N/ROOT/vdirName/DirName

where MachineName can be any name or LocalHost.

Syntax

varReturn= object.Method

Parameters
varReturn
A variable that receives the return value from the method.
object
A variable that contains the IIsWebDirectory object, usually as a result of a previous GetObject operation.
Method
The object method chosen.
Can Contain
IIsWebDirectory IIsWebFile (ADSI)
Properties
Windows ADSI Object Properties
Metabase Properties
A - Asp... |
AccessFlags | AspEnableChunkedEncoding
AccessSSLFlags | AspEnableParentPaths
AnonymousPasswordSync | AspEnableTypelibCache
AnonymousUserName | AspErrorsToNTLog
AnonymousUserPass | AspExceptionCatchEnable
AppAllowClientDebug | AspLogErrorRequests
AppAllowDebugging | AspProcessorThreadMax
AppFriendlyName | AspQueueConnectionTestTime
AppIsolated | AspQueueTimeout
AppOopRecoverLimit | AspRequestQueueMax
AppPackageID | AspScriptEngineCacheMax
AppPackageName | AspScriptErrorMessage
AppRoot | AspScriptErrorSentToBrowser
AppWamClsid | AspScriptFileCacheSize
AspAllowOutOfProcComponents | AspScriptLanguage
AspAllowSessionState | AspScriptTimeout
AspBufferingOn | AspSessionMax
AspCodepage | AspSessionTimeout
AspEnableApplicationRestart | AspTrackThreadingModel
AspEnableAspHtmlFallback |
Auth... - U |
AuthFlags | EnableReverseDns
AuthPersistence | HttpCustomHeaders
CacheControlCustom | HttpErrors
CacheControlMaxAge | HttpExpires
CacheControlNoCache | HttpPics
CacheISAPI | HttpRedirect
ContentIndexed | IPSecurity
CreateCGIWithNewConsole | LogonMethod
CreateProcessAsUser | MimeMap
DefaultDoc | PoolIdcTimeout
DefaultDocFooter | Realm
DefaultLogonDomain | RedirectHeaders
DirBrowseFlags | ScriptMaps
DontLog | SSIExecDisable
EnableDocFooter | UploadReadAheadSize
Methods
IIsWebDirectory.AppCreate (ADSI) | Creates an application at a specified metabase key (the parameter is a Boolean).
IIsWebDirectory.AppCreate2 (ADSI) | Creates an application at a specified metabase key (the parameter is a Long).
IIsWebDirectory.AppDelete (ADSI) | Deletes an application definition at a specified key.
IIsWebDirectory.AppDeleteRecursive (ADSI) | Deletes application definitions at a specified key and subkeys.
IIsWebDirectory.AppDisable (ADSI) | Disables an application at a specified key.
IIsWebDirectory.AppDisableRecursive (ADSI) | Disables applications at a specified key and subkeys.
IIsWebDirectory.AppEnable (ADSI) | Enables an application that was previously disabled at a specified key.
IIsWebDirectory.AppEnableRecursive (ADSI) | Enables applications that were previously disabled at a specified key and subkeys.
IIsWebDirectory.AppGetStatus (ADSI) | Retrieves the status of an application.
IIsWebDirectory.AppUnload (ADSI) | Unloads an application at a specified key.
IIsWebDirectory.AppUnloadRecursive (ADSI) | Unloads applications at a specified key and subkeys.
IIsWebDirectory.AspAppRestart (ADSI) | Restarts the ASP application that invoked it.
Related Topics
  • For information on Standard methods for ADSI objects, see Windows ADSI Object Methods.
  • For information on Standard methods for ADSI container objects, see Windows ADSI Container Object Methods.
Remarks

Web directories can be nested and are addressed with the path to the directory, including the directory name (for example, .../vdirName/Dir1/Dir1a/Dir1ab, and so on).


IIsWebDirectory.AppCreate (ADSI)

You can use the AppCreate method of the IIsWebDirectory (ADSI) or IIsWebVirtualDir (ADSI) object to create a Web application definition and mark it as running in-process or out-of-process. If an application already exists at the specified path, you can use this method to reconfigure the application from in-process to out-of-process, or the reverse.

Syntax

DirObj.AppCreate InProcFlag

Parameters
DirObj
An IIS ADSI object of type IIsWebDirectory or IIsWebVirtualDir.
InProcFlag
Specifies whether the application being created is to run in-process (TRUE) or out-of-process (FALSE). If the application already exists and is running in-process, specifying this flag as FALSE will cause the application definition to be deleted and a new application created to run out-of-process. If the application already exists and is running out-of-process, specifying this flag as TRUE will cause the application definition to be deleted and a new application created to run in-process. If the application exists, and the setting of InProcFlag matches the application's existing in-process or out-of-process status, then this method will cause no change to the application definition.
Code Example
<%
  Dim DirObj
  Const INPROC = True
  Const OUTPROC = False
  Set DirObj = GetObject("IIS://LocalHost/W3SVC/1/ROOT/MyAppDir")
  'Create an application in-process.
  DirObj.AppCreate INPROC
%>
Related Topics
  • For information on other methods in the IIsWebDirectory object, see IIsWebDirectory (ADSI).


IIsWebDirectory.AppCreate2 (ADSI)

You can use the AppCreate2 method of the IIsWebDirectory (ADSI) or IIsWebVirtualDir (ADSI) object to create a Web application definition and mark it as running in-process, out-of-process, or in a process pool. If an application already exists at the specified path, you can use this method to reconfigure the application to run in whatever process space you want.

Syntax

DirObj.AppCreate2 InProcFlag

Parameters
DirObj
An IIS ADSI object of type IIsWebDirectory or IIsWebVirtualDir.
InProcFlag
Binary value that specifies whether the application being created is to run in-process (0), out-of-process (1), or in a pooled process (2). If the application already exists and is running, changing the value of this flag will cause the application definition to be deleted and a new application created to run in the specified process space.
Code Example
<%
  Dim DirObj
  Const INPROC = 0
  Const OUTPROC = 1
  Const POOLED = 2
  Set DirObj = GetObject("IIS://LocalHost/W3SVC/1/ROOT/MyAppDir")
  'Create the application in-process.
  DirObj.AppCreate2 POOLED
%>
Related Topics
  • For information on other methods in the IIsWebDirectory object, see IIsWebDirectory (ADSI).


IIsWebDirectory.AppDelete (ADSI)

You can use the AppDelete method of the IIsWebDirectory (ADSI) or IIsWebVirtualDir (ADSI) object to delete a Web application definition from a metabase key. If the application is running, it will be shut down. If the application is in-process with IIS, all resources associated with the application (such as out-of-process applications) will be released if the resource is not referenced by another in-process application.

note Note Server component DLLs are not released from in-process applications, even if they are not currently referenced by other applications.

Deletions performed by using AppDelete cannot be undone.

Syntax

DirObj.AppDelete

Parameters
DirObj
An IIS ADSI object of type IIsWebDirectory or IIsWebVirtualDir.
Code Example
<%
  Dim DirObj
  Set DirObj = GetObject("IIS://LocalHost/W3SVC/1/ROOT/MyAppDir")
  'Delete the application at this directory.
  DirObj.AppDelete
%>
Related Topics
  • For information on other methods in the IIsWebDirectory object, see IIsWebDirectory (ADSI).


IIsWebDirectory.AppDeleteRecursive (ADSI)

You can use the AppDeleteRecursive method of the IIsWebDirectory (ADSI) or IIsWebVirtualDir (ADSI) object to delete Web application definitions from a metabase key and all subkeys. If the applications are running, they will be shut down. If the application is in-process with IIS, all resources associated with the application (such as out-of-process packages) will be released if the resource is not referenced by another in-process application.

note Note Server component DLLs are not released from in-process applications, even if they aren't currently referenced by other applications.

Deletions performed using AppDeleteRecursive cannot be undone.

Syntax

DirObj.AppDeleteRecursive

Parameters
DirObj
An IIS ADSI object of type IIsWebDirectory or IIsWebVirtualDir.
Code Example
<%
  Dim DirObj
  Set DirObj = GetObject("IIS://LocalHost/W3SVC/1/ROOT/MyAppDir")
  'Delete the application at this directory
  'and all subdirectories.
  DirObj.AppDeleteRecursive
%>
Related Topics
  • For information on other methods in the IIsWebDirectory object, see IIsWebDirectory (ADSI).


IIsWebDirectory.AppDisable (ADSI)

You can use the AppDisable method of the IIsWebDirectory (ADSI) or IIsWebVirtualDir (ADSI) object to disable a Web application that is running out-of-process. All of the application's resources are released and the application's process is terminated. Attempts to access this application will fail. You can use the AppEnable method to re-enable a disabled application. Both methods are used primarily when moving, copying, or renaming metabase keys. The AppDisable method has no effect if the application is running in-process.

Syntax

DirObj.AppDisable

Parameters
DirObj
An IIS ADSI object of type IIsWebDirectory or IIsWebVirtualDir.
Code Example
<%
  Dim DirObj
  Set DirObj = GetObject("IIS://LocalHost/W3SVC/1/ROOT/MyAppDir")
  'Disable the application at this directory.
  DirObj.AppDisable
%>
Related Topics
  • For information on other methods in the IIsWebDirectory object, see IIsWebDirectory (ADSI).


IIsWebDirectory.AppDisableRecursive (ADSI)

You can use the AppDisableRecursive method of the IIsWebDirectory (ADSI) or IIsWebVirtualDir (ADSI) object to disable Web applications that are running out-of-process. The applications at the specified key and at all subordinate keys will be disabled. All of the application resources are released and the application processes are terminated. Attempts to access this application will fail. You can use the AppEnableRecursive method to re-enable disabled applications. Both methods are used primarily when moving, copying, or renaming metabase keys. The AppDisableRecursive method has no effect if the applications are running in-process.

Syntax

DirObj.AppDisableRecursive

Parameters
DirObj
An IIS ADSI object of type IIsWebDirectory or IIsWebVirtualDir.
Code Example
<%
  Dim DirObj
  Set DirObj = GetObject("IIS://LocalHost/W3SVC/1/ROOT/MyAppDir")
  'Disable the application at this directory
  'and at all subdirectories.
  DirObj.AppDisableRecursive
%>
Related Topics
  • For information on other methods in the IIsWebDirectory object, see IIsWebDirectory (ADSI).


IIsWebDirectory.AppEnable (ADSI)

You can use the AppEnable method of the IIsWebDirectory (ADSI) or IIsWebVirtualDir (ADSI) object to reinstate a Web application definition that was previously disabled with the AppDisable method. If the application specified was not previously deleted, it will be reregistered with Component Services.

Syntax

DirObj.AppEnable

Parameters
DirObj
An IIS ADSI object of type IIsWebDirectory or IIsWebVirtualDir.
Code Example
<%
  Dim DirObj
  Set DirObj = GetObject("IIS://LocalHost/W3SVC/1/ROOT/MyAppDir")
  'Enable the application at this directory.
  DirObj.AppEnable
%>
Related Topics
  • For information on other methods in the IIsWebDirectory object, see IIsWebDirectory (ADSI).


IIsWebDirectory.AppEnableRecursive (ADSI)

You can use the AppEnableRecursive method of the IIsWebDirectory (ADSI) or IIsWebVirtualDir (ADSI) object to reinstate Web application definitions that were previously disabled with the AppDisableRecursive method. If the applications specified were not previously deleted, they will be reregistered with Component Services.

Syntax

DirObj.AppEnableRecursive

Parameters
DirObj
An IIS ADSI object of type IIsWebDirectory or IIsWebVirtualDir.
Code Example
<%
  Dim DirObj
  Set DirObj = GetObject("IIS://LocalHost/W3SVC/1/ROOT/MyAppDir")
  'Enable the application at this directory
  'and at all subdirectories.
  DirObj.AppEnableRecursive
%>
Related Topics
  • For information on other methods in the IIsWebDirectory object, see IIsWebDirectory (ADSI).


IIsWebDirectory.AppGetStatus (ADSI)

You can use the AppGetStatus method of the IIsWebDirectory (ADSI) or IIsWebVirtualDir (ADSI) object to retrieve the current status of a Web application.

Syntax

vReturn = DirObj.AppGetStatus

Parameters
vReturn
Receives the status of the application.
DirObj
An IIS ADSI object of type IIsWebDirectory or IIsWebVirtualDir.
Return Values
APPSTATUS_NOTDEFINED | No application is defined at the specified path.
APPSTATUS_RUNNING | The application is running.
APPSTATUS_STOPPED | The application is not running.

Code Example
<%
  Dim DirObj, vStatus
  Set DirObj = GetObject("IIS://LocalHost/W3SVC/1/ROOT/MyAppDir")
  'Get the status of the application.
  vReturn = DirObj.AppGetStatus
%>
Related Topics
  • For information on other methods in the IIsWebDirectory object, see IIsWebDirectory (ADSI).


IIsWebDirectory.AppUnload (ADSI)

You can use the AppUnload method of the IIsWebDirectory (ADSI) or IIsWebVirtualDir (ADSI) object to unload a Web application that is running out-of-process. All of the application's resources are released and the application's process is terminated. If the application is running in-process, the application is released, if it is not being referenced by any other applications.

note Note Server component DLLs are not released from in-process applications, even if they aren't currently referenced by other applications.

Syntax

DirObj.AppUnload

Parameters
DirObj
An IIS ADSI object of type IIsWebDirectory or IIsWebVirtualDir.
Code Example
<%
  Dim DirObj
  Set DirObj = GetObject("IIS://LocalHost/W3SVC/1/ROOT/MyAppDir")
  'Unload the application at this directory.
  DirObj.AppUnload
%>
Related Topics
  • For information on other methods in the IIsWebDirectory object, see IIsWebDirectory (ADSI).


IIsWebDirectory.AppUnloadRecursive (ADSI)

You can use the AppUnloadRecursive method of the IIsWebDirectory (ADSI) or IIsWebVirtualDir (ADSI) object to unload Web applications that are running out-of-process. The applications at the specified key and at all subordinate keys will be unloaded. All of the application resources are released and the application processes are terminated. If the application is running in-process, the application is released, if it is not being referenced by any other applications.

note Note Server component DLLs are not released from in-process applications, even if they aren't currently referenced by other applications.

Syntax

DirObj.AppUnloadRecursive

Parameters
DirObj
An IIS ADSI object of type IIsWebDirectory or IIsWebVirtualDir.
Code Example
<%
  Dim DirObj
  Set DirObj = GetObject("IIS://LocalHost/W3SVC/1/ROOT/MyAppDir")
  'Unload the application at this directory
  'and all subordinate directories.
  DirObj.AppUnloadRecursive
%>
Related Topics
  • For information on other methods in the IIsWebDirectory object, see IIsWebDirectory (ADSI).


IIsWebDirectory.AspAppRestart (ADSI)

You can use the AspAppRestart method of the IIsWebDirectory (ADSI) or IIsWebVirtualDir (ADSI) object to restart ASP applications. Users can use this method to restart ASP applications without accessing the Global.asa file or stopping and starting the World Wide Web Publishing Service (WWW service) itself. Essentially, a user can restart the application on demand.

Syntax

DirObj.AspAppRestart()

Parameters
DirObj
An ASP application object of type IIsWebDirectory or IIsWebVirtualDir.
Related Topics
  • For information on other methods in the IIsWebDirectory object, see IIsWebDirectory (ADSI).


IIsWebFile (ADSI)

You can use the IIsWebFile object to set metabase key values that apply to a file in a Web directory for a Web virtual server. Metabase property values set for a specific file will override inherited values that have been set at a higher level in the metabase hierarchy.

The IIsWebFile object is an ADSI object but not an ADSI container object.

ADsPath
IIS://MachineName/W3SVC/n/Root/vdirName/DirName/ FileName

where MachineName can be any name or LocalHost.

Syntax

varReturn= object.Method

Parameters
varReturn
A variable that receives the return value from the method.
object
A variable that contains the IIsWebFile object, usually as a result of a previous GetObject operation.
Method
The object method chosen.
Properties
Windows ADSI Object Properties

Metabase Properties

AccessFlags | EnableReverseDns
AccessSSLFlags | HttpCustomHeaders
AnonymousPasswordSync | HttpErrors
AnonymousUserName | HttpExpires
AnonymousUserPass | HttpPics
AuthFlags | HttpRedirect
AuthPersistence | IPSecurity
CacheControlCustom | LogonMethod
CacheControlMaxAge | MimeMap
CacheControlNoCache | PoolIdcTimeout
CreateCGIWithNewConsole |
CreateProcessAsUser | Realm
DefaultDocFooter | RedirectHeaders
DefaultLogonDomain | ScriptMaps
DontLog | SSIExecDisable
EnableDocFooter |
 | UploadReadAheadSize
Methods
Windows ADSI Object Methods Standard methods for ADSI objects.


IIsWebInfo (ADSI)

Some metabase properties associated with the World Wide Web Publishing Service (WWW service) are stored at the Info subkey of the W3SVC key. You can use the IIsWebInfo object to set values for these properties.

The IIsWebInfo object is an ADSI object but not an ADSI container object.

ADsPath
IIS://MachineName/W3SVC/INFO

where MachineName can be any name or "LocalHost."

Syntax

varReturn= object.Method

Parameters
varReturn
A variable that receives the return value from the method.
object
A variable that contains the IIsWebInfo object, usually as a result of a previous GetObject operation.
Method
The object method chosen.
Properties
Windows ADSI Object Properties

Metabase Properties

AdminServer | LogModuleList
CustomErrorDescriptions | ServerConfigFlags
Methods
Windows ADSI Object Methods Standard methods for ADSI objects.


IIsWebServer (ADSI)

You can use the IIsWebServer object to set metabase properties that apply to a specific Web virtual server and to set inheritable metabase properties for virtual directories, Web directories, and Web files. Specific methods are also available to control server operation. Web virtual servers are identified in the metabase by their index numbers. The first Web server is number 1, the second is number 2, and so on.

The IIsWebServer object is an IIS ADSI container object.

ADsPath
IIS://MachineName/W3SVC/N

where MachineName can be any computer name or LocalHost.

Syntax

varReturn= objWebServer.Method

Parameters
varReturn
Specifies result value.
ObjWebServer
Refers to the IIS ADSI object.
Method
Specifies the method called.
Can Contain
IIsCertMapper (ADSI) | IIsWebVirtualDir (ADSI)
IIsFilters (ADSI) |
Properties
Windows ADSI Object Properties
Metabase Properties
A-Asp... |
AccessFlags | AspEnableApplicationRestart
AccessSSLFlags | AspEnableAspHtmlFallback
AdminACL | AspEnableChunkedEncoding
AllowKeepAlive | AspEnableParentPaths
AllowPathInfoForScriptMappings | AspEnableTypelibCache
AnonymousPasswordSync | AspErrorsToNTLog
AnonymousUserName | AspExceptionCatchEnable
AnonymousUserPass | AspLogErrorRequests
AppAllowClientDebug | AspProcessorThreadMax
AppAllowDebugging | AspQueueConnectionTestTime
AppFriendlyName | AspQueueTimeout
AppIsolated | AspRequestQueueMax
AppOopRecoverLimit | AspScriptEngineCacheMax
AppPackageID | AspScriptErrorSentToBrowser
AppPackageName | AspScriptFileCacheSize
AppRoot | AspScriptLanguage
AppWamClsid | AspScriptTimeout
AspAllowOutOfProcComponents | AspSessionMax
AspAllowSessionState | AspSessionTimeout
AspBufferingOn | AspTrackThreadingModel
AspCodepage |
Auth...-I |
AuthFlags | DefaultLogonDomain
AuthPersistence | DirBrowseFlags
CacheControlCustom | DisableSocketPooling
CacheControlMaxAge | DontLog
CacheControlNoCache | EnableDocFooter
CacheISAPI | EnableReverseDns
CGITimeout | FrontPageWeb
ConnectionTimeout | HttpCustomHeaders
CPUResetInterval | HttpErrors
CreateCGIWithNewConsole | HttpExpires
CreateProcessAsUser | HttpPics
DefaultDoc | HttpRedirect
DefaultDocFooter | IPSecurity
Log... |
LogExtFileFlags | LogOdbcPassword
LogFileDirectory | LogOdbcTableName
LogFileLocaltimeRollover | LogOdbcUserName
LogFilePeriod | LogonMethod
LogFileTruncateSize | LogPluginClsid
LogOdbcDataSource | LogType
M-U |
MaxBandwidth | Realm
MaxBandwidthBlocked | RedirectHeaders
MaxConnections | ScriptMaps
MaxEndpointConnections | SecureBindings
MimeMap | ServerAutoStart
NotDeletable | ServerBindings
NTAuthenticationProviders | ServerComment
PasswordCacheTTL | ServerListenBacklog
PasswordChangeFlags | ServerListenTimeout
PasswordExpirePrenotifyDays | ServerSize
PoolIdcTimeout | ServerState
ProcessNTCRIfLoggedOn | SSIExecDisable
 | UploadReadAheadSize
Methods
IIsWebServer.Continue (ADSI) | Resumes the server.
IIsWebServer.Pause (ADSI) | Pauses the server.
IIsWebServer.Start (ADSI) | Starts the server.
IIsWebServer.Status (ADSI) | Retrieves the current status of the server.
IIsWebServer.Stop (ADSI) | Stops the server.
Related Topics
Windows ADSI Object Methods | Standard methods for ADSI objects.
Windows ADSI Container Object Methods | Standard methods for ADSI container objects.


IIsWebServer.Continue (ADSI)

The Continue method of the IIsWebServer (ADSI) object continues the server operation after it has been paused.

Syntax

IIsWebServer.Continue

Code Example
<%
  Dim ServerObj
  'Continue the second Web server.
  Set ServerObj = GetObject("IIS://LocalHost/W3SVC/2")
  ServerObj.Continue
%>
Related Topics
  • For information on other methods in the IIsWebServer object, see IIsWebServer (ADSI).


IIsWebServer.Pause (ADSI)

The Pause method of the IIsWebServer (ADSI) object pauses the server operation.

Syntax

IIsWebServer.Pause

Code Example
<%
  Dim ServerObj
  'Pause the second Web server.
  Set ServerObj = GetObject("IIS://LocalHost/W3SVC/2")
  ServerObj.Pause
%>
Related Topics
  • For information on other methods in the IIsWebServer object, see IIsWebServer (ADSI).


IIsWebServer.Start (ADSI)

The Start method of the IIsWebServer (ADSI) object starts the server operation.

Syntax

IIsWebServer.Start

Code Example
<%
  Dim ServerObj
  'Start the second Web server.
  Set ServerObj = GetObject("IIS://LocalHost/W3SVC/2")
  ServerObj.Start
%>
Related Topics
  • For information on other methods in the IIsWebServer object, see IIsWebServer (ADSI).


IIsWebServer.Status (ADSI)

The Status method of the IIsWebServer (ADSI) object returns an integer that indicates the current status of the server. The possible values and their meaning are listed in the following table.

Values | Description
1 | Starting
2 | Started
3 | Stopping
4 | Stopped
5 | Pausing
6 | Paused
7 | Continuing
Syntax

IIsWebServer.Status

Related Topics
  • For information on other methods in the IIsWebServer object, see IIsWebServer (ADSI).


IIsWebServer.Stop (ADSI)

The Stop method of the IIsWebServer (ADSI) object stops the server operation.

Syntax

IIsWebServer.Stop

Code Example
<%
  Dim ServerObj
  'Stop the second Web server.
  Set ServerObj = GetObject("IIS://LocalHost/W3SVC/2")
  ServerObj.Stop
%>
Related Topics
  • For information on other methods in the IIsWebServer object, see IIsWebServer (ADSI).


IIsWebService (ADSI)

You can use the IIsWebService object to set inheritable metabase properties for Web sites and Web virtual directories. The IIsWebService object is an ADSI container object.

ADsPath
IIS://MachineName/W3SVC

where MachineName can be any computer name or LocalHost.

Syntax

varReturn= object.Method

Parameters
varReturn
A variable that receives the return value from the method.
object
A variable that contains the IIsWebServer object, usually as a result of a previous GetObject operation.
Method
The object method chosen.
Can Contain
IIsFilters (ADSI) | IIsWebServer (ADSI)
IIsWebInfo (ADSI) |
Properties
Windows ADSI Object Properties
Metabase Properties
A-Asp... |
AccessFlags | AspEnableAspHtmlFallback
AccessSSLFlags | AspEnableChunkedEncoding
AdminACL | AspEnableParentPaths
AllowPathInfoForScriptMappings | AspEnableTypelibCache
AnonymousPasswordSync | AspErrorsToNTLog
AnonymousUserName | AspExceptionCatchEnable
AnonymousUserPass | AspLogErrorRequests
AppAllowClientDebug | AspProcessorThreadMax
AppAllowDebugging | AspQueueConnectionTestTime
AppFriendlyName | AspQueueTimeout
AppIsolated | AspRequestQueueMax
AppPackageID | AspScriptEngineCacheMax
AppPackageName | AspScriptErrorMessage
AppRoot | AspScriptErrorSentToBrowser
AppWamClsid | AspScriptFileCacheSize
AspAllowOutOfProcComponents | AspScriptLanguage
AspAllowSessionState | AspScriptTimeout
AspBufferingOn | AspSessionMax
AspCodepage | AspSessionTimeout
AspEnableApplicationRestart | AspTrackThreadingModel
Auth...-I |
AuthFlags | DirBrowseFlags
AuthPersistence | DirectoryLevelsToScan
CacheControlCustom | DisableSocketPooling
CacheControlMaxAge | DontLog
CacheControlNoCache | EnableDocFooter
CacheISAPI | EnableReverseDns
ConnectionTimeout | HttpCustomHeaders
ContentIndexed | HttpErrors
CPUResetInterval | HttpExpires
CreateCGIWithNewConsole | HttpPics
CreateProcessAsUser | HttpRedirect
DefaultDoc | InProcessIsapiApps
DefaultDocFooter | IPSecurity
DefaultLogonDomain |
Log... |
LogExtFileFlags | LogOdbcPassword
LogFileDirectory | LogOdbcTableName
LogFileLocaltimeRollover | LogOdbcUserName
LogFilePeriod | LogonMethod
LogFileTruncateSize | LogPluginClsid
LogOdbcDataSource | LogType
M-U |
MaxConnections | ScriptMaps
MaxEndpointConnections | ServerAutoStart
MimeMap | ServerBindings
NTAuthenticationProviders | ServerComment
PasswordCacheTTL | ServerListenBacklog
PasswordChangeFlags | ServerListenTimeout
PasswordExpirePrenotifyDays | ServerSize
PoolIdcTimeout | SSIExecDisable
ProcessNTCRIfLoggedOn | SslUseDsMapper
Realm | UploadReadAheadSize
RedirectHeaders | WAMUserName
 | WAMUserPass
Methods
Windows ADSI Object Methods | Standard methods for ADSI objects.
Windows ADSI Container Object Methods | Standard methods for ADSI container objects.


IIsWebVirtualDir (ADSI)

You can use the IIsWebVirtualDir object to set metabase properties that apply to one or all virtual directories for a Web site. If you use the IIsWebVirtualDir object at the server's ROOT directory (.../W3SVC/2/ROOT), inheritable property values will apply to all virtual subdirectories. You can set properties for a specific virtual directory by using the IIsWebVirtualDir object for a specific virtual directory (.../W3SVC/2/ROOT/AVdir).

You can also use IIsWebVirtualDir methods to create and manage Web applications in Web virtual directories and virtual subdirectories. Applications also can be defined and managed in Web directories. See IIsWebDirectory (ADSI).

The IIsWebVirtualDir object is an ADSI container object.

ADsPath

For the server's root virtual directory,

IIS://MachineName/W3SVC/N/ROOT

where MachineName can be any name or LocalHost.

For a specific virtual directory,

IIS://MachineName/W3SVC/N/ROOT/vdirName

where MachineName can be any name or LocalHost.

Syntax

varReturn= object.Method

Parameters
varReturn
A variable that receives the return value from the method.
object
A variable that contains the IIsWebVirtualDir object, usually as a result of a previous GetObject operation.
Method
The object method chosen.
Can Contain
IIsWebVirtualDir (WMI) | IIsWebFile (ADSI)
IIsWebDirectory (ADSI) |
Properties
Windows ADSI Object Properties
Metabase Properties
A-Asp... |
AccessFlags | AspEnableChunkedEncoding
AccessSSLFlags | AspEnableParentPaths
AnonymousPasswordSync | AspEnableTypelibCache
AnonymousUserName | AspErrorsToNTLog
AnonymousUserPass | AspExceptionCatchEnable
AppAllowClientDebug | AspLogErrorRequests
AppAllowDebugging | AspProcessorThreadMax
AppFriendlyName | AspQueueConnectionTestTime
AppIsolated | AspQueueTimeout
AppOopRecoverLimit | AspRequestQueueMax
AppPackageID | AspScriptEngineCacheMax
AppPackageName | AspScriptErrorMessage
AppRoot | AspScriptErrorSentToBrowser
AppWamClsid | AspScriptFileCacheSize
AspAllowOutOfProcComponents | AspScriptLanguage
AspAllowSessionState | AspScriptTimeout
AspBufferingOn | AspSessionMax
AspCodepage | AspSessionTimeout
AspEnableApplicationRestart | AspTrackThreadingModel
AspEnableAspHtmlFallback |
Auth...-U |
AuthFlags | HttpErrors
AuthPersistence | HttpExpires
CacheControlCustom | HttpPics
CacheControlMaxAge | HttpRedirect
CacheControlNoCache | IPSecurity
CacheISAPI | LogonMethod
ContentIndexed | MimeMap
CreateCGIWithNewConsole | Path
CreateProcessAsUser | PoolIdcTimeout
DefaultDoc | Realm
DefaultDocFooter | RedirectHeaders
DefaultLogonDomain | ScriptMaps
DirBrowseFlags | SSIExecDisable
DontLog | UNCPassword
EnableDocFooter | UNCUserName
EnableReverseDns | UploadReadAheadSize
HttpCustomHeaders |
Methods
IIsWebDirectory.AppCreate (ADSI) | Creates an application at a specified metabase key (the parameter is a Boolean).
IIsWebDirectory.AppCreate2 (ADSI) | Creates an application at a specified metabase key (the parameter is a Long).
IIsWebDirectory.AppDelete (ADSI) | Deletes an application definition at a specified key.
IIsWebDirectory.AppDeleteRecursive (ADSI) | Deletes application definitions at a specified key and its subkeys.
IIsWebDirectory.AppDisable (ADSI) | Disables an application at a specified key.
IIsWebDirectory.AppDisableRecursive (ADSI) | Disables applications at a specified key and its subkeys.
IIsWebDirectory.AppEnable (ADSI) | Enables an application that was previously disabled at a specified key.
IIsWebDirectory.AppEnableRecursive (ADSI) | Enables applications that were previously disabled at a specified key and its subkeys.
IIsWebDirectory.AppGetStatus (ADSI) | Retrieves the status of an application.
IIsWebDirectory.AppUnload (ADSI) | Unloads an application at a specified key.
IIsWebDirectory.AppUnloadRecursive (ADSI) | Unloads applications at a specified key and its subkeys.
IIsWebDirectory.AspAppRestart (ADSI) | Restarts the ASP application that invoked it.
Related Topics
Windows ADSI Object Methods | Standard methods for ADSI objects.
Windows ADSI Container Object Methods | Standard methods for ADSI container objects.


Constants used by the IIS ADSI Provider

The following constants are used with methods and properties of the IIS Admin Objects.

<%
Const ADS_PROPERTY_CLEAR = 1 'PutEx
Const ADS_PROPERTY_UPDATE = 2 'PutEx
Const APPSTATUS_NOTDEFINED = 4 'AppStatus
Const APPSTATUS_RUNNING = 2 'AppStatus
Const APPSTATUS_STOPPED = 3 'AppStatus
Const APPSTATUS_UNLOADED = 1 'AppStatus
Const IIS_ANY_PROPERTY = 0 'GetDataPaths
Const IIS_INHERITABLE_ONLY = 1 'GetDataPaths
Const MD_ERROR_DATA_NOT_FOUND = &H800CC801 'GetDataPaths
Const MD_ERROR_IISAO_INVALID_SCHEMA = &H8800CC810 'GetObject
Const MD_BACKUP_FORCE_BACKUP = 4 'Backup
Const MD_BACKUP_HIGHEST_VERSION = &HFFFFFFFE 'Backup, Delete, Restore
Const MD_BACKUP_MAX_VERSION = 9999 'Limit
Const MD_BACKUP_MAX_LEN = 100 'Limit
Const MD_BACKUP_NEXT_VERSION = &HFFFFFFFF 'Backup
Const MD_BACKUP_OVERWRITE = 1 'Backup
Const MD_BACKUP_SAVE_FIRST = 2 'Backup
Const MD_SERVER_STATE_CONTINUING = 7 'ServerState
Const MD_SERVER_STATE_PAUSING = 5 'ServerState
Const MD_SERVER_STATE_PAUSED = 6 'ServerState
Const MD_SERVER_STATE_STARTING = 1 'ServerState
Const MD_SERVER_STATE_STARTED = 2 'ServerState
Const MD_SERVER_STATE_STOPPING = 3 'ServerState
Const MD_SERVER_STATE_STOPPED = 4 'ServerState
Const NOT_A_VALID_PROPERTY = &H80005006 'Various methods
%>


Windows ADSI Reference

The IIS ADSI Provider Reference section describes the objects, methods, and properties that are exposed by the IIS ADSI Provider only. Any script or code that uses Actve Directory Services Interfaces (ADSI) needs to use some basic Windows ADSI interfaces. The Windows ADSI interfaces include methods and properties which are frequently used. For example, the ADSI object Get and Set methods allow you to change properties in a data store such as the IIS metabase, and the ADSI object SetInfo saves the changes. When writing scripts and code that use ADSI, it saves time to keep open a reference to the Windows ADSI interfaces.

The objects, properties, and methods of the Windows ADSI interfaces are already documented in the Windows Platform SDK under "Directory Services," "Active Directory® Services Interfaces (ADSI,)" and "ADSI Reference." You can also view it on MSDN online at ADSI Reference.

Example

The following sample VBScript code shows how you can use the ADSI methods of the IIS ADSI Objects to change values in the metabase, and illustrates the use of metabase property inheritance for efficiency. MyComputer is a placeholder for the name of the computer on which IIS is running.

 Dim WebServerObj
  Dim VDirObj

  'Open the object for the first virtual Web server root.
  Set WebServerObj = GetObject("IIS://MyComputer/W3SVC/1/Root")

  'Deny write access for all directories and files
  'for the server (except those already specifically set)
  'by using the Put method.
  WebServerObj.Put "AccessWrite", False

  'Save the changed value to the metabase.
  WebServerObj.SetInfo

  'Get a directory subordinate to the Web server root.
  Set VDirObj = GetObject("IIS://MyComputer/W3SVC/1/Root/Vdir1/Dir1a")

  'Overwrite the inherited value for write access
  'by using the dot method equivalent to Put.
  VDirObj.AccessWrite = True

  'Save the changed value to the metabase.
  VDirObj.SetInfo

Related Topics

  • For more information about the IIS ADSI Provider, see Using the IIS ADSI Provider.
  • For examples of ADSI scripts that manage IIS, see About IIS ADSI Objects.


Metabase Property Reference

This section contains reference pages for each of the Internet Information Services (IIS) 6.0 metabase properties. Most of these properties can be changed using IIS Manager. You can also use the methods of the IIS Windows Management Instrumentation (WMI) provider or the IIS Active Directory Service Interfaces (ADSI) provider in command-line scripts to change these properties.

As an alternative to writing your own command-line scripts, IIS installs command-line administration scripts that provide enough functionality to help you administer your server. Before you use any of these methods, please review the IIS metabase section, specifically Configuring the Metabase and Metabase Security.

To view a particular property, click the property name from the table of contents in the left pane, or from the table below.

Key

@Application-level property: Application-level properties, when set, apply to the entire application regardless of the isolation mode in which your IIS server is running. Setting an application-level property in one location does not affect the entire application pool (see individual property topics for exceptions).

#Process-level property: Process-level properties only have an effect on IIS behavior if they are set at the service level (for both isolation modes), or at the server level (for IIS 5.0 isolation mode, if the application is set to High isolation). The documentation might list other locations where IIS allows you to set these properties, but they have no effect on IIS behavior.

A B C D E F G H I J K L M N O P Q R S T U V W X Y Z

To Top A

ADConnectionsPassword | ADConnectionsUserName
AccessFlags | AccessSSLFlags
AddNoHeaders | AdminACL
AdminACLBin | AdminEmail
AdminName | AdminServer
AllowAnonymous | AllowClientPosts
AllowControlMsgs | AllowFeedPosts
AllowKeepAlive | AllowPathInfoForScriptMappings
AlwaysUseSsl | AnonymousOnly
AnonymousPasswordSync | AnonymousUserName
AnonymousUserPass | AppAllowClientDebug @
AppAllowDebugging @ | AppFriendlyName
AppIsolated | AppOopRecoverLimit
AppPackageID | AppPackageName
AppPoolAutoStart | AppPoolCommand
AppPoolId | AppPoolIdentityType
AppPoolQueueLength | AppPoolState
AppRoot | AppWamClsid
ApplicationDependencies | ArticleTableFile
ArticleTimeLimit | AspAllowOutOfProcComponents #
AspAllowSessionState @ | AspAppServiceFlags @
AspBufferingLimit @ | AspBufferingOn @
AspCalcLineNumber @ | AspCodepage @
AspDiskTemplateCacheDirectory # | AspEnableApplicationRestart @
AspEnableAspHtmlFallback # | AspEnableChunkedEncoding #
AspEnableParentPaths @ | AspEnableTypelibCache #
AspErrorsToNTLog # | AspExceptionCatchEnable #
AspExecuteInMTA @ | AspKeepSessionIDSecure @
AspLCID @ | AspLogErrorRequests #
AspMaxDiskTemplateCacheFiles # | AspMaxRequestEntityAllowed
AspPartitionID @ | AspProcessorThreadMax #
AspQueueConnectionTestTime @ | AspQueueTimeout @
AspRequestQueueMax # | AspRunOnEndAnonymously @
AspScriptEngineCacheMax # | AspScriptErrorMessage @
AspScriptErrorSentToBrowser @ | AspScriptFileCacheSize #
AspScriptLanguage @ | AspScriptTimeout @
AspSessionMax @ | AspSessionTimeout @
AspSxsName @ | AspTrackThreadingModel #
AuthChangeURL | AuthExpiredURL
AuthExpiredUnsecureURL | AuthFlags
AuthNotifyPwdExpURL | AuthNotifyPwdExpUnsecureURL
AuthPersistence | AuthTurnList
AutoShutdownAppPoolExe | AutoShutdownAppPoolParams
AzEnable | AzImpersonationLevel
AzScopeName | AzStoreName

To Top B

BinSchemaTimeStamp BadMailDirectory
BannerMessage

To Top C

CGITimeout | CPUAction
CPULimit | CPUResetInterval
CSideEtrnDomains | CacheControlCustom
CacheControlMaxAge | CacheControlNoCache
CacheISAPI | CentralBinaryLoggingEnabled
CertCheckMode | ChangeNumber
ClientPostHardLimit | ClientPostSoftLimit
ClusterEnabled | CollectionComment
ConnectResponse | ConnectionTimeout
ContentIndexed | CreateCGIWithNewConsole
CreateProcessAsUser | CustomErrorDescriptions

To Top D

DefaultDoc | DefaultDocFooter
DefaultDomain | DefaultLogonDomain
DefaultModeratorDomain | DemandStartThreshold
DirBrowseFlags | DirectoryLevelsToScan
DisableNewNews | DisableSocketPooling
DisallowOverlappingRotation | DisallowRotationOnConfigChange
DoDynamicCompression | DoMasquerade
DoStaticCompression | DomainRouting
DontLog | DownlevelAdminInstance
DropDirectory

To Top E

EnableDocFooter | EnableEditWhileRunning
EnableHistory | EnableReverseDns
EnableReverseDnsLookup | EtrnDays
EtrnSubdomains | ExMdbGuid
ExitMessage | ExpireNewsgroups
ExpirePolicyName | ExpireSpace
ExpireTime

To Top F

FeedAccountName | FeedAdminError
FeedAllowControlMsgs | FeedAuthenticationType
FeedConcurrentSessions | FeedCreateAutomatically
FeedDisabled | FeedDistribution
FeedErrParmMask | FeedFeedpairId
FeedHandshake | FeedInterval
FeedMaxConnectionAttempts | FeedNewsgroups
FeedNextPullHigh | FeedNextPullLow
FeedOutgoingPort | FeedPassword
FeedPeerGapSize | FeedPeerTempDirectory
FeedPostHardLimit | FeedPostSoftLimit
FeedReportPeriod | FeedSecurityType
FeedServerName | FeedStartTimeHigh
FeedStartTimeLow | FeedTempDirectory
FeedType | FeedUucpName
FilterDescription | FilterEnableCache
FilterEnabled | FilterFlags
FilterLoadOrder | FilterPath
FilterState | FrontPageWeb
FsPropertyPath | FtpDirBrowseShowLongDate
FtpLogInUtf8 | FullyQualifiedDomainName

To Top G

GreetingMessage | GroupHelpFile
GroupListFile | GroupvarListFile

To Top H

HcCacheControlHeader | HcCompressionBufferSize
HcCompressionDirectory | HcCompressionDll
HcCreateFlags | HcDoDiskSpaceLimiting
HcDoDynamicCompression | HcDoOnDemandCompression
HcDoStaticCompression | HcDynamicCompressionLevel
HcExpiresHeader | HcFileExtensions
HcFilesDeletedPerDiskFree | HcIoBufferSize
HcMaxDiskSpaceUsage | HcMaxQueueLength
HcMinFileSizeForComp | HcNoCompressionForHttp10
HcNoCompressionForProxies | HcNoCompressionForRange
HcOnDemandCompLevel | HcPriority
HcScriptFileExtensions | HcSendCacheHeaders
HeaderWaitTimeout | HistoryExpiration
HistoryMajorVersionNumber | HistoryTableFile
HonorClientMsgIds | HopCount
HttpCustomHeaders | HttpErrors
HttpExpires | HttpPics
HttpRedirect

To Top I

IIs5IsolationModeEnabled | IPSecurity
IdleTimeout | ImapClearTextProvider
ImapDefaultDomain | ImapDsAccount
ImapDsBindType | ImapDsDataDirectory
ImapDsDefaultMailRoot | ImapDsHost
ImapDsNamingContext | ImapDsPassword
ImapDsSchemaType | ImapExpireDelay
ImapExpireMail | ImapExpireStart
ImapMailExpirationTime | ImapRoutingDll
ImapRoutingSources | ImapRoutingTableType
ImapServiceVersion | InProcessIsapiApps

To Top J

To Top K

KeyType

To Top L

LimitRemoteConnections | ListFile
LoadBalancerCapabilities | LocalDomains
LocalRetryAttempts | LocalRetryInterval
LogAnonymous | LogCustomPropertyDataType
LogCustomPropertyHeader | LogCustomPropertyID
LogCustomPropertyMask | LogCustomPropertyName
LogCustomPropertyNodeID | LogCustomPropertyServicesString
LogEventOnRecycle | LogExtFileFlags
LogFileDirectory | LogFileLocaltimeRollover
LogFilePeriod | LogFileTruncateSize
LogModuleId | LogModuleList
LogModuleUiId | LogNonAnonymous
LogOdbcDataSource | LogOdbcPassword
LogOdbcTableName | LogOdbcUserName
LogPluginClsid | LogType
LogonMethod

To Top M

MD_0 | MD_1001
MD_APP_LAST_OUTPROC_PID | MD_ETAG_CHANGENUMBER
MD_IISADMIN_EXTENSIONS | MD_ISM_ACCESS_CHECK
MD_METADATA_ID_REGISTRATION | MD_SERVER_CAPABILITIES
MD_SERVER_PLATFORM | MSDOSDirOutput
MajorIIsVersionNumber | MasqueradeDomain
MaxBandwidth | MaxBandwidthBlocked
MaxBatchedMessages | MaxClientsMessage
MaxConnections | MaxDirChangeIOSize
MaxEndpointConnections | MaxErrorFiles
MaxGlobalBandwidth | MaxHistoryFiles
MaxMailObjects | MaxMessageSize
MaxOutConnections | MaxOutConnectionsPerDomain
MaxProcesses | MaxRecipients
MaxRequestEntityAllowed | MaxSearchResults
MaxSessionSize | MaxSmtpErrors
MaxSmtpLogonErrors | MimeMap
MinFileBytesPerSec | MinorIIsVersionNumber
ModeratorFile

To Top N

NTAuthenticationProviders | NameResolutionType
NewsCrawlerTime | NewsDropDirectory
NewsFailedPickupDirectory | NewsPickupDirectory
NntpClearTextProvider | NntpCommandLogMask
NntpOrganization | NntpServiceVersion
NntpUucpName | NotDeletable

To Top O

OrphanActionExe OrphanActionParams
OrphanWorkerProcess

To Top P

PassivePortRange | PassportRequireADMapping
PasswordCacheTTL | PasswordChangeFlags
PasswordExpirePrenotifyDays | Path
PeriodicRestartMemory | PeriodicRestartPrivateMemory
PeriodicRestartRequests | PeriodicRestartSchedule
PeriodicRestartTime | PickupDirectory
PingInterval | PingResponseTime
PingingEnabled | PoolIdcTimeout
Pop3ClearTextProvider | Pop3DefaultDomain
Pop3DsAccount | Pop3DsBindType
Pop3DsDataDirectory | Pop3DsDefaultMailRoot
Pop3DsHost | Pop3DsNamingContext
Pop3DsPassword | Pop3DsSchemaType
Pop3ExpireDelay | Pop3ExpireMail
Pop3ExpireStart | Pop3MailExpirationTime
Pop3RoutingDll | Pop3RoutingSources
Pop3RoutingTableType | Pop3ServiceVersion
PostmasterEmail | PostmasterName
PrettyNamesFile | ProcessNTCRIfLoggedOn

To Top Q

QueueDirectory

To Top R

RapidFailProtection | RapidFailProtectionInterval
RapidFailProtectionMaxCrashes | Realm
RedirectHeaders | RelayForAuth
RelayIpList | RemoteRetryAttempts
RemoteRetryInterval | RemoteSmtpPort
RemoteSmtpSecurePort | RemoteTimeout
RevocationFreshnessTime | RevocationURLRetrievalTimeout
RouteAction | RouteActionString
RoutePassword | RouteUserName
RoutingDll | RoutingSources

To Top S

SMPAffinitized | SMPProcessorAffinityMask
SSIExecDisable | SSLAlwaysNegoClientCert
SSLCertHash | SSLStoreName
SaslLogonDomain | ScriptMaps
SecureBindings | SecuritySetupRequired
SendBadTo | SendNdrTo
ServerAutoStart | ServerBindings
ServerCommand | ServerComment
ServerConfigFlags | ServerListenBacklog
ServerListenTimeout | ServerSize
ServerState | SessionKey
ShouldDeliver | ShouldPickupMail
ShouldPipelineIn | ShouldPipelineOut
ShutdownLatency | ShutdownTimeLimit
SmartHost | SmartHostType
SmtpAdvQueueDll | SmtpAqueueWait
SmtpAuthTimeout | SmtpBdatTimeout
SmtpClearTextProvider | SmtpCommandLogMask
SmtpConnectTimeout | SmtpDSNLanguageID
SmtpDSNOptions | SmtpDataTimeout
SmtpDisableRelay | SmtpDomainValidationFlags
SmtpDotStuffPickupDirFiles | SmtpDsAccount
SmtpDsBindType | SmtpDsDataDirectory
SmtpDsDefaultMailRoot | SmtpDsDomain
SmtpDsFlags | SmtpDsHost
SmtpDsNamingContext | SmtpDsPassword
SmtpDsPort | SmtpDsSchemaType
SmtpDsUseCat | SmtpEventlogLevel
SmtpFlushMailFile | SmtpHeloNoDomain
SmtpHeloTimeout | SmtpInboundCommandSupportOptions
SmtpIpRestrictionFlag | SmtpLocalDelayExpireMinutes
SmtpLocalNDRExpireMinutes | SmtpMailFromTimeout
SmtpMailNoHelo | SmtpMaxRemoteQThreads
SmtpOutboundCommandSupportOptions | SmtpRcptToTimeout
SmtpRemoteDelayExpireMinutes | SmtpRemoteNDRExpireMinutes
SmtpRemoteProgressiveRetry | SmtpRemoteRetryThreshold
SmtpRoutingTableType | SmtpRsetTimeout
SmtpSSLCertHostnameValidation | SmtpSSLRequireTrustedCA
SmtpSaslTimeout | SmtpServer
SmtpServiceVersion | SmtpTurnTimeout
SmtpUseTcpDns | SslCtlIdentifier
SslCtlStoreName | SslUseDsMapper
StartupTimeLimit

To Top T

To Top U

UNCPassword | UNCUserName
UpdatedDefaultDomain | UpdatedFQDN
UploadReadAheadSize | UseDigestSSP
UserIsolationMode

To Top V

VrDoExpire | VrDriverClsid
VrDriverProgid | VrOwnModerator
VrUseAccount

To Top W

WAMUserName | WAMUserPass
WebSvcExtRestrictionList | Win32Error

To Top X

XMLSchemaTimeStamp XoverTableFile

To Top Y

To Top Z


AccessFlags

The AccessFlags property contains flags for configuring file access permissions, which are defined in the Flags section. The last four flags augment the first four flags in that they relate to access granted to remote computers. You can enable local access without remote access, but you cannot enable remote access without local access.
Attribute Name | Attribute Value
XML Data Type | DWORD
WMI Data Type | SINT32
ADSI Data Type | DWORD
ABO Data Type | DWORD
ABO Metabase Identifier | MD_ACCESS_PERM
Attributes | INHERIT
Default Value | accessread
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_FILE
StartingNumber | Not applicable
EndingNumber | 0
ID | 6016

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/W3SVC/n/ROOT /LM/W3SVC/n/ROOT/virtual_directory_name | IIsWebVirtualDir
/LM/W3SVC/n | IIsWebServer
/LM/MSFTPSVC/n | IIsFtpServer
/LM/W3SVC | IIsWebService
/LM/MSFTPSVC | IIsFtpService
/LM/W3SVC/n/ROOT/file_name /LM/W3SVC/n/ROOT/virtual_directory_name/file_name | IIsWebFile
/LM/W3SVC/n/ROOT/physical_directory_name /LM/W3SVC/n/virtual_directory_name/physical_directory_name | IIsWebDirectory
/LM/MSFTPSVC/n/ROOT /LM/MSFTPSVC/n/ROOT/virtual_directory_name | IIsFtpVirtualDir
/LM/NNTPSVC | IIsNntpService
/LM/NNTPSVC/n | IIsNntpServer
/LM/NNTPSVC/n/ROOT /LM/NNTPSVC/n/ROOT/virtual_directory_name | IIsNntpVirtualDir
/LM/SMTPSVC | IIsSmtpService
/LM/SMTPSVC/n | IIsSmtpServer
/LM/SMTPSVC/n/ROOT /LM/SMTPSVC/n/ROOT/virtual_directory_name | IIsSmtpVirtualDir

Flags

Flag Name | AccessExecute
Description | A value of true indicates that the file or the contents of the folder may be executed, regardless of file type.
Metabase Bitmask Identifier | MD_ACCESS_EXECUTE
Decimal Value | 4
Hex Value | 0x00000004
Flag Name | AccessSource
Description | A value of true indicates that users are allowed to access source code if either Read or Write permissions are set. Source code includes scripts in Microsoft® Active Server Pages (ASP) applications.
Metabase Bitmask Identifier | MD_ACCESS_SOURCE
Decimal Value | 16
Hex Value | 0x00000010
Flag Name | AccessRead
Description | A value of true indicates that the file or the contents of the folder may be read through Microsoft Internet Explorer.
Metabase Bitmask Identifier | MD_ACCESS_READ
Decimal Value | 1
Hex Value | 0x00000001
Flag Name | AccessWrite
Description | A value of true indicates that users are allowed to upload files and their associated properties to the enabled directory on your server or to change content in a Write-enabled file. Write can be implemented only with a browser that supports the PUT feature of the HTTP 1.1 protocol standard.
Metabase Bitmask Identifier | MD_ACCESS_WRITE
Decimal Value | 2
Hex Value | 0x00000002
Flag Name | AccessScript
Description | A value of true indicates that the file or the contents of the folder may be executed if they are script files or static content. A value of false only allows static files, such as HTML files, to be served.
Metabase Bitmask Identifier | MD_ACCESS_SCRIPT
Decimal Value | 512
Hex Value | 0x00000200
Flag Name | AccessNoRemoteExecute
Description | A value of true indicates that remote requests to execute applications are denied; only requests from the same computer as the IIS server succeed if the AccessExecute property is set to true. You cannot set AccessNoRemoteExecute to false to enable remote requests, and set AccessExecute to false to disable local requests.
Metabase Bitmask Identifier | MD_ACCESS_NO_REMOTE_EXECUTE
Decimal Value | 8192
Hex Value | 0x00000400
Flag Name | AccessNoRemoteRead
Description | A value of true indicates that remote requests to view files are denied; only requests from the same computer as the IIS server succeed if the AccessRead property is set to true. You cannot set AccessNoRemoteRead to false to enable remote requests, and set AccessRead to false to disable local requests.
Metabase Bitmask Identifier | MD_ACCESS_NO_REMOTE_READ
Decimal Value | 4096
Hex Value | 0x00001000
Flag Name | AccessNoRemoteWrite
Description | A value of true indicates that remote requests to create or change files are denied; only requests from the same computer as the IIS server succeed if the AccessWrite property is set to true. You cannot set AccessNoRemoteWrite to false to enable remote requests, and set AccessWrite to false to disable local requests.
Metabase Bitmask Identifier | MD_ACCESS_NO_REMOTE_WRITE
Decimal Value | 1024
Hex Value | 0x00000400
Flag Name | AccessNoRemoteScript
Description | A value of true indicates that remote requests to view dynamic content are denied; only requests from the same computer as the IIS server succeed if the AccessScript property is set to true. You cannot set AccessNoRemoteScript to false to enable remote requests, and set AccessScript to false to disable local requests.
Metabase Bitmask Identifier | MD_ACCESS_NO_REMOTE_SCRIPT
Decimal Value | 16384
Hex Value | 0x00004000

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


AccessSSLFlags

The AccessSSLFlags property contains the Secure Sockets Layer (SSL) file permission flags as seen in the Flags section. The default value of 0 means that no SSL permissions are set.
Attribute Name | Attribute Value
XML Data Type | DWORD
WMI Data Type | SINT32
ADSI Data Type | DWORD
ABO Data Type | DWORD
ABO Metabase Identifier | MD_SSL_ACCESS_PERM
Attributes | INHERIT
Default Value | 0
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_FILE
StartingNumber | Not applicable
EndingNumber | 0
ID | 6030

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/W3SVC/n/ROOT /LM/W3SVC/n/ROOT/virtual_directory_name | IIsWebVirtualDir
/LM/W3SVC/n | IIsWebServer
/LM/W3SVC | IIsWebService
/LM/W3SVC/n/ROOT/file_name /LM/W3SVC/n/ROOT/virtual_directory_name/file_name | IIsWebFile
/LM/W3SVC/n/ROOT/physical_directory_name /LM/W3SVC/n/virtual_directory_name/physical_directory_name | IIsWebDirectory
/LM/NNTPSVC | IIsNntpService
/LM/NNTPSVC/n | IIsNntpServer
/LM/NNTPSVC/n/ROOT /LM/NNTPSVC/n/ROOT/virtual_directory_name | IIsNntpVirtualDir
/LM/SMTPSVC | IIsSmtpService
/LM/SMTPSVC/n | IIsSmtpServer
/LM/SMTPSVC/n/ROOT /LM/SMTPSVC/n/ROOT/virtual_directory_name | IIsSmtpVirtualDir

Flags

Flag Name | AccessSSL
Description | A value of true indicates that file access requires SSL file permission processing, with or without a client certificate.
Metabase Bitmask Identifier | MD_ACCESS_SSL
Decimal Value | 8
Hex Value | 0x00000008
Flag Name | AccessSSL128
Description | A value of true indicates that file access requires SSL file permission processing with a minimum key size of 128 bits, with or without a client certificate.
Metabase Bitmask Identifier | MD_ACCESS_SSL128
Decimal Value | 256
Hex Value | 0x00000100
Flag Name | AccessSSLNegotiateCert
Description | A value of true indicates that SSL file access processing requests a certificate from the client. A value of false indicates that access continues if the client does not have a certificate. Some versions of Internet Explorer will close the connection if the server requests a certificate and a certificate is not available (even if AccessSSLRequireCert is also set to true).
Metabase Bitmask Identifier | MD_ACCESS_NEGO_CERT
Decimal Value | 32
Hex Value | 0x00000020
Flag Name | AccessSSLRequireCert
Description | A value of true indicates that SSL file access processing requests a certificate from the client. If the client provides no certificate, the connection is closed. AccessSSLNegotiateCert must also be set to true when using AccessSSLRequireCert.
Metabase Bitmask Identifier | MD_ACCESS_REQUIRE_CERT
Decimal Value | 64
Hex Value | 0x00000040
Flag Name | AccessSSLMapCert
Description | A value of true indicates that SSL file permission processing maps a client certificate to a Microsoft Windows® operating system user-account. The AccessSSLNegotiateCert property must also be set to true for the mapping to occur.
Metabase Bitmask Identifier | MD_ACCESS_MAP_CERT
Decimal Value | 128
Hex Value | 0x00000080

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.
Related Topics
AccessFlags


ADConnectionsPassword

The ADConnectionsPassword property is used when the FTP property, UserIsolationMode, is set to 2, which makes FTP user isolation dependent upon the Active Directory® directory service. Set ADConnectionsUserName to the user name that has access to the domain controller, and set ADConnectionsPassword to the corresponding password.

Attribute Name | Attribute Value
XML Data Type | String
WMI Data Type | String
ADSI Data Type | String
ABO Data Type | String
ABO Metabase Identifier | MD_AD_CONNECTIONS_PASSWORD
Attributes | INHERIT | SECURE
Default Value | null
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 5015

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/MSFTPSVC/n | IIsFtpServer
/LM/MSFTPSVC | IIsFtpService

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.
Related Topics
UserIsolationMode


ADConnectionsUserName

The ADConnectionsUserName property is used when the FTP property, UserIsolationMode, is set to 2, which makes FTP user isolation dependent upon Active Directory®. Set ADConnectionsUserName to the user name that has access to the domain controller, and set ADConnectionsPassword to the corresponding password.

Attribute Name | Attribute Value
XML Data Type | String
WMI Data Type | String
ADSI Data Type | String
ABO Data Type | String
ABO Metabase Identifier | MD_AD_CONNECTIONS_USERNAME
Attributes | INHERIT
Default Value | null
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 5014

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/MSFTPSVC/n | IIsFtpServer
/LM/MSFTPSVC | IIsFtpService

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.
Related Topics
UserIsolationMode


AddNoHeaders

The AddNoHeaders property disables adding the Received header. Normally, a server adds a Received header to the top of a message when it receives the message.

Attribute Name | Attribute Value
XML Data Type | Boolean
WMI Data Type | Boolean
ADSI Data Type | Boolean
ABO Data Type | Boolean
ABO Metabase Identifier | No friendly named is defined for this identifier in iiscfng.h. Search the systemroot\System32\Inetsrv\MBSchema.xml file for this property and use the integer from its ID attribute.
Attributes | INHERIT
Default Value | true
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | 0
ID | 37000

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/SMTPSVC | IIsSmtpService
/LM/SMTPSVC/n | IIsSmtpServer

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


AdminACL

The AdminACL property contains a Windows discretionary access control list (DACL) that controls access to any metabase key. This property grants read access, restricted write access, or unrestricted write access. For information about the possible values that can be set for this property, see the Bitmask Values table.

Attribute Name | Attribute Value
XML Data Type | NTACL
WMI Data Type | NTACL
ADSI Data Type | NTACL
ABO Data Type | NTACL
ABO Metabase Identifier | MD_ADMIN_ACL
Attributes | INHERIT | SECURE | REFERENCE
Default Value | null
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 6027

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/W3SVC/n/ROOT /LM/W3SVC/n/ROOT/virtual_directory_name | IIsWebVirtualDir
/LM/W3SVC/n | IIsWebServer
/LM/MSFTPSVC/n | IIsFtpServer
/LM/W3SVC | IIsWebService
/LM/MSFTPSVC | IIsFtpService
/LM/W3SVC/n/ROOT/file_name /LM/W3SVC/n/ROOT/virtual_directory_name/file_name | IIsWebFile
/LM/W3SVC/n/ROOT/physical_directory_name /LM/W3SVC/n/virtual_directory_name/physical_directory_name | IIsWebDirectory
/LM/MSFTPSVC/n/ROOT /LM/MSFTPSVC/n/ROOT/virtual_directory_name | IIsFtpVirtualDir
/LM/logging | IIsLogModules
/LM/W3SVC/Info | IIsWebInfo
/LM/MSFTPSVC/Info | IIsFtpInfo
/LM/NNTPSVC | IIsNntpService
/LM/NNTPSVC/n | IIsNntpServer
/LM/SMTPSVC | IIsSmtpService
/LM/SMTPSVC/n | IIsSmtpServer
/ | IIS_ROOT
/LM/W3SVC/AppPools/DefaultAppPool /LM/W3SVC/AppPools/DefaultAppPool/application_pool_name | IIsApplicationPool
/LM/W3SVC/AppPools | IIsApplicationPools

Values

Constant | Value | Description
MD_ACR_READ | 0x00000001 | Enables read access to all properties.
MD_ACR_WRITE | 0x00000002 | Enables write access to all properties.
MD_ACR_ENUM_KEYS | 0x00000008 | Enables key enumeration.
MD_ACR_RESTRICTED_WRITE | 0x00000020 | See the Remarks section following this table.
MD_ACR_UNSECURE_PROPS_READ | 0x00000080 | Enables read access to properties that do not have the METADATA_SECURE attribute set.
MD_ACR_WRITE_DAC | 0x00040000 | Enables write access to AdminACL for security descriptor creator.

Remarks

MD_ACR_RESTRICTED_WRITE enables restricted write access to the following properties.

AdminACL | AppIsolated
Path | AccessFlags
AnonymousUserName | AnonymousUserPass
MaxBandwidth | MaxBandwidthBlocked
SecureBindings | ServerBindings

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


AdminACLBin

The AdminACLBin property is used by Microsoft® Exchange Server.
Attribute Name | Attribute Value
XML Data Type | binary
WMI Data Type | binary
ADSI Data Type | binary
ABO Data Type | binary
ABO Metabase Identifier | MD_VPROP_ADMIN_ACL_RAW_BINARY
Attributes | INHERIT | SECURE | REFERENCE
Default Value | null
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 6286

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/W3SVC/n/ROOT /LM/W3SVC/n/ROOT/virtual_directory_name | IIsWebVirtualDir
/LM/W3SVC/n | IIsWebServer
/LM/MSFTPSVC/n | IIsFtpServer
/LM/W3SVC | IIsWebService
/LM/MSFTPSVC | IIsFtpService
/LM/W3SVC/n/ROOT/file_name /LM/W3SVC/n/ROOT/virtual_directory_name/file_name | IIsWebFile
/LM/W3SVC/n/ROOT/physical_directory_name /LM/W3SVC/n/virtual_directory_name/physical_directory_name | IIsWebDirectory
/LM/MSFTPSVC/n/ROOT /LM/MSFTPSVC/n/ROOT/virtual_directory_name | IIsFtpVirtualDir
/LM/logging | IIsLogModules
/LM/W3SVC/Info | IIsWebInfo
/LM/MSFTPSVC/Info | IIsFtpInfo
/LM/NNTPSVC | IIsNntpService
/LM/NNTPSVC/n | IIsNntpServer
/LM/SMTPSVC | IIsSmtpService
/LM/SMTPSVC/n | IIsSmtpServer
/LM/W3SVC/AppPools/DefaultAppPool /LM/W3SVC/AppPools/DefaultAppPool/application_pool_name | IIsApplicationPool
/LM/W3SVC/AppPools | IIsApplicationPools

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


AdminEmail

The AdminEmail property corresponds to the "Administrator e-mail account" option, which is on the Settings tab of the Network News Transfer Protocol (NNTP) virtual server Properties.
Attribute Name | Attribute Value
XML Data Type | String
WMI Data Type | String
ADSI Data Type | String
ABO Data Type | String
ABO Metabase Identifier | No friendly named is defined for this identifier in iiscfng.h. Search the systemroot\System32\Inetsrv\MBSchema.xml file for this property and use the integer from its ID attribute.
Attributes | INHERIT
Default Value | null
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 45060

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/NNTPSVC | IIsNntpService
/LM/NNTPSVC/n | IIsNntpServer

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


AdminName

The AdminName property holds the name of the NNTP administrator.
Attribute Name | Attribute Value
XML Data Type | String
WMI Data Type | String
ADSI Data Type | String
ABO Data Type | String
ABO Metabase Identifier | No friendly named is defined for this identifier in iiscfng.h. Search the systemroot\System32\Inetsrv\MBSchema.xml file for this property and use the integer from its ID attribute.
Attributes | INHERIT
Default Value | null
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 45061

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/NNTPSVC | IIsNntpService
/LM/NNTPSVC/n | IIsNntpServer

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


AdminServer

The AdminServer property identifies the Web server instance that is being administered by the remote administration program.

important Important Because this property is internally configured by IIS, you should consider it to be read-only. Do not configure this property.

Attribute Name | Attribute Value
XML Data Type | String
WMI Data Type | String
ADSI Data Type | String
ABO Data Type | String
ABO Metabase Identifier | MD_ADMIN_INSTANCE
Attributes | INHERIT
Default Value | 1
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 2115

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/W3SVC | IIsWebService
/LM/W3SVC/Info | IIsWebInfo

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


AllowAnonymous

The AllowAnonymous property specifies whether the FTP server will allow anonymous access.
Attribute Name | Attribute Value
XML Data Type | Boolean
WMI Data Type | Boolean
ADSI Data Type | Boolean
ABO Data Type | Boolean
ABO Metabase Identifier | MD_ALLOW_ANONYMOUS
Attributes | INHERIT
Default Value | true
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | 0
ID | 5005

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/MSFTPSVC/n | IIsFtpServer
/LM/MSFTPSVC | IIsFtpService
/LM/NNTPSVC | IIsNntpService
/LM/SMTPSVC | IIsSmtpService
/LM/SMTPSVC/n | IIsSmtpServer

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


AllowClientPosts

The AllowClientPosts property corresponds to "Allow client posting" on the Settings tab of NNTP virtual server Properties.
Attribute Name | Attribute Value
XML Data Type | Boolean
WMI Data Type | Boolean
ADSI Data Type | Boolean
ABO Data Type | Boolean
ABO Metabase Identifier | No friendly named is defined for this identifier in iiscfng.h. Search the systemroot\System32\Inetsrv\MBSchema.xml file for this property and use the integer from its ID attribute.
Attributes | INHERIT
Default Value | true
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | 0
ID | 45062

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/NNTPSVC | IIsNntpService
/LM/NNTPSVC/n | IIsNntpServer

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


AllowControlMsgs

The AllowControlMsgs property corresponds to "Allow control messages" on the Settings tab of NNTP virtual server Properties.
Attribute Name | Attribute Value
XML Data Type | Boolean
WMI Data Type | Boolean
ADSI Data Type | Boolean
ABO Data Type | Boolean
ABO Metabase Identifier | No friendly named is defined for this identifier in iiscfng.h. Search the systemroot\System32\Inetsrv\MBSchema.xml file for this property and use the integer from its ID attribute.
Attributes | INHERIT
Default Value | true
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | 0
ID | 45064

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/NNTPSVC | IIsNntpService
/LM/NNTPSVC/n | IIsNntpServer

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


AllowFeedPosts

The AllowFeedPosts property corresponds to "Allow feed posting" on the Settings tab of NNTP virtual server Properties.
Attribute Name | Attribute Value
XML Data Type | Boolean
WMI Data Type | Boolean
ADSI Data Type | Boolean
ABO Data Type | Boolean
ABO Metabase Identifier | No friendly named is defined for this identifier in iiscfng.h. Search the systemroot\System32\Inetsrv\MBSchema.xml file for this property and use the integer from its ID attribute.
Attributes | INHERIT
Default Value | true
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | 0
ID | 45063

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/NNTPSVC | IIsNntpService
/LM/NNTPSVC/n | IIsNntpServer

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


AllowKeepAlive

The AllowKeepAlive property specifies whether Keep-Alive processing is permitted.
Attribute Name | Attribute Value
XML Data Type | Boolean
WMI Data Type | Boolean
ADSI Data Type | Boolean
ABO Data Type | Boolean
ABO Metabase Identifier | MD_ALLOW_KEEPALIVES
Attributes | INHERIT
Default Value | true
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_FILE
StartingNumber | Not applicable
EndingNumber | 0
ID | 6038

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/W3SVC/n | IIsWebServer
/LM/W3SVC | IIsWebService

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


AllowPathInfoForScriptMappings

The AllowPathInfoForScriptMappings property indicates whether clients are permitted to specify path information in script-mapped requests.
Attribute Name | Attribute Value
XML Data Type | Boolean
WMI Data Type | Boolean
ADSI Data Type | Boolean
ABO Data Type | Boolean
ABO Metabase Identifier | MD_ALLOW_PATH_INFO_FOR_SCRIPT_MAPPINGS
Attributes | INHERIT
Default Value | false
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | 0
ID | 2095

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/W3SVC/n | IIsWebServer
/LM/W3SVC | IIsWebService

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


AlwaysUseSsl

The AlwaysUseSsl property is used by the Microsoft Exchange Server messaging system.
Attribute Name | Attribute Value
XML Data Type | Boolean
WMI Data Type | Boolean
ADSI Data Type | Boolean
ABO Data Type | Boolean
ABO Metabase Identifier | No friendly named is defined for this identifier in iiscfng.h. Search the systemroot\System32\Inetsrv\MBSchema.xml file for this property and use the integer from its ID attribute.
Attributes | INHERIT
Default Value | false
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | 0
ID | 36924

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/SMTPSVC | IIsSmtpService
/LM/SMTPSVC/n | IIsSmtpServer

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


AnonymousOnly

The AnonymousOnly property specifies whether the service or server restricts access to anonymous FTP users. If the value is set to true, only anonymous users will be allowed to log on to the FTP server. If set to false, users will be allowed to log on using a valid user name, as well as anonymously.

note Note If the value of AnonymousOnly is set to true, and the value of the metabase property AllowAnonymous is set to false, no users will be permitted to log on to the FTP server.

Attribute Name | Attribute Value
XML Data Type | Boolean
WMI Data Type | Boolean
ADSI Data Type | Boolean
ABO Data Type | Boolean
ABO Metabase Identifier | MD_ANONYMOUS_ONLY
Attributes | INHERIT
Default Value | false
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | 0
ID | 5006

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/MSFTPSVC/n | IIsFtpServer
/LM/MSFTPSVC | IIsFtpService
/LM/SMTPSVC | IIsSmtpService
/LM/SMTPSVC/n | IIsSmtpServer

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


AnonymousPasswordSync

The AnonymousPasswordSync property indicates whether IIS should handle the user password for anonymous users attempting to access resources. The following list details the behavior of this property:

  • If AnonymousPasswordSync is set to false, the administrator must manually set the AnonymousUserPass property to the anonymous user password; otherwise anonymous access will not function properly.
  • If AnonymousPasswordSync is set to true, the anonymous user password is set by IIS.
  • If AnonymousPasswordSync is set to true and the value of the metabase property AllowAnonymous is set to false, no users will be permitted to log on to the FTP server.
  • For anonymous password synchronization to work when the domain controller for the IIS server is running Microsoft® Windows® 2000, you must have sub-authentication enabled. For more information, see the "Sub-Authentication" section in Digest Authentication.

important Important Setting AnonymousPasswordSync on a server running IIS 6.0 has no effect unless you run your application under the System identity and enable sub-authentication. However, it is strongly recommended that you never run an application under the System identity because of the risk it poses to security. If your application contains a buffer-overrun, malicious users can do anything they want under the guise of the System identity. Also, sub-authentication is not enabled by default on a new installation of IIS 6.0. (See Sub-Authentication.) This new default behavior of IIS 6.0 might break old applications that use Anonymous authentication.

Attribute Name | Attribute Value
XML Data Type | Boolean
WMI Data Type | Boolean
ADSI Data Type | Boolean
ABO Data Type | Boolean
ABO Metabase Identifier | MD_ANONYMOUS_USE_SUBAUTH
Attributes | INHERIT
Default Value | true
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_FILE
StartingNumber | Not applicable
EndingNumber | 0
ID | 6022

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/W3SVC/n/ROOT /LM/W3SVC/n/ROOT/virtual_directory_name | IIsWebVirtualDir
/LM/W3SVC/n | IIsWebServer
/LM/MSFTPSVC/n | IIsFtpServer
/LM/W3SVC | IIsWebService
/LM/MSFTPSVC | IIsFtpService
/LM/W3SVC/n/ROOT/file_name /LM/W3SVC/n/ROOT/virtual_directory_name/file_name | IIsWebFile
/LM/W3SVC/n/ROOT/physical_directory_name /LM/W3SVC/n/virtual_directory_name/physical_directory_name | IIsWebDirectory
/LM/NNTPSVC | IIsNntpService
/LM/NNTPSVC/n | IIsNntpServer
/LM/SMTPSVC | IIsSmtpService
/LM/SMTPSVC/n | IIsSmtpServer

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.
Related Topics
AnonymousUserName
AnonymousUserPass


AnonymousUserName

The AnonymousUserName property specifies the name of the registered local user that is used to authenticate anonymous users. The server associates a user name and password with every server action.
Attribute Name | Attribute Value
XML Data Type | String
WMI Data Type | String
ADSI Data Type | String
ABO Data Type | String
ABO Metabase Identifier | MD_ANONYMOUS_USER_NAME
Attributes | INHERIT
Default Value | null
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_FILE
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 6020

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/W3SVC/n/ROOT /LM/W3SVC/n/ROOT/virtual_directory_name | IIsWebVirtualDir
/LM/W3SVC/n | IIsWebServer
/LM/MSFTPSVC/n | IIsFtpServer
/LM/W3SVC | IIsWebService
/LM/MSFTPSVC | IIsFtpService
/LM/W3SVC/n/ROOT/file_name /LM/W3SVC/n/ROOT/virtual_directory_name/file_name | IIsWebFile
/LM/W3SVC/n/ROOT/physical_directory_name /LM/W3SVC/n/virtual_directory_name/physical_directory_name | IIsWebDirectory
/LM/NNTPSVC | IIsNntpService
/LM/NNTPSVC/n | IIsNntpServer
/LM/SMTPSVC | IIsSmtpService
/LM/SMTPSVC/n | IIsSmtpServer

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.
Related Topics
AnonymousUserPass
AnonymousPasswordSync


AnonymousUserPass

The AnonymousUserPass property specifies the password of the registered local user that is used to authenticate anonymous users. The server associates a user name and password with every server action.
Attribute Name | Attribute Value
XML Data Type | String
WMI Data Type | String
ADSI Data Type | String
ABO Data Type | String
ABO Metabase Identifier | MD_ANONYMOUS_PWD
Attributes | INHERIT | SECURE
Default Value | null
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_FILE
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 6021

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/W3SVC/n/ROOT /LM/W3SVC/n/ROOT/virtual_directory_name | IIsWebVirtualDir
/LM/W3SVC/n | IIsWebServer
/LM/MSFTPSVC/n | IIsFtpServer
/LM/W3SVC | IIsWebService
/LM/MSFTPSVC | IIsFtpService
/LM/W3SVC/n/ROOT/file_name /LM/W3SVC/n/ROOT/virtual_directory_name/file_name | IIsWebFile
/LM/W3SVC/n/ROOT/physical_directory_name /LM/W3SVC/n/virtual_directory_name/physical_directory_name | IIsWebDirectory
/LM/NNTPSVC | IIsNntpService
/LM/NNTPSVC/n | IIsNntpServer
/LM/SMTPSVC | IIsSmtpService

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.
Related Topics
AnonymousUserName
AnonymousPasswordSync


AppAllowClientDebug

The AppAllowClientDebug property specifies whether ASP client-side debugging is enabled. This property is independent of AppAllowDebugging, which applies to server-side debugging.
Attribute Name | Attribute Value
XML Data Type | Boolean
WMI Data Type | Boolean
ADSI Data Type | Boolean
ABO Data Type | Boolean
ABO Metabase Identifier | MD_ASP_ENABLECLIENTDEBUG
Attributes | INHERIT
Default Value | false
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | ASP_MD_UT_APP
StartingNumber | Not applicable
EndingNumber | 0
ID | 7019

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/W3SVC/n/ROOT /LM/W3SVC/n/ROOT/virtual_directory_name | IIsWebVirtualDir
/LM/W3SVC/n | IIsWebServer
/LM/W3SVC | IIsWebService
/LM/W3SVC/n/ROOT/physical_directory_name /LM/W3SVC/n/virtual_directory_name/physical_directory_name | IIsWebDirectory

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


AppAllowDebugging

The AppAllowDebugging property specifies whether ASP debugging is enabled on the server. This property is independent of the AppAllowClientDebug property, which applies to client-side debugging.

note Note IIS application threads are serialized when server-side debugging is enabled: Only one thread at a time is allowed to run for each application. This could adversely affect server performance on busy sites.

Attribute Name | Attribute Value
XML Data Type | Boolean
WMI Data Type | Boolean
ADSI Data Type | Boolean
ABO Data Type | Boolean
ABO Metabase Identifier | MD_ASP_ENABLESERVERDEBUG
Attributes | INHERIT
Default Value | false
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | ASP_MD_UT_APP
StartingNumber | Not applicable
EndingNumber | 0
ID | 7018

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/W3SVC/n/ROOT /LM/W3SVC/n/ROOT/virtual_directory_name | IIsWebVirtualDir
/LM/W3SVC/n | IIsWebServer
/LM/W3SVC | IIsWebService
/LM/W3SVC/n/ROOT/physical_directory_name /LM/W3SVC/n/virtual_directory_name/physical_directory_name | IIsWebDirectory

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


AppFriendlyName

The AppFriendlyName property specifies the user-friendly name of the package or application.
Attribute Name | Attribute Value
XML Data Type | String
WMI Data Type | String
ADSI Data Type | String
ABO Data Type | String
ABO Metabase Identifier | MD_APP_FRIENDLY_NAME (IIS_MD_HTTP_BASE+102)
Attributes | INHERIT
Default Value | null
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | iis_md_ut_wam
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 2102

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/W3SVC/n/ROOT /LM/W3SVC/n/ROOT/virtual_directory_name | IIsWebVirtualDir
/LM/W3SVC/n | IIsWebServer
/LM/W3SVC | IIsWebService
/LM/W3SVC/n/ROOT/physical_directory_name /LM/W3SVC/n/virtual_directory_name/physical_directory_name | IIsWebDirectory

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.
Related Topics
AppPackageName


AppIsolated

The AppIsolated property indicates whether an application is to run in-process, out-of-process, or in a pooled-process. A value of 0 indicates that the application is to run in-process, a value of 1 indicates out-of-process, and a value of 2 indicates a pooled-process. Use the application management methods of the IIsWebVirtualDir and IIsWebDirectory objects to set the process space for your application.

important Important Because this property is internally configured by IIS, you should consider it to be read-only. Do not configure this property.

Attribute Name | Attribute Value
XML Data Type | DWORD
WMI Data Type | SINT32
ADSI Data Type | DWORD
ABO Data Type | DWORD
ABO Metabase Identifier | MD_APP_ISOLATED
Attributes | INHERIT
Default Value | 2
MetaFlagsEx | CACHE_PROPERTY_CLEARED
User Type | iis_md_ut_wam
StartingNumber | Not applicable
EndingNumber | 0
ID | 2104

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/W3SVC/n/ROOT /LM/W3SVC/n/ROOT/virtual_directory_name | IIsWebVirtualDir
/LM/W3SVC/n | IIsWebServer
/LM/W3SVC | IIsWebService
/LM/W3SVC/n/ROOT/physical_directory_name /LM/W3SVC/n/virtual_directory_name/physical_directory_name | IIsWebDirectory

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.
Related Topics
InProcessIsapiApps


ApplicationDependencies

The ApplicationDependencies property contains the Application Dependencies list for the items in the Web Service Restriction List. If an application is contained in this property, the application has dependencies on an item (or multiple items) in the Web Service Restriction List.

Attribute Name | Attribute Value
XML Data Type | MULTISZ
WMI Data Type | MULTISZ
ADSI Data Type | MULTISZ
ABO Data Type | MULTISZ
ABO Metabase Identifier | MD_APP_DEPENDENCIES
Attributes | NO_ATTRIBUTES
Default Value | null
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 2167

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/W3SVC | IIsWebService

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


AppOopRecoverLimit

The AppOopRecoverLimit property specifies the maximum number of times an out-of-process application will be restarted after a failure. The server will not service requests from components that have exceeded this limit. This property does not apply to applications or extensions that are run in-process.

note Note IIS must be restarted before changes to this property take effect.

The metabase represents unlimited as the DWORD value of 4294967295 (0xFFFFFFFF); however, VBScript represents unlimited in hexadecimal format as &HFFFFFFFF. Previous versions of IIS represented unlimited as -1.

Attribute Name | Attribute Value
XML Data Type | DWORD
WMI Data Type | SINT32
ADSI Data Type | DWORD
ABO Data Type | DWORD
ABO Metabase Identifier | MD_APP_OOP_CRASH_LIMIT
Attributes | INHERIT
Default Value | 4294967295
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | iis_md_ut_wam
StartingNumber | Not applicable
EndingNumber | 0
ID | 2110

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/W3SVC/n/ROOT /LM/W3SVC/n/ROOT/virtual_directory_name | IIsWebVirtualDir
/LM/W3SVC/n | IIsWebServer
/LM/W3SVC/n/ROOT/physical_directory_name /LM/W3SVC/n/virtual_directory_name/physical_directory_name | IIsWebDirectory

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.
Related Topics
InProcessIsapiApps


AppPackageID

The AppPackageID property provides the COM+ application identifier (ID) for a transaction. This ID is used in all transactions managed by Component Services.

important Important Because this property is internally configured by IIS, you should consider it to be read-only. Do not configure this property.

Attribute Name | Attribute Value
XML Data Type | String
WMI Data Type | String
ADSI Data Type | String
ABO Data Type | String
ABO Metabase Identifier | MD_APP_PACKAGE_ID
Attributes | INHERIT
Default Value | null
MetaFlagsEx | CACHE_PROPERTY_CLEARED
User Type | iis_md_ut_wam
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 2106

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/W3SVC/n/ROOT /LM/W3SVC/n/ROOT/virtual_directory_name | IIsWebVirtualDir
/LM/W3SVC/n | IIsWebServer
/LM/W3SVC | IIsWebService
/LM/W3SVC/n/ROOT/physical_directory_name /LM/W3SVC/n/virtual_directory_name/physical_directory_name | IIsWebDirectory

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.
Related Topics
AppPackageName


AppPackageName

The AppPackageName property provides the COM+ application name for a transaction.

important Important Because this property is internally configured by IIS, you should consider it to be read-only. Do not configure this property.

Attribute Name | Attribute Value
XML Data Type | String
WMI Data Type | String
ADSI Data Type | String
ABO Data Type | String
ABO Metabase Identifier | MD_APP_PACKAGE_NAME
Attributes | INHERIT
Default Value | null
MetaFlagsEx | CACHE_PROPERTY_CLEARED
User Type | iis_md_ut_wam
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 2107

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/W3SVC/n/ROOT /LM/W3SVC/n/ROOT/virtual_directory_name | IIsWebVirtualDir
/LM/W3SVC/n | IIsWebServer
/LM/W3SVC | IIsWebService
/LM/W3SVC/n/ROOT/physical_directory_name /LM/W3SVC/n/virtual_directory_name/physical_directory_name | IIsWebDirectory

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.
Related Topics
AppPackageID
AppFriendlyName


AppPoolAutoStart

The AppPoolAutoStart property indicates to the World Wide Web Publishing Service (WWW service) to automatically start an application pool when the application pool is created or when IIS is started, if the value of this property is set to true.
Attribute Name | Attribute Value
XML Data Type | Boolean
WMI Data Type | Boolean
ADSI Data Type | Boolean
ABO Data Type | Boolean
ABO Metabase Identifier | MD_APPPOOL_AUTO_START
Attributes | NO_ATTRIBUTES
Default Value | true
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 9028

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/W3SVC/AppPools/DefaultAppPool /LM/W3SVC/AppPools/DefaultAppPool/application_pool_name | IIsApplicationPool
/LM/W3SVC/AppPools | IIsApplicationPools

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


AppPoolCommand

The AppPoolCommand property allows an application to send commands to the application pool to start or stop the application pool. Applications can read the value of the AppPoolState property to determine if the application pool has responded to the command issued by the use of this property.

Attribute Name | Attribute Value
XML Data Type | DWORD
WMI Data Type | SINT32
ADSI Data Type | DWORD
ABO Data Type | DWORD
ABO Metabase Identifier | MD_APPPOOL_COMMAND
Attributes | VOLATILE
Default Value | null
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | 2
ID | 9026

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/W3SVC/AppPools/DefaultAppPool /LM/W3SVC/AppPools/DefaultAppPool/application_pool_name | IIsApplicationPool

Values

Constant | Value | Description
MD_APPPOOL_COMMAND_START | 0x00000001 | Starts the application pool.
MD_APPPOOL_COMMAND_STOP | 0x00000002 | Stops the application pool.

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


AppPoolId

The AppPoolId property specifies the application pool where the application is routed.

note Note If an AppPoolId is not specified for a particular application; the application inherits the AppPoolId from a parent key that has the AppPoolId property set. If none of the application’s parents have this property set, the application pool inherits this setting from the site level, or from the World Wide Web Publishing Service (WWW service) level. If no valid AppPoolId is available through inheritance, the application pool fails and an error is written in the event log.

Attribute Name | Attribute Value
XML Data Type | String
WMI Data Type | String
ADSI Data Type | String
ABO Data Type | String
ABO Metabase Identifier | MD_APP_APPPOOL_ID
Attributes | INHERIT
Default Value | null
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 9101

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/W3SVC/n/ROOT /LM/W3SVC/n/ROOT/virtual_directory_name | IIsWebVirtualDir
/LM/W3SVC/n | IIsWebServer
/LM/W3SVC | IIsWebService
/LM/W3SVC/n/ROOT/physical_directory_name /LM/W3SVC/n/virtual_directory_name/physical_directory_name | IIsWebDirectory

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


AppPoolIdentityType

The AppPoolIdentityType property allows application pools to run as LocalSystem, LocalService, NetworkService, or a specific user account. For the possible values to use in setting this property, see the Bitmask Values table below.

Attribute Name | Attribute Value
XML Data Type | DWORD
WMI Data Type | SINT32
ADSI Data Type | DWORD
ABO Data Type | DWORD
ABO Metabase Identifier | MD_APPPOOL_IDENTITY_TYPE
Attributes | INHERIT
Default Value | 2
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | 3
ID | 9021

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/W3SVC/AppPools/DefaultAppPool /LM/W3SVC/AppPools/DefaultAppPool/application_pool_name | IIsApplicationPool
/LM/W3SVC/AppPools | IIsApplicationPools

Bitmask Values

Constant | Value | Description
MD_APPPOOL_IDENTITY_TYPE_LOCALSYSTEM | 0x00000000 | The application pool runs as LocalSystem.
MD_APPPOOL_IDENTITY_TYPE_LOCALSERVICE | 0x00000001 | The application pool runs as LocalService.
MD_APPPOOL_IDENTITY_TYPE_NETWORKSERVICE | 0x00000002 | The application pool runs as NetworkService.
MD_APPPOOL_IDENTITY_TYPE_SPECIFICUSER | 0x00000003 | The application pool runs as a specified user account.

Remarks

MD_ACR_RESTRICTED_WRITE enables write access to the following properties:

AdminACL | AppIsolated
Path | AccessFlags
AnonymousUserName | AnonymousUserPass
MaxBandwidth | MaxBandwidthBlocked
SecureBindings | ServerBindings

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


AppPoolQueueLength

The AppPoolQueueLength property indicates to the Universal Listener how many requests to queue up for an application pool before rejecting future requests. When the limit for this property is exceeded, IIS rejects the additional requests with a 503 error.

note Note Setting the AppPoolQueueLength value to 0 disables enforcing a maximum request queue length.

Attribute Name | Attribute Value
XML Data Type | DWORD
WMI Data Type | SINT32
ADSI Data Type | DWORD
ABO Data Type | DWORD
ABO Metabase Identifier | MD_APPPOOL_UL_APPPOOL_QUEUE_LENGTH
Attributes | INHERIT
Default Value | 3000
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 9017

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/W3SVC/AppPools/DefaultAppPool /LM/W3SVC/AppPools/DefaultAppPool/application_pool_name | IIsApplicationPool
/LM/W3SVC/AppPools | IIsApplicationPools

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


AppPoolState

The AppPoolState property value is used by applications to determine the state of an application pool. The possible states are listed below in the Bitmask Values table.

important Important Because this property is internally configured by IIS, you should consider it to be read-only. Do not configure this property.

Attribute Name | Attribute Value
XML Data Type | DWORD
WMI Data Type | SINT32
ADSI Data Type | DWORD
ABO Data Type | DWORD
ABO Metabase Identifier | MD_APPPOOL_STATE
Attributes | VOLATILE
Default Value | null
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | 4
ID | 9027

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/W3SVC/AppPools/DefaultAppPool /LM/W3SVC/AppPools/DefaultAppPool/application_pool_name | IIsApplicationPool

Bitmask Values

Constant | Value | Description
MD_APPPOOL_STATE_STARTING | 0x00000001 | The application pool is starting.
MD_APPPOOL_STATE_STARTED | 0x00000002 | The application pool has started.
MD_APPPOOL_STATE_STOPPING | 0x00000003 | The application pool is stopping.
MD_APPPOOL_STATE_STOPPED | 0x00000004 | The application pool has stopped.

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


AppRoot

The AppRoot property contains the metabase path to the application root. For example, the metabase path for the application root of your Default Web Site is /LM/W3SVC/1/ROOT. To configure a key as an application root, use the application management methods of the IIsWebVirtualDir and IIsWebDirectory objects.

important Important Because this property is internally configured by IIS, you should consider it to be read-only. Do not configure this property.

Attribute Name | Attribute Value
XML Data Type | String
WMI Data Type | String
ADSI Data Type | String
ABO Data Type | String
ABO Metabase Identifier | MD_APP_ROOT
Attributes | INHERIT
Default Value | null
MetaFlagsEx | CACHE_PROPERTY_CLEARED
User Type | IIS_MD_UT_FILE
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 2103

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/W3SVC/n/ROOT /LM/W3SVC/n/ROOT/virtual_directory_name | IIsWebVirtualDir
/LM/W3SVC/n | IIsWebServer
/LM/W3SVC | IIsWebService
/LM/W3SVC/n/ROOT/physical_directory_name /LM/W3SVC/n/virtual_directory_name/physical_directory_name | IIsWebDirectory

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


AppWamClsid

The AppWamClsid property provides the class ID for the application's Web Application Management (WAM) interface.

important Important Because this property is internally configured by IIS, you should consider it to be read-only. Do not configure this property.

Attribute Name | Attribute Value
XML Data Type | String
WMI Data Type | String
ADSI Data Type | String
ABO Data Type | String
ABO Metabase Identifier | MD_APP_WAM_CLSID
Attributes | INHERIT
Default Value | null
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | iis_md_ut_wam
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 2105

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/W3SVC/n/ROOT /LM/W3SVC/n/ROOT/virtual_directory_name | IIsWebVirtualDir
/LM/W3SVC/n | IIsWebServer
/LM/W3SVC | IIsWebService
/LM/W3SVC/n/ROOT/physical_directory_name /LM/W3SVC/n/virtual_directory_name/physical_directory_name | IIsWebDirectory

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


ArticleTableFile

The ArticleTableFile property specifies the location on the file system of the article hash table.

Attribute Name | Attribute Value
XML Data Type | String
WMI Data Type | String
ADSI Data Type | String
ABO Data Type | String
ABO Metabase Identifier | No friendly named is defined for this identifier in iiscfng.h. Search the systemroot\System32\Inetsrv\MBSchema.xml file for this property and use the integer from its ID attribute.
Attributes | INHERIT
Default Value | null
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 45158

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/NNTPSVC/n | IIsNntpServer

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


ArticleTimeLimit

The ArticleTimeLimit property corresponds to ArticleTimeLimit registry key described in Microsoft Knowledge Base article Q258784.
Attribute Name | Attribute Value
XML Data Type | DWORD
WMI Data Type | SINT32
ADSI Data Type | DWORD
ABO Data Type | DWORD
ABO Metabase Identifier | No friendly named is defined for this identifier in iiscfng.h. Search the systemroot\System32\Inetsrv\MBSchema.xml file for this property and use the integer from its ID attribute.
Attributes | INHERIT
Default Value | null
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | 0
ID | 45056

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/NNTPSVC | IIsNntpService
/LM/NNTPSVC/n | IIsNntpServer

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


AspAllowOutOfProcComponents

In IIS 4.0, the AspAllowOutOfProcComponents property specifies whether an ASP script is allowed to call out-of-process components, which are executables that are launched from within an application. This property was made obsolete in IIS 5.0 and its value is ignored. However, scripts using this property will continue to function normally.

Attribute Name | Attribute Value
XML Data Type | Boolean
WMI Data Type | Boolean
ADSI Data Type | Boolean
ABO Data Type | Boolean
ABO Metabase Identifier | MD_ASP_ALLOWOUTOFPROCCOMPONENTS
Attributes | INHERIT
Default Value | true
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | iis_md_ut_wam
StartingNumber | Not applicable
EndingNumber | 0
ID | 7014

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/W3SVC/n/ROOT /LM/W3SVC/n/ROOT/virtual_directory_name | IIsWebVirtualDir
/LM/W3SVC/n | IIsWebServer
/LM/W3SVC | IIsWebService
/LM/W3SVC/n/ROOT/physical_directory_name /LM/W3SVC/n/virtual_directory_name/physical_directory_name | IIsWebDirectory

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


AspAllowSessionState

The AspAllowSessionState property enables session state persistence for the ASP application. If the value is set to true, the server creates a new Session object for each connection, session state is accessible, session storage is allowed, Session_OnStart and Session_OnEnd occurs, and the ASPSessionID cookie is sent to the client. If the value is set to false, state access and storage are not allowed, events are not processed, and no cookie is sent.

note Note The ASP page directive, @ENABLESESSIONSTATE, can be used to override this metabase property.

Attribute Name | Attribute Value
XML Data Type | Boolean
WMI Data Type | Boolean
ADSI Data Type | Boolean
ABO Data Type | Boolean
ABO Metabase Identifier | MD_ASP_ALLOWSESSIONSTATE
Attributes | INHERIT
Default Value | true
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | ASP_MD_UT_APP
StartingNumber | Not applicable
EndingNumber | 0
ID | 7011

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/W3SVC/n/ROOT /LM/W3SVC/n/ROOT/virtual_directory_name | IIsWebVirtualDir
/LM/W3SVC/n | IIsWebServer
/LM/W3SVC | IIsWebService
/LM/W3SVC/n/ROOT/physical_directory_name /LM/W3SVC/n/virtual_directory_name/physical_directory_name | IIsWebDirectory

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


AspAppServiceFlags

The AspAppServiceFlags property contains the flags that must be set to enable COM+ services on your IIS applications. Once you enable the flags, you may also need to set other properties. For more information, see Configuring Applications to Use COM+ Services. Set this property at the application level.

Attribute Name | Attribute Value
XML Data Type | DWORD
WMI Data Type | SINT32
ADSI Data Type | DWORD
ABO Data Type | DWORD
ABO Metabase Identifier | MD_ASP_SERVICE_FLAGS
Attributes | INHERIT
Default Value | 0
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | ASP_MD_UT_APP
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 7044

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/W3SVC/n/ROOT /LM/W3SVC/n/ROOT/virtual_directory_name | IIsWebVirtualDir
/LM/W3SVC/n | IIsWebServer
/LM/W3SVC | IIsWebService
/LM/W3SVC/n/ROOT/physical_directory_name /LM/W3SVC/n/virtual_directory_name/physical_directory_name | IIsWebDirectory

Flags

Flag Name | AspEnableTracker
Description | A value of true enables COM+ tracker, which allows administrators or developers to debug ASP applications. For more information, see the COM+ Software Developer Kit (SDK) and see Configuring Applications to Use COM+ Services.
Metabase Bitmask Identifier | MD_ASP_SERVICE_FLAG_TRACKER
Decimal Value | 1
Hex Value | 0x00000001
Flag Name | AspEnableSxs
Description | A value of true enables COM+ side-by-side assemblies, which allow ASP applications to specify which version of a system DLL or classic COM component to use, such as MDAC, MFS, MSVCRT, MSXML, and so on. For more information, see the COM+ Software Developer Kit (SDK) and see Configuring Applications to Use COM+ Services.
Metabase Bitmask Identifier | MD_ASP_SERVICE_FLAG_FUSION
Decimal Value | 2
Hex Value | 0x00000002
Flag Name | AspUsePartition
Description | A value of true enables COM+ partitioning, which can be used to isolate Web applications into their own COM+ partitions. COM+ partitions can hold different versions of your own custom COM components. If you set this flag, also set the AspPartitionID metabase property. For more information, see Configuring Applications to Use COM+ Services.
Metabase Bitmask Identifier | MD_ASP_SERVICE_FLAG_PARTITIONS
Decimal Value | 4
Hex Value | 0x00000004

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


AspBufferingLimit

The AspBufferingLimit property sets the maximum size of the ASP buffer. If response buffering is turned on, this property controls the maximum number of bytes that an ASP page can write to the response buffer before a flush occurs.

Attribute Name | Attribute Value
XML Data Type | DWORD
WMI Data Type | SINT32
ADSI Data Type | DWORD
ABO Data Type | DWORD
ABO Metabase Identifier | MD_ASP_BUFFER_LIMIT
Attributes | INHERIT
Default Value | 4194304
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | ASP_MD_UT_APP
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 7052

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/W3SVC/n/ROOT /LM/W3SVC/n/ROOT/virtual_directory_name | IIsWebVirtualDir
/LM/W3SVC/n | IIsWebServer
/LM/W3SVC | IIsWebService
/LM/W3SVC/n/ROOT/physical_directory_name /LM/W3SVC/n/virtual_directory_name/physical_directory_name | IIsWebDirectory

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


AspBufferingOn

The AspBufferingOn property specifies whether output from an ASP application will be buffered. If the value is set to true, all output from the application is collected in the buffer before the buffer is flushed to the client browser. With buffering on, the ASP application has to completely process the ASP script before the client browser receives any output. For this reason, applications that have buffering enabled may seem slower to users than those applications that have buffering disabled, even though the total time taken for the buffered script is less. Therefore, if buffering is turned on, consider using the Flush method of the ASP built-in Response object to pass the user pieces of content as the script is being processed.

If this property is set to false, output from an ASP script is written to the client browser as it becomes available. If buffering is turned off, any methods that modify existing HTTP headers or generate new headers must be executed before the content body is sent to the client browser. If buffering is turned on, this restriction is unnecessary.

Attribute Name | Attribute Value
XML Data Type | Boolean
WMI Data Type | Boolean
ADSI Data Type | Boolean
ABO Data Type | Boolean
ABO Metabase Identifier | MD_ASP_BUFFERINGON
Attributes | INHERIT
Default Value | true
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | ASP_MD_UT_APP
StartingNumber | Not applicable
EndingNumber | 0
ID | 7000

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/W3SVC/n/ROOT /LM/W3SVC/n/ROOT/virtual_directory_name | IIsWebVirtualDir
/LM/W3SVC/n | IIsWebServer
/LM/W3SVC | IIsWebService
/LM/W3SVC/n/ROOT/physical_directory_name /LM/W3SVC/n/virtual_directory_name/physical_directory_name | IIsWebDirectory

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


AspCalcLineNumber

The AspCalcLineNumber property specifies whether ASP should calculate and store the line number of each executed line of code in order to provide the number in an error report.
Attribute Name | Attribute Value
XML Data Type | Boolean
WMI Data Type | Boolean
ADSI Data Type | Boolean
ABO Data Type | Boolean
ABO Metabase Identifier | MD_ASP_CALCLINENUMBER
Attributes | INHERIT
Default Value | true
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | ASP_MD_UT_APP
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 7050

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/W3SVC/n/ROOT /LM/W3SVC/n/ROOT/virtual_directory_name | IIsWebVirtualDir
/LM/W3SVC/n | IIsWebServer
/LM/W3SVC | IIsWebService
/LM/W3SVC/n/ROOT/physical_directory_name /LM/W3SVC/n/virtual_directory_name/physical_directory_name | IIsWebDirectory

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


AspCodepage

The AspCodepage property specifies the default code page for an application. This setting can be overridden at the page level by using the ASP page directive, @CODEPAGE, for literal strings, or one of the Codepage properties of the ASP built-in Session and Response objects for dynamic data. If this property is set to 0 at any node, the system default code page (CP_ACP) is inferred.

Attribute Name | Attribute Value
XML Data Type | DWORD
WMI Data Type | SINT32
ADSI Data Type | DWORD
ABO Data Type | DWORD
ABO Metabase Identifier | MD_ASP_CODEPAGE
Attributes | INHERIT
Default Value | 0
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | ASP_MD_UT_APP
StartingNumber | Not applicable
EndingNumber | 0
ID | 7016

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/W3SVC/n/ROOT /LM/W3SVC/n/ROOT/virtual_directory_name | IIsWebVirtualDir
/LM/W3SVC/n | IIsWebServer
/LM/W3SVC | IIsWebService
/LM/W3SVC/n/ROOT/physical_directory_name /LM/W3SVC/n/virtual_directory_name/physical_directory_name | IIsWebDirectory

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


AspDiskTemplateCacheDirectory

AspDiskTemplateCacheDirectory contains the name of the directory that ASP uses to store compiled ASP templates to disk after overflow of the in-memory cache. If the default directory is changed, then the administrator must ensure that the identity of the processes running Asp.dll has been assigned full control rights to the new directory. Typically, the identity of the processes running Asp.dll is the IWAM_USER and System accounts.

AspDiskTemplateCacheDirectory can only be set to a local path. ASP template caching fails if this property is set to a UNC or mapped network path.

Attribute Name | Attribute Value
XML Data Type | EXPANDSZ
WMI Data Type | String
ADSI Data Type | EXPANDSZ
ABO Data Type | EXPANDSZ
ABO Metabase Identifier | MD_ASP_DISKTEMPLATECACHEDIRECTORY
Attributes | INHERIT
Default Value | %windir%\system32\inetsrv\asp compiled templates
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | iis_md_ut_wam
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 7036

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/W3SVC/n/ROOT /LM/W3SVC/n/ROOT/virtual_directory_name | IIsWebVirtualDir
/LM/W3SVC/n | IIsWebServer
/LM/W3SVC | IIsWebService
/LM/W3SVC/n/ROOT/physical_directory_name /LM/W3SVC/n/virtual_directory_name/physical_directory_name | IIsWebDirectory

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


AspEnableApplicationRestart

The AspEnableApplicationRestart determines whether an ASP application can be automatically restarted. When changes are made to Global.asa or metabase properties that affect an application, the application will not restart unless the AspEnableApplicationRestart property is set to true.

important Important When this property is changed from false to true, the application immediately restarts.

IIS also provides an ADSI method, IIsWebDirectory.AspAppRestart (ADSI), which can be used to restart the application.

Attribute Name | Attribute Value
XML Data Type | Boolean
WMI Data Type | Boolean
ADSI Data Type | Boolean
ABO Data Type | Boolean
ABO Metabase Identifier | MD_ASP_ENABLEAPPLICATIONRESTART
Attributes | INHERIT
Default Value | true
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | ASP_MD_UT_APP
StartingNumber | Not applicable
EndingNumber | 0
ID | 7027

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/W3SVC/n/ROOT /LM/W3SVC/n/ROOT/virtual_directory_name | IIsWebVirtualDir
/LM/W3SVC/n | IIsWebServer
/LM/W3SVC | IIsWebService
/LM/W3SVC/n/ROOT/physical_directory_name /LM/W3SVC/n/virtual_directory_name/physical_directory_name | IIsWebDirectory

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


AspEnableAspHtmlFallback

The AspEnableAspHtmlFallback property controls the behavior of ASP when a new request is to be rejected due to a full request queue. A true value for this property will cause an .htm file with a similar name as the requested .asp file, if it exists, to be sent instead of the .asp file. The naming convention for the .htm file is the name of the .asp file with _asp appended. For example, if the .asp file is hello.asp, then the .htm file should be hello_asp.htm
Attribute Name | Attribute Value
XML Data Type | Boolean
WMI Data Type | Boolean
ADSI Data Type | Boolean
ABO Data Type | Boolean
ABO Metabase Identifier | MD_ASP_ENABLEASPHTMLFALLBACK
Attributes | INHERIT
Default Value | false
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | iis_md_ut_wam
StartingNumber | Not applicable
EndingNumber | 0
ID | 7021

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/W3SVC/n/ROOT /LM/W3SVC/n/ROOT/virtual_directory_name | IIsWebVirtualDir
/LM/W3SVC/n | IIsWebServer
/LM/W3SVC | IIsWebService
/LM/W3SVC/n/ROOT/physical_directory_name /LM/W3SVC/n/virtual_directory_name/physical_directory_name | IIsWebDirectory

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


AspEnableChunkedEncoding

The AspEnableChunkedEncoding property specifies whether HTTP 1.1 chunked transfer encoding is enabled for the World Wide Web Publishing Service (WWW service). The WWW service setting for this property is inheritable by all in-process and pooled out-of-process applications, at all levels below the key where this property is set. Metabase settings at the Web server level or lower are ignored for in-process and pooled out-of-process applications. However, settings at the Web server level or lower will be used if that key is an isolated out-of-process application.

note Note Even if AspEnableChunkedEncoding is set to true, chunked transfer encoding is used only by browsers that support and have HTTP 1.1 enabled.

Attribute Name | Attribute Value
XML Data Type | Boolean
WMI Data Type | Boolean
ADSI Data Type | Boolean
ABO Data Type | Boolean
ABO Metabase Identifier | MD_ASP_ENABLECHUNKEDENCODING
Attributes | INHERIT
Default Value | true
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | iis_md_ut_wam
StartingNumber | Not applicable
EndingNumber | 0
ID | 7022

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/W3SVC/n/ROOT /LM/W3SVC/n/ROOT/virtual_directory_name | IIsWebVirtualDir
/LM/W3SVC/n | IIsWebServer
/LM/W3SVC | IIsWebService
/LM/W3SVC/n/ROOT/physical_directory_name /LM/W3SVC/n/virtual_directory_name/physical_directory_name | IIsWebDirectory

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


AspEnableParentPaths

The AspEnableParentPaths property specifies whether an ASP page allows paths relative to the current directory (using the ..\ notation). If set to true, this property constitutes a potential security risk, because an include path could access critical or confidential files outside the root directory of the application.
Attribute Name | Attribute Value
XML Data Type | Boolean
WMI Data Type | Boolean
ADSI Data Type | Boolean
ABO Data Type | Boolean
ABO Metabase Identifier | MD_ASP_ENABLEPARENTPATHS
Attributes | INHERIT
Default Value | false
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | ASP_MD_UT_APP
StartingNumber | Not applicable
EndingNumber | 0
ID | 7008

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/W3SVC/n/ROOT /LM/W3SVC/n/ROOT/virtual_directory_name | IIsWebVirtualDir
/LM/W3SVC/n | IIsWebServer
/LM/W3SVC | IIsWebService
/LM/W3SVC/n/ROOT/physical_directory_name /LM/W3SVC/n/virtual_directory_name/physical_directory_name | IIsWebDirectory

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


AspEnableTypelibCache

The AspEnableTypelibCache property specifies whether type libraries are cached on the server. The World Wide Web Publishing Service (WWW service) setting for this property is applicable to all in-process and pooled out-of-process application nodes, at all levels. Metabase settings at the Web server level or lower are ignored for in-process and pooled out-of-process applications. However, settings at the Web server level or lower are used if that node is an isolated out-of-process application.
Attribute Name | Attribute Value
XML Data Type | Boolean
WMI Data Type | Boolean
ADSI Data Type | Boolean
ABO Data Type | Boolean
ABO Metabase Identifier | MD_ASP_ENABLETYPELIBCACHE
Attributes | INHERIT
Default Value | true
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | iis_md_ut_wam
StartingNumber | Not applicable
EndingNumber | 0
ID | 7023

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/W3SVC/n/ROOT /LM/W3SVC/n/ROOT/virtual_directory_name | IIsWebVirtualDir
/LM/W3SVC/n | IIsWebServer
/LM/W3SVC | IIsWebService
/LM/W3SVC/n/ROOT/physical_directory_name /LM/W3SVC/n/virtual_directory_name/physical_directory_name | IIsWebDirectory

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


AspErrorsToNTLog

The AspErrorsToNTLog property specifies whether IIS scripting errors are written to the Windows Event Log.

The IIsWebService (ADSI) setting for this property is applicable to all in-process application keys, at all levels. Metabase property settings at the IIsWebServer level or lower are ignored for in-process applications unless the IIsWebServer key is isolated as an out-of-process application.

If AspLogErrorRequests is set to true and AspErrorsToNTLog is set to false, ASP errors are sent to the IIS log. If these errors are serious or logging to IIS log previously failed, then each error is also sent to the Windows Event Log.

If AspLogErrorRequests is false, then these errors are only sent to the IIS log, and not to the Windows Event Log.

If AspLogErrorRequests is set to true and AspErrorsToNTLog is set to true, then all ASP related errors go to the Windows Event Log and the IIS log.

note Note To completely prevent ASP errors from being logged in the IIS log file, you must disable logging altogether. To accomplish this see the DontLog and LogType properties.

Attribute Name | Attribute Value
XML Data Type | Boolean
WMI Data Type | Boolean
ADSI Data Type | Boolean
ABO Data Type | Boolean
ABO Metabase Identifier | MD_ASP_ERRORSTONTLOG
Attributes | INHERIT
Default Value | false
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | iis_md_ut_wam
StartingNumber | Not applicable
EndingNumber | 0
ID | 7024

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/W3SVC/n/ROOT /LM/W3SVC/n/ROOT/virtual_directory_name | IIsWebVirtualDir
/LM/W3SVC/n | IIsWebServer
/LM/W3SVC | IIsWebService
/LM/W3SVC/n/ROOT/physical_directory_name /LM/W3SVC/n/virtual_directory_name/physical_directory_name | IIsWebDirectory

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


AspExceptionCatchEnable

The AspExceptionCatchEnable property specifies whether ASP pages trap exceptions thrown by components. If set to false (or, disabled), the Microsoft Script Debugger tool does not catch exceptions sent by the component that you are debugging.
Attribute Name | Attribute Value
XML Data Type | Boolean
WMI Data Type | Boolean
ADSI Data Type | Boolean
ABO Data Type | Boolean
ABO Metabase Identifier | MD_ASP_EXCEPTIONCATCHENABLE
Attributes | INHERIT
Default Value | true
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | iis_md_ut_wam
StartingNumber | Not applicable
EndingNumber | 0
ID | 7015

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/W3SVC/n/ROOT /LM/W3SVC/n/ROOT/virtual_directory_name | IIsWebVirtualDir
/LM/W3SVC/n | IIsWebServer
/LM/W3SVC | IIsWebService
/LM/W3SVC/n/ROOT/physical_directory_name /LM/W3SVC/n/virtual_directory_name/physical_directory_name | IIsWebDirectory

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


AspExecuteInMTA

ASP is capable of running all of its threads in a multi-threaded apartment (MTA). If your COM components are primarily free-threaded or both-threaded, running the ASP threads as MTA can improve performance significantly.

By default, the AspExecuteInMTA property is set to 0, which means that ASP does not execute in MTA. Set this property to 1 at the application level to enable ASP to run in MTA.

Attribute Name | Attribute Value
XML Data Type | DWORD
WMI Data Type | SINT32
ADSI Data Type | DWORD
ABO Data Type | DWORD
ABO Metabase Identifier | MD_ASP_EXECUTEINMTA
Attributes | INHERIT
Default Value | 0
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | ASP_MD_UT_APP
StartingNumber | Not applicable
EndingNumber | 0
ID | 7041

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/W3SVC/n/ROOT /LM/W3SVC/n/ROOT/virtual_directory_name | IIsWebVirtualDir
/LM/W3SVC/n | IIsWebServer
/LM/W3SVC | IIsWebService
/LM/W3SVC/n/ROOT/physical_directory_name /LM/W3SVC/n/virtual_directory_name/physical_directory_name | IIsWebDirectory

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


AspKeepSessionIDSecure

The AspKeepSessionIDSecure property, when enabled, ensures that a SessionID is sent as a secure cookie if assigned over a secure channel.

Attribute Name | Attribute Value
XML Data Type | DWORD
WMI Data Type | SINT32
ADSI Data Type | DWORD
ABO Data Type | DWORD
ABO Metabase Identifier | MD_ASP_KEEPSESSIONIDSECURE
Attributes | INHERIT
Default Value | 0
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | ASP_MD_UT_APP
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 7043

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/W3SVC/n/ROOT /LM/W3SVC/n/ROOT/virtual_directory_name | IIsWebVirtualDir
/LM/W3SVC/n | IIsWebServer
/LM/W3SVC | IIsWebService
/LM/W3SVC/n/ROOT/physical_directory_name /LM/W3SVC/n/virtual_directory_name/physical_directory_name | IIsWebDirectory

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


AspLCID

The AspLCID property specifies the default locale identifier (LCID) for an application. LCIDs define how dates, times, and currencies are formatted. LCIDs are not the same for each geographical locale.

Override this setting at the page level by using the ASP page directive, @LCID for literal strings, or one of the LCID properties of the ASP built-in Response or Session objects for dynamic data. If this property is set to 0 at any node, the system default locale (LOCALE_SYSTEM_DEFAULT) is inferred. Setting AspLCID changes the locale for both the ASP application and the scripting engine. Using the Microsoft Visual Basic® Scripting Edition (VBScript) function setLocale() only changes the locale for the scripting engine.

note Note The locale group has to be installed on the Web server before its locale identifier can be specified in a Web page or application. Use the Regional and Language Options item in Control Panel to install locale groups.

Attribute Name | Attribute Value
XML Data Type | DWORD
WMI Data Type | SINT32
ADSI Data Type | DWORD
ABO Data Type | DWORD
ABO Metabase Identifier | MD_ASP_LCID
Attributes | INHERIT
Default Value | 0
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | ASP_MD_UT_APP
StartingNumber | Not applicable
EndingNumber | 0
ID | 7042

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/W3SVC/n/ROOT /LM/W3SVC/n/ROOT/virtual_directory_name | IIsWebVirtualDir
/LM/W3SVC/n | IIsWebServer
/LM/W3SVC | IIsWebService
/LM/W3SVC/n/ROOT/physical_directory_name /LM/W3SVC/n/virtual_directory_name/physical_directory_name | IIsWebDirectory

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


AspLogErrorRequests

The AspLogErrorRequests property controls whether the Web server writes unsuccessful client requests to the Windows Event Log file. If AspLogErrorRequests is set to true, a standard set of ASP error requests are logged. For a list of these errors, see the ASP Error List.

If AspLogErrorRequests is set to true and AspErrorsToNTLog is set to false, then the ASP errors are sent to the IIS log. If these errors are serious or logging to IIS log previously failed, then each error is also sent to the Windows Event Log.

If AspLogErrorRequests is set to false, then these errors are only sent to the IIS log, and not to the Windows Event Log.

If AspLogErrorRequests is set to true and AspErrorsToNTLog is set to true, then all ASP related errors go to the Windows Event Log and the IIS log.

To completely prevent ASP errors from being logged in the IIS log file, you must disable logging altogether. To accomplish this see the DontLog and LogType properties.

ASP Error List

This table contains the list of ASP errors.
ASP error code | ASP error | Description
ASP 0100 | Out of memory | Unable to allocate required memory.
ASP 0101 | Unexpected error | The function returned (exception name).
ASP 0102 | Expecting string input | The function expects a string as input.
ASP 0103 | Expecting numeric input | The function expects a number as input.
ASP 0104 | Operation not Allowed | Operation not allowed.
ASP 0105 | Index out of range | An array index is out of range.
ASP 0106 | Type Mismatch | An unhandled data type was encountered.
ASP 0107 | Stack Overflow | The data being processed is over the allowed limit.
ASP 0115 | Unexpected error | A trappable error (exception name) occurred in an external object. The script cannot continue running.
ASP 0190 | Unexpected error | A trappable error occurred while releasing an external object.
ASP 0191 | Unexpected error | A trappable error occurred in the OnStartPage method of an external object.
ASP 0192 | Unexpected error | A trappable error occurred in the OnEndPage method of an external object.
ASP 0193 | OnStartPage Failed | An error occurred in the OnStartPage method of an external object.
ASP 0194 | OnEndPage Failed | An error occurred in the OnEndPage method of an external object.
ASP 0240 | Script Engine Exception | A script engine threw exception (exception name) in (object name) from (object name).
ASP 0241 | CreateObject Exception | The CreateObject of (object name) caused exception (exception name).
ASP 0242 | Query OnStartPage Interface Exception | Querying object's (object name) OnStartPage or OnEndPage methods caused exception (exception name).
Attribute Name | Attribute Value
XML Data Type | Boolean
WMI Data Type | Boolean
ADSI Data Type | Boolean
ABO Data Type | Boolean
ABO Metabase Identifier | MD_ASP_LOGERRORREQUESTS
Attributes | INHERIT
Default Value | true
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | iis_md_ut_wam
StartingNumber | Not applicable
EndingNumber | 0
ID | 7001

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/W3SVC/n/ROOT /LM/W3SVC/n/ROOT/virtual_directory_name | IIsWebVirtualDir
/LM/W3SVC/n | IIsWebServer
/LM/W3SVC | IIsWebService
/LM/W3SVC/n/ROOT/physical_directory_name /LM/W3SVC/n/virtual_directory_name/physical_directory_name | IIsWebDirectory

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.
Related Topics
AspErrorsToNTLog


AspMaxDiskTemplateCacheFiles

The value of the AspMaxDiskTemplateCacheFiles property specifies the maximum number of compiled ASP templates that can be stored. The directory that stores the compiled templates is configured by the AspDiskTemplateCacheDirectory property. This is a per process setting, so if ASP is hosted in more than one process, the number of files in this directory could exceed the individual maximum.

The metabase represents unlimited as the DWORD value of 4294967295 (0xFFFFFFFF); however, VBScript represents unlimited in hexadecimal format as &HFFFFFFFF. Previous versions of IIS represented unlimited as -1.

Attribute Name | Attribute Value
XML Data Type | DWORD
WMI Data Type | SINT32
ADSI Data Type | DWORD
ABO Data Type | DWORD
ABO Metabase Identifier | MD_ASP_MAXDISKTEMPLATECACHEFILES
Attributes | INHERIT
Default Value | 4294967295
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | iis_md_ut_wam
StartingNumber | Not applicable
EndingNumber | 0
ID | 7040

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/W3SVC/n/ROOT /LM/W3SVC/n/ROOT/virtual_directory_name | IIsWebVirtualDir
/LM/W3SVC/n | IIsWebServer
/LM/W3SVC | IIsWebService
/LM/W3SVC/n/ROOT/physical_directory_name /LM/W3SVC/n/virtual_directory_name/physical_directory_name | IIsWebDirectory

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.
Related Topics
AspDiskTemplateCacheDirectory


AspMaxRequestEntityAllowed

The AspMaxRequestEntityAllowed property specifies the maximum number of bytes allowed in the entity body of an ASP request. If a Content-Length header is present and specifies an amount of data greater than the value of AspMaxRequestEntityAllowed, IIS returns a 403 error response. This property is related in function to MaxRequestEntityAllowed, but is specific to ASP request. Whereas you might set the MaxRequestEntityAllowed property to 1 MB at the general World Wide Web Publishing Service (WWW Service) level, you may choose to set AspMaxRequestEntityAllowed to a lower value, if you know that your specific ASP applications handle a smaller amount of data.

Attribute Name | Attribute Value
XML Data Type | DWORD
WMI Data Type | SINT32
ADSI Data Type | DWORD
ABO Data Type | DWORD
ABO Metabase Identifier | MD_ASP_MAX_REQUEST_ENTITY_ALLOWED
Attributes | INHERIT
Default Value | 200000
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | ASP_MD_UT_APP
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 7053

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/W3SVC/n/ROOT /LM/W3SVC/n/ROOT/virtual_directory_name | IIsWebVirtualDir
/LM/W3SVC/n | IIsWebServer
/LM/W3SVC | IIsWebService
/LM/W3SVC/n/ROOT/physical_directory_name /LM/W3SVC/n/virtual_directory_name/physical_directory_name | IIsWebDirectory

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


AspPartitionID

COM+ partitions are used to isolate Web applications into their own COM+ partitions. COM+ partitions hold different versions of your own custom COM components.

Set the AspPartitionID property to the Globally Unique Identifier (GUID) of the COM+ partition. Also, set the AspUsePartition flag of the AspAppServiceFlags metabase property. Set both properties at the application level.

Attribute Name | Attribute Value
XML Data Type | String
WMI Data Type | String
ADSI Data Type | String
ABO Data Type | String
ABO Metabase Identifier | MD_ASP_SERVICE_PARTITION_ID
Attributes | INHERIT
Default Value | null
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | ASP_MD_UT_APP
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 7048

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/W3SVC/n/ROOT /LM/W3SVC/n/ROOT/virtual_directory_name | IIsWebVirtualDir
/LM/W3SVC/n | IIsWebServer
/LM/W3SVC | IIsWebService
/LM/W3SVC/n/ROOT/physical_directory_name /LM/W3SVC/n/virtual_directory_name/physical_directory_name | IIsWebDirectory

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


AspProcessorThreadMax

The AspProcessorThreadMax property specifies the maximum number of worker threads per processor that IIS may create.

note Note This setting can dramatically influence the scalability of your Web applications, and the performance of your server in general. Because this property defines the maximum number of ASP requests that can execute simultaneously, this setting should remain at the default value unless your ASP applications are making extended calls to external components. In this case, you may increase the value of AspProcessorThreadMax. Doing so allows the server to create more threads to handle more concurrent requests.

If the value of this property is changed, the Web server instance must be stopped and restarted for the change to take effect. The World Wide Web Publishing Service (WWW service) setting for this property is applicable to all in-process and pooled out-of-process application nodes, at all levels. Metabase settings at the Web server level or lower ignores in-process and pooled out-of-process applications. However, settings at the Web server level or lower are used if that node is an isolated out-of-process application.

Attribute Name | Attribute Value
XML Data Type | DWORD
WMI Data Type | SINT32
ADSI Data Type | DWORD
ABO Data Type | DWORD
ABO Metabase Identifier | MD_ASP_PROCESSORTHREADMAX
Attributes | INHERIT
Default Value | 10
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | iis_md_ut_wam
StartingNumber | Not applicable
EndingNumber | 0
ID | 7025

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/W3SVC/n/ROOT /LM/W3SVC/n/ROOT/virtual_directory_name | IIsWebVirtualDir
/LM/W3SVC/n | IIsWebServer
/LM/W3SVC | IIsWebService
/LM/W3SVC/n/ROOT/physical_directory_name /LM/W3SVC/n/virtual_directory_name/physical_directory_name | IIsWebDirectory

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


AspQueueConnectionTestTime

IIS places all ASP requests into a queue. If the request is queued longer than the number of seconds specified by the AspQueueConnectionTestTime property, ASP checks to determine whether the client is still connected before executing the request. If the client is no longer connected, the request is not processed and is deleted from the queue.

note Note Most often, users do not wait more than a few seconds for ASP pages to process. Although the maximum waiting time varies from user to user, the generally accepted maximum is approximately 10 seconds. You can use the AspQueueConnectionTestTime property to ensure that IIS does not waste time processing a request that has been abandoned by the user. This property is useful for making ASP processing efficient only up to the point at which ASP begins to process the script. Once the script is running, however, your application should continue to check for client connection at appropriate times, by using the IsClientConnected method of the ASP built-in Response object.

Attribute Name | Attribute Value
XML Data Type | DWORD
WMI Data Type | SINT32
ADSI Data Type | DWORD
ABO Data Type | DWORD
ABO Metabase Identifier | MD_ASP_QUEUECONNECTIONTESTTIME
Attributes | INHERIT
Default Value | 3
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | ASP_MD_UT_APP
StartingNumber | Not applicable
EndingNumber | 0
ID | 7028

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/W3SVC/n/ROOT /LM/W3SVC/n/ROOT/virtual_directory_name | IIsWebVirtualDir
/LM/W3SVC/n | IIsWebServer
/LM/W3SVC | IIsWebService
/LM/W3SVC/n/ROOT/physical_directory_name /LM/W3SVC/n/virtual_directory_name/physical_directory_name | IIsWebDirectory

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


AspQueueTimeout

The AspQueueTimeout property specifies the amount of time (in seconds) that an ASP script request is allowed to wait in the queue. When requests are pulled from the queue, they are checked to see if they have expired (have waited longer than the value of this parameter). Expired requests are rejected with a message indicating the server is too busy.

The metabase represents unlimited as the DWORD value of 4294967295 (0xFFFFFFFF); however, VBScript represents unlimited in hexadecimal format as &HFFFFFFFF. Previous versions of IIS represented unlimited as -1.

Attribute Name | Attribute Value
XML Data Type | DWORD
WMI Data Type | SINT32
ADSI Data Type | DWORD
ABO Data Type | DWORD
ABO Metabase Identifier | MD_ASP_QUEUETIMEOUT
Attributes | INHERIT
Default Value | 4294967295
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | ASP_MD_UT_APP
StartingNumber | Not applicable
EndingNumber | 0
ID | 7013

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/W3SVC/n/ROOT /LM/W3SVC/n/ROOT/virtual_directory_name | IIsWebVirtualDir
/LM/W3SVC/n | IIsWebServer
/LM/W3SVC | IIsWebService
/LM/W3SVC/n/ROOT/physical_directory_name /LM/W3SVC/n/virtual_directory_name/physical_directory_name | IIsWebDirectory

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


AspRequestQueueMax

The AspRequestQueueMax property specifies the maximum number of concurrent ASP requests that are permitted into the queue. Any client browser that attempts to request ASP files when the queue is full is given an HTTP 500 Server Too Busy error.

Setting this property at the IIsWebService level applies to all in-process and pooled out-of-process application keys, at all levels. Metabase settings at the IIsWebServer level or lower are ignored for in-process and pooled out-of-process applications. However, settings at the IIsWebServer level or lower are used if that key is an isolated out-of-process application.

Attribute Name | Attribute Value
XML Data Type | DWORD
WMI Data Type | SINT32
ADSI Data Type | DWORD
ABO Data Type | DWORD
ABO Metabase Identifier | MD_ASP_REQEUSTQUEUEMAX
Attributes | INHERIT
Default Value | 500
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | iis_md_ut_wam
StartingNumber | Not applicable
EndingNumber | 0
ID | 7026

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/W3SVC/n/ROOT /LM/W3SVC/n/ROOT/virtual_directory_name | IIsWebVirtualDir
/LM/W3SVC/n | IIsWebServer
/LM/W3SVC | IIsWebService
/LM/W3SVC/n/ROOT/physical_directory_name /LM/W3SVC/n/virtual_directory_name/physical_directory_name | IIsWebDirectory

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


AspRunOnEndAnonymously

The AspRunOnEndAnonymously property specifies whether the SessionOnEnd and ApplicationOnEnd global ASP functions should be run as the anonymous user.

Attribute Name | Attribute Value
XML Data Type | Boolean
WMI Data Type | Boolean
ADSI Data Type | Boolean
ABO Data Type | Boolean
ABO Metabase Identifier | MD_ASP_RUN_ONEND_ANON
Attributes | INHERIT
Default Value | true
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | ASP_MD_UT_APP
StartingNumber | Not applicable
EndingNumber | 0
ID | 7051

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/W3SVC/n/ROOT /LM/W3SVC/n/ROOT/virtual_directory_name | IIsWebVirtualDir
/LM/W3SVC/n | IIsWebServer
/LM/W3SVC | IIsWebService
/LM/W3SVC/n/ROOT/physical_directory_name /LM/W3SVC/n/virtual_directory_name/physical_directory_name | IIsWebDirectory

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


AspScriptEngineCacheMax

The AspScriptEngineCacheMax property specifies the maximum number of scripting engines that ASP pages will keep cached in memory.
Attribute Name | Attribute Value
XML Data Type | DWORD
WMI Data Type | SINT32
ADSI Data Type | DWORD
ABO Data Type | DWORD
ABO Metabase Identifier | MD_ASP_SCRIPTENGINECACHEMAX
Attributes | INHERIT
Default Value | 120
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | iis_md_ut_wam
StartingNumber | Not applicable
EndingNumber | 0
ID | 7005

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/W3SVC/n/ROOT /LM/W3SVC/n/ROOT/virtual_directory_name | IIsWebVirtualDir
/LM/W3SVC/n | IIsWebServer
/LM/W3SVC | IIsWebService
/LM/W3SVC/n/ROOT/physical_directory_name /LM/W3SVC/n/virtual_directory_name/physical_directory_name | IIsWebDirectory

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


AspScriptErrorMessage

The AspScriptErrorMessage property specifies the error message to send to the browser if specific debugging errors are not sent to the client (if AspScriptErrorSentToBrowser is set to false).
Attribute Name | Attribute Value
XML Data Type | String
WMI Data Type | String
ADSI Data Type | String
ABO Data Type | String
ABO Metabase Identifier | MD_ASP_SCRIPTERRORMESSAGE
Attributes | INHERIT
Default Value | an error occurred on the server when processing the url. please contact the system administrator.
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | ASP_MD_UT_APP
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 7003

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/W3SVC/n/ROOT /LM/W3SVC/n/ROOT/virtual_directory_name | IIsWebVirtualDir
/LM/W3SVC/n | IIsWebServer
/LM/W3SVC | IIsWebService
/LM/W3SVC/n/ROOT/physical_directory_name /LM/W3SVC/n/virtual_directory_name/physical_directory_name | IIsWebDirectory

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.
Related Topics
AspScriptErrorSentToBrowser


AspScriptErrorSentToBrowser

The AspScriptErrorSentToBrowser property specifies whether the Web server writes debugging specifics (file name, error, line number, description) to the client browser, in addition to logging them to the Windows Event Log. The AspScriptErrorMessage property provides the error message to be sent if this property is set to false.
Attribute Name | Attribute Value
XML Data Type | Boolean
WMI Data Type | Boolean
ADSI Data Type | Boolean
ABO Data Type | Boolean
ABO Metabase Identifier | MD_ASP_SCRIPTERRORSSENTTOBROWSER
Attributes | INHERIT
Default Value | true
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | ASP_MD_UT_APP
StartingNumber | Not applicable
EndingNumber | 0
ID | 7002

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/W3SVC/n/ROOT /LM/W3SVC/n/ROOT/virtual_directory_name | IIsWebVirtualDir
/LM/W3SVC/n | IIsWebServer
/LM/W3SVC | IIsWebService
/LM/W3SVC/n/ROOT/physical_directory_name /LM/W3SVC/n/virtual_directory_name/physical_directory_name | IIsWebDirectory

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.
Related Topics
AspScriptErrorMessage


AspScriptFileCacheSize

The AspScriptFileCacheSize property specifies the number of precompiled script files to cache. If set to 0, no script files are cached. If set to 4294967295, all script files requested are cached. This property is used to tune performance, depending on the amount of available memory and the amount of script file traffic.

The metabase represents unlimited as the DWORD value of 4294967295 (0xFFFFFFFF); however, VBScript represents unlimited in hexadecimal format as &HFFFFFFFF. Previous versions of IIS represented unlimited as -1.

Attribute Name | Attribute Value
XML Data Type | DWORD
WMI Data Type | SINT32
ADSI Data Type | DWORD
ABO Data Type | DWORD
ABO Metabase Identifier | MD_ASP_SCRIPTFILECACHESIZE
Attributes | INHERIT
Default Value | 500
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | iis_md_ut_wam
StartingNumber | Not applicable
EndingNumber | 0
ID | 7004

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/W3SVC/n/ROOT /LM/W3SVC/n/ROOT/virtual_directory_name | IIsWebVirtualDir
/LM/W3SVC/n | IIsWebServer
/LM/W3SVC | IIsWebService
/LM/W3SVC/n/ROOT/physical_directory_name /LM/W3SVC/n/virtual_directory_name/physical_directory_name | IIsWebDirectory

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


AspScriptLanguage

The AspScriptLanguage property specifies the default script language for all ASP applications runing on the Web server. The scripting engine for this language will be used for ASP code within the script language delimiters (<% and %>), unless specifically overridden by the following directive which must appear as the first line in any ASP page.
<%@ LANGUAGE = ScriptingLanguage %>

note Note IIS issues an error if ScriptingLanguage name is not registered on the system.

Attribute Name | Attribute Value
XML Data Type | String
WMI Data Type | String
ADSI Data Type | String
ABO Data Type | String
ABO Metabase Identifier | MD_ASP_SCRIPTLANGUAGE
Attributes | INHERIT
Default Value | VBScript
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | ASP_MD_UT_APP
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 7012

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/W3SVC/n/ROOT /LM/W3SVC/n/ROOT/virtual_directory_name | IIsWebVirtualDir
/LM/W3SVC/n | IIsWebServer
/LM/W3SVC | IIsWebService
/LM/W3SVC/n/ROOT/physical_directory_name /LM/W3SVC/n/virtual_directory_name/physical_directory_name | IIsWebDirectory

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


AspScriptTimeout

The AspScriptTimeout property specifies (in seconds) the default length of time that ASP pages allow a script to run before terminating the script and writing an event to the Windows Event Log. ASP script can override this value by using the ScriptTimeout property of the ASP built-in Session object. The ScriptTimeout property allows your ASP application to set a higher script timeout value. For example, you can use this setting to adjust the timeout once a particular user establishes a valid session by logging in or ordering a product.

note Note The minimum value for this property is one second.

Attribute Name | Attribute Value
XML Data Type | DWORD
WMI Data Type | SINT32
ADSI Data Type | DWORD
ABO Data Type | DWORD
ABO Metabase Identifier | MD_ASP_SCRIPTTIMEOUT
Attributes | INHERIT
Default Value | 90
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | ASP_MD_UT_APP
StartingNumber | Not applicable
EndingNumber | 0
ID | 7006

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/W3SVC/n/ROOT /LM/W3SVC/n/ROOT/virtual_directory_name | IIsWebVirtualDir
/LM/W3SVC/n | IIsWebServer
/LM/W3SVC | IIsWebService
/LM/W3SVC/n/ROOT/physical_directory_name /LM/W3SVC/n/virtual_directory_name/physical_directory_name | IIsWebDirectory

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.
Related Topics
AspSessionTimeout


AspSessionMax

The AspSessionMax property specifies the maximum number of concurrent sessions that IIS will permit. If a client attempts to establish a new session with IIS once this limit is reached, the client will receive an error (HTTP 500 Server Too Busy).

note Note ASP requires a certain amount of memory overhead for each session maintained. Although you could use AspSessionMax to limit this memory overhead, it is generally more appropriate to manage the lifetime of session objects within IIS by using the AspSessionTimeout property, so that client browsers will be rejected once the limit is reached.

If an incoming request does not have an ASP session cookie, or has a session cookie that does not match an existing session, the incoming request is considered a new session request. Setting this property at the IIsWebService level applies to all in-process and pooled out-of-process application keys, at all levels. Metabase settings at the IIsWebServer level or lower are ignored for in-process and pooled out-of-process applications. However, settings at the IIsWebServer level or lower are used if that key is an isolated out-of-process application.

The metabase represents unlimited as the DWORD value of 4294967295 (0xFFFFFFFF); however, VBScript represents unlimited in hexadecimal format as &HFFFFFFFF. Previous versions of IIS represented unlimited as -1.

Attribute Name | Attribute Value
XML Data Type | DWORD
WMI Data Type | SINT32
ADSI Data Type | DWORD
ABO Data Type | DWORD
ABO Metabase Identifier | MD_ASP_SESSIONMAX
Attributes | INHERIT
Default Value | 4294967295
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | ASP_MD_UT_APP
StartingNumber | Not applicable
EndingNumber | 0
ID | 7029

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/W3SVC/n/ROOT /LM/W3SVC/n/ROOT/virtual_directory_name | IIsWebVirtualDir
/LM/W3SVC/n | IIsWebServer
/LM/W3SVC | IIsWebService
/LM/W3SVC/n/ROOT/physical_directory_name /LM/W3SVC/n/virtual_directory_name/physical_directory_name | IIsWebDirectory

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.
Related Topics
AspSessionTimeout


AspSessionTimeout

The AspSessionTimeout property specifies (in minutes) the default amount of time that a Session object is maintained after the last request associated with the object is made. You can override this property in script by using the Timeout property of the ASP built-in Session object.

note Note You can use AspSessionTimeout to fine tune your ASP applications. Because Session objects consume memory resources, using this property to limit the lifetime of an individual Session makes your applications more scalable.

Setting this property at the IIsWebService level applies to all in-process and pooled out-of-process application keys, at all levels. Metabase settings at the IIsWebServer level or lower are ignored for in-process and pooled out-of-process applications. However, settings at the IIsWebServer level or lower are used if that key is an isolated out-of-process application.

Attribute Name | Attribute Value
XML Data Type | DWORD
WMI Data Type | SINT32
ADSI Data Type | DWORD
ABO Data Type | DWORD
ABO Metabase Identifier | MD_ASP_SESSIONTIMEOUT
Attributes | INHERIT
Default Value | 10
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | ASP_MD_UT_APP
StartingNumber | Not applicable
EndingNumber | 0
ID | 7007

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/W3SVC/n/ROOT /LM/W3SVC/n/ROOT/virtual_directory_name | IIsWebVirtualDir
/LM/W3SVC/n | IIsWebServer
/LM/W3SVC | IIsWebService
/LM/W3SVC/n/ROOT/physical_directory_name /LM/W3SVC/n/virtual_directory_name/physical_directory_name | IIsWebDirectory

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.
Related Topics
AspScriptTimeout


AspSxsName

The AspSxsName property enables side-by-side (SxS) assemblies. SxS assemblies allow ASP applications to specify which version of a system DLL or classic COM component to use, such as MDAC, MFS, MSVCRT, MSXML, and so on.

Set the AspSxsName metabase property to the name of the COM+ application. Also, set the AspEnableSxs flag of the AspAppServiceFlags metabase property. Set both metabase properties at the application level.

Attribute Name | Attribute Value
XML Data Type | String
WMI Data Type | String
ADSI Data Type | String
ABO Data Type | String
ABO Metabase Identifier | MD_ASP_SERVICE_SXS_NAME
Attributes | INHERIT
Default Value | null
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | ASP_MD_UT_APP
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 7049

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/W3SVC/n/ROOT /LM/W3SVC/n/ROOT/virtual_directory_name | IIsWebVirtualDir
/LM/W3SVC/n | IIsWebServer
/LM/W3SVC | IIsWebService
/LM/W3SVC/n/ROOT/physical_directory_name /LM/W3SVC/n/virtual_directory_name/physical_directory_name | IIsWebDirectory

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


AspTrackThreadingModel

The AspTrackThreadingModel property specifies whether IIS checks the threading model of any components that your application creates.

important Important This metabase property is usually best left at the default value (false), so that ASP will not use system resources to track the threading model and your ASP application provides the best possible performance. If this property is set to false, and you give application scope to components that you create, those components must aggregate the free-threaded marshaler. If you do not aggregate the free-threaded marshaler, ASP generates an error when you try to create an instance of the component. For more information about this topic, see the "Building Components for ASP" section in the Platform SDK.

Another reason to leave this property at the default setting (false), is that any objects that are created in your ASP application without the OnStartPage or OnEndPage method are released earlier than they would be otherwise and there is degradation of your application's scalability. For more details about improving performance, see Performance Tuning.

note Note In IIS 4.0, the default value for this property was true.

Setting this property at the IIsWebService level applies to all in-process and pooled out-of-process application keys, at all levels. Metabase settings at the IIsWebServer level or lower are ignored for in-process and pooled out-of-process applications. However, settings at the IIsWebServer level or lower are used if that key is an isolated out-of-process application.

Attribute Name | Attribute Value
XML Data Type | Boolean
WMI Data Type | Boolean
ADSI Data Type | Boolean
ABO Data Type | Boolean
ABO Metabase Identifier | MD_ASP_ID_LAST
Attributes | INHERIT
Default Value | false
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | iis_md_ut_wam
StartingNumber | Not applicable
EndingNumber | 0
ID | 7020

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/W3SVC/n/ROOT /LM/W3SVC/n/ROOT/virtual_directory_name | IIsWebVirtualDir
/LM/W3SVC/n | IIsWebServer
/LM/W3SVC | IIsWebService
/LM/W3SVC/n/ROOT/physical_directory_name /LM/W3SVC/n/virtual_directory_name/physical_directory_name | IIsWebDirectory

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


AuthChangeURL

The AuthChangeURL property contains the URL to be invoked when a user enters a new password.
Attribute Name | Attribute Value
XML Data Type | String
WMI Data Type | String
ADSI Data Type | String
ABO Data Type | String
ABO Metabase Identifier | MD_AUTH_CHANGE_URL
Attributes | INHERIT
Default Value | null
MetaFlagsEx | Not applicable
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 2060

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/W3SVC | IIsWebService

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


AuthExpiredUnsecureURL

The AuthExpiredUnsecureURL property contains a URL that will be invoked when a user's password has expired.
Attribute Name | Attribute Value
XML Data Type | String
WMI Data Type | String
ADSI Data Type | String
ABO Data Type | String
ABO Metabase Identifier | MD_AUTH_EXPIRED_UNSECUREURL
Attributes | INHERIT
Default Value | null
MetaFlagsEx | Not applicable
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 2067

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/W3SVC | IIsWebService

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


AuthExpiredURL

The AuthExpiredURL property contains a URL that will be invoked when a user's password has expired. It will be invoked in a secure (HTTPS) manner.
Attribute Name | Attribute Value
XML Data Type | String
WMI Data Type | String
ADSI Data Type | String
ABO Data Type | String
ABO Metabase Identifier | MD_AUTH_EXPIRED_URL
Attributes | INHERIT
Default Value | null
MetaFlagsEx | Not applicable
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 2061

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/W3SVC | IIsWebService

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


AuthFlags

The AuthFlags property contains the settings for the Windows authentication schemes that are returned to clients as being available. This property contains the file access authentication flags, which are listed below in the Flags section.

Attribute Name | Attribute Value
XML Data Type | DWORD
WMI Data Type | SINT32
ADSI Data Type | DWORD
ABO Data Type | DWORD
ABO Metabase Identifier | MD_AUTHORIZATION
Attributes | INHERIT
Default Value | authanonymous
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_FILE
StartingNumber | Not applicable
EndingNumber | 0
ID | 6000

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/W3SVC/n/ROOT /LM/W3SVC/n/ROOT/virtual_directory_name | IIsWebVirtualDir
/LM/W3SVC/n | IIsWebServer
/LM/W3SVC | IIsWebService
/LM/W3SVC/n/ROOT/file_name /LM/W3SVC/n/ROOT/virtual_directory_name/file_name | IIsWebFile
/LM/W3SVC/n/ROOT/physical_directory_name /LM/W3SVC/n/virtual_directory_name/physical_directory_name | IIsWebDirectory
/LM/NNTPSVC | IIsNntpService
/LM/NNTPSVC/n | IIsNntpServer
/LM/SMTPSVC | IIsSmtpService
/LM/SMTPSVC/n | IIsSmtpServer

Flags

Flag Name | AuthBasic
Description | Specifies Basic authentication as one of the possible Windows authentication schemes returned to clients as being available.
Metabase Bitmask Identifier | MD_AUTH_BASIC
Decimal Value | 2
Hex Value | 0x00000002
Flag Name | AuthAnonymous
Description | Specifies Anonymous authentication as one of the possible Windows authentication schemes returned to clients as being available.
Metabase Bitmask Identifier | MD_AUTH_ANONYMOUS
Decimal Value | 1
Hex Value | 0x00000001
Flag Name | AuthNTLM
Description | Specifies Integrated Windows authentication (also known as Challenge/Response or NTLM authentication) as one of the possible Windows authentication schemes returned to clients as being available.
Metabase Bitmask Identifier | MD_AUTH_NT
Decimal Value | 4
Hex Value | 0x00000001
Flag Name | AuthMD5
Description | Specifies Digest authentication and Advanced Digest authentication as one of the possible Windows authentication schemes returned to clients as being available.
Metabase Bitmask Identifier | MD_AUTH_MD5
Decimal Value | 16
Hex Value | 0x00000010
Flag Name | AuthPassport
Description | A value of true indicates that Microsoft® .NET Passport authentication is enabled. For more information, see .NET Passport Authentication.
Metabase Bitmask Identifier | MD_AUTH_PASSPORT
Decimal Value | 64
Hex Value | 0x00000040

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


AuthNotifyPwdExpUnsecureURL

The AuthNotifyPwdExpUnsecureURL property contains a URL that will be invoked if the user's password expires sooner than the number of days specified in PasswordExpirePreNotifyDays.
Attribute Name | Attribute Value
XML Data Type | String
WMI Data Type | String
ADSI Data Type | String
ABO Data Type | String
ABO Metabase Identifier | MD_AUTH_NOTIFY_PWD_EXP_UNSECUREURL
Attributes | INHERIT
Default Value | null
MetaFlagsEx | Not applicable
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 2069

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/W3SVC | IIsWebService

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


AuthNotifyPwdExpURL

The AuthNotifyPwdExpURL property contains a URL that will be invoked if the user's password expires sooner than the number of days specified in PasswordExpirePreNotifyDays. It will be invoked in a secure (HTTPS) manner.
Attribute Name | Attribute Value
XML Data Type | String
WMI Data Type | String
ADSI Data Type | String
ABO Data Type | String
ABO Metabase Identifier | MD_AUTH_NOTIFY_PWD_EXP_URL
Attributes | INHERIT
Default Value | null
MetaFlagsEx | Not applicable
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 2062

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/W3SVC | IIsWebService

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


AutoShutdownAppPoolExe

The AutoShutdownAppPoolExe property specifies an executable to run when the World Wide Web Publishing Service (WWW Service) shuts down an application pool for rapid fail protection.
Attribute Name | Attribute Value
XML Data Type | String
WMI Data Type | String
ADSI Data Type | String
ABO Data Type | String
ABO Metabase Identifier | MD_AUTO_SHUTDOWN_APPPOOL_COMMAND
Attributes | INHERIT
Default Value | null
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 9035

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/W3SVC/AppPools/DefaultAppPool /LM/W3SVC/AppPools/DefaultAppPool/application_pool_name | IIsApplicationPool
/LM/W3SVC/AppPools | IIsApplicationPools

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


AutoShutdownAppPoolParams

The AutoSHutdownAppPoolParams property specifies any command-line parameters for any program that is specified in the AutoShutdownAppPoolExe property.

Attribute Name | Attribute Value
XML Data Type | String
WMI Data Type | String
ADSI Data Type | String
ABO Data Type | String
ABO Metabase Identifier | MD_APPPOOL_STATE_STOPPED
Attributes | INHERIT
Default Value | null
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 9036

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/W3SVC/AppPools/DefaultAppPool /LM/W3SVC/AppPools/DefaultAppPool/application_pool_name | IIsApplicationPool
/LM/W3SVC/AppPools | IIsApplicationPools

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


AuthPersistence

The AuthPersistence property specifies authentication persistence across requests on a connection using NTLM authentication. When the AuthPersistSingleRequest flag is set to true on this property, and on all other authentication schemes, IIS 6.0 automatically reauthenticates every request, even those on the same connection. This behavior is different on IIS 5.0 and IIS 5.1, where there were two other flags for the AuthPersistence property specifying persistence based on the existence of a proxy server.

Attribute Name | Attribute Value
XML Data Type | DWORD
WMI Data Type | SINT32
ADSI Data Type | DWORD
ABO Data Type | DWORD
ABO Metabase Identifier | MD_AUTHORIZATION_PERSISTENCE
Attributes | INHERIT
Default Value | authpersistsinglerequest
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_FILE
StartingNumber | Not applicable
EndingNumber | 0
ID | 6031

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/W3SVC/n/ROOT /LM/W3SVC/n/ROOT/virtual_directory_name | IIsWebVirtualDir
/LM/W3SVC/n | IIsWebServer
/LM/W3SVC | IIsWebService
/LM/W3SVC/n/ROOT/file_name /LM/W3SVC/n/ROOT/virtual_directory_name/file_name | IIsWebFile
/LM/W3SVC/n/ROOT/physical_directory_name /LM/W3SVC/n/virtual_directory_name/physical_directory_name | IIsWebDirectory

Flags

Flag Name | AuthPersistSingleRequest
Description | Setting this flag to true specifies that authentication persists only for a single request on a connection. IIS resets the authentication at the end of each request, and forces re-authentication on the next request of the session.
Metabase Bitmask Identifier | MD_AUTH_SINGLEREQUEST
Decimal Value | 64
Hex Value | 0x00000040

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


AuthTurnList

The AuthTurnList property is used by Microsoft Exchange.
Attribute Name | Attribute Value
XML Data Type | MULTISZ
WMI Data Type | MULTISZ
ADSI Data Type | MULTISZ
ABO Data Type | MULTISZ
ABO Metabase Identifier | No friendly named is defined for this identifier in iiscfng.h. Search the systemroot\System32\Inetsrv\MBSchema.xml file for this property and use the integer from its ID attribute.
Attributes | INHERIT
Default Value | null
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 36966

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/SMTPSVC/n/Domain | IIsSmtpDomain

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


AzEnable

The AzEnable property enables URL Authorization for the virtual directory, application, or URL corresponding to the entry in the metabase.
Attribute Name | Attribute Value
XML Data Type | Boolean
WMI Data Type | Boolean
ADSI Data Type | Boolean
ABO Data Type | Boolean
ABO Metabase Identifier | MD_ENABLE_URL_AUTHORIZATION
Attributes | INHERIT
Default Value | false
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_FILE
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 6048

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/W3SVC/n/ROOT /LM/W3SVC/n/ROOT/virtual_directory_name | IIsWebVirtualDir
/LM/W3SVC/n | IIsWebServer
/LM/W3SVC | IIsWebService
/LM/W3SVC/n/ROOT/file_name /LM/W3SVC/n/ROOT/virtual_directory_name/file_name | IIsWebFile
/LM/W3SVC/n/ROOT/physical_directory_name /LM/W3SVC/n/virtual_directory_name/physical_directory_name | IIsWebDirectory
/LM/NNTPSVC | IIsNntpService
/LM/NNTPSVC/n | IIsNntpServer
/LM/SMTPSVC | IIsSmtpService
/LM/SMTPSVC/n | IIsSmtpServer

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


AzImpersonationLevel

The AzImpersonationLevel property determines the impersonation behavior for the application, allowing the Web application to be configured to impersonate the client user, the IIS worker process, or the IUSER_* account for the worker process.

note Note Take care in setting this value, as each setting significantly changes the environment and implied design of the Web application.

Impersonation Level | Numeric value of the Field
Client User | 0
IIS Worker Process | 1
IUSER_* | 2
Attribute Name | Attribute Value
XML Data Type | DWORD
WMI Data Type | SINT32
ADSI Data Type | DWORD
ABO Data Type | DWORD
ABO Metabase Identifier | MD_URL_AUTHORIZATION_IMPERSONATION_LEVEL
Attributes | INHERIT
Default Value | 0
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_FILE
StartingNumber | 0
EndingNumber | 2
ID | 6053

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/W3SVC/n/ROOT /LM/W3SVC/n/ROOT/virtual_directory_name | IIsWebVirtualDir
/LM/W3SVC/n | IIsWebServer
/LM/W3SVC | IIsWebService
/LM/W3SVC/n/ROOT/file_name /LM/W3SVC/n/ROOT/virtual_directory_name/file_name | IIsWebFile
/LM/W3SVC/n/ROOT/physical_directory_name /LM/W3SVC/n/virtual_directory_name/physical_directory_name | IIsWebDirectory

Code Example

For general code examples, please see Code Examples to Configure Metabase Properties


AzScopeName

The AzScopeName property associates the virtual directory, application, or URL with a scope. If no scope or an empty string is specified, the default scope of the IIS 6.0 URL Authorization will be used.

Attribute Name | Attribute Value
XML Data Type | String
WMI Data Type | String
ADSI Data Type | String
ABO Data Type | String
ABO Metabase Identifier | MD_URL_AUTHORIZATION_SCOPE_NAME
Attributes | INHERIT
Default Value | null
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_FILE
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 6050

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/W3SVC/n/ROOT /LM/W3SVC/n/ROOT/virtual_directory_name | IIsWebVirtualDir
/LM/W3SVC/n | IIsWebServer
/LM/W3SVC | IIsWebService
/LM/W3SVC/n/ROOT/file_name /LM/W3SVC/n/ROOT/virtual_directory_name/file_name | IIsWebFile
/LM/W3SVC/n/ROOT/physical_directory_name /LM/W3SVC/n/virtual_directory_name/physical_directory_name | IIsWebDirectory
/LM/NNTPSVC | IIsNntpService
/LM/NNTPSVC/n | IIsNntpServer
/LM/SMTPSVC | IIsSmtpService
/LM/SMTPSVC/n | IIsSmtpServer

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


AzStoreName

The AzStoreName property associates an Authorization Manager policy store with the virtual directory, application, or URL. This string value must specify the store type and path to the policy store (i.e. "msxml://c:\mystore.xml" or "msldap://CN=MyAzStore, CN=Program Data, DC=mydomain, DC=com").

Attribute Name | Attribute Value
XML Data Type | String
WMI Data Type | String
ADSI Data Type | String
ABO Data Type | String
ABO Metabase Identifier | MD_URL_AUTHORIZATION_STORE_NAME
Attributes | INHERIT
Default Value | null
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_FILE
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 6049

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/W3SVC/n/ROOT /LM/W3SVC/n/ROOT/virtual_directory_name | IIsWebVirtualDir
/LM/W3SVC/n | IIsWebServer
/LM/W3SVC | IIsWebService
/LM/W3SVC/n/ROOT/file_name /LM/W3SVC/n/ROOT/virtual_directory_name/file_name | IIsWebFile
/LM/W3SVC/n/ROOT/physical_directory_name /LM/W3SVC/n/virtual_directory_name/physical_directory_name | IIsWebDirectory
/LM/NNTPSVC | IIsNntpService
/LM/NNTPSVC/n | IIsNntpServer
/LM/SMTPSVC | IIsSmtpService
/LM/SMTPSVC/n | IIsSmtpServer

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


BinSchemaTimeStamp

The BINSchemaTimeStamp property is used internally by IIS to keep the MBSchema.xml file in sync with the binary schema file.

important Important Because this property is internally configured by IIS, you should consider it to be read-only. Do not configure this property.

Attribute Name | Attribute Value
XML Data Type | binary
WMI Data Type | binary
ADSI Data Type | binary
ABO Data Type | binary
ABO Metabase Identifier | MD_GLOBAL_BINSCHEMATIMESTAMP
Attributes | NO_ATTRIBUTES
Default Value | null
MetaFlagsEx | Not applicable
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 9991

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
. | IIS_Global

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


BadMailDirectory

The BadMailDirectory property contains the directory where undeliverable mail messages are placed. This corresponds to "Badmail directory" on the Message tab.
Attribute Name | Attribute Value
XML Data Type | String
WMI Data Type | String
ADSI Data Type | String
ABO Data Type | String
ABO Metabase Identifier | No friendly named is defined for this identifier in iiscfng.h. Search the systemroot\System32\Inetsrv\MBSchema.xml file for this property and use the integer from its ID attribute.
Attributes | INHERIT
Default Value | null
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 36909

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/SMTPSVC | IIsSmtpService
/LM/SMTPSVC/n | IIsSmtpServer

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


BannerMessage

The BannerMessage property is used by Microsoft® Exchange.
Attribute Name | Attribute Value
XML Data Type | MULTISZ
WMI Data Type | MULTISZ
ADSI Data Type | MULTISZ
ABO Data Type | MULTISZ
ABO Metabase Identifier | MD_BANNER_MESSAGE
Attributes | INHERIT
Default Value | null
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 5011

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/MSFTPSVC/n | IIsFtpServer
/LM/MSFTPSVC | IIsFtpService

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


CacheControlCustom

The CacheControlCustom property specifies custom HTTP 1.1 cache control directives. Multiple directives can be specified if they are separated by carriage return/line feed (CRLF) pairs. There should not be a trailing carriage return/line feed after the final directive.
Attribute Name | Attribute Value
XML Data Type | String
WMI Data Type | String
ADSI Data Type | String
ABO Data Type | String
ABO Metabase Identifier | MD_CC_OTHER
Attributes | INHERIT
Default Value | null
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_FILE
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 6043

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/W3SVC/n/ROOT /LM/W3SVC/n/ROOT/virtual_directory_name | IIsWebVirtualDir
/LM/W3SVC/n | IIsWebServer
/LM/W3SVC | IIsWebService
/LM/W3SVC/n/ROOT/file_name /LM/W3SVC/n/ROOT/virtual_directory_name/file_name | IIsWebFile
/LM/W3SVC/n/ROOT/physical_directory_name /LM/W3SVC/n/virtual_directory_name/physical_directory_name | IIsWebDirectory

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


CacheControlMaxAge

The CacheControlMaxAge property specifies the HTTP 1.1 cache control maximum age value. The value of this property ranges from 0 to 4294967295 (or unlimited), measured in seconds.

The metabase represents unlimited as the DWORD value of 4294967295 (0xFFFFFFFF); however, VBScript represents unlimited in hexadecimal format as &HFFFFFFFF. Previous versions of IIS represented unlimited as -1.

Attribute Name | Attribute Value
XML Data Type | DWORD
WMI Data Type | SINT32
ADSI Data Type | DWORD
ABO Data Type | DWORD
ABO Metabase Identifier | MD_CC_MAX_AGE
Attributes | INHERIT
Default Value | 0
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_FILE
StartingNumber | Not applicable
EndingNumber | 0
ID | 6042

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/W3SVC/n/ROOT /LM/W3SVC/n/ROOT/virtual_directory_name | IIsWebVirtualDir
/LM/W3SVC/n | IIsWebServer
/LM/W3SVC | IIsWebService
/LM/W3SVC/n/ROOT/file_name /LM/W3SVC/n/ROOT/virtual_directory_name/file_name | IIsWebFile
/LM/W3SVC/n/ROOT/physical_directory_name /LM/W3SVC/n/virtual_directory_name/physical_directory_name | IIsWebDirectory

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


CacheControlNoCache

The CacheControlNoCache property specifies the HTTP 1.1 directive to prevent caching of content.
Attribute Name | Attribute Value
XML Data Type | Boolean
WMI Data Type | Boolean
ADSI Data Type | Boolean
ABO Data Type | Boolean
ABO Metabase Identifier | MD_CC_NO_CACHE
Attributes | INHERIT
Default Value | false
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_FILE
StartingNumber | Not applicable
EndingNumber | 0
ID | 6041

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/W3SVC/n/ROOT /LM/W3SVC/n/ROOT/virtual_directory_name | IIsWebVirtualDir
/LM/W3SVC/n | IIsWebServer
/LM/W3SVC | IIsWebService
/LM/W3SVC/n/ROOT/file_name /LM/W3SVC/n/ROOT/virtual_directory_name/file_name | IIsWebFile
/LM/W3SVC/n/ROOT/physical_directory_name /LM/W3SVC/n/virtual_directory_name/physical_directory_name | IIsWebDirectory

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


CacheISAPI

The CacheISAPI property indicates whether ISAPI extensions are cached in memory after first use. If the value of this property is set to true, ISAPI extensions, once loaded, remain in the cache until the server is stopped. If the value is set to false, extensions are unloaded from memory after the ISAPI extension is no longer in use.

ISAPI extensions are cached or not cached based on the value of this property at the time they were loaded into memory for use. Thus, if this property is changed after an extension has been loaded and cached, the change will have no effect on that extension until the Web server is restarted.

important Important There are severe performance implications to setting the value of this property to false. Also, some extensions cannot work properly when this property is set to false.

Attribute Name | Attribute Value
XML Data Type | Boolean
WMI Data Type | Boolean
ADSI Data Type | Boolean
ABO Data Type | Boolean
ABO Metabase Identifier | MD_CACHE_EXTENSIONS
Attributes | INHERIT
Default Value | true
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_FILE
StartingNumber | Not applicable
EndingNumber | 0
ID | 6034

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/W3SVC/n/ROOT /LM/W3SVC/n/ROOT/virtual_directory_name | IIsWebVirtualDir
/LM/W3SVC/n | IIsWebServer
/LM/W3SVC | IIsWebService
/LM/W3SVC/n/ROOT/physical_directory_name /LM/W3SVC/n/virtual_directory_name/physical_directory_name | IIsWebDirectory

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


CentralBinaryLoggingEnabled

The CentralBinaryLoggingEnabled property is a global flag to denote that IIS will generate one centralized binary log file rather than a separate file per Web site.

note Note This parameter is not inheritable and only exists on the parent node.

Attribute Name | Attribute Value
XML Data Type | Boolean
WMI Data Type | Boolean
ADSI Data Type | Boolean
ABO Data Type | Boolean
ABO Metabase Identifier | MD_GLOBAL_BINARY_LOGGING_ENABLED
Attributes | NO_ATTRIBUTES
Default Value | false
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 4016

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/W3SVC | IIsWebService

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


CertCheckMode

The CertCheckMode property enables or disables Certificate Revocation List (CRL) checking. When CertCheckMode is set to a value greater than 0 (CertCheckMode>0), the CRL does not search for certificates that have been revoked. When CertCheckMode is equal to 0 (CertCheckMode=0), the CRL searches for certificates that have been revoked.

Attribute Name | Attribute Value
XML Data Type | DWORD
WMI Data Type | SINT32
ADSI Data Type | DWORD
ABO Data Type | DWORD
ABO Metabase Identifier | MD_CERT_CHECK_MODE
Attributes | INHERIT
Default Value | 0
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | 0
ID | 2160

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/W3SVC/n | IIsWebServer
/LM/W3SVC | IIsWebService

Values

Constant | Value | Description
MD_CERT_NO_REVOC_CHECK | 0x00000001 | When MD_CERT_NO_REVOC_CHECK is set to true, certificate revocation is not performed.
MD_CERT_CACHE_RETRIEVAL_ONLY | 0x00000002 | When MD_CERT_CACHE_RETRIEVAL_ONLY is set to true, the CRL will not be updated from a remote location, such as a CRL URL location, during a certificate revocation verification. In this case, the CRL that is cached on the client is used. If the CRL is expired, the certificate revocation verification fails.
MD_CERT_CHECK_REVOCATION_FRESHNESS_TIME | 0x00000004 | When MD_CERT_CHECK_REVOCATION_FRESHNESS_TIME is set to true, the client CRL is replaced by the remote CRL, even if the CRL that is cached on the client is valid. The value of the RevocationFreshnessTime property is used as a counter, which determines the frequency of this action.
MD_CERT_NO_USAGE_CHECK | 0x00010000 | When MD_CERT_NO_USAGE_CHECK is set to true, the certificate provided by the client is not verified as valid.

important Important The MD_CERT_NO_REVOC_CHECK , MD_CERT_CACHE_RETRIEVAL_ONLY, and MD_CERT_CHECK_REVOCATION_FRESHNESS_TIME flags are mutually exclusive.

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


CGITimeout

The CGITimeout property specifies the timeout (in seconds) for CGI applications. The value range is 10 seconds to &H80000000 (2.1 million seconds).

note Note &H represents Microsoft Visual Basic Scripting Edition (VBScript) hexadecimal format.

Attribute Name | Attribute Value
XML Data Type | DWORD
WMI Data Type | SINT32
ADSI Data Type | DWORD
ABO Data Type | DWORD
ABO Metabase Identifier | MD_SCRIPT_TIMEOUT
Attributes | INHERIT
Default Value | 300
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_FILE
StartingNumber | Not applicable
EndingNumber | 0
ID | 6033

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/W3SVC/n/ROOT /LM/W3SVC/n/ROOT/virtual_directory_name | IIsWebVirtualDir
/LM/W3SVC/n | IIsWebServer
/LM/W3SVC | IIsWebService
/LM/W3SVC/n/ROOT/file_name /LM/W3SVC/n/ROOT/virtual_directory_name/file_name | IIsWebFile
/LM/W3SVC/n/ROOT/physical_directory_name /LM/W3SVC/n/virtual_directory_name/physical_directory_name | IIsWebDirectory

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


ChangeNumber

The ChangeNumber property is used internally by IIS to keep track of changes to the metabase.

important Important Because this property is internally configured by IIS, you should consider it to be read-only. Do not configure this property.

Attribute Name | Attribute Value
XML Data Type | DWORD
WMI Data Type | SINT32
ADSI Data Type | DWORD
ABO Data Type | DWORD
ABO Metabase Identifier | MD_GLOBAL_CHANGE_NUMBER
Attributes | NO_ATTRIBUTES
Default Value | null
MetaFlagsEx | Not applicable
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 9997

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
. | IIS_Global

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


ClientPostHardLimit

The ClientPostHardLimit property contains the number of bytes the server will take before breaking the session.

The metabase represents unlimited as the DWORD value of 4294967295 (0xFFFFFFFF); however, VBScript represents unlimited in hexadecimal format as &HFFFFFFFF. Previous versions of IIS represented unlimited as -1.

Attribute Name | Attribute Value
XML Data Type | DWORD
WMI Data Type | SINT32
ADSI Data Type | DWORD
ABO Data Type | DWORD
ABO Metabase Identifier | No friendly named is defined for this identifier in iiscfng.h. Search the systemroot\System32\Inetsrv\MBSchema.xml file for this property and use the integer from its ID attribute.
Attributes | INHERIT
Default Value | 4294967295
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | 0
ID | 45165

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/NNTPSVC | IIsNntpService
/LM/NNTPSVC/n | IIsNntpServer

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


ClientPostSoftLimit

The ClientPostSoftLimit property contains the largest post the server will take.

The metabase represents unlimited as the DWORD value of 4294967295 (0xFFFFFFFF); however, VBScript represents unlimited in hexadecimal format as &HFFFFFFFF. Previous versions of IIS represented unlimited as -1.

Attribute Name | Attribute Value
XML Data Type | DWORD
WMI Data Type | SINT32
ADSI Data Type | DWORD
ABO Data Type | DWORD
ABO Metabase Identifier | No friendly named is defined for this identifier in iiscfng.h. Search the systemroot\System32\Inetsrv\MBSchema.xml file for this property and use the integer from its ID attribute.
Attributes | INHERIT
Default Value | 4294967295
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | 0
ID | 45166

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/NNTPSVC | IIsNntpService
/LM/NNTPSVC/n | IIsNntpServer

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


ClusterEnabled

The ClusterEnabled property is used by Microsoft Exchange.
Attribute Name | Attribute Value
XML Data Type | Boolean
WMI Data Type | Boolean
ADSI Data Type | Boolean
ABO Data Type | Boolean
ABO Metabase Identifier | MD_CLUSTER_ENABLED
Attributes | NO_ATTRIBUTES
Default Value | false
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | 0
ID | 1025

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/W3SVC/n | IIsWebServer
/LM/MSFTPSVC/n | IIsFtpServer
/LM/NNTPSVC/n | IIsNntpServer
/LM/SMTPSVC/n | IIsSmtpServer

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


CollectionComment

The CollectionComment property exposes comments in the metabase.
Attribute Name | Attribute Value
XML Data Type | String
WMI Data Type | String
ADSI Data Type | String
ABO Data Type | String
ABO Metabase Identifier | MD_COMMENTS
Attributes | NO_ATTRIBUTES
Default Value | null
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 9990

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path IIS Admin Object Type

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


ConnectionTimeout

The ConnectionTimeout property specifies the amount of time (in seconds) that the server waits before disconnecting an inactive connection.
Attribute Name | Attribute Value
XML Data Type | DWORD
WMI Data Type | SINT32
ADSI Data Type | DWORD
ABO Data Type | DWORD
ABO Metabase Identifier | MD_CONNECTION_TIMEOUT
Attributes | INHERIT
Default Value | 900
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | 2147483647
ID | 1013

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/W3SVC/n | IIsWebServer
/LM/MSFTPSVC/n | IIsFtpServer
/LM/W3SVC | IIsWebService
/LM/MSFTPSVC | IIsFtpService
/LM/NNTPSVC | IIsNntpService
/LM/NNTPSVC/n | IIsNntpServer
/LM/SMTPSVC | IIsSmtpService
/LM/SMTPSVC/n | IIsSmtpServer

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


ConnectResponse

The ConnectResponse property changes the banner response issued at connection to Microsoft Exchange. You must restart the service for this to take effect.
Attribute Name | Attribute Value
XML Data Type | String
WMI Data Type | String
ADSI Data Type | String
ABO Data Type | String
ABO Metabase Identifier | No friendly named is defined for this identifier in iiscfng.h. Search the systemroot\System32\Inetsrv\MBSchema.xml file for this property and use the integer from its ID attribute.
Attributes | INHERIT
Default Value | null
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 36907

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/SMTPSVC | IIsSmtpService
/LM/SMTPSVC/n | IIsSmtpServer

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


ContentIndexed

The ContentIndexed property specifies whether the installed content indexer should index content under this directory tree.
Attribute Name | Attribute Value
XML Data Type | Boolean
WMI Data Type | Boolean
ADSI Data Type | Boolean
ABO Data Type | Boolean
ABO Metabase Identifier | MD_IS_CONTENT_INDEXED
Attributes | INHERIT
Default Value | false
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_FILE
StartingNumber | Not applicable
EndingNumber | 0
ID | 6039

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/W3SVC/n/ROOT /LM/W3SVC/n/ROOT/virtual_directory_name | IIsWebVirtualDir
/LM/W3SVC/n | IIsWebServer
/LM/W3SVC | IIsWebService
/LM/W3SVC/n/ROOT/physical_directory_name /LM/W3SVC/n/virtual_directory_name/physical_directory_name | IIsWebDirectory
/LM/NNTPSVC | IIsNntpService
/LM/NNTPSVC/n | IIsNntpServer
/LM/NNTPSVC/n/ROOT /LM/NNTPSVC/n/ROOT/virtual_directory_name | IIsNntpVirtualDir

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


CPUAction

The CPUAction property configures the action(s) that IIS takes when Microsoft Windows NT® job objects run. Only one Windows NT job object exists per application pool, therefore the CPUAction property is configured on a per application pool basis.

Attribute Name | Attribute Value
XML Data Type | DWORD
WMI Data Type | SINT32
ADSI Data Type | DWORD
ABO Data Type | DWORD
ABO Metabase Identifier | MD_CPU_ACTION
Attributes | INHERIT
Default Value | 0
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | 3
ID | 9022

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/W3SVC/AppPools/DefaultAppPool /LM/W3SVC/AppPools/DefaultAppPool/application_pool_name | IIsApplicationPool
/LM/W3SVC/AppPools | IIsApplicationPools

Values

important Important Only one value from the following table should be used per application pool.

Constant | Value | Description
MD_CPU_NO_ACTION | 0x00000000 | No action is taken except that a warning is written to the event log when the CPU limit is exceeded.
MD_CPU_KILL_W3WP | 0x00000001 | Application pool worker processes that exceed their CPU limit will be forced to shut down.
MD_CPU_TRACE | 0x00000002 | Enables capacity tracing for the application pool when 80% of the CPU limit is reached.

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


CPULimit

The CPULimit property configures the maximum percentage of CPU time (in 1/1000ths of a percent) that the worker processes in an application pool are allowed to consume over a period of time as indicated by the CPUResetInterval property. If the limit set by the CPULimit property is exceeded, an event is written to the event log and an optional set of events can be triggered as determined by the CPUAction property.

note Note Setting the value of this property to 0 disables limiting the worker processes to a percentage of CPU time.

Attribute Name | Attribute Value
XML Data Type | DWORD
WMI Data Type | SINT32
ADSI Data Type | DWORD
ABO Data Type | DWORD
ABO Metabase Identifier | MD_CPU_LIMIT
Attributes | INHERIT
Default Value | 0
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | 100000
ID | 9023

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/W3SVC/AppPools/DefaultAppPool /LM/W3SVC/AppPools/DefaultAppPool/application_pool_name | IIsApplicationPool
/LM/W3SVC/AppPools | IIsApplicationPools

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


CPUResetInterval

The CPUResetInterval property specifies the reset period (in minutes) for CPU monitoring and throttling limits on the application pool. When the number of minutes elapsed since the last process accounting reset equals the number specified by this property, IIS will reset the CPU timers for both the logging and limit intervals. Setting the value of this property to 0 disables CPU monitoring.

important Important The value in CpuResetInterval must be greater than the time between logging operations, otherwise IIS will reset counters before logging has occurred, and process accounting will not occur.

note Note Because process accounting in IIS uses Windows® Job Objects to monitor CPU times for an entire process, process accounting will log and throttle only applications that are isolated in a separate process from IIS.

Attribute Name | Attribute Value
XML Data Type | DWORD
WMI Data Type | SINT32
ADSI Data Type | DWORD
ABO Data Type | DWORD
ABO Metabase Identifier | MD_CPU_RESET_INTERVAL
Attributes | INHERIT
Default Value | 0
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | 1440
ID | 2144

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/W3SVC/AppPools/DefaultAppPool /LM/W3SVC/AppPools/DefaultAppPool/application_pool_name | IIsApplicationPool
/LM/W3SVC/AppPools | IIsApplicationPools

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


CreateCGIWithNewConsole

The CreateCGIWithNewConsole property indicates whether a CGI application runs in its own console. If the value is set to true, each CGI application creates a new console when started. A value of false indicates that CGI applications should run without a console.
Attribute Name | Attribute Value
XML Data Type | Boolean
WMI Data Type | Boolean
ADSI Data Type | Boolean
ABO Data Type | Boolean
ABO Metabase Identifier | MD_CREATE_PROC_NEW_CONSOLE
Attributes | INHERIT
Default Value | false
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_FILE
StartingNumber | Not applicable
EndingNumber | 0
ID | 6036

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/W3SVC/n/ROOT /LM/W3SVC/n/ROOT/virtual_directory_name | IIsWebVirtualDir
/LM/W3SVC/n | IIsWebServer
/LM/W3SVC | IIsWebService
/LM/W3SVC/n/ROOT/file_name /LM/W3SVC/n/ROOT/virtual_directory_name/file_name | IIsWebFile
/LM/W3SVC/n/ROOT/physical_directory_name /LM/W3SVC/n/virtual_directory_name/physical_directory_name | IIsWebDirectory

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


CreateProcessAsUser

The CreateProcessAsUser property specifies whether a CGI process is created in the system context or in the context of the requesting user.
Attribute Name | Attribute Value
XML Data Type | Boolean
WMI Data Type | Boolean
ADSI Data Type | Boolean
ABO Data Type | Boolean
ABO Metabase identifier | MD_CREATE_PROCESS_AS_USER
Attributes | INHERIT
Default Value | true
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_FILE
StartingNumber | Not applicable
EndingNumber | 0
ID | 6035

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/W3SVC/n/ROOT /LM/W3SVC/n/ROOT/virtual_directory_name | IIsWebVirtualDir
/LM/W3SVC/n | IIsWebServer
/LM/W3SVC | IIsWebService
/LM/W3SVC/n/ROOT/file_name /LM/W3SVC/n/ROOT/virtual_directory_name/file_name | IIsWebFile
/LM/W3SVC/n/ROOT/physical_directory_name /LM/W3SVC/n/virtual_directory_name/physical_directory_name | IIsWebDirectory

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


CSideEtrnDomains

The CSideEtrnDomains property lists the domains that will be sent when this Simple Mail Transport Protocol (SMTP) virtual server sends the ETRN command, acting as a client.
Attribute Name | Attribute Value
XML Data Type | String
WMI Data Type | String
ADSI Data Type | String
ABO Data Type | String
ABO Metabase identifier | No friendly named is defined for this identifier in iiscfng.h. Search the systemroot\System32\Inetsrv\MBSchema.xml file for this property and use the integer from its ID attribute.
Attributes | INHERIT
Default Value | null
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 36968

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/SMTPSVC/n/Domain | IIsSmtpDomain

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


CustomErrorDescriptions

The value of the CustomErrorDescriptions property is a list of custom error messages. Each string in the list specifies an error code and subcode for the custom message, what the specific error text and subcode error text is, and whether the custom message is supported by file or URL, or by file only. Each string value is in the format ErrorCode, ErrorSubcode, ErrorText, ErrorSubcodeText, followed by another comma and either a 0 for file and URL support, or a 1 for file support only.
Attribute Name | Attribute Value
XML Data Type | MULTISZ
WMI Data Type | MULTISZ
ADSI Data Type | MULTISZ
ABO Data Type | MULTISZ
ABO Metabase identifier | MD_CUSTOM_ERROR_DESC
Attributes | NO_ATTRIBUTES
Default Value | null
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 2120

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/W3SVC/Info | IIsWebInfo

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.
Related Topics
HttpErrors


DefaultDoc

The DefaultDoc contains one or more file names of default documents that will be returned to the client if no file name is included in the client's request. The default document will be returned if the EnableDefaultDoc flag of the DirBrowseFlags property is set to true for the directory. This property can contain a list of default document file names separated by a comma and a space, for example Default.htm, Default.asp.

important Important If the EnableDefaultDoc flag is not set in the DirBrowseFlags property, the server will not search for a default document.

Attribute Name | Attribute Value
XML Data Type | String
WMI Data Type | String
ADSI Data Type | String
ABO Data Type | String
ABO Metabase identifier | MD_DEFAULT_LOAD_FILE
Attributes | INHERIT
Default Value | default.htm
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_FILE
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 6006

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/W3SVC/n/ROOT /LM/W3SVC/n/ROOT/virtual_directory_name | IIsWebVirtualDir
/LM/W3SVC/n | IIsWebServer
/LM/W3SVC | IIsWebService
/LM/W3SVC/n/ROOT/physical_directory_name /LM/W3SVC/n/virtual_directory_name/physical_directory_name | IIsWebDirectory

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.
Related Topics
DirBrowseFlags


DefaultDocFooter

The DefaultDocFooter property specifies the custom footer that is appended to HTML files that are returned to the client (footers are not appended to ASP files). The custom footer will be sent only if the EnableDocFooter property is set to true. The footer can be a string, such as "String:ThisIsACustomFooter," or a reference to a file, such as "FILE:C:\Wwwroot\Footers\Footer.htm."

important Important If the EnableDefaultDoc flag is not set in the DirBrowseFlags property, the server will not search for a default document.

Attribute Name | Attribute Value
XML Data Type | String
WMI Data Type | String
ADSI Data Type | String
ABO Data Type | String
ABO Metabase identifier | MD_FOOTER_DOCUMENT
Attributes | INHERIT
Default Value | null
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_FILE
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 6009

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/W3SVC/n/ROOT /LM/W3SVC/n/ROOT/virtual_directory_name | IIsWebVirtualDir
/LM/W3SVC/n | IIsWebServer
/LM/W3SVC | IIsWebService
/LM/W3SVC/n/ROOT/file_name /LM/W3SVC/n/ROOT/virtual_directory_name/file_name | IIsWebFile
/LM/W3SVC/n/ROOT/physical_directory_name /LM/W3SVC/n/virtual_directory_name/physical_directory_name | IIsWebDirectory

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.
Related Topics
EnableDocFooter


DefaultDomain

The DefaultDomain property specifies the default domain for logon to an SMTP server. If this value is not specified, the default domain is the domain name controlled by the computer, if the computer is a domain controller. If the computer is not a domain controller, the default domain is the computer name.
Attribute Name | Attribute Value
XML Data Type | String
WMI Data Type | String
ADSI Data Type | String
ABO Data Type | String
ABO Metabase identifier | MD_DEFAULT_LOGON_DOMAIN
Attributes | INHERIT
Default Value | null
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 36908

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/SMTPSVC | IIsSmtpService
/LM/SMTPSVC/n | IIsSmtpServer

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


DefaultLogonDomain

In Web, FTP, and NNTP servers, the DefaultLogonDomain property is used to specify the default domain that the server uses to authenticate users (in a Web hosting scenario where UserIsolationMode = 2). If the value of DefaultLogonDomain is not specified, the default domain will be the domain name controlled by the computer, if the computer is a domain controller. If the computer is not a domain controller, the default domain will be the computer name.

In the case of FTP, IIS uses this domain name to query the corresponding Active Directory (AD) for the two properties required for each user in the Web hosting scenario: msIIS-FTPRoot and msIIS-FTPDir.

Attribute Name | Attribute Value
XML Data Type | String
WMI Data Type | String
ADSI Data Type | String
ABO Data Type | String
ABO Metabase identifier | MD_DEFAULT_LOGON_DOMAIN
Attributes | INHERIT
Default Value | null
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_FILE
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 6012

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/W3SVC/n/ROOT /LM/W3SVC/n/ROOT/virtual_directory_name | IIsWebVirtualDir
/LM/W3SVC/n | IIsWebServer
/LM/MSFTPSVC/n | IIsFtpServer
/LM/W3SVC | IIsWebService
/LM/MSFTPSVC | IIsFtpService
/LM/W3SVC/n/ROOT/file_name /LM/W3SVC/n/ROOT/virtual_directory_name/file_name | IIsWebFile
/LM/W3SVC/n/ROOT/physical_directory_name /LM/W3SVC/n/virtual_directory_name/physical_directory_name | IIsWebDirectory
/LM/SMTPSVC | IIsSmtpService
/LM/SMTPSVC/n | IIsSmtpServer

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


DefaultModeratorDomain

The DefaultModeratorDomain property corresponds to "Default moderator domain" on the Settings tab of NNTP virtual server Properties.
Attribute Name | Attribute Value
XML Data Type | String
WMI Data Type | String
ADSI Data Type | String
ABO Data Type | String
ABO Metabase identifier | No friendly named is defined for this identifier in iiscfng.h. Search the systemroot\System32\Inetsrv\MBSchema.xml file for this property and use the integer from its ID attribute.
Attributes | INHERIT
Default Value | null
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 45065

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/NNTPSVC | IIsNntpService
/LM/NNTPSVC/n | IIsNntpServer

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


DemandStartThreshold

The DemandStartThreshold property specifies the maximum number of worker processes allowed to run concurrently on a machine.

The metabase represents unlimited as the DWORD value of 4294967295 (0xFFFFFFFF); however, VBScript represents unlimited in hexadecimal format as &HFFFFFFFF. Previous versions of IIS represented unlimited as -1.

Attribute Name | Attribute Value
XML Data Type | DWORD
WMI Data Type | SINT32
ADSI Data Type | DWORD
ABO Data Type | DWORD
ABO Metabase identifier | MD_DEMAND_START_THRESHOLD
Attributes | NO_ATTRIBUTES
Default Value | 4294967295
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 9207

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/W3SVC | IIsWebService

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


DirBrowseFlags

The DirBrowseFlags contains flags, as seen in the Flags section, that control whether directory browsing is enabled, how much directory and file information is provided if browsing is enabled, and whether there is a default page in the directory.

note Note If a client accesses the directory and does not provide a file name, and the EnableDefaultDoc flag is set to true, the server will look for a default file specified in the DefaultDoc property. If a default file does not exist in the directory, and the EnableDirBrowsing flag is set to true, then directory browsing is enabled.

Attribute Name | Attribute Value
XML Data Type | DWORD
WMI Data Type | SINT32
ADSI Data Type | DWORD
ABO Data Type | DWORD
ABO Metabase identifier | MD_DIRECTORY_BROWSING
Attributes | INHERIT
Default Value | dirbrowseshowdate | dirbrowseshowtime | dirbrowseshowsize | dirbrowseshowextension | enabledefaultdoc
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_FILE
StartingNumber | Not applicable
EndingNumber | 0
ID | 6005

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/W3SVC/n/ROOT /LM/W3SVC/n/ROOT/virtual_directory_name | IIsWebVirtualDir
/LM/W3SVC/n | IIsWebServer
/LM/W3SVC | IIsWebService
/LM/W3SVC/n/ROOT/physical_directory_name /LM/W3SVC/n/virtual_directory_name/physical_directory_name | IIsWebDirectory

Flags

Flag Name | EnableDirBrowsing
Description | When set to true, directory browsing is enabled.
Metabase Bitmask Identifier | MD_DIRBROW_ENABLED
Decimal Value | 2147483648
Hex Value | 0x80000000
Flag Name | DirBrowseShowDate
Description | When set to true, date information is displayed when browsing directories.
Metabase Bitmask Identifier | MD_DIRBROW_SHOW_DATE
Decimal Value | 2
Hex Value | 0x00000002
Flag Name | DirBrowseShowTime
Description | When set to true, file time information is displayed when displaying directories.
Metabase Bitmask Identifier | MD_DIRBROW_SHOW_TIME
Decimal Value | 4
Hex Value | 0x00000004
Flag Name | DirBrowseShowSize
Description | When set to true, file size information is displayed when browsing directories.
Metabase Bitmask Identifier | MD_DIRBROW_SHOW_SIZE
Decimal Value | 8
Hex Value | 0x00000008
Flag Name | DirBrowseShowExtension
Description | When set to true, file name extensions are displayed when browsing directories.
Metabase Bitmask Identifier | MD_DIRBROW_SHOW_EXTENSION
Decimal Value | 16
Hex Value | 0x00000010
Flag Name | DirBrowseShowLongDate
Description | When set to true, date information is displayed in extended format when displaying directories.
Metabase Bitmask Identifier | MD_DIRBROW_LONG_DATE
Decimal Value | 32
Hex Value | 0x00000020
Flag Name | EnableDefaultDoc
Description | When set to true, the default document (specified by the DefaultDoc property) for a directory is loaded when the directory is browsed.
Metabase Bitmask Identifier | MD_DIRBROW_LOADDEFAULT
Decimal Value | 1073741824
Hex Value | 0x40000000

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


DirectoryLevelsToScan

The DirectoryLevelsToScan property specifies the number of virtual directory levels to scan in the metabase from the root virtual directory for a server in order to build a list of directories to be monitored for file system changes. If a virtual directory is not included in the list, then the IIS cache will not be flushed when a file change occurs in the directory. This list is also used for down-level remote administration from earlier versions of IIS. The value of this property ranges from 0 to 4294967295 (or unlimited).

The metabase represents unlimited as the DWORD value of 4294967295 (0xFFFFFFFF) ; however, Microsoft Visual Basic Scripting Edition (VBScript) represents unlimited in hexadecimal format as &HFFFFFFFF. Previous versions of IIS represented unlimited as -1.

Attribute Name | Attribute Value
XML Data Type | DWORD
WMI Data Type | SINT32
ADSI Data Type | DWORD
ABO Data Type | DWORD
ABO Metabase identifier | MD_LEVELS_TO_SCAN
Attributes | NO_ATTRIBUTES
Default Value | 2
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | 0
ID | 1022

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/W3SVC | IIsWebService
/LM/MSFTPSVC | IIsFtpService
/LM/NNTPSVC | IIsNntpService

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


DisableNewNews

The DisableNewNews property is set to disable the NEWNEWS command. Administrators may want to disable NEWNEWS for performance reasons so that other servers are not pulling entire feeds.
Attribute Name | Attribute Value
XML Data Type | Boolean
WMI Data Type | Boolean
ADSI Data Type | Boolean
ABO Data Type | Boolean
ABO Metabase identifier | No friendly named is defined for this identifier in iiscfng.h. Search the systemroot\System32\Inetsrv\MBSchema.xml file for this property and use the integer from its ID attribute.
Attributes | INHERIT
Default Value | false
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | 0
ID | 45068

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/NNTPSVC | IIsNntpService
/LM/NNTPSVC/n | IIsNntpServer

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


DisableSocketPooling

The DisableSocketPooling property specifies whether socket pooling is used for sites distinguished by IP address, rather than port number or host header name, for example. If DisableSocketPooling is set to false, socket pooling is enabled and sockets are shared between sites that use the same port number (but different IP addresses). If DisableSocketPooling is set to true, there is no socket sharing for sites based on IP address.

note Note Socket pooling was first introduced in IIS 5.0.

In IIS version 4.0, each Web site was bound to a different IP address, which meant that each site had its own socket that was not shared with sites bound to other IP addresses. These sockets are created when the site starts, and they consume significant nonpaged memory (RAM). This memory consumption limits the number of sites bound to IP addresses that can be created on a single computer.

By default, socket pooling is enabled. In general, this behavior should not be modified. If changed, the change should be made at the site level only so that other sites can continue to take advantage of the socket pooling feature.

Attribute Name | Attribute Value
XML Data Type | Boolean
WMI Data Type | Boolean
ADSI Data Type | Boolean
ABO Data Type | Boolean
ABO Metabase identifier | MD_DISABLE_SOCKET_POOLING
Attributes | INHERIT
Default Value | true
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | 0
ID | 1029

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/W3SVC/n | IIsWebServer
/LM/MSFTPSVC/n | IIsFtpServer
/LM/W3SVC | IIsWebService
/LM/MSFTPSVC | IIsFtpService
/LM/SMTPSVC | IIsSmtpService
/LM/SMTPSVC/n | IIsSmtpServer

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


DisableStaticFileCache

The DisableStaticFileCache property specifies the caching of static files for a directory. If DisableStaticFileCache = 1, static files are not cached for the specified directory. Note: Active Server Pages (ASP) files and templates are cached independently of this setting. This property may be set on any valid virtual directory and applies to the virtual directory root and any subdirectories.

The DisableStaticFileCache property is used when multiple virtual directories are created on Universal Naming Convention (UNC) shares and are secured with individual identities and access control lists (ACLs) to fully secure files from access by unauthorized users. For this configuration scenario, not setting this property would potentially allow unauthorized access to a site’s files in the cache through other security identities.

The DisableStaticFileCache property may also be set to permit case-sensitive requests for files that are stored in virtual directories located on network file system (NFS) volumes and accessed through an NFS client, such as one provided by Services For Unix (SFU).

The static file cache may alternatively be disabled at the machine level through the registry key HKLM\inetinfo\parameters\DisableMemoryCache.

Disabling the static file cache will, in most cases, reduce the Web server request handling performance. However, the effect may be negligible if requests are broadly and randomly distributed across a large number of files.

Attribute Name | Attribute Value
XML Data Type | Boolean
WMI Data Type | Boolean
ADSI Data Type | Boolean
ABO Data Type | Boolean
ABO Metabase identifier | MD_VR_NO_CACHE
Attributes | INHERIT
Default Value | false
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | 0
ID | 3007

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/W3SVC/n/ROOT /LM/W3SVC/n/ROOT/virtual_directory_name | IIsWebVirtualDir

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


DisallowOverlappingRotation

The DisallowOverlappingRotation property specifies whether or not the World Wide Web Publishing Service (WWW Service) should start up another worker process to replace the existing worker process while it is shutting down. The value of this property should be set to true if the worker process loads any application code that does not support multi-instance.
Attribute Name | Attribute Value
XML Data Type | Boolean
WMI Data Type | Boolean
ADSI Data Type | Boolean
ABO Data Type | Boolean
ABO Metabase identifier | MD_APPPOOL_DISALLOW_OVERLAPPING_ROTATION
Attributes | INHERIT
Default Value | false
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 9015

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/W3SVC/AppPools/DefaultAppPool /LM/W3SVC/AppPools/DefaultAppPool/application_pool_name | IIsApplicationPool
/LM/W3SVC/AppPools | IIsApplicationPools

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


DisallowRotationOnConfigChange

The DisallowRotationOnConfigChange property specifies whether or not the World Wide Web Publishing Service (WWW Service) should rotate worker processes in an application pool when the configuration has changed. This means that the worker processes will not pick up application pool changes to values passed to the worker process, such as IdleTimeout and PeriodicRestartRequests. The value of DisallowRotationOnConfigChange should be set to true if the worker process loads any application code that does not support multi-instance.

Attribute Name | Attribute Value
XML Data Type | Boolean
WMI Data Type | Boolean
ADSI Data Type | Boolean
ABO Data Type | Boolean
ABO Metabase identifier | MD_APPPOOL_DISALLOW_ROTATION_ON_CONFIG_CHANGE
Attributes | INHERIT
Default Value | false
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 9018

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/W3SVC/AppPools/DefaultAppPool /LM/W3SVC/AppPools/DefaultAppPool/application_pool_name | IIsApplicationPool
/LM/W3SVC/AppPools | IIsApplicationPools

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


DoDynamicCompression

The DoDynamicCompression property is identical to the HcDoDynamicCompression property.
Attribute Name | Attribute Value
XML Data Type | Boolean
WMI Data Type | Boolean
ADSI Data Type | Boolean
ABO Data Type | Boolean
ABO Metabase identifier | MD_HC_DO_NAMESPACE_DYNAMIC_COMPRESSION
Attributes | INHERIT
Default Value | false
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_FILE
StartingNumber | Not applicable
EndingNumber | 0
ID | 2255

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/W3SVC/n/ROOT /LM/W3SVC/n/ROOT/virtual_directory_name | IIsWebVirtualDir
/LM/W3SVC/n | IIsWebServer
/LM/W3SVC | IIsWebService
/LM/W3SVC/n/ROOT/file_name /LM/W3SVC/n/ROOT/virtual_directory_name/file_name | IIsWebFile
/LM/W3SVC/n/ROOT/physical_directory_name /LM/W3SVC/n/virtual_directory_name/physical_directory_name | IIsWebDirectory

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.
Related Topics
HcDoDynamicCompression


DomainRouting

The DomainRouting property is used by Microsoft Exchange.
Attribute Name | Attribute Value
XML Data Type | MULTISZ
WMI Data Type | MULTISZ
ADSI Data Type | MULTISZ
ABO Data Type | MULTISZ
ABO Metabase identifier | No friendly named is defined for this identifier in iiscfng.h. Search the systemroot\System32\Inetsrv\MBSchema.xml file for this property and use the integer from its ID attribute.
Attributes | INHERIT
Default Value | null
MetaFlagsEx | CACHE_PROPERTY_CLEARED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 36920

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/SMTPSVC | IIsSmtpService
/LM/SMTPSVC/n | IIsSmtpServer

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


DoMasquerade

The DoMasquerade property toggles domain masquerading.
Attribute Name | Attribute Value
XML Data Type | Boolean
WMI Data Type | Boolean
ADSI Data Type | Boolean
ABO Data Type | Boolean
ABO Metabase identifier | No friendly named is defined for this identifier in iiscfng.h. Search the systemroot\System32\Inetsrv\MBSchema.xml file for this property and use the integer from its ID attribute.
Attributes | INHERIT
Default Value | false
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | 0
ID | 36913

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/SMTPSVC | IIsSmtpService
/LM/SMTPSVC/n | IIsSmtpServer

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


DontLog

The DontLog property specifies whether client requests are written to the log file. By default, requests are written to the log file. You can set this value to true to turn logging off.
Attribute Name | Attribute Value
XML Data Type | Boolean
WMI Data Type | Boolean
ADSI Data Type | Boolean
ABO Data Type | Boolean
ABO Metabase identifier | MD_DONT_LOG
Attributes | INHERIT
Default Value | false
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_FILE
StartingNumber | Not applicable
EndingNumber | 0
ID | 6023

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/W3SVC/n/ROOT /LM/W3SVC/n/ROOT/virtual_directory_name | IIsWebVirtualDir
/LM/W3SVC/n | IIsWebServer
/LM/MSFTPSVC/n | IIsFtpServer
/LM/W3SVC | IIsWebService
/LM/MSFTPSVC | IIsFtpService
/LM/W3SVC/n/ROOT/file_name /LM/W3SVC/n/ROOT/virtual_directory_name/file_name | IIsWebFile
/LM/W3SVC/n/ROOT/physical_directory_name /LM/W3SVC/n/virtual_directory_name/physical_directory_name | IIsWebDirectory
/LM/MSFTPSVC/n/ROOT /LM/MSFTPSVC/n/ROOT/virtual_directory_name | IIsFtpVirtualDir
/LM/NNTPSVC | IIsNntpService
/LM/NNTPSVC/n | IIsNntpServer
/LM/NNTPSVC/n/ROOT /LM/NNTPSVC/n/ROOT/virtual_directory_name | IIsNntpVirtualDir
/LM/SMTPSVC | IIsSmtpService
/LM/SMTPSVC/n | IIsSmtpServer
/LM/SMTPSVC/n/ROOT /LM/SMTPSVC/n/ROOT/virtual_directory_name | IIsSmtpVirtualDir

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.
Related Topics
LogType


DoStaticCompression

The DoStaticCompression property is identical to the HcDoStaticCompression property.
Attribute Name | Attribute Value
XML Data Type | Boolean
WMI Data Type | Boolean
ADSI Data Type | Boolean
ABO Data Type | Boolean
ABO Metabase identifier | MD_HC_DO_NAMESPACE_STATIC_COMPRESSION
Attributes | INHERIT
Default Value | false
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_FILE
StartingNumber | Not applicable
EndingNumber | 0
ID | 2256

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/W3SVC/n/ROOT /LM/W3SVC/n/ROOT/virtual_directory_name | IIsWebVirtualDir
/LM/W3SVC/n | IIsWebServer
/LM/W3SVC | IIsWebService
/LM/W3SVC/n/ROOT/file_name /LM/W3SVC/n/ROOT/virtual_directory_name/file_name | IIsWebFile
/LM/W3SVC/n/ROOT/physical_directory_name /LM/W3SVC/n/virtual_directory_name/physical_directory_name | IIsWebDirectory

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.
Related Topics
HcDoStaticCompression


DownlevelAdminInstance

The DownlevelAdminInstance indicates the server instance for remote administration clients.
Attribute Name | Attribute Value
XML Data Type | DWORD
WMI Data Type | SINT32
ADSI Data Type | DWORD
ABO Data Type | DWORD
ABO Metabase identifier | MD_DOWNLEVEL_ADMIN_INSTANCE
Attributes | INHERIT
Default Value | 0
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | 0
ID | 1021

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/W3SVC | IIsWebService
/LM/MSFTPSVC | IIsFtpService

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


DropDirectory

The DropDirectory property lists the location of the Drop directory.
Attribute Name | Attribute Value
XML Data Type | String
WMI Data Type | String
ADSI Data Type | String
ABO Data Type | String
ABO Metabase identifier | No friendly named is defined for this identifier in iiscfng.h. Search the systemroot\System32\Inetsrv\MBSchema.xml file for this property and use the integer from its ID attribute.
Attributes | INHERIT
Default Value | null
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 36882

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/SMTPSVC | IIsSmtpService
/LM/SMTPSVC/n | IIsSmtpServer

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


EnableDocFooter

The EnableDocFooter property enables or disables custom footers specified by the DefaultDocFooter property. Setting EnableDocFooter to false disables custom footers, and results in higher performance.
Attribute Name | Attribute Value
XML Data Type | Boolean
WMI Data Type | Boolean
ADSI Data Type | Boolean
ABO Data Type | Boolean
ABO Metabase identifier | MD_FOOTER_ENABLED
Attributes | INHERIT
Default Value | false
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_FILE
StartingNumber | Not applicable
EndingNumber | 0
ID | 6010

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/W3SVC/n/ROOT /LM/W3SVC/n/ROOT/virtual_directory_name | IIsWebVirtualDir
/LM/W3SVC/n | IIsWebServer
/LM/W3SVC | IIsWebService
/LM/W3SVC/n/ROOT/file_name /LM/W3SVC/n/ROOT/virtual_directory_name/file_name | IIsWebFile
/LM/W3SVC/n/ROOT/physical_directory_name /LM/W3SVC/n/virtual_directory_name/physical_directory_name | IIsWebDirectory

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.
Related Topics
DefaultDocFooter


EnableEditWhileRunning

The EnableEditWhileRunning property is used to enable the edit-while-running feature. The EnableHistory property must also be set to true for the edit-while-running feature to be enabled. For more information about the edit-while-running feature, see Metabase Edit-While-Running Feature.
Attribute Name | Attribute Value
XML Data Type | DWORD
WMI Data Type | SINT32
ADSI Data Type | DWORD
ABO Data Type | DWORD
ABO Metabase identifier | MD_ROOT_ENABLE_EDIT_WHILE_RUNNING
Attributes | NO_ATTRIBUTES
Default Value | null
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 9998

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM | IIsComputer

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.
Related Topics
EnableHistory


EnableHistory

The EnableHistory property enables or disables the metabase history feature. Setting this property to true enables metabase history. Setting the MaxHistoryFiles property to 0 (zero) effectively disables the metabase history feature. For more information, see Configuring the Metabase History Feature.

important Important If this property is set to false when EnableEditWhileRunning is set to true, IIS will write a warning to the event log and reset this property to true.

Attribute Name | Attribute Value
XML Data Type | DWORD
WMI Data Type | SINT32
ADSI Data Type | DWORD
ABO Data Type | DWORD
ABO Metabase identifier | MD_ROOT_ENABLE_HISTORY
Attributes | NO_ATTRIBUTES
Default Value | null
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 9996

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM | IIsComputer

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.
Related Topics
MaxHistoryFiles
EnableEditWhileRunning


EnableReverseDns

The EnableReverseDns property enables or disables reverse Domain Name Server (DNS) lookups for the World Wide Web Publishing Service (WWW service). Reverse lookups involve looking up the domain name when the IP address is known. Reverse DNS lookups can use significant resources and time.
Attribute Name | Attribute Value
XML Data Type | Boolean
WMI Data Type | Boolean
ADSI Data Type | Boolean
ABO Data Type | Boolean
ABO Metabase identifier | MD_DO_REVERSE_DNS
Attributes | INHERIT
Default Value | false
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_FILE
StartingNumber | Not applicable
EndingNumber | 0
ID | 6029

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/W3SVC/n/ROOT /LM/W3SVC/n/ROOT/virtual_directory_name | IIsWebVirtualDir
/LM/W3SVC/n | IIsWebServer
/LM/W3SVC | IIsWebService
/LM/W3SVC/n/ROOT/file_name /LM/W3SVC/n/ROOT/virtual_directory_name/file_name | IIsWebFile
/LM/W3SVC/n/ROOT/physical_directory_name /LM/W3SVC/n/virtual_directory_name/physical_directory_name | IIsWebDirectory

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


EnableReverseDnsLookup

The EnableReverseDnsLookup property corresponds to "Perform reverse DNS lookup on incoming messages" check box in the Advanced Delivery dialog box.
Attribute Name | Attribute Value
XML Data Type | Boolean
WMI Data Type | Boolean
ADSI Data Type | Boolean
ABO Data Type | Boolean
ABO Metabase identifier | MD_REVERSE_NAME_LOOKUP
Attributes | INHERIT
Default Value | false
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | 0
ID | 36884

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/SMTPSVC | IIsSmtpService
/LM/SMTPSVC/n | IIsSmtpServer

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


EtrnDays

The EtrnDays property is used by Microsoft Exchange.
Attribute Name | Attribute Value
XML Data Type | DWORD
WMI Data Type | SINT32
ADSI Data Type | DWORD
ABO Data Type | DWORD
ABO Metabase identifier | MD_ETRN_DAYS
Attributes | INHERIT
Default Value | 0
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | 0
ID | 36918

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/SMTPSVC | IIsSmtpService
/LM/SMTPSVC/n | IIsSmtpServer

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


EtrnSubdomains

The EtrnSubdomains property indicates whether Etrn subdomains (the @ extension to Etrn) are allowed.
Attribute Name | Attribute Value
XML Data Type | Boolean
WMI Data Type | Boolean
ADSI Data Type | Boolean
ABO Data Type | Boolean
ABO Metabase identifier | No friendly named is defined for this identifier in iiscfng.h. Search the systemroot\System32\Inetsrv\MBSchema.xml file for this property and use the integer from its ID attribute.
Attributes | INHERIT
Default Value | true
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | 0
ID | 36938

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/SMTPSVC | IIsSmtpService
/LM/SMTPSVC/n | IIsSmtpServer

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


ExitMessage

The ExitMessage property specifies the message text an FTP server transmits to a client, when the client sends a quit command.
Attribute Name | Attribute Value
XML Data Type | String
WMI Data Type | String
ADSI Data Type | String
ABO Data Type | String
ABO Metabase identifier | MD_EXIT_MESSAGE
Attributes | INHERIT
Default Value | null
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 5001

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/MSFTPSVC/n | IIsFtpServer
/LM/MSFTPSVC | IIsFtpService

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


ExMdbGuid

The ExMdbGuid property is used by the Microsoft Exchange driver.
Attribute Name | Attribute Value
XML Data Type | String
WMI Data Type | String
ADSI Data Type | String
ABO Data Type | String
ABO Metabase identifier | No friendly named is defined for this identifier in iiscfng.h. Search the systemroot\System32\Inetsrv\MBSchema.xml file for this property and use the integer from its ID attribute.
Attributes | INHERIT
Default Value | null
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 46162

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/NNTPSVC/n/ROOT /LM/NNTPSVC/n/ROOT/virtual_directory_name | IIsNntpVirtualDir

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


ExpireNewsgroups

The ExpireNewsgroups property lists newsgroups for which this expiration policy applies.
Attribute Name | Attribute Value
XML Data Type | MULTISZ
WMI Data Type | MULTISZ
ADSI Data Type | MULTISZ
ABO Data Type | MULTISZ
ABO Metabase identifier | No friendly named is defined for this identifier in iiscfng.h. Search the systemroot\System32\Inetsrv\MBSchema.xml file for this property and use the integer from its ID attribute.
Attributes | INHERIT
Default Value | null
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 45658

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/NNTPSVC/n/Expires/expire n | IIsNntpExpire

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


ExpirePolicyName

The ExpirePolicyName property contains the name of the News Network Transport Protocol (NNTP) expiration policy.
Attribute Name | Attribute Value
XML Data Type | String
WMI Data Type | String
ADSI Data Type | String
ABO Data Type | String
ABO Metabase identifier | No friendly named is defined for this identifier in iiscfng.h. Search the systemroot\System32\Inetsrv\MBSchema.xml file for this property and use the integer from its ID attribute.
Attributes | INHERIT
Default Value | null
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 45659

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/NNTPSVC/n/Expires/expire n | IIsNntpExpire

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


ExpireSpace

The ExpireSpace property contains the size limit for expiration by size. This property is not currently supported.
Attribute Name | Attribute Value
XML Data Type | DWORD
WMI Data Type | SINT32
ADSI Data Type | DWORD
ABO Data Type | DWORD
ABO Metabase identifier | No friendly named is defined for this identifier in iiscfng.h. Search the systemroot\System32\Inetsrv\MBSchema.xml file for this property and use the integer from its ID attribute.
Attributes | INHERIT
Default Value | null
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | 0
ID | 45656

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/NNTPSVC/n/Expires/expire n | IIsNntpExpire

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


ExpireTime

The ExpireTime property contains the amount of elapsed time before article expiration begins.
Attribute Name | Attribute Value
XML Data Type | DWORD
WMI Data Type | SINT32
ADSI Data Type | DWORD
ABO Data Type | DWORD
ABO Metabase identifier | No friendly named is defined for this identifier in iiscfng.h. Search the systemroot\System32\Inetsrv\MBSchema.xml file for this property and use the integer from its ID attribute.
Attributes | INHERIT
Default Value | null
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | 0
ID | 45657

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/NNTPSVC/n/Expires/expire n | IIsNntpExpire

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


FeedAccountName

The FeedAccountName property contains the user name when authentication is required for a feed.
Attribute Name | Attribute Value
XML Data Type | String
WMI Data Type | String
ADSI Data Type | String
ABO Data Type | String
ABO Metabase identifier | No friendly named is defined for this identifier in iiscfng.h. Search the systemroot\System32\Inetsrv\MBSchema.xml file for this property and use the integer from its ID attribute.
Attributes | INHERIT
Default Value | null
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 45461

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/NNTPSVC/n/Feeds/feed n | IIsNntpFeed

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


FeedAdminError

The FeedAdminError property contains the error text displayed after an administrative error.
Attribute Name | Attribute Value
XML Data Type | DWORD
WMI Data Type | SINT32
ADSI Data Type | DWORD
ABO Data Type | DWORD
ABO Metabase identifier | No friendly named is defined for this identifier in iiscfng.h. Search the systemroot\System32\Inetsrv\MBSchema.xml file for this property and use the integer from its ID attribute.
Attributes | INHERIT
Default Value | null
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | 0
ID | 45481

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/NNTPSVC/n/Feeds/feed n | IIsNntpFeed

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


FeedAllowControlMsgs

The FeedAllowControlMsgs property allows control messages from a remote feed.
Attribute Name | Attribute Value
XML Data Type | DWORD
WMI Data Type | SINT32
ADSI Data Type | DWORD
ABO Data Type | DWORD
ABO Metabase identifier | No friendly named is defined for this identifier in iiscfng.h. Search the systemroot\System32\Inetsrv\MBSchema.xml file for this property and use the integer from its ID attribute.
Attributes | INHERIT
Default Value | null
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | 0
ID | 45466

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/NNTPSVC/n/Feeds/feed n | IIsNntpFeed

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


FeedAuthenticationType

The FeedAuthenticationType contains the feed authentication type (cleartext or none).
Attribute Name | Attribute Value
XML Data Type | DWORD
WMI Data Type | SINT32
ADSI Data Type | DWORD
ABO Data Type | DWORD
ABO Metabase identifier | No friendly named is defined for this identifier in iiscfng.h. Search the systemroot\System32\Inetsrv\MBSchema.xml file for this property and use the integer from its ID attribute.
Attributes | INHERIT
Default Value | null
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | 0
ID | 45460

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/NNTPSVC/n/Feeds/feed n | IIsNntpFeed

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


FeedConcurrentSessions

The FeedConcurrentSessions property contains the number of concurrent sessions allowed from feed server.
Attribute Name | Attribute Value
XML Data Type | DWORD
WMI Data Type | SINT32
ADSI Data Type | DWORD
ABO Data Type | DWORD
ABO Metabase identifier | No friendly named is defined for this identifier in iiscfng.h. Search the systemroot\System32\Inetsrv\MBSchema.xml file for this property and use the integer from its ID attribute.
Attributes | INHERIT
Default Value | null
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | 0
ID | 45470

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/NNTPSVC/n/Feeds/feed n | IIsNntpFeed

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


FeedCreateAutomatically

The FeedCreateAutomatically property controls whether groups are created automatically.
Attribute Name | Attribute Value
XML Data Type | DWORD
WMI Data Type | SINT32
ADSI Data Type | DWORD
ABO Data Type | DWORD
ABO Metabase identifier | No friendly named is defined for this identifier in iiscfng.h. Search the systemroot\System32\Inetsrv\MBSchema.xml file for this property and use the integer from its ID attribute.
Attributes | INHERIT
Default Value | null
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | 0
ID | 45467

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/NNTPSVC/n/Feeds/feed n | IIsNntpFeed

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


FeedDisabled

The FeedDisabled property controls whether the feed is enabled or disabled.
Attribute Name | Attribute Value
XML Data Type | DWORD
WMI Data Type | SINT32
ADSI Data Type | DWORD
ABO Data Type | DWORD
ABO Metabase identifier | No friendly named is defined for this identifier in iiscfng.h. Search the systemroot\System32\Inetsrv\MBSchema.xml file for this property and use the integer from its ID attribute.
Attributes | INHERIT
Default Value | null
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | 0
ID | 45468

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/NNTPSVC/n/Feeds/feed n | IIsNntpFeed

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


FeedDistribution

The FeedDistribution property is used by Microsoft Exchange.
Attribute Name | Attribute Value
XML Data Type | MULTISZ
WMI Data Type | MULTISZ
ADSI Data Type | MULTISZ
ABO Data Type | MULTISZ
ABO Metabase identifier | No friendly named is defined for this identifier in iiscfng.h. Search the systemroot\System32\Inetsrv\MBSchema.xml file for this property and use the integer from its ID attribute.
Attributes | INHERIT
Default Value | null
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 45469

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/NNTPSVC/n/Feeds/feed n | IIsNntpFeed

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


FeedErrParmMask

The FeedErrParmMask property is used by Microsoft Exchange.
Attribute Name | Attribute Value
XML Data Type | DWORD
WMI Data Type | SINT32
ADSI Data Type | DWORD
ABO Data Type | DWORD
ABO Metabase identifier | No friendly named is defined for this identifier in iiscfng.h. Search the systemroot\System32\Inetsrv\MBSchema.xml file for this property and use the integer from its ID attribute.
Attributes | INHERIT
Default Value | null
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | 0
ID | 45482

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/NNTPSVC/n/Feeds/feed n | IIsNntpFeed

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


FeedFeedpairId

The FeedFeedpairId property is used by Microsoft Exchange.
Attribute Name | Attribute Value
XML Data Type | DWORD
WMI Data Type | SINT32
ADSI Data Type | DWORD
ABO Data Type | DWORD
ABO Metabase identifier | No friendly named is defined for this identifier in iiscfng.h. Search the systemroot\System32\Inetsrv\MBSchema.xml file for this property and use the integer from its ID attribute.
Attributes | INHERIT
Default Value | null
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | 0
ID | 45479

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/NNTPSVC/n/Feeds/feed n | IIsNntpFeed

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


FeedHandshake

The FeedHandshake property is used by Microsoft Exchange.
Attribute Name | Attribute Value
XML Data Type | DWORD
WMI Data Type | SINT32
ADSI Data Type | DWORD
ABO Data Type | DWORD
ABO Metabase identifier | No friendly named is defined for this identifier in iiscfng.h. Search the systemroot\System32\Inetsrv\MBSchema.xml file for this property and use the integer from its ID attribute.
Attributes | INHERIT
Default Value | null
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | 0
ID | 45480

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/NNTPSVC/n/Feeds/feed n | IIsNntpFeed

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


FeedInterval

The FeedInterval property corresponds to the "Run Interval" box on the Schedule tab of feed properties. The property defines how often the feed runs.
Attribute Name | Attribute Value
XML Data Type | DWORD
WMI Data Type | SINT32
ADSI Data Type | DWORD
ABO Data Type | DWORD
ABO Metabase identifier | No friendly named is defined for this identifier in iiscfng.h. Search the systemroot\System32\Inetsrv\MBSchema.xml file for this property and use the integer from its ID attribute.
Attributes | INHERIT
Default Value | null
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | 0
ID | 45465

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/NNTPSVC/n/Feeds/feed n | IIsNntpFeed

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


FeedMaxConnectionAttempts

The FeedMaxConnectionAttempts property contains the number of times feed tries to connect without success before disabling the feed.
Attribute Name | Attribute Value
XML Data Type | DWORD
WMI Data Type | SINT32
ADSI Data Type | DWORD
ABO Data Type | DWORD
ABO Metabase identifier | No friendly named is defined for this identifier in iiscfng.h. Search the systemroot\System32\Inetsrv\MBSchema.xml file for this property and use the integer from its ID attribute.
Attributes | INHERIT
Default Value | null
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | 0
ID | 45471

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/NNTPSVC/n/Feeds/feed n | IIsNntpFeed

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


FeedNewsgroups

The FeedNewsgroups property corresponds to the list of newsgroups that the feed accepts, asks for, or pushes.
Attribute Name | Attribute Value
XML Data Type | MULTISZ
WMI Data Type | MULTISZ
ADSI Data Type | MULTISZ
ABO Data Type | MULTISZ
ABO Metabase identifier | No friendly named is defined for this identifier in iiscfng.h. Search the systemroot\System32\Inetsrv\MBSchema.xml file for this property and use the integer from its ID attribute.
Attributes | INHERIT
Default Value | null
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 45458

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/NNTPSVC/n/Feeds/feed n | IIsNntpFeed

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


FeedNextPullHigh

The FeedNextPullHigh contains the high DWORD of the time of the next pull feed.
Attribute Name | Attribute Value
XML Data Type | DWORD
WMI Data Type | SINT32
ADSI Data Type | DWORD
ABO Data Type | DWORD
ABO Metabase identifier | No friendly named is defined for this identifier in iiscfng.h. Search the systemroot\System32\Inetsrv\MBSchema.xml file for this property and use the integer from its ID attribute.
Attributes | INHERIT
Default Value | null
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | 0
ID | 45474

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/NNTPSVC/n/Feeds/feed n | IIsNntpFeed

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


FeedNextPullLow

The FeedNextPullLow contains the low DWORD of the time of the next pull feed.
Attribute Name | Attribute Value
XML Data Type | DWORD
WMI Data Type | SINT32
ADSI Data Type | DWORD
ABO Data Type | DWORD
ABO Metabase identifier | No friendly named is defined for this identifier in iiscfng.h. Search the systemroot\System32\Inetsrv\MBSchema.xml file for this property and use the integer from its ID attribute.
Attributes | INHERIT
Default Value | null
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | 0
ID | 45475

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/NNTPSVC/n/Feeds/feed n | IIsNntpFeed

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


FeedOutgoingPort

The FeedOutgoingPort property corresponds to "Outbound IP Port" of the feed.
Attribute Name | Attribute Value
XML Data Type | DWORD
WMI Data Type | SINT32
ADSI Data Type | DWORD
ABO Data Type | DWORD
ABO Metabase identifier | No friendly named is defined for this identifier in iiscfng.h. Search the systemroot\System32\Inetsrv\MBSchema.xml file for this property and use the integer from its ID attribute.
Attributes | INHERIT
Default Value | null
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | 0
ID | 45478

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/NNTPSVC/n/Feeds/feed n | IIsNntpFeed

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


FeedPassword

If authentication is required for feed, the FeedPassword property contains the password for the account.
Attribute Name | Attribute Value
XML Data Type | String
WMI Data Type | String
ADSI Data Type | String
ABO Data Type | String
ABO Metabase identifier | No friendly named is defined for this identifier in iiscfng.h. Search the systemroot\System32\Inetsrv\MBSchema.xml file for this property and use the integer from its ID attribute.
Attributes | SECURE
Default Value | null
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 45462

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/NNTPSVC/n/Feeds/feed n | IIsNntpFeed

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


FeedPeerGapSize

The FeedPeerGapSize property contains the gap size to leave in the file before the article.
Attribute Name | Attribute Value
XML Data Type | DWORD
WMI Data Type | SINT32
ADSI Data Type | DWORD
ABO Data Type | DWORD
ABO Metabase identifier | No friendly named is defined for this identifier in iiscfng.h. Search the systemroot\System32\Inetsrv\MBSchema.xml file for this property and use the integer from its ID attribute.
Attributes | INHERIT
Default Value | null
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | 0
ID | 45477

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/NNTPSVC/n/Feeds/feed n | IIsNntpFeed

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


FeedPeerTempDirectory

The FeedPeerTempDirectory property contains the temporary directory used for the feed.
Attribute Name | Attribute Value
XML Data Type | String
WMI Data Type | String
ADSI Data Type | String
ABO Data Type | String
ABO Metabase identifier | No friendly named is defined for this identifier in iiscfng.h. Search the systemroot\System32\Inetsrv\MBSchema.xml file for this property and use the integer from its ID attribute.
Attributes | INHERIT
Default Value | null
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 45476

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/NNTPSVC/n/Feeds | IIsNntpFeeds
/LM/NNTPSVC/n/Feeds/feed n | IIsNntpFeed

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


FeedPostHardLimit

The FeedPostHardLimit property corresponds to "Limit connection size" for the feed on the Settings tab of NNTP virtual server Properties. Units are in kilobytes.

The metabase represents unlimited as the DWORD value of 4294967295 (0xFFFFFFFF); however, VBScript represents unlimited in hexadecimal format as &HFFFFFFFF. Previous versions of IIS represented unlimited as -1.

Attribute Name | Attribute Value
XML Data Type | DWORD
WMI Data Type | SINT32
ADSI Data Type | DWORD
ABO Data Type | DWORD
ABO Metabase identifier | No friendly named is defined for this identifier in iiscfng.h. Search the systemroot\System32\Inetsrv\MBSchema.xml file for this property and use the integer from its ID attribute.
Attributes | INHERIT
Default Value | 4294967295
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | 0
ID | 45167

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/NNTPSVC | IIsNntpService
/LM/NNTPSVC/n | IIsNntpServer

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


FeedPostSoftLimit

The FeedPostSoftLimit property corresponds to "Limit post size" for the feed on the Settings tab of NNTP virtual server Properties. Units are in kilobytes.

The metabase represents unlimited as the DWORD value of 4294967295 (0xFFFFFFFF); however, VBScript represents unlimited in hexadecimal format as &HFFFFFFFF. Previous versions of IIS represented unlimited as -1.

Attribute Name | Attribute Value
XML Data Type | DWORD
WMI Data Type | SINT32
ADSI Data Type | DWORD
ABO Data Type | DWORD
ABO Metabase identifier | No friendly named is defined for this identifier in iiscfng.h. Search the systemroot\System32\Inetsrv\MBSchema.xml file for this property and use the integer from its ID attribute.
Attributes | INHERIT
Default Value | 4294967295
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | 0
ID | 45168

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/NNTPSVC | IIsNntpService
/LM/NNTPSVC/n | IIsNntpServer

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


FeedReportPeriod

The FeedReportPeriod property is used by Microsoft Exchange.
Attribute Name | Attribute Value
XML Data Type | DWORD
WMI Data Type | SINT32
ADSI Data Type | DWORD
ABO Data Type | DWORD
ABO Metabase identifier | No friendly named is defined for this identifier in iiscfng.h. Search the systemroot\System32\Inetsrv\MBSchema.xml file for this property and use the integer from its ID attribute.
Attributes | INHERIT
Default Value | 0
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | 0
ID | 45180

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/NNTPSVC | IIsNntpService
/LM/NNTPSVC/n | IIsNntpServer

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


FeedSecurityType

The FeedSecurityType property is used by Microsoft Exchange.
Attribute Name | Attribute Value
XML Data Type | DWORD
WMI Data Type | SINT32
ADSI Data Type | DWORD
ABO Data Type | DWORD
ABO Metabase identifier | No friendly named is defined for this identifier in iiscfng.h. Search the systemroot\System32\Inetsrv\MBSchema.xml file for this property and use the integer from its ID attribute.
Attributes | INHERIT
Default Value | null
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | 0
ID | 45459

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/NNTPSVC/n/Feeds/feed n | IIsNntpFeed

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


FeedServerName

The FeedServerName property corresponds to "Remote Server Name" on General tab of feed properties.
Attribute Name | Attribute Value
XML Data Type | String
WMI Data Type | String
ADSI Data Type | String
ABO Data Type | String
ABO Metabase identifier | No friendly named is defined for this identifier in iiscfng.h. Search the systemroot\System32\Inetsrv\MBSchema.xml file for this property and use the integer from its ID attribute.
Attributes | INHERIT
Default Value | null
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 45456

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/NNTPSVC/n/Feeds/feed n | IIsNntpFeed

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


FeedStartTimeHigh

The FeedStartTimeHigh property contains the high DWORD of the feed start time.
Attribute Name | Attribute Value
XML Data Type | DWORD
WMI Data Type | SINT32
ADSI Data Type | DWORD
ABO Data Type | DWORD
ABO Metabase identifier | No friendly named is defined for this identifier in iiscfng.h. Search the systemroot\System32\Inetsrv\MBSchema.xml file for this property and use the integer from its ID attribute.
Attributes | INHERIT
Default Value | null
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | 0
ID | 45463

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/NNTPSVC/n/Feeds/feed n | IIsNntpFeed

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


FeedStartTimeLow

The FeedStartTimeLow property contains the low DWORD of the feed start time.
Attribute Name | Attribute Value
XML Data Type | DWORD
WMI Data Type | SINT32
ADSI Data Type | DWORD
ABO Data Type | DWORD
ABO Metabase identifier | No friendly named is defined for this identifier in iiscfng.h. Search the systemroot\System32\Inetsrv\MBSchema.xml file for this property and use the integer from its ID attribute.
Attributes | INHERIT
Default Value | null
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | 0
ID | 45464

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/NNTPSVC/n/Feeds/feed n | IIsNntpFeed

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


FeedTempDirectory

The FeedTempDirectory contains the temporary directory used for feeds.
Attribute Name | Attribute Value
XML Data Type | String
WMI Data Type | String
ADSI Data Type | String
ABO Data Type | String
ABO Metabase identifier | No friendly named is defined for this identifier in iiscfng.h. Search the systemroot\System32\Inetsrv\MBSchema.xml file for this property and use the integer from its ID attribute.
Attributes | INHERIT
Default Value | null
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 45473

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/NNTPSVC/n/Feeds/feed n | IIsNntpFeed

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


FeedType

The FeedType property specifies the role of the remote server in this feed — master, slave, or peer.
Attribute Name | Attribute Value
XML Data Type | DWORD
WMI Data Type | SINT32
ADSI Data Type | DWORD
ABO Data Type | DWORD
ABO Metabase identifier | No friendly named is defined for this identifier in iiscfng.h. Search the systemroot\System32\Inetsrv\MBSchema.xml file for this property and use the integer from its ID attribute.
Attributes | INHERIT
Default Value | null
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | 0
ID | 45457

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/NNTPSVC/n/Feeds/feed n | IIsNntpFeed

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


FeedUucpName

The FeedUucpName property corresponds to "Unique path ID generated by remote server" on the General tab of feed properties.
Attribute Name | Attribute Value
XML Data Type | String
WMI Data Type | String
ADSI Data Type | String
ABO Data Type | String
ABO Metabase identifier | No friendly named is defined for this identifier in iiscfng.h. Search the systemroot\System32\Inetsrv\MBSchema.xml file for this property and use the integer from its ID attribute.
Attributes | INHERIT
Default Value | null
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 45472

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/NNTPSVC/n/Feeds/feed n | IIsNntpFeed

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


FilterDescription

The value of FilterDescription contains the description of the corresponding filter.
Attribute Name | Attribute Value
XML Data Type | String
WMI Data Type | String
ADSI Data Type | String
ABO Data Type | String
ABO Metabase identifier | MD_FILTER_DESCRIPTION
Attributes | NO_ATTRIBUTES
Default Value | null
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 2045

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/W3SVC/Filters/filter_name /LM/W3SVC/n/Filters/filter_name | IIsFilter

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


FilterEnableCache

The FilterEnableCache property can be set on individual filters to mark them "cache friendly" to HTTP.sys. This means that the filter does not conditionally reroute URLs for /default.htm to either /default-1.htm or /default-2.htm, which would break the HTTP.sys cache. By default, filters are considered unfriendly to the HTTP.sys cache.
Attribute Name | Attribute Value
XML Data Type | Boolean
WMI Data Type | Boolean
ADSI Data Type | Boolean
ABO Data Type | Boolean
ABO Metabase identifier | MD_FILTER_ENABLE_CACHE
Attributes | NO_ATTRIBUTES
Default Value | false
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | 0
ID | 2046

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/W3SVC/Filters/filter_name /LM/W3SVC/n/Filters/filter_name | IIsFilter

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


FilterEnabled

The FilterEnabled indicates whether the installed filter is enabled.
Attribute Name | Attribute Value
XML Data Type | Boolean
WMI Data Type | Boolean
ADSI Data Type | Boolean
ABO Data Type | Boolean
ABO Metabase identifier | MD_FILTER_ENABLED
Attributes | NO_ATTRIBUTES
Default Value | true
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | 0
ID | 2043

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/W3SVC/Filters/filter_name /LM/W3SVC/n/Filters/filter_name | IIsFilter

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


FilterFlags

The FilterFlags contains flags that indicate the events that are registered to notify the installed ISAPI filter, which are defined in the Flags section.

important Important Because this property is internally configured by IIS, you should consider it to be read-only. Do not configure this property.

For more information, see "Developing ISAPI Filters" in the Platform SDK.

Attribute Name | Attribute Value
XML Data Type | DWORD
WMI Data Type | SINT32
ADSI Data Type | DWORD
ABO Data Type | DWORD
ABO Metabase identifier | MD_FILTER_FLAGS
Attributes | NO_ATTRIBUTES
Default Value | 0
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | 0
ID | 2044

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/W3SVC/Filters/filter_name /LM/W3SVC/n/Filters/filter_name | IIsFilter

Flags

Flag Name | NotifySecurePort
Description | Notify only if port secure.
Metabase Bitmask Identifier | MD_NOTIFY_SECURE_PORT
Decimal Value | 1
Hex Value | 0x00000001
Flag Name | NotifyNonSecurePort
Description | Notify only if port nonsecure.
Metabase Bitmask Identifier | MD_NOTIFY_NONSECURE_PORT
Decimal Value | 2
Hex Value | 0x00000002
Flag Name | NotifyReadRawData
Description | Notify if reading raw data.
Metabase Bitmask Identifier | MD_NOTIFY_READ_RAW_DATA
Decimal Value | 32768
Hex Value | 0x00008000
Flag Name | NotifyPreProcHeaders
Description | Notify if preprocessing headers.
Metabase Bitmask Identifier | MD_NOTIFY_PREPROC_HEADERS
Decimal Value | 16384
Hex Value | 0x00004000
Flag Name | NotifyAuthentication
Description | Notify if performing authentication.
Metabase Bitmask Identifier | MD_NOTIFY_AUTHENTICATION
Decimal Value | 8192
Hex Value | 0x00002000
Flag Name | NotifyUrlMap
Description | Notify if mapping URL to physical path.
Metabase Bitmask Identifier | MD_NOTIFY_URL_MAP
Decimal Value | 4096
Hex Value | 0x00001000
Flag Name | NotifyAccessDenied
Description | Notify if server sending HTTP error 401 to client.
Metabase Bitmask Identifier | MD_NOTIFY_ACCESS_DENIED
Decimal Value | 2048
Hex Value | 0x00000800
Flag Name | NotifySendResponse
Description | Notify if response being sent to client.
Metabase Bitmask Identifier | MD_NOTIFY_SEND_RESPONSE
Decimal Value | 64
Hex Value | 0x00000040
Flag Name | NotifySendRawData
Description | Notify if sending raw data.
Metabase Bitmask Identifier | MD_NOTIFY_SEND_RAW_DATA
Decimal Value | 1024
Hex Value | 0x00000400
Flag Name | NotifyLog
Description | Notify if logging.
Metabase Bitmask Identifier | MD_NOTIFY_LOG
Decimal Value | 512
Hex Value | 0x00000200
Flag Name | NotifyEndOfRequest
Description | Notify if request has ended.
Metabase Bitmask Identifier | MD_NOTIFY_END_OF_REQUEST
Decimal Value | 128
Hex Value | 0x00000080
Flag Name | NotifyEndOfNetSession
Description | Notify if network session is ending.
Metabase Bitmask Identifier | MD_NOTIFY_END_OF_NET_SESSION
Decimal Value | 256
Hex Value | 0x00000100
Flag Name | NotifyOrderHigh
Description | High priority for notifications.
Metabase Bitmask Identifier | MD_NOTIFY_ORDER_HIGH
Decimal Value | 524288
Hex Value | 0x00080000
Flag Name | NotifyOrderMedium
Description | Medium priority for notifications.
Metabase Bitmask Identifier | MD_NOTIFY_ORDER_MEDIUM
Decimal Value | 262144
Hex Value | 0x00040000
Flag Name | NotifyOrderLow
Description | Low priority for notifications.
Metabase Bitmask Identifier | MD_NOTIFY_ORDER_LOW
Decimal Value | 131072
Hex Value | 0x00020000
Flag Name | NotifyAuthComplete
Description | Notify if the client's identity has been negotiated with the client. Because of the timing of this notification, the AUTH_USER server variable can be used to reliably obtain the identity of the user. If the value of this property is 1, then the filter registers for the SF_NOTIFY_AUTH_COMPLETE notification. If the value is 0, the filter does not.
Metabase Bitmask Identifier | MD_NOTIFY_AUTH_COMPLETE
Decimal Value | 67108864
Hex Value | 0x04000000

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


FilterLoadOrder

The value of FilterLoadOrder, is a comma-delimited list, which specifies the order that filters are to be loaded, such as Filter1, Filter2, and so on.

Attribute Name | Attribute Value
XML Data Type | String
WMI Data Type | String
ADSI Data Type | String
ABO Data Type | String
ABO Metabase identifier | MD_FILTER_LOAD_ORDER
Attributes | NO_ATTRIBUTES
Default Value | null
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 2040

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/W3SVC/Filters /LM/W3SVC/n/Filters | IIsFilters

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


FilterPath

The FilterPath property specifies the full path to a filter DLL; for example C:\Wwwroot\Bin\Filter.dll.

Attribute Name | Attribute Value
XML Data Type | String
WMI Data Type | String
ADSI Data Type | String
ABO Data Type | String
ABO Metabase identifier | MD_FILTER_IMAGE_PATH
Attributes | NO_ATTRIBUTES
Default Value | null
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 2041

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/W3SVC/Filters/filter_name /LM/W3SVC/n/Filters/filter_name | IIsFilter

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


FilterState

The FilterState property indicates whether the installed filter is loaded or unloaded, as defined in the Bitmask Values table.

important Important Because this property is internally configured by IIS, you should consider it to be read-only. Do not configure this property.

Attribute Name | Attribute Value
XML Data Type | DWORD
WMI Data Type | SINT32
ADSI Data Type | DWORD
ABO Data Type | DWORD
ABO Metabase identifier | MD_FILTER_STATE
Attributes | NO_ATTRIBUTES
Default Value | 0
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | 0
ID | 2042

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/W3SVC/Filters/filter_name /LM/W3SVC/n/Filters/filter_name | IIsFilter

Values

Constant | Value | Description
MD_FILTER_STATE_LOADED | 0x00000001 | Filter is loaded.
MD_FILTER_STATE_UNLOADED | 0x00000004 | Filter is unloaded.

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


FrontPageWeb

The FrontPageWeb property indicates whether a server instance will be targeted by Microsoft® FrontPage®. Setting FrontPageWeb to true causes FrontPage Manager to create the files required for FrontPage Server Extensions. Setting FrontPageWeb to false causes these files to be deleted.

Attribute Name | Attribute Value
XML Data Type | Boolean
WMI Data Type | Boolean
ADSI Data Type | Boolean
ABO Data Type | Boolean
ABO Metabase identifier | MD_FRONTPAGE_WEB
Attributes | INHERIT
Default Value | false
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | 0
ID | 2072

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/W3SVC/n/ROOT /LM/W3SVC/n/ROOT/virtual_directory_name | IIsWebVirtualDir
/LM/W3SVC/n | IIsWebServer
/LM/W3SVC/n/ROOT/physical_directory_name /LM/W3SVC/n/virtual_directory_name/physical_directory_name | IIsWebDirectory

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


FsPropertyPath

The FsPropertyPath property contains the path to driver property files.
Attribute Name | Attribute Value
XML Data Type | String
WMI Data Type | String
ADSI Data Type | String
ABO Data Type | String
ABO Metabase identifier | No friendly named is defined for this identifier in iiscfng.h. Search the systemroot\System32\Inetsrv\MBSchema.xml file for this property and use the integer from its ID attribute.
Attributes | INHERIT
Default Value | null
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 46158

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/NNTPSVC/n/ROOT /LM/NNTPSVC/n/ROOT/virtual_directory_name | IIsNntpVirtualDir

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


FtpDirBrowseShowLongDate

The FtpDirBrowseShowLongDate indicates whether to display two-digit or four-digit years when browsing directories.

note Note The MSDOSDirOutput property allows UNIX-style directory browsing, and if set to false, FtpDirBrowseShowLongDate will have no effect. FtpDirBrowseShowLongDate is valid only when MSDOSDirOutput=true, which sets the directory output to MS-DOS® format .

Attribute Name | Attribute Value
XML Data Type | Boolean
WMI Data Type | Boolean
ADSI Data Type | Boolean
ABO Data Type | Boolean
ABO Metabase identifier | MD_SHOW_4_DIGIT_YEAR
Attributes | INHERIT
Default Value | false
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_FILE
StartingNumber | Not applicable
EndingNumber | 0
ID | 5010

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/MSFTPSVC/n | IIsFtpServer
/LM/MSFTPSVC | IIsFtpService
/LM/MSFTPSVC/n/ROOT /LM/MSFTPSVC/n/ROOT/virtual_directory_name | IIsFtpVirtualDir

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


FtpLogInUtf8

The FtpLogInUtf8 property is used by IIS.
Attribute Name | Attribute Value
XML Data Type | Boolean
WMI Data Type | Boolean
ADSI Data Type | Boolean
ABO Data Type | Boolean
ABO Metabase identifier | MD_FTP_LOG_IN_UTF_8
Attributes | INHERIT
Default Value | false
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 5013

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/MSFTPSVC/n | IIsFtpServer
/LM/MSFTPSVC | IIsFtpService

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


FullyQualifiedDomainName

The FullyQualifiedDomainName contains the fully qualified domain name (FQDN) of the Simple Mail Transfer Protocol (SMTP) virtual server.
Attribute Name | Attribute Value
XML Data Type | String
WMI Data Type | String
ADSI Data Type | String
ABO Data Type | String
ABO Metabase identifier | MD_FQDN_VALUE
Attributes | INHERIT
Default Value | null
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 36935

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/SMTPSVC | IIsSmtpService
/LM/SMTPSVC/n | IIsSmtpServer

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


GreetingMessage

The GreetingMessage contains a greeting message that can be sent to new clients from an FTP server.

Attribute Name | Attribute Value
XML Data Type | MULTISZ
WMI Data Type | MULTISZ
ADSI Data Type | MULTISZ
ABO Data Type | MULTISZ
ABO Metabase identifier | MD_GREETING_MESSAGE
Attributes | INHERIT
Default Value | null
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 5002

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/MSFTPSVC/n | IIsFtpServer
/LM/MSFTPSVC | IIsFtpService

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


GroupHelpFile

The GroupHelpFile property contains the path to the descript.txt file, which is currently unused.
Attribute Name | Attribute Value
XML Data Type | String
WMI Data Type | String
ADSI Data Type | String
ABO Data Type | String
ABO Metabase identifier | No friendly named is defined for this identifier in iiscfng.h. Search the systemroot\System32\Inetsrv\MBSchema.xml file for this property and use the integer from its ID attribute.
Attributes | INHERIT
Default Value | null
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 45156

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/NNTPSVC/n | IIsNntpServer

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


GroupListFile

The GroupListFile property contains the path to the group.lst file.
Attribute Name | Attribute Value
XML Data Type | String
WMI Data Type | String
ADSI Data Type | String
ABO Data Type | String
ABO Metabase identifier | No friendly named is defined for this identifier in iiscfng.h. Search the systemroot\System32\Inetsrv\MBSchema.xml file for this property and use the integer from its ID attribute.
Attributes | INHERIT
Default Value | null
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 45157

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/NNTPSVC/n | IIsNntpServer

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


GroupvarListFile

The GroupvarListFile property contains the path to the groupvar.lst file.
Attribute Name | Attribute Value
XML Data Type | String
WMI Data Type | String
ADSI Data Type | String
ABO Data Type | String
ABO Metabase identifier | No friendly named is defined for this identifier in iiscfng.h. Search the systemroot\System32\Inetsrv\MBSchema.xml file for this property and use the integer from its ID attribute.
Attributes | INHERIT
Default Value | null
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 45182

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/NNTPSVC | IIsNntpService
/LM/NNTPSVC/n | IIsNntpServer

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


HcCacheControlHeader

The HcCacheControlHeader property specifies the directive that IIS adds to the Cache-Control header. This header, along with the Expires header specified by HcExpiresHeader, is included with every compressed file that is sent to a client browser.

The HcCacheControlHeader property specifies a header that overrides the HTTP Expires header, which is specified by HcExpiresHeader, and is included to ensure that older clients and proxy servers do not attempt to cache compressed files.

Neither the header specified by HcCacheControlHeader nor the header specified by HcExpiresHeader is sent with a response if the metabase property HcSendCacheHeaders is set to false.

The World Wide Web Publishing Service (WWW service) must be restarted before changes to this property take effect.

Attribute Name | Attribute Value
XML Data Type | String
WMI Data Type | String
ADSI Data Type | String
ABO Data Type | String
ABO Metabase identifier | MD_HC_CACHE_CONTROL_HEADER
Attributes | NO_ATTRIBUTES
Default Value | max-age=86400
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 2211

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/W3SVC/Filters/Compression/Parameters | IIsCompressionSchemes

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.
Related Topics

HcExpiresHeader

HcSendCacheHeaders


HcCompressionBufferSize

The HcCompressionBufferSize property specifies the size of the compression buffer (in bytes) that IIS uses for receiving compressed data. This buffer is used for on-demand compression of static content, as well as dynamic content compression. A larger buffer yields slightly faster compression performance, but at the cost of using additional memory.

The size limit specified by HcCompressionBufferSize is used by IIS, only if either HcDoOnDemandCompression or HcDoDynamicCompression are set to true. The maximum allowable size of the compression buffer is 1,048,576 bytes (1 MB).

The World Wide Web Publishing Service (WWW service) must be restarted before changes to this property take effect.

Attribute Name | Attribute Value
XML Data Type | DWORD
WMI Data Type | SINT32
ADSI Data Type | DWORD
ABO Data Type | DWORD
ABO Metabase identifier | MD_HC_COMPRESSION_BUFFER_SIZE
Attributes | NO_ATTRIBUTES
Default Value | 8192
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | 0
ID | 2223

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/W3SVC/Filters/Compression/Parameters | IIsCompressionSchemes

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.
Related Topics

HcDoOnDemandCompression

HcDoDynamicCompression


HcCompressionDirectory

The HcCompressionDirectory property specifies the directory where compressed versions of static files are temporarily cached. If compression is enabled for IIS, every time IIS receives a request for a static file, such as an .htm or .txt file, the server searches the compression directory for an already compressed version of the requested static file.

To force IIS to recompress all outgoing static files, delete all files found in the compression directory specified by HcCompressionDirectory.

important Important It is strongly recommended that the directory specified by HcCompressionDirectory reside on an NTFS file system volume, not on a FAT volume. If the file being requested resides on an NTFS volume, and you have set HcCompressionDirectory to specify a FAT volume, IIS will not perform HTTP compression on that file. This behavior is due to a number of differences between FAT and NTFS volumes, such as time stamping and access control mechanisms. In addition, NTFS handles directories that contain a large number of files more efficiently than FAT volumes do.

Attribute Name | Attribute Value
XML Data Type | EXPANDSZ
WMI Data Type | String
ADSI Data Type | EXPANDSZ
ABO Data Type | EXPANDSZ
ABO Metabase identifier | MD_HC_COMPRESSION_DIRECTORY
Attributes | NO_ATTRIBUTES
Default Value | %windir%\iis temporary compressed files
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 2210

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/W3SVC/Filters/Compression/Parameters | IIsCompressionSchemes

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.
Related Topics
HcDoOnDemandCompression


HcCompressionDll

The HcCompressionDll property specifies the fully qualified file system path and file name of the compression DLL associated with the compression scheme.

The World Wide Web Publishing Service (WWW service) must be restarted before changes to this property take effect.

Attribute Name | Attribute Value
XML Data Type | EXPANDSZ
WMI Data Type | String
ADSI Data Type | EXPANDSZ
ABO Data Type | EXPANDSZ
ABO Metabase identifier | MD_HC_COMPRESSION_DLL
Attributes | NO_ATTRIBUTES
Default Value | null
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 2237

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/W3SVC/Filters/Compression/gzip /LM/W3SVC/Filters/Compression/deflate | IIsCompressionScheme

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


HcCreateFlags

The HcCreateFlags property contains a flag that is passed to the HcCompressionDLL property. This flag identifies the compression schema to be used (either “gzip” or “deflate”).
Attribute Name | Attribute Value
XML Data Type | DWORD
WMI Data Type | SINT32
ADSI Data Type | DWORD
ABO Data Type | DWORD
ABO Metabase identifier | MD_HC_CREATE_FLAGS
Attributes | NO_ATTRIBUTES
Default Value | 0
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | 0
ID | 2243

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/W3SVC/Filters/Compression/gzip /LM/W3SVC/Filters/Compression/deflate | IIsCompressionScheme

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


HcDoDiskSpaceLimiting

The HcDoDiskSpaceLimiting allows you to limit the amount of disk space that all compressed files, which are stored in the compression directory specified by HcCompressionDirectory can occupy. If HcDoDiskSpaceLimiting is set to true, IIS will not allow compressed files to occupy more than the number of bytes specified by HcMaxDiskSpaceUsage. Once the limit is reached, compressed files are removed from the compression directory on an LRU (least-recently) basis. If HcDoDiskSpaceLimiting is set to false, no limit is enforced on the amount of disk space that the files in the compression directory can occupy.

note Note Limiting the use of disk space has a significant impact on performance because additional overhead is required to check for the limit. Use this feature only when you lack adequate disk space to cache all content files on your Web server.

HcDoDiskSpaceLimiting is relevant only if you have set the property HcDoOnDemandCompression to true.

Attribute Name | Attribute Value
XML Data Type | Boolean
WMI Data Type | Boolean
ADSI Data Type | Boolean
ABO Data Type | Boolean
ABO Metabase identifier | MD_HC_DO_DISK_SPACE_LIMITING
Attributes | NO_ATTRIBUTES
Default Value | false
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | 0
ID | 2216

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/W3SVC/Filters/Compression/Parameters | IIsCompressionSchemes

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.
Related Topics

HcCompressionDirectory

HcMaxDiskSpaceUsage

HcDoOnDemandCompression


HcDoDynamicCompression

The HcDoDynamicCompression property specifies whether responses to requests for dynamic content, such as scripts in ASP pages and ISAPI extensions are compressed. Setting HcDoDynamicCompression to true, indicates that all dynamic content is compressed when requested by a client.

important Important Because dynamic content is by definition always changing, IIS does not cache compressed versions of dynamic output. Thus, if dynamic compression is enabled, each request for dynamic content causes the content to be compressed. Dynamic compression consumes considerable CPU time and memory resources, and should only be used on servers that have slow network connections, but CPU time to spare.

For individual compression schemes (IIsCompressionScheme), the HcDoDynamicCompression property specifies whether that particular compression scheme supports compression of dynamic content.

Because HcDoDynamicCompression is not inheritable, HcDoDynamicCompression must be set to true at both the global level (IIsCompressionSchemes) and the individual scheme level (IIsCompressionScheme), in order to enable dynamic compression for a server.

If you change the value of HcDoDynamicCompression at the individual compression scheme level, the World Wide Web Publishing Service (WWW service) must be restarted for the change to take effect.

Attribute Name | Attribute Value
XML Data Type | Boolean
WMI Data Type | Boolean
ADSI Data Type | Boolean
ABO Data Type | Boolean
ABO Metabase identifier | MD_HC_DO_DYNAMIC_COMPRESSION
Attributes | NO_ATTRIBUTES
Default Value | false
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | 0
ID | 2213

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/W3SVC/Filters/Compression/gzip /LM/W3SVC/Filters/Compression/deflate | IIsCompressionScheme
/LM/W3SVC/Filters/Compression/Parameters | IIsCompressionSchemes

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


HcDoOnDemandCompression

The HcDoOnDemandCompression property specifies whether static files, such as .htm and .txt files, are compressed if a compressed version of the file does not exist in the compression directory specified by HcCompressionDirectory.

For on-demand compression of static files to occur, HcDoOnDemandCompression must be set to true at the global (IIsCompressionSchemes) level and at least one compression scheme (IIsCompressionScheme) level. The supported compression schemes are gzip and deflate. For information about the levels that this property can be set, see the Access Locations table.

If HcDoOnDemandCompression is set to true at the IIsCompressionScheme level and at least one IIsCompressionSchemes level, and IIS receives a request for static content, IIS checks the compression directory. If a corresponding compressed version of the requested file is not found, IIS will send an uncompressed version of the requested file to the client browser, while a background thread compresses the requested file. The newly compressed file is then stored in the compression directory, and subsequent requests for that file are serviced directly from the compression directory. In other words, an uncompressed version of the file is returned to the client, unless a compressed version of the file already exists in the compression directory.

If HcDoOnDemandCompression is set to false, at the global level, IIS does not compress static content files when a corresponding compressed version is not found in the compression directory.

If you change the value of HcDoOnDemandCompression at the individual compression scheme level, the World Wide Web Publishing Service (WWW service) must be restarted for the change to take effect.

Attribute Name | Attribute Value
XML Data Type | Boolean
WMI Data Type | Boolean
ADSI Data Type | Boolean
ABO Data Type | Boolean
ABO Metabase identifier | MD_HC_DO_ON_DEMAND_COMPRESSION
Attributes | NO_ATTRIBUTES
Default Value | true
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | 0
ID | 2215

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/W3SVC/Filters/Compression/gzip /LM/W3SVC/Filters/Compression/deflate | IIsCompressionScheme
/LM/W3SVC/Filters/Compression/Parameters | IIsCompressionSchemes

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.
Related Topics

HcCompressionDirectory


HcDoStaticCompression

The HcDoStaticCompression property specifies whether IIS compresses responses to requests for static content.

At the global level (IIsCompressionSchemes), HcDoStaticCompression indicates that IIS will respond to requests for static content, such as .htm and .txt files by first checking the compression directory specified by HcCompressionDirectory. If a compressed version of the static file is found in the directory, it is sent to the client browser. Otherwise, if on-demand compression is enabled with HcDoOnDemandCompression, IIS sends the requested file in uncompressed form, and adds that file to the background compression queue.

At the individual compression scheme level (IIsCompressionScheme), HcDoStaticCompression indicates whether the individual compression scheme supports compression of static files.

Because HcDoStaticCompression is not inheritable, in order for static compression to actually be enabled for a server, HcDoStaticCompression must be set to true at both the global level and individual scheme level.

If you change the value of this property at the individual compression scheme level, the World Wide Web Publishing Service (WWW service) must be restarted before the change takes effect.

Attribute Name | Attribute Value
XML Data Type | Boolean
WMI Data Type | Boolean
ADSI Data Type | Boolean
ABO Data Type | Boolean
ABO Metabase identifier | MD_HC_DO_STATIC_COMPRESSION
Attributes | NO_ATTRIBUTES
Default Value | true
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | 0
ID | 2214

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/W3SVC/Filters/Compression/gzip /LM/W3SVC/Filters/Compression/deflate | IIsCompressionScheme
/LM/W3SVC/Filters/Compression/Parameters | IIsCompressionSchemes

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.
Related Topics

HcCompressionDirectory

HcDoOnDemandCompression


HcDynamicCompressionLevel

The HcDynamicCompressionLevel property specifies the compression level for the compression scheme, when the scheme is compressing dynamic content. Low compression levels produce slightly larger compressed files, but with lower overall impact on CPU and memory resources. Higher compression levels generally result in smaller compressed files, but with higher CPU and memory usage.

The World Wide Web Publishing Service (WWW service) must be restarted for any changes to this property take effect.

Attribute Name | Attribute Value
XML Data Type | DWORD
WMI Data Type | SINT32
ADSI Data Type | DWORD
ABO Data Type | DWORD
ABO Metabase identifier | MD_HC_DYNAMIC_COMPRESSION_LEVEL
Attributes | NO_ATTRIBUTES
Default Value | 0
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | 0
ID | 2241

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/W3SVC/Filters/Compression/gzip /LM/W3SVC/Filters/Compression/deflate | IIsCompressionScheme

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


HcExpiresHeader

The HcExpiresHeader property specifies the content of the HTTP Expires header that is sent with all requested compressed files, along with the Cache-Control header discussed in HcCacheControlHeader.

The combination of HcExpiresHeader and HcCacheControlHeader ensures that older clients and proxy servers do not attempt to cache compressed files.

Neither the header specified by HcCacheControlHeader, nor the header specified by HcExpiresHeader, is sent with the response if the metabase property HcSendCacheHeaders is set to false.

The World Wide Web Publishing Service (WWW service) must be restarted before any changes to this property take effect.

Attribute Name | Attribute Value
XML Data Type | String
WMI Data Type | String
ADSI Data Type | String
ABO Data Type | String
ABO Metabase identifier | MD_HC_EXPIRES_HEADER
Attributes | NO_ATTRIBUTES
Default Value | null
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 2212

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/W3SVC/Filters/Compression/Parameters | IIsCompressionSchemes

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.
Related Topics

HcCacheControlHeader

HcSendCacheHeaders


HcFileExtensions

The HcFileExtensions indicates which file name extensions are supported by the compression scheme. Only static files with the specified file extensions are compressed by IIS. If this setting is empty, no static files are compressed.

In addition to file name extension matches, HcDoOnDemandCompression and HcDoStaticCompression must be set to true for compression to be performed.

The World Wide Web Publishing Service (WWW service) must be restarted for any changes to this property take effect.

Attribute Name | Attribute Value
XML Data Type | MULTISZ
WMI Data Type | MULTISZ
ADSI Data Type | MULTISZ
ABO Data Type | MULTISZ
ABO Metabase identifier | MD_HC_FILE_EXTENSIONS
Attributes | NO_ATTRIBUTES
Default Value | null
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 2238

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/W3SVC/Filters/Compression/gzip /LM/W3SVC/Filters/Compression/deflate | IIsCompressionScheme

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.
Related Topics
HcScriptFileExtensions


HcFilesDeletedPerDiskFree

The HcFilesDeletedPerDiskFree property specifies the number of compressed files that are deleted from the compression directory when IIS determines that the compression directory has grown beyond its limits. IIS deletes a number of files equal to the setting of this property, starting with the LRU (least-recently used) files.

The HcFilesDeletedPerDiskFree property is relevant only if HcDoDiskSpaceLimiting is set to true, and HcMaxDiskSpaceUsage is set to something other than 0xFFFFFFFF (unlimited). The maximum allowable value of HcFilesDeletedPerDiskFree is 1024.

Attribute Name | Attribute Value
XML Data Type | DWORD
WMI Data Type | SINT32
ADSI Data Type | DWORD
ABO Data Type | DWORD
ABO Metabase identifier | MD_HC_FILES_DELETED_PER_DISK_FREE
Attributes | NO_ATTRIBUTES
Default Value | 256
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | 0
ID | 2225

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/W3SVC/Filters/Compression/Parameters | IIsCompressionSchemes

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


HcIoBufferSize

The HcIoBufferSize property specifies the size of the buffer (in bytes) that IIS uses to read uncompressed files. A larger buffer yields slightly faster compression performance, but at the cost of additional memory usage.

HcIoBufferSize is used by IIS only if HcDoOnDemandCompression is set to true. The maximum allowable value is 1,048,576 bytes (1 MB).

The World Wide Web Publishing Service (WWW service) must be restarted before any changes to this property take effect.

Attribute Name | Attribute Value
XML Data Type | DWORD
WMI Data Type | SINT32
ADSI Data Type | DWORD
ABO Data Type | DWORD
ABO Metabase identifier | MD_HC_IO_BUFFER_SIZE
Attributes | NO_ATTRIBUTES
Default Value | 8192
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | 0
ID | 2222

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/W3SVC/Filters/Compression/Parameters | IIsCompressionSchemes

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


HcMaxDiskSpaceUsage

The HcMaxDiskSpaceUsage property specifies whether IIS limits the number of bytes of disk space occupied by compressed files in the compression directory.

Disk space limiting is performed, and HcMaxDiskSpaceUsage is checked by IIS, only if HcDoDiskSpaceLimiting is set to true. If HcMaxDiskSpaceUsage is set to 4294967295, there will be no limit on the number of bytes occupied by compressed files.

The metabase represents unlimited as the DWORD value of 4294967295 (0xFFFFFFFF); however, VBScript represents unlimited in hexadecimal format as &HFFFFFFFF. Previous versions of IIS represented unlimited as -1.

Attribute Name | Attribute Value
XML Data Type | DWORD
WMI Data Type | SINT32
ADSI Data Type | DWORD
ABO Data Type | DWORD
ABO Metabase identifier | MD_HC_MAX_DISK_SPACE_USAGE
Attributes | NO_ATTRIBUTES
Default Value | 1000000
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | 0
ID | 2221

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/W3SVC/Filters/Compression/Parameters | IIsCompressionSchemes

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


HcMaxQueueLength

IIS performs on-demand compression of static content in the background. When a static file is requested, and IIS has determined that a previously compressed version of the requested file does not already exist in the compression directory, the request is put into a simple FIFO (first in, first out) queue. The HcMaxQueueLength property specifies how many concurrent background compression requests can be in the queue. If the queue is full, additional compression requests are ignored until there is room in the queue.

If HcMaxQueueLength is set to 4294967295, there is no limit to the number of pending requests in the queue.

The metabase represents unlimited as the DWORD value of 4294967295 (0xFFFFFFFF); however, VBScript represents unlimited in hexadecimal format as &HFFFFFFFF. Previous versions of IIS represented unlimited as -1.

Attribute Name | Attribute Value
XML Data Type | DWORD
WMI Data Type | SINT32
ADSI Data Type | DWORD
ABO Data Type | DWORD
ABO Metabase identifier | MD_HC_MAX_QUEUE_LENGTH
Attributes | NO_ATTRIBUTES
Default Value | 1000
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | 0
ID | 2224

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/W3SVC/Filters/Compression/Parameters | IIsCompressionSchemes

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


HcMinFileSizeForComp

The HcMinFileSizeForComp allows you to specify the minimum number of bytes a file must contain for it to be compressed using on-demand compression. Very small files do not compress well, and in some cases, compression may even make the file larger than it was initially.

If HcMinFileSizeForComp is set to 0 (zero), all files are compressed.

Attribute Name | Attribute Value
XML Data Type | DWORD
WMI Data Type | SINT32
ADSI Data Type | DWORD
ABO Data Type | DWORD
ABO Metabase identifier | MD_HC_MIN_FILE_SIZE_FOR_COMP
Attributes | NO_ATTRIBUTES
Default Value | 256
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | 0
ID | 2226

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/W3SVC/Filters/Compression/Parameters | IIsCompressionSchemes

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


HcNoCompressionForHttp10

The HcNoCompressionForHttp10 property disables compression for requests containing an HTTP 1.0 version number. HTTP 1.0, as described in RFC 1945, provides a minimal level of support for certain types of compression. However, some confusion exists around HTTP 1.0 compression, especially with regard to proxy servers. To minimize the chance of inappropriately returning a compressed file to a client that cannot decompress it, you can use this metabase property to disable compression in questionable scenarios.

Attribute Name | Attribute Value
XML Data Type | Boolean
WMI Data Type | Boolean
ADSI Data Type | Boolean
ABO Data Type | Boolean
ABO Metabase identifier | MD_HC_NO_COMPRESSION_FOR_HTTP_10
Attributes | NO_ATTRIBUTES
Default Value | true
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | 0
ID | 2217

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/W3SVC/Filters/Compression/Parameters | IIsCompressionSchemes

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


HcNoCompressionForProxies

The HcNoCompressionForProxies allows you to disable the HTTP 1.1 response for compression requests that have come through proxy servers. Certain HTTP proxy servers, including some advertised as HTTP 1.1 compliant, do not correctly handle the caching of compressed objects.

Attribute Name | Attribute Value
XML Data Type | Boolean
WMI Data Type | Boolean
ADSI Data Type | Boolean
ABO Data Type | Boolean
ABO Metabase identifier | MD_HC_NO_COMPRESSION_FOR_PROXIES
Attributes | NO_ATTRIBUTES
Default Value | false
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | 0
ID | 2218

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/W3SVC/Filters/Compression/Parameters | IIsCompressionSchemes

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


HcNoCompressionForRange

The HcNoCompressionForRange property specifies how IIS handles HTTP Range requests. The HTTP 1.1 Request for Comment, RFC 2068, is ambiguous about whether Range requests apply to the compressed or uncompressed version of a file. Some browsers could be unprepared for compressed Range responses. As a result, IIS, by default, does not send compressed responses to Range requests, to avoid problems with browser misbehavior.

Attribute Name | Attribute Value
XML Data Type | Boolean
WMI Data Type | Boolean
ADSI Data Type | Boolean
ABO Data Type | Boolean
ABO Metabase identifier | MD_HC_NO_COMPRESSION_FOR_RANGE
Attributes | NO_ATTRIBUTES
Default Value | true
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | 0
ID | 2219

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/W3SVC/Filters/Compression/Parameters | IIsCompressionSchemes

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


HcOnDemandCompLevel

The HcOnDemandCompLevel property specifies the compression level for the compression scheme, when the scheme is to compress static content on demand. Low compression levels produce slightly larger compressed files, but with lower overall impact on CPU and memory resources. Higher compression levels generally result in small compressed files but with higher CPU and memory usage.

Valid compression levels range from 1 to 10.

The World Wide Web Publishing Service (WWW service) must be restarted before any changes to this property take effect.

Attribute Name | Attribute Value
XML Data Type | DWORD
WMI Data Type | SINT32
ADSI Data Type | DWORD
ABO Data Type | DWORD
ABO Metabase identifier | MD_HC_ON_DEMAND_COMP_LEVEL
Attributes | NO_ATTRIBUTES
Default Value | 10
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | 0
ID | 2242

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/W3SVC/Filters/Compression/gzip /LM/W3SVC/Filters/Compression/deflate | IIsCompressionScheme

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.
Related Topics
HcDynamicCompressionLevel


HcPriority

The HcPriority property specifies the priority rating assigned to a particular compression scheme. If your installation of IIS has multiple compression schemes installed and a client browser indicates, in the Accept-Encoding header, that it can handle multiple compression schemes, IIS uses the priority numbers specified in HcPriority to determine which scheme to use for the request. In that case, IIS uses the matching scheme that has the highest priority number.

Valid priority numbers range from 1 to 10. In general, if you have multiple compression schemes installed with IIS, you should assign each compression scheme a different priority number.

The World Wide Web Publishing Service (WWW service) must be restarted before any changes to this property take effect.

Attribute Name | Attribute Value
XML Data Type | DWORD
WMI Data Type | SINT32
ADSI Data Type | DWORD
ABO Data Type | DWORD
ABO Metabase identifier | MD_HC_PRIORITY
Attributes | NO_ATTRIBUTES
Default Value | 1
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | 0
ID | 2240

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/W3SVC/Filters/Compression/gzip /LM/W3SVC/Filters/Compression/deflate | IIsCompressionScheme

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


HcScriptFileExtensions

The HcScriptFileExtensions indicates which file name extensions are supported by the compression scheme. The output from dynamic files with the file extensions specified in this property are compressed by IIS.

important Important Setting this parameter to an empty string can have an adverse effect on your server’s performance.

If this parameter is empty, all dynamic responses are sent compressed. In addition, any static file type not specified in HcFileExtensions is dynamically compressed and therefore, not cached.

Also, HcDoDynamicCompression must be set to true for dynamic compression to be performed.

The World Wide Web Publishing Service (WWW service) must be restarted before any changes to this property take effect.

Attribute Name | Attribute Value
XML Data Type | MULTISZ
WMI Data Type | MULTISZ
ADSI Data Type | MULTISZ
ABO Data Type | MULTISZ
ABO Metabase identifier | MD_HC_SCRIPT_FILE_EXTENSIONS
Attributes | NO_ATTRIBUTES
Default Value | null
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 2244

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/W3SVC/Filters/Compression/gzip /LM/W3SVC/Filters/Compression/deflate | IIsCompressionScheme

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.
Related Topics
HcFileExtensions


HcSendCacheHeaders

The HcSendCacheHeaders property specifies whether the headers specified by HcCacheControlHeader and HcExpiresHeader are sent with each compressed response. If this property is set to true, Cache-Control and Expires headers are sent with all compressed responses. If this property is set to false, however, only the HTTP 1.1 Vary header is sent.

important Important In general, the Cache-Control and Expires HTTP headers are included with compressed responses to prevent inappropriate caching of compressed files, especially by proxy servers and older browsers. If you choose to disable these headers, you should also set HcNoCompressionForProxies and HcNoCompressionForHttp10 to true.

Attribute Name | Attribute Value
XML Data Type | Boolean
WMI Data Type | Boolean
ADSI Data Type | Boolean
ABO Data Type | Boolean
ABO Metabase identifier | MD_HC_SEND_CACHE_HEADERS
Attributes | NO_ATTRIBUTES
Default Value | true
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | 0
ID | 2220

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/W3SVC/Filters/Compression/Parameters | IIsCompressionSchemes

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


HeaderWaitTimeout

The HeaderWaitTimeout property specifies the amount of time (in seconds) the server waits for all HTTP headers for the request (indicated by a double carriage return) to be received before disconnecting the client. The purpose of this property is to help prevent a common variant of the Denial of Service (DoS) attack that attempts to max out connection limits and keep those connections connected.
Attribute Name | Attribute Value
XML Data Type | DWORD
WMI Data Type | SINT32
ADSI Data Type | DWORD
ABO Data Type | DWORD
ABO Metabase identifier | MD_HEADER_WAIT_TIMEOUT
Attributes | INHERIT
Default Value | 0
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 9204

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/W3SVC | IIsWebService

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


HistoryExpiration

The HistoryExpiration property is used by Microsoft Exchange.
Attribute Name | Attribute Value
XML Data Type | DWORD
WMI Data Type | SINT32
ADSI Data Type | DWORD
ABO Data Type | DWORD
ABO Metabase identifier | No friendly named is defined for this identifier in iiscfng.h. Search the systemroot\System32\Inetsrv\MBSchema.xml file for this property and use the integer from its ID attribute.
Attributes | INHERIT
Default Value | null
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | 0
ID | 45057

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/NNTPSVC | IIsNntpService
/LM/NNTPSVC/n | IIsNntpServer

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


HistoryMajorVersionNumber

The HistoryMajorVersionNumber is used internally only by IIS to keep track of the major version number of the MetaBase.xml and MBSchema.xml files. The major version number is also used to version and name history files.

important Important Because this property is internally configured by IIS, you should consider it to be read-only. Do not configure this property.

Attribute Name | Attribute Value
XML Data Type | DWORD
WMI Data Type | SINT32
ADSI Data Type | DWORD
ABO Data Type | DWORD
ABO Metabase identifier | MD_GLOBAL_EDIT_WHILE_RUNNING_MAJOR_VERSION_NUMBER
Attributes | NO_ATTRIBUTES
Default Value | null
MetaFlagsEx | Not applicable
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 9994

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
. | IIS_Global

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


HistoryTableFile

The HistoryTableFile property is used by Microsoft Exchange.
Attribute Name | Attribute Value
XML Data Type | String
WMI Data Type | String
ADSI Data Type | String
ABO Data Type | String
ABO Metabase identifier | No friendly named is defined for this identifier in iiscfng.h. Search the systemroot\System32\Inetsrv\MBSchema.xml file for this property and use the integer from its ID attribute.
Attributes | INHERIT
Default Value | null
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 45159

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/NNTPSVC/n | IIsNntpServer

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


HonorClientMsgIds

The HonorClientMsgIds property is used by Microsoft Exchange.
Attribute Name | Attribute Value
XML Data Type | Boolean
WMI Data Type | Boolean
ADSI Data Type | Boolean
ABO Data Type | Boolean
ABO Metabase identifier | No friendly named is defined for this identifier in iiscfng.h. Search the systemroot\System32\Inetsrv\MBSchema.xml file for this property and use the integer from its ID attribute.
Attributes | INHERIT
Default Value | true
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | 0
ID | 45058

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/NNTPSVC | IIsNntpService
/LM/NNTPSVC/n | IIsNntpServer

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


HopCount

The HopCount property specifies the number of hops that are allowed before a message is determined to be in a looping condition and marking for non-delivery.
Attribute Name | Attribute Value
XML Data Type | DWORD
WMI Data Type | SINT32
ADSI Data Type | DWORD
ABO Data Type | DWORD
ABO Metabase identifier | MD_HOP_COUNT
Attributes | INHERIT
Default Value | 10
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | 0
ID | 36886

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/SMTPSVC | IIsSmtpService
/LM/SMTPSVC/n | IIsSmtpServer

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


HttpCustomHeaders

The HttpCustomHeaders property contains custom headers that are sent to the client, in addition to the default header of the HTML file. Each string in this property is formatted as a key name and value pair: Keyname: Value.

Attribute Name | Attribute Value
XML Data Type | MULTISZ
WMI Data Type | MULTISZ
ADSI Data Type | MULTISZ
ABO Data Type | MULTISZ
ABO Metabase identifier | MD_HTTP_CUSTOM
Attributes | INHERIT
Default Value | null
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_FILE
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 6004

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/W3SVC/n/ROOT /LM/W3SVC/n/ROOT/virtual_directory_name | IIsWebVirtualDir
/LM/W3SVC/n | IIsWebServer
/LM/W3SVC | IIsWebService
/LM/W3SVC/n/ROOT/file_name /LM/W3SVC/n/ROOT/virtual_directory_name/file_name | IIsWebFile
/LM/W3SVC/n/ROOT/physical_directory_name /LM/W3SVC/n/virtual_directory_name/physical_directory_name | IIsWebDirectory

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


HttpErrors

The HttpErrors property specifies the custom error string sent to clients in response to HTTP 1.1 errors. Each string in the list specifies the HTTP error code and subcode, indicates whether the handler will be a URL or a file, and specifies which URL or file the client will be sent. Each string can be in either format: a URL or a file.

To send a URL to the client, use HTTPErrorCode, HTTPErrorSubcode, URL, HandlerURL. To send a file, use HTTPErrorCode, HTTPErrorSubcode, FILE, Filename.

Attribute Name | Attribute Value
XML Data Type | MULTISZ
WMI Data Type | MULTISZ
ADSI Data Type | MULTISZ
ABO Data Type | MULTISZ
ABO Metabase identifier | MD_CUSTOM_ERROR
Attributes | INHERIT
Default Value | null
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_FILE
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 6008

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/W3SVC/n/ROOT /LM/W3SVC/n/ROOT/virtual_directory_name | IIsWebVirtualDir
/LM/W3SVC/n | IIsWebServer
/LM/W3SVC | IIsWebService
/LM/W3SVC/n/ROOT/file_name /LM/W3SVC/n/ROOT/virtual_directory_name/file_name | IIsWebFile
/LM/W3SVC/n/ROOT/physical_directory_name /LM/W3SVC/n/virtual_directory_name/physical_directory_name | IIsWebDirectory

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.
Related Topics
CustomErrorDescriptions


HttpExpires

The HttpExpires property specifies the expiration of HTML document content by returning the value to the browser in the HTML file header. The browser compares the given value with the current date to determine whether to display a cached page or to request an updated page from the server. This property can be made relative, or dynamic, by using the format D,#SecondsUntilExpiration, with 0xFFFFFFFF indicating no expiration date. It can also be absolute, with the format S,ValidGMTstring.

Attribute Name | Attribute Value
XML Data Type | String
WMI Data Type | String
ADSI Data Type | String
ABO Data Type | String
ABO Metabase identifier | MD_HTTP_EXPIRES
Attributes | INHERIT
Default Value | d, 0x15180
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_FILE
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 6002

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/W3SVC/n/ROOT /LM/W3SVC/n/ROOT/virtual_directory_name | IIsWebVirtualDir
/LM/W3SVC/n | IIsWebServer
/LM/W3SVC | IIsWebService
/LM/W3SVC/n/ROOT/file_name /LM/W3SVC/n/ROOT/virtual_directory_name/file_name | IIsWebFile
/LM/W3SVC/n/ROOT/physical_directory_name /LM/W3SVC/n/virtual_directory_name/physical_directory_name | IIsWebDirectory

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


HttpPics

The HttpPics property specifies the World Wide Web Consortium (W3C) Platform for Internet Content Selection (PICS) rating header. For more information about PICS, see the World Wide Web Consortium Web site.

Attribute Name | Attribute Value
XML Data Type | MULTISZ
WMI Data Type | MULTISZ
ADSI Data Type | MULTISZ
ABO Data Type | MULTISZ
ABO Metabase identifier | MD_HTTP_PICS
Attributes | INHERIT
Default Value | null
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_FILE
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 6003

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/W3SVC/n/ROOT /LM/W3SVC/n/ROOT/virtual_directory_name | IIsWebVirtualDir
/LM/W3SVC/n | IIsWebServer
/LM/W3SVC | IIsWebService
/LM/W3SVC/n/ROOT/file_name /LM/W3SVC/n/ROOT/virtual_directory_name/file_name | IIsWebFile
/LM/W3SVC/n/ROOT/physical_directory_name /LM/W3SVC/n/virtual_directory_name/physical_directory_name | IIsWebDirectory

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


HttpRedirect

The HttpRedirect property specifies the directory or URL to which a client is redirected when attempting to access a specific resource. There are two general forms that the value for this property can take.

The simple format is Destination,Flag.

  • Where Destination can specify either a URL or a virtual path to a file.
  • Where Flag can have one of four values:
    • EXACT_DESTINATION indicates that the value provided for Destination should be considered an absolute target location.
    • CHILD_ONLY indicates that the value should be added to the beginning of the file name of the request to be redirected.
    • PERMANENT indicates that this redirection is permanent for this resource.
    • TEMPORARY indicates that this redirection is temporary for this resource.

The more complex form involves the use of wildcards. The format is *; Wildcard1; Destination1; Wildcard2; Destination2, Flag. Each Wildcard; Destination pair indicates that requests matching the wildcard are redirected to the specified destination. Flag can have the same values as the simple string format.

important Important Setting HttpRedirect at the site or service level has no affect.

Attribute Name | Attribute Value
XML Data Type | String
WMI Data Type | String
ADSI Data Type | String
ABO Data Type | String
ABO Metabase identifier | MD_HTTP_REDIRECT
Attributes | INHERIT
Default Value | null
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_FILE
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 6011

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/W3SVC/n/ROOT /LM/W3SVC/n/ROOT/virtual_directory_name | IIsWebVirtualDir
/LM/W3SVC/n/ROOT/file_name /LM/W3SVC/n/ROOT/virtual_directory_name/file_name | IIsWebFile
/LM/W3SVC/n/ROOT/physical_directory_name /LM/W3SVC/n/virtual_directory_name/physical_directory_name | IIsWebDirectory

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


IdleTimeout

The IdleTimeout property specifies how long (in minutes) a worker process should run idle if no new requests are received and the worker process is not processing requests. After the allotted time passes, the worker process should request to be shut down by the World Wide Web Publishing Service (WWW Service).

note Note If the value of this property is less than the value of PeriodicRestartTime, IIS sets both properties to their default values.

Attribute Name | Attribute Value
XML Data Type | DWORD
WMI Data Type | SINT32
ADSI Data Type | DWORD
ABO Data Type | DWORD
ABO Metabase identifier | MD_APPPOOL_IDLE_TIMEOUT
Attributes | INHERIT
Default Value | 20
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | 4294967
ID | 9005

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/W3SVC/AppPools/DefaultAppPool /LM/W3SVC/AppPools/DefaultAppPool/application_pool_name | IIsApplicationPool
/LM/W3SVC/AppPools | IIsApplicationPools

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


IIs5IsolationModeEnabled

The IIs5IsolationModeEnabled property specifies whether to run in IIS 5.0 isolation mode. Setting this property to true causes IIS to run in IIS 5.0 isolation mode. Setting this property to false causes IIS to run in worker process isolation mode.
Attribute Name | Attribute Value
XML Data Type | Boolean
WMI Data Type | Boolean
ADSI Data Type | Boolean
ABO Data Type | Boolean
ABO Metabase identifier | MD_GLOBAL_STANDARD_APP_MODE_ENABLED
Attributes | NO_ATTRIBUTES
Default Value | true
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 9203

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/W3SVC | IIsWebService

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


ImapClearTextProvider

The ImapClearTextProvider property is used by Microsoft Exchange.
Attribute Name | Attribute Value
XML Data Type | String
WMI Data Type | String
ADSI Data Type | String
ABO Data Type | String
ABO Metabase identifier | No friendly named is defined for this identifier in iiscfng.h. Search the systemroot\System32\Inetsrv\MBSchema.xml file for this property and use the integer from its ID attribute.
Attributes | INHERIT
Default Value | null
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 49375

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path IIS Admin Object Type

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


ImapDefaultDomain

The ImapDefaultDomain property is used by Microsoft Exchange.
Attribute Name | Attribute Value
XML Data Type | String
WMI Data Type | String
ADSI Data Type | String
ABO Data Type | String
ABO Metabase identifier | No friendly named is defined for this identifier in iiscfng.h. Search the systemroot\System32\Inetsrv\MBSchema.xml file for this property and use the integer from its ID attribute.
Attributes | INHERIT
Default Value | null
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 49368

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path IIS Admin Object Type

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


ImapDsAccount

The ImapDsAccount property is used by Microsoft Exchange.
Attribute Name | Attribute Value
XML Data Type | String
WMI Data Type | String
ADSI Data Type | String
ABO Data Type | String
ABO Metabase identifier | No friendly named is defined for this identifier in iiscfng.h. Search the systemroot\System32\Inetsrv\MBSchema.xml file for this property and use the integer from its ID attribute.
Attributes | INHERIT
Default Value | null
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 49383

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path IIS Admin Object Type

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


ImapDsBindType

The ImapDsBindType property is used by Microsoft Exchange.
Attribute Name | Attribute Value
XML Data Type | String
WMI Data Type | String
ADSI Data Type | String
ABO Data Type | String
ABO Metabase identifier | No friendly named is defined for this identifier in iiscfng.h. Search the systemroot\System32\Inetsrv\MBSchema.xml file for this property and use the integer from its ID attribute.
Attributes | INHERIT
Default Value | null
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 49379

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path IIS Admin Object Type

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


ImapDsDataDirectory

The ImapDsDataDirectory property is used by Microsoft Exchange.
Attribute Name | Attribute Value
XML Data Type | String
WMI Data Type | String
ADSI Data Type | String
ABO Data Type | String
ABO Metabase identifier | No friendly named is defined for this identifier in iiscfng.h. Search the systemroot\System32\Inetsrv\MBSchema.xml file for this property and use the integer from its ID attribute.
Attributes | INHERIT
Default Value | null
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 49377

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path IIS Admin Object Type

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


ImapDsDefaultMailRoot

The ImapDsDefaultMailRoot property is used by Microsoft Exchange.
Attribute Name | Attribute Value
XML Data Type | String
WMI Data Type | String
ADSI Data Type | String
ABO Data Type | String
ABO Metabase identifier | No friendly named is defined for this identifier in iiscfng.h. Search the systemroot\System32\Inetsrv\MBSchema.xml file for this property and use the integer from its ID attribute.
Attributes | INHERIT
Default Value | null
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 49378

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path IIS Admin Object Type

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


ImapDsHost

The ImapDsHost property is used by Microsoft Exchange.
Attribute Name | Attribute Value
XML Data Type | String
WMI Data Type | String
ADSI Data Type | String
ABO Data Type | String
ABO Metabase identifier | No friendly named is defined for this identifier in iiscfng.h. Search the systemroot\System32\Inetsrv\MBSchema.xml file for this property and use the integer from its ID attribute.
Attributes | INHERIT
Default Value | null
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 49381

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path IIS Admin Object Type

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


ImapDsNamingContext

The ImapDsNamingContext property is used by Microsoft Exchange.
Attribute Name | Attribute Value
XML Data Type | String
WMI Data Type | String
ADSI Data Type | String
ABO Data Type | String
ABO Metabase identifier | No friendly named is defined for this identifier in iiscfng.h. Search the systemroot\System32\Inetsrv\MBSchema.xml file for this property and use the integer from its ID attribute.
Attributes | INHERIT
Default Value | null
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 49382

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path IIS Admin Object Type

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


ImapDsPassword

The ImapDsPassword property is used by Microsoft Exchange.
Attribute Name | Attribute Value
XML Data Type | String
WMI Data Type | String
ADSI Data Type | String
ABO Data Type | String
ABO Metabase identifier | No friendly named is defined for this identifier in iiscfng.h. Search the systemroot\System32\Inetsrv\MBSchema.xml file for this property and use the integer from its ID attribute.
Attributes | INHERIT | SECURE
Default Value | null
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 49384

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path IIS Admin Object Type

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


ImapDsSchemaType

The ImapDsSchemaType property is used by Microsoft Exchange.
Attribute Name | Attribute Value
XML Data Type | String
WMI Data Type | String
ADSI Data Type | String
ABO Data Type | String
ABO Metabase identifier | No friendly named is defined for this identifier in iiscfng.h. Search the systemroot\System32\Inetsrv\MBSchema.xml file for this property and use the integer from its ID attribute.
Attributes | INHERIT
Default Value | null
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 49380

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path IIS Admin Object Type

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


ImapExpireDelay

The ImapExpireDelay property is used by Microsoft Exchange.
Attribute Name | Attribute Value
XML Data Type | DWORD
WMI Data Type | SINT32
ADSI Data Type | DWORD
ABO Data Type | DWORD
ABO Metabase identifier | No friendly named is defined for this identifier in iiscfng.h. Search the systemroot\System32\Inetsrv\MBSchema.xml file for this property and use the integer from its ID attribute.
Attributes | INHERIT
Default Value | 1440
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | 0
ID | 49370

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path IIS Admin Object Type

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


ImapExpireMail

The ImapExpireMail property is used by Microsoft Exchange.
Attribute Name | Attribute Value
XML Data Type | DWORD
WMI Data Type | SINT32
ADSI Data Type | DWORD
ABO Data Type | DWORD
ABO Metabase Identifier | No friendly named is defined for this identifier in iiscfng.h. Search the systemroot\System32\Inetsrv\MBSchema.xml file for this property and use the integer from its ID attribute.
Attributes | INHERIT
Default Value | 0
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | 0
ID | 49373

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path IIS Admin Object Type

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


ImapExpireStart

The ImapExpireStart property is used by Microsoft Exchange.
Attribute Name | Attribute Value
XML Data Type | DWORD
WMI Data Type | SINT32
ADSI Data Type | DWORD
ABO Data Type | DWORD
ABO Metabase Identifier | No friendly named is defined for this identifier in iiscfng.h. Search the systemroot\System32\Inetsrv\MBSchema.xml file for this property and use the integer from its ID attribute.
Attributes | INHERIT
Default Value | 0
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | 0
ID | 49371

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path IIS Admin Object Type

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


ImapMailExpirationTime

The ImapMailExpirationTime property is used by Microsoft Exchange.
Attribute Name | Attribute Value
XML Data Type | DWORD
WMI Data Type | SINT32
ADSI Data Type | DWORD
ABO Data Type | DWORD
ABO Metabase Identifier | No friendly named is defined for this identifier in iiscfng.h. Search the systemroot\System32\Inetsrv\MBSchema.xml file for this property and use the integer from its ID attribute.
Attributes | INHERIT
Default Value | 0
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | 0
ID | 49153

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path IIS Admin Object Type

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


ImapRoutingDll

The ImapRoutingDll property is used by Microsoft Exchange.
Attribute Name | Attribute Value
XML Data Type | String
WMI Data Type | String
ADSI Data Type | String
ABO Data Type | String
ABO Metabase Identifier | No friendly named is defined for this identifier in iiscfng.h. Search the systemroot\System32\Inetsrv\MBSchema.xml file for this property and use the integer from its ID attribute.
Attributes | INHERIT
Default Value | null
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 49369

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path IIS Admin Object Type

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


ImapRoutingSources

The ImapRoutingSources property is used by Microsoft Exchange.
Attribute Name | Attribute Value
XML Data Type | MULTISZ
WMI Data Type | MULTISZ
ADSI Data Type | MULTISZ
ABO Data Type | MULTISZ
ABO Metabase Identifier | No friendly named is defined for this identifier in iiscfng.h. Search the systemroot\System32\Inetsrv\MBSchema.xml file for this property and use the integer from its ID attribute.
Attributes | INHERIT
Default Value | null
MetaFlagsEx | CACHE_PROPERTY_CLEARED
User Type | iis_md_ut_wam
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 49366

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path IIS Admin Object Type

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


ImapRoutingTableType

The ImapRoutingTableType property is used by Microsoft Exchange.
Attribute Name | Attribute Value
XML Data Type | String
WMI Data Type | String
ADSI Data Type | String
ABO Data Type | String
ABO Metabase Identifier | No friendly named is defined for this identifier in iiscfng.h. Search the systemroot\System32\Inetsrv\MBSchema.xml file for this property and use the integer from its ID attribute.
Attributes | INHERIT
Default Value | ldap
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 49376

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path IIS Admin Object Type

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


ImapServiceVersion

The ImapServiceVersion property is used by Microsoft Exchange.
Attribute Name | Attribute Value
XML Data Type | DWORD
WMI Data Type | SINT32
ADSI Data Type | DWORD
ABO Data Type | DWORD
ABO Metabase Identifier | No friendly named is defined for this identifier in iiscfng.h. Search the systemroot\System32\Inetsrv\MBSchema.xml file for this property and use the integer from its ID attribute.
Attributes | INHERIT
Default Value | 0
MetaFlagsEx | CACHE_PROPERTY_CLEARED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | 0
ID | 49652

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path IIS Admin Object Type

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


InProcessIsapiApps

The InProcessIsapiApps property specifies a list of ISAPI filters and extensions that must be run in the Web server process. The string format is either Fullpath\Appname.dll, or just Appname.dll. ISAPI DLL entries without a qualifying path will match any ISAPI request that contains the DLL name, regardless of the physical path specified in the request.

For example, any of the following would be a valid list for this property: "D:\winnt\system32\inetsrv\ssinc.dll", "D:\winnt\system32\inetsrv\httpodbc.dll", "author.dll", "shtml.dll", "admin.dll".

note Note This property only indicates which ISAPI applications are required to run in the Web server process. The inclusion of an application in this list does not imply that the application is automatically run when starting up the server. There can be significant performance issues if too many applications are forced to run outside of the server process.

Attribute Name | Attribute Value
XML Data Type | MULTISZ
WMI Data Type | MULTISZ
ADSI Data Type | MULTISZ
ABO Data Type | MULTISZ
ABO Metabase Identifier | MD_IN_PROCESS_ISAPI_APPS
Attributes | INHERIT
Default Value | null
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 2073

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/W3SVC | IIsWebService

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.
Related Topics
AppIsolated


IPSecurity

The IPSecurity property specifies the IP access restrictions for a URL. This property can be used to assign or deny access to browsers, based on either their IP address or DNS host name.

note Note For a more detailed explanation for this object, see IIsIPSecurity (ADSI).

Attribute Name | Attribute Value
XML Data Type | IPSECLIST
WMI Data Type | IPSECLIST
ADSI Data Type | IPSECLIST
ABO Data Type | IPSECLIST
ABO Metabase Identifier | MD_IP_SEC
Attributes | inherit | reference
Default Value | null
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_FILE
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 6019

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/W3SVC/n/ROOT /LM/W3SVC/n/ROOT/virtual_directory_name | IIsWebVirtualDir
/LM/W3SVC/n | IIsWebServer
/LM/MSFTPSVC/n | IIsFtpServer
/LM/W3SVC | IIsWebService
/LM/MSFTPSVC | IIsFtpService
/LM/W3SVC/n/ROOT/file_name /LM/W3SVC/n/ROOT/virtual_directory_name/file_name | IIsWebFile
/LM/W3SVC/n/ROOT/physical_directory_name /LM/W3SVC/n/virtual_directory_name/physical_directory_name | IIsWebDirectory
/LM/MSFTPSVC/n/ROOT /LM/MSFTPSVC/n/ROOT/virtual_directory_name | IIsFtpVirtualDir
/LM/NNTPSVC | IIsNntpService
/LM/NNTPSVC/n | IIsNntpServer
/LM/SMTPSVC | IIsSmtpService
/LM/SMTPSVC/n | IIsSmtpServer

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


KeyType

The KeyType property specifies the type of metabase key and the IIS Admin Object that relates to that key. The KeyType property specifies the class of the object associated with the key, such as IIsWebServer or IIsWebVirtualDir. The KeyType determines the set of properties accessible at the key.

note Note The KeyType property is accessible by all IIS Admin Objects. The value is the name of the IIS Admin Object accessed, and is the same as the ADSI Class property.

Attribute Name | Attribute Value
XML Data Type | String
WMI Data Type | String
ADSI Data Type | String
ABO Data Type | String
ABO Metabase Identifier | MD_KEY_TYPE
Attributes | NO_ATTRIBUTES
Default Value | null
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 1002

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/W3SVC/n/ROOT /LM/W3SVC/n/ROOT/virtual_directory_name | IIsWebVirtualDir
/LM/W3SVC/n | IIsWebServer
/LM/MSFTPSVC/n | IIsFtpServer
/LM | IIsComputer
/LM/W3SVC | IIsWebService
/LM/MSFTPSVC | IIsFtpService
/LM/W3SVC/n/ROOT/file_name /LM/W3SVC/n/ROOT/virtual_directory_name/file_name | IIsWebFile
/LM/W3SVC/n/ROOT/physical_directory_name /LM/W3SVC/n/virtual_directory_name/physical_directory_name | IIsWebDirectory
/LM/MSFTPSVC/n/ROOT /LM/MSFTPSVC/n/ROOT/virtual_directory_name | IIsFtpVirtualDir
/LM/W3SVC/Filters/filter_name /LM/W3SVC/n/Filters/filter_name | IIsFilter
/LM/W3SVC/Filters /LM/W3SVC/n/Filters | IIsFilters
/LM/W3SVC/Filters/Compression/gzip /LM/W3SVC/Filters/Compression/deflate | IIsCompressionScheme
/LM/W3SVC/Filters/Compression/Parameters | IIsCompressionSchemes
/LM/W3SVC/n/IIsCertMapper | IIsCertMapper
/LM/MimeMap | IIsMimeMap
/LM/logging | IIsLogModules
/LM/logging/Microsoft IIS Log File Format /LM/logging/NCSA Common Log File Format /LM/logging/ODBC Logging /LM/logging/W3C Extended Log File Format | IIsLogModule
/LM/logging/Custom Logging /LM/logging/Custom Logging/Date /LM/logging/Custom Logging/Time /LM/logging/Custom Logging/Extended Properties /LM/logging/Custom Logging/Extended Properties/extended_property_name | IIsCustomLogModule
/LM/W3SVC/Info | IIsWebInfo
/LM/MSFTPSVC/Info | IIsFtpInfo
/LM/NNTPSVC | IIsNntpService
/LM/NNTPSVC/n | IIsNntpServer
/LM/NNTPSVC/n/ROOT /LM/NNTPSVC/n/ROOT/virtual_directory_name | IIsNntpVirtualDir
/LM/NNTPSVC/Info | IIsNntpInfo
/LM/SMTPSVC | IIsSmtpService
/LM/SMTPSVC/n | IIsSmtpServer
/LM/SMTPSVC/n/ROOT /LM/SMTPSVC/n/ROOT/virtual_directory_name | IIsSmtpVirtualDir
/LM/SMTPSVC/n/Domain | IIsSmtpDomain
/LM/SMTPSVC/n/RoutingSources | IIsSmtpRoutingSource
/LM/SMTPSVC/Info | IIsSmtpInfo
/LM/NNTPSVC/n/Rebuild | IIsNntpRebuild
/LM/NNTPSVC/n/Sessions | IIsNntpSessions
/LM/NNTPSVC/n/Feeds | IIsNntpFeeds
/LM/NNTPSVC/n/Feeds/feed n | IIsNntpFeed
/LM/NNTPSVC/n/Expires | IIsNntpExpiration
/LM/NNTPSVC/n/Expires/expire n | IIsNntpExpire
/LM/NNTPSVC/n/Groups | IIsNntpGroups
/LM/SMTPSVC/n/Sessions | IIsSmtpSessions
/ | IIS_ROOT
. | IIS_Global
/LM/SMTPSVC/n/Alias | IIsSmtpAlias
/LM/SMTPSVC/n/DL | IIsSmtpDL
/LM/SMTPSVC/n/User | IIsSmtpUser
/LM/W3SVC/AppPools/DefaultAppPool /LM/W3SVC/AppPools/DefaultAppPool/application_pool_name | IIsApplicationPool
/LM/W3SVC/AppPools | IIsApplicationPools

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


LimitRemoteConnections

The LimitRemoteConnections property specifies the maximum number of inbound remote connections allowed at one time for a given virtual server.
Attribute Name | Attribute Value
XML Data Type | Boolean
WMI Data Type | Boolean
ADSI Data Type | Boolean
ABO Data Type | Boolean
ABO Metabase Identifier | No friendly named is defined for this identifier in iiscfng.h. Search the systemroot\System32\Inetsrv\MBSchema.xml file for this property and use the integer from its ID attribute.
Attributes | INHERIT
Default Value | false
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | 0
ID | 36926

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/SMTPSVC | IIsSmtpService
/LM/SMTPSVC/n | IIsSmtpServer

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


ListFile

The ListFile property contains the path to the listfile.hsh file.
Attribute Name | Attribute Value
XML Data Type | String
WMI Data Type | String
ADSI Data Type | String
ABO Data Type | String
ABO Metabase Identifier | No friendly named is defined for this identifier in iiscfng.h. Search the systemroot\System32\Inetsrv\MBSchema.xml file for this property and use the integer from its ID attribute.
Attributes | INHERIT
Default Value | null
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 45172

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/NNTPSVC/n | IIsNntpServer

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


LoadBalancerCapabilities

The LoadBalancerCapabilities property specifies behavior when a service is unavailable. A setting of 1 terminates the connection. A setting of 2 sends error code 503.
Attribute Name | Attribute Value
XML Data Type | DWORD
WMI Data Type | SINT32
ADSI Data Type | DWORD
ABO Data Type | DWORD
ABO Metabase Identifier | MD_LOAD_BALANCER_CAPABILITIES
Attributes | INHERIT
Default Value | 2
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | 2
ID | 9034

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/W3SVC/AppPools/DefaultAppPool /LM/W3SVC/AppPools/DefaultAppPool/application_pool_name | IIsApplicationPool
/LM/W3SVC/AppPools | IIsApplicationPools

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


LocalDomains

The LocalDomains property is used by Microsoft Exchange.
Attribute Name | Attribute Value
XML Data Type | MULTISZ
WMI Data Type | MULTISZ
ADSI Data Type | MULTISZ
ABO Data Type | MULTISZ
ABO Metabase Identifier | No friendly named is defined for this identifier in iiscfng.h. Search the systemroot\System32\Inetsrv\MBSchema.xml file for this property and use the integer from its ID attribute.
Attributes | INHERIT
Default Value | null
MetaFlagsEx | Not applicable
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 36919

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/SMTPSVC | IIsSmtpService
/LM/SMTPSVC/n | IIsSmtpServer

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


LocalRetryAttempts

The LocalRetryAttempts property is used by Microsoft Exchange.
Attribute Name | Attribute Value
XML Data Type | DWORD
WMI Data Type | SINT32
ADSI Data Type | DWORD
ABO Data Type | DWORD
ABO Metabase Identifier | MD_LOCAL_RETRY_ATTEMPTS
Attributes | INHERIT
Default Value | 48
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | 0
ID | 36896

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/SMTPSVC | IIsSmtpService
/LM/SMTPSVC/n | IIsSmtpServer

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


LocalRetryInterval

The LocalRetryInterval property specifies the number of minutes between retries for local delivery.
Attribute Name | Attribute Value
XML Data Type | DWORD
WMI Data Type | SINT32
ADSI Data Type | DWORD
ABO Data Type | DWORD
ABO Metabase Identifier | MD_LOCAL_RETRY_MINUTES
Attributes | INHERIT
Default Value | 60
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | 0
ID | 36897

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/SMTPSVC | IIsSmtpService
/LM/SMTPSVC/n | IIsSmtpServer

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


LogAnonymous

The LogAnonymous property specifies whether anonymous requests are logged to the event log.

Attribute Name | Attribute Value
XML Data Type | Boolean
WMI Data Type | Boolean
ADSI Data Type | Boolean
ABO Data Type | Boolean
ABO Metabase Identifier | MD_LOG_ANONYMOUS
Attributes | INHERIT
Default Value | false
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | 0
ID | 5007

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/MSFTPSVC/n | IIsFtpServer
/LM/MSFTPSVC | IIsFtpService

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


LogCustomPropertyDataType

The LogCustomPropertyDataType property contains bitmask values that indicate the data type of a custom logging field. The bitmask values are listed in the Bitmask Values section.

For more information about custom logging fields, see "Setting Metabase Properties for Logging" in the Platform SDK.

Attribute Name | Attribute Value
XML Data Type | DWORD
WMI Data Type | SINT32
ADSI Data Type | DWORD
ABO Data Type | DWORD
ABO Metabase Identifier | MD_LOGCUSTOM_SERVICES_string
Attributes | INHERIT
Default Value | 0
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | 0
ID | 4505

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/logging/Custom Logging /LM/logging/Custom Logging/Date /LM/logging/Custom Logging/Time /LM/logging/Custom Logging/Extended Properties /LM/logging/Custom Logging/Extended Properties/extended_property_name | IIsCustomLogModule

Values

Constant | Value | Description
MD_LOGCUSTOM_DATATYPE_INT | 0x00000000 | Datatype is int.
MD_LOGCUSTOM_DATATYPE_UINT | 0x00000001 | Datatype is unsigned int.
MD_LOGCUSTOM_DATATYPE_LONG | 0X00000002 | Datatype is long.
MD_LOGCUSTOM_DATATYPE_ULONG | 0X00000003 | Datatype is unsigned long.
MD_LOGCUSTOM_DATATYPE_FLOAT | 0X00000004 | Datatype is float.
MD_LOGCUSTOM_DATATYPE_DOUBLE | 0X00000005 | Datatype is double.
MD_LOGCUSTOM_DATATYPE_LPSTR | 0X00000006 | Datatype is long pointer to string array.
MD_LOGCUSTOM_DATATYPE_LPWSTR | 0X00000007 | Datatype is lpwstr.

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


LogCustomPropertyHeader

The LogCustomPropertyHeader property indicates which header string will be written to the log file for the custom logging field.

For more information about custom logging fields, see "Setting Metabase Properties for Logging" in the Platform SDK.

Attribute Name | Attribute Value
XML Data Type | String
WMI Data Type | String
ADSI Data Type | String
ABO Data Type | String
ABO Metabase Identifier | MD_LOGCUSTOM_PROPERTY_HEADER
Attributes | INHERIT
Default Value | null
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 4502

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/logging/Custom Logging /LM/logging/Custom Logging/Date /LM/logging/Custom Logging/Time /LM/logging/Custom Logging/Extended Properties /LM/logging/Custom Logging/Extended Properties/extended_property_name | IIsCustomLogModule

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


LogCustomPropertyID

The LogCustomPropertyID property specifies the ABO Metabase identifier of the metabase property that determines if logging is enabled or disabled for the logging field in question. Consult the metabase property reference page, to obtain the ABO Metabase identifier for a particular property.

For instance, the ABO Metabase identifier for LogExtFileFlags is MD_LOGEXT_FIELD_MASK, and the ID number is 4013.

When a logging module is called to log custom information fields, the logging module accesses the property specified by LogCustomPropertyID, and checks the individual flag bits, specified by LogCustomPropertyMask, to determine if that particular field is currently enabled or disabled.

For more information about custom logging fields, see "Setting Metabase Properties for Logging" in the Platform SDK.

Attribute Name | Attribute Value
XML Data Type | DWORD
WMI Data Type | SINT32
ADSI Data Type | DWORD
ABO Data Type | DWORD
ABO Metabase Identifier | MD_LOGCUSTOM_PROPERTY_ID
Attributes | INHERIT
Default Value | 0
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | 0
ID | 4503

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/logging/Custom Logging /LM/logging/Custom Logging/Date /LM/logging/Custom Logging/Time /LM/logging/Custom Logging/Extended Properties /LM/logging/Custom Logging/Extended Properties/extended_property_name | IIsCustomLogModule

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


LogCustomPropertyMask

The LogCustomPropertyMask property specifies the bitmask that can be used against the metabase property, specified by LogCustomPropertyID, to determine whether the particular logging field is currently enabled or disabled.

When a logging module logs custom information fields, the logging module accesses the property specified by LogCustomPropertyID, and checks the individual flag bits, specified by LogCustomPropertyMask, to determine if that particular field is currently enabled or disabled.

For more information about custom logging fields, see "Setting Metabase Properties for Logging" in the Platform SDK.

Attribute Name | Attribute Value
XML Data Type | DWORD
WMI Data Type | SINT32
ADSI Data Type | DWORD
ABO Data Type | DWORD
ABO Metabase Identifier | MD_LOGCUSTOM_PROPERTY_MASK
Attributes | INHERIT
Default Value | 0
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | 0
ID | 4504

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/logging/Custom Logging /LM/logging/Custom Logging/Date /LM/logging/Custom Logging/Time /LM/logging/Custom Logging/Extended Properties /LM/logging/Custom Logging/Extended Properties/extended_property_name | IIsCustomLogModule

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


LogCustomPropertyName

The LogCustomPropertyName property specifies the name of the custom logging information field. Typically, this name is the same as the name used in the logging module user interface.

For more information about custom logging fields, see "Setting Metabase Properties for Logging" in the Platform SDK.

Attribute Name | Attribute Value
XML Data Type | String
WMI Data Type | String
ADSI Data Type | String
ABO Data Type | String
ABO Metabase Identifier | MD_LOGCUSTOM_PROPERTY_NAME
Attributes | INHERIT
Default Value | null
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 4501

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/logging/Custom Logging /LM/logging/Custom Logging/Date /LM/logging/Custom Logging/Time /LM/logging/Custom Logging/Extended Properties /LM/logging/Custom Logging/Extended Properties/extended_property_name | IIsCustomLogModule

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


LogCustomPropertyNodeID

The LogCustomPropertyNodeID property contains the numeric ID of the logging information field for identification purposes. Each field has a corresponding flag in the LogExtFileFlags property which should be set if you want the information logged.

Information Field | Numeric ID of the Field
Bytes Received | 17
Bytes Send | 16
Client IP Address | 5
Cookie | 22
Date | 1
Extended Properties | 3
Host | 20
Method | 11
Protocol Status | 14
Protocol Version | 19
Referer | 23
Server IP Address | 9
Server Name | 8
Server Port | 10
Service Name | 7
Time | 2
Time Taken | 18
URI Query | 13
URI Stem | 12
User Agent | 21
User Name | 6
Win32® Status | 15
Attribute Name | Attribute Value
XML Data Type | DWORD
WMI Data Type | SINT32
ADSI Data Type | DWORD
ABO Data Type | DWORD
ABO Metabase Identifier | MD_NOTIFY_ORDER_MASK
Attributes | INHERIT
Default Value | 0
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | 0
ID | 4508

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/logging/Custom Logging /LM/logging/Custom Logging/Date /LM/logging/Custom Logging/Time /LM/logging/Custom Logging/Extended Properties /LM/logging/Custom Logging/Extended Properties/extended_property_name | IIsCustomLogModule

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


LogCustomPropertyServicesString

The LogCustomPropertyServicesstring property specifies to which services the custom logging fields apply.

For more information about custom logging fields, see "Setting Metabase Properties for Logging" in the Platform SDK.

Attribute Name | Attribute Value
XML Data Type | MULTISZ
WMI Data Type | MULTISZ
ADSI Data Type | MULTISZ
ABO Data Type | MULTISZ
ABO Metabase Identifier | MD_LOGCUSTOM_SERVICES_string
Attributes | INHERIT
Default Value | w3svc msftpsvc smtpsvc nntpsvc
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 4506

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/logging/Custom Logging /LM/logging/Custom Logging/Date /LM/logging/Custom Logging/Time /LM/logging/Custom Logging/Extended Properties /LM/logging/Custom Logging/Extended Properties/extended_property_name | IIsCustomLogModule

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


LogEventOnRecycle

The LogEventOnRecycle property specifies that IIS should log an event when an application pool is recycled. Application pools recycle for a variety of reasons. In order for IIS to log the event, the LogEventOnRecycle property must have a bit set corresponding to the reason for the recycle.
Attribute Name | Attribute Value
XML Data Type | DWORD
WMI Data Type | SINT32
ADSI Data Type | DWORD
ABO Data Type | DWORD
ABO Metabase Identifier | MD_APP_POOL_LOG_EVENT_ON_RECYCLE
Attributes | INHERIT
Default Value | APPPOOLRECYCLEMEMORY
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 9037

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/W3SVC/AppPools/DefaultAppPool /LM/W3SVC/AppPools/DefaultAppPool/application_pool_name | IIsApplicationPool
/LM/W3SVC/AppPools | IIsApplicationPools

Flags

Flag Name | AppPoolRecycleTime
Description

important Important This feature of IIS 6.0 is available only when IIS is running in worker process isolation mode. For more information, see Recycling Worker Processes.

Setting this flag to true schedules the worker process to be recycled after a specified number of minutes.
Metabase Bitmask Identifier | MD_APP_POOL_RECYCLE_TIME
Decimal Value | 1
Hex Value | 0x00000001
Flag Name | AppPoolRecycleRequests
Description

important Important This feature of IIS 6.0 is available only when IIS is running in worker process isolation mode. For more information, see Recycling Worker Processes.

Setting this flag to true schedules the worker process to be recycled after a specified number of requests.
Metabase Bitmask Identifier | MD_APP_POOL_RECYCLE_REQUESTS
Decimal Value | 2
Hex Value | 0x00000002
Flag Name | AppPoolRecycleSchedule
Description | important Important This feature of IIS 6.0 is available only when IIS is running in worker process isolation mode. For more information, see Recycling Worker Processes. Setting this flag to true schedules the worker process to be recycled at specified times.
Metabase Bitmask Identifier | MD_APP_POOL_RECYCLE_SCHEDULE
Decimal Value | 4
Hex Value | 0x00000004
Flag Name | AppPoolRecycleMemory
Description

important Important This feature of IIS 6.0 is available only when IIS is running in worker process isolation mode. For more information, see Recycling Worker Processes.

Setting this flag to true schedules the worker process to be recycled once a specified amount of used or virtual memory memory is in use (in megabytes).
Metabase Bitmask Identifier | MD_APP_POOL_RECYCLE_MEMORY
Decimal Value | 8
Hex Value | 0x00000008
Flag Name | AppPoolRecycleIsapiUnhealthy
Description

important Important This feature of IIS 6.0 is available only when IIS is running in worker process isolation mode. For more information, see Recycling Worker Processes.

Setting this flag to true schedules the worker process to be recycled if IIS finds that an ISAPI is unhealthy.
Metabase Bitmask Identifier | MD_APP_POOL_RECYCLE_ISAPI_UNHEALTHY
Decimal Value | 16
Hex Value | 0x00000010
Flag Name | AppPoolRecycleOnDemand
Description | important Important This feature of IIS 6.0 is available only when IIS is running in worker process isolation mode. For more information, see Recycling Worker Processes. Setting this flag to true schedules the worker process to be recycled on demand by an administrator.
Metabase Bitmask Identifier | MD_APP_POOL_RECYCLE_ON_DEMAND
Decimal Value | 32
Hex Value | 0x00000020
Flag Name | AppPoolRecycleConfigChange
Description

important Important This feature of IIS 6.0 is available only when IIS is running in worker process isolation mode. For more information, see Recycling Worker Processes.

Setting this flag to true schedules the worker process to be recycled after configuration changes are made.
Metabase Bitmask Identifier | MD_APP_POOL_RECYCLE_CONFIG_CHANGE
Decimal Value | 64
Hex Value | 0x00000040
Flag Name | AppPoolRecyclePrivateMemory
Description | important Important This feature of IIS 6.0 is available only when IIS is running in worker process isolation mode. For more information, see Recycling Worker Processes.
Metabase Bitmask Identifier | MD_APP_POOL_RECYCLE_PRIVATE_MEMORY
Decimal Value | 128
Hex Value | 0x00000080

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


LogExtFileFlags

The LogExtFileFlags property contains flags that determine which categories of information are written to either the log file or ODBC data source during logging events. The flags are described in the Flags section.

Attribute Name | Attribute Value
XML Data Type | DWORD
WMI Data Type | SINT32
ADSI Data Type | DWORD
ABO Data Type | DWORD
ABO Metabase Identifier | MD_LOGEXT_FIELD_MASK
Attributes | INHERIT
Default Value | logextfiletime | logextfileclientip | logextfilemethod | logextfileuristem | logextfilehttpstatus
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | 0
ID | 4013

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/W3SVC/n | IIsWebServer
/LM/MSFTPSVC/n | IIsFtpServer
/LM/W3SVC | IIsWebService
/LM/MSFTPSVC | IIsFtpService
/LM/NNTPSVC | IIsNntpService
/LM/NNTPSVC/n | IIsNntpServer
/LM/SMTPSVC | IIsSmtpService
/LM/SMTPSVC/n | IIsSmtpServer

Flags

Flag Name | LogExtFileDate
Description | Log the date.
Metabase Bitmask Identifier | MD_EXTLOG_DATE
Decimal Value | 1
Hex Value | 0x00000001
Flag Name | LogExtFileHost
Description | Log the name of host server.
Metabase Bitmask Identifier | MD_EXTLOG_HOST
Decimal Value | 1048576
Hex Value | 0x00100000
Flag Name | LogExtFileTime
Description | Log the time.
Metabase Bitmask Identifier | MD_EXTLOG_TIME
Decimal Value | 2
Hex Value | 0x00000002
Flag Name | LogExtFileClientIp
Description | Log the client IP address.
Metabase Bitmask Identifier | MD_EXTLOG_CLIENT_IP
Decimal Value | 4
Hex Value | 0x00000004
Flag Name | LogExtFileUserName
Description | Log the user name.
Metabase Bitmask Identifier | MD_EXTLOG_USERNAME
Decimal Value | 8
Hex Value | 0x00000008
Flag Name | LogExtFileSiteName
Description | Log the site name.
Metabase Bitmask Identifier | MD_EXTLOG_SITE_NAME
Decimal Value | 16
Hex Value | 0x00000010
Flag Name | LogExtFileComputerName
Description | Log the local computer name.
Metabase Bitmask Identifier | MD_EXTLOG_COMPUTER_NAME
Decimal Value | 32
Hex Value | 0x00000020
Flag Name | LogExtFileServerIp
Description | Log the server's own IP address.
Metabase Bitmask Identifier | MD_EXTLOG_SERVER_IP
Decimal Value | 64
Hex Value | 0x00000040
Flag Name | LogExtFileMethod
Description | Log the protocol method.
Metabase Bitmask Identifier | MD_EXTLOG_METHOD
Decimal Value | 128
Hex Value | 0x00000080
Flag Name | LogExtFileUriStem
Description | Log the Universal Resource Identifier (URI) stem information. The URI stem usually consists of the actual resource being requested.
Metabase Bitmask Identifier | MD_EXTLOG_URI_STEM
Decimal Value | 256
Hex Value | 0x00000100
Flag Name | LogExtFileUriQuery
Description | Log the Universal Resource Identifier (URI) query information. The URI query usually consists of parameters passed to the URL by using the URL?Parameters format.
Metabase Bitmask Identifier | MD_EXTLOG_URI_QUERY
Decimal Value | 512
Hex Value | 0x00000200
Flag Name | LogExtFileHttpStatus
Description | Log the HTTP status.
Metabase Bitmask Identifier | MD_EXTLOG_HTTP_STATUS
Decimal Value | 1024
Hex Value | 0x00000400
Flag Name | LogExtFileWin32Status
Description | Log the current Microsoft® Win32® error status.
Metabase Bitmask Identifier | MD_EXTLOG_WIN32_STATUS
Decimal Value | 2048
Hex Value | 0x00000800
Flag Name | LogExtFileBytesSent
Description | Log the total bytes sent.
Metabase Bitmask Identifier | MD_EXTLOG_BYTES_SENT
Decimal Value | 4096
Hex Value | 0x00001000
Flag Name | LogExtFileBytesRecv
Description | Log the total bytes received.
Metabase Bitmask Identifier | MD_EXTLOG_BYTES_RECV
Decimal Value | 8192
Hex Value | 0x00002000
Flag Name | LogExtFileTimeTaken
Description | Log the total time taken for a request to be completed.
Metabase Bitmask Identifier | MD_EXTLOG_TIME_TAKEN
Decimal Value | 16384
Hex Value | 0x00004000
Flag Name | LogExtFileServerPort
Description | Log the active server port.
Metabase Bitmask Identifier | MD_EXTLOG_SERVER_PORT
Decimal Value | 32768
Hex Value | 0x00008000
Flag Name | LogExtFileUserAgent
Description | Log the contents of the user agent field sent by the client.
Metabase Bitmask Identifier | MD_EXTLOG_USER_AGENT
Decimal Value | 65536
Hex Value | 0x00010000
Flag Name | LogExtFileCookie
Description | Log information from the client cookie.
Metabase Bitmask Identifier | MD_EXTLOG_COOKIE
Decimal Value | 131072
Hex Value | 0x00020000
Flag Name | LogExtFileReferer
Description | Log the referrer field sent by the client.
Metabase Bitmask Identifier | MD_EXTLOG_REFERER
Decimal Value | 262144
Hex Value | 0x00040000
Flag Name | LogExtFileProtocolVersion
Description | Log the client server protocol version.
Metabase Bitmask Identifier | MD_EXTLOG_PROTOCOL_VERSION
Decimal Value | 524288
Hex Value | 0x00080000
Flag Name | LogExtFileHttpSubStatus
Description | Log the sub-status code of the HTTP error. For example, for the 500.20 HTTP error, the status code is 500 and the sub-status code is 20.
Metabase Bitmask Identifier | na
Decimal Value | 2097152
Hex Value | na

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


LogFileDirectory

The LogFileDirectory property specifies the default logging directory, where the log file and logging-related support files are stored.

important Important The specified log-file directory must be on the local computer.

Attribute Name | Attribute Value
XML Data Type | EXPANDSZ
WMI Data Type | String
ADSI Data Type | EXPANDSZ
ABO Data Type | EXPANDSZ
ABO Metabase Identifier | MD_LOGFILE_DIRECTORY
Attributes | INHERIT
Default Value | %windir%\system32\logfiles
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 4001

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/W3SVC/n | IIsWebServer
/LM/MSFTPSVC/n | IIsFtpServer
/LM/W3SVC | IIsWebService
/LM/MSFTPSVC | IIsFtpService
/LM/NNTPSVC | IIsNntpService
/LM/NNTPSVC/n | IIsNntpServer
/LM/SMTPSVC | IIsSmtpService
/LM/SMTPSVC/n | IIsSmtpServer

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


LogFileLocaltimeRollover

The LogFileLocaltimeRollover property specifies IIS log file rollover behavior for W3C Extended logging. If the property is set to false, the default rollover behavior will be in effect, meaning a new log file will be created based on Coordinated Universal Time (UTC), not local time. If this property is set to true, a new log file will be created based on local time, not UTC. UTC was formerly called Greenwich Mean Time, or GMT.

note Note Regardless of the setting, the time stamp for each W3C Extended Logging log record is UTC-based.

Attribute Name | Attribute Value
XML Data Type | Boolean
WMI Data Type | Boolean
ADSI Data Type | Boolean
ABO Data Type | Boolean
ABO Metabase Identifier | MD_DEFAULT_EXTLOG_FIELDS
Attributes | INHERIT
Default Value | false
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 4015

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/W3SVC/n | IIsWebServer
/LM/MSFTPSVC/n | IIsFtpServer
/LM/W3SVC | IIsWebService
/LM/MSFTPSVC | IIsFtpService

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


LogFilePeriod

The LogFilePeriod property specifies how often IIS creates a new log file. This property can be set to the following values as seen in the Bitmask Values section: 1 (daily), 2 (weekly), 3 (monthly), or 4 (hourly). If this property is set to 0, a new file will be created when the maximum size designated in LogFileTruncateSize is reached.

Attribute Name | Attribute Value
XML Data Type | DWORD
WMI Data Type | SINT32
ADSI Data Type | DWORD
ABO Data Type | DWORD
ABO Metabase Identifier | MD_LOGFILE_PERIOD
Attributes | INHERIT
Default Value | 1
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | 4
ID | 4003

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/W3SVC/n | IIsWebServer
/LM/MSFTPSVC/n | IIsFtpServer
/LM/W3SVC | IIsWebService
/LM/MSFTPSVC | IIsFtpService
/LM/NNTPSVC | IIsNntpService
/LM/NNTPSVC/n | IIsNntpServer
/LM/SMTPSVC | IIsSmtpService
/LM/SMTPSVC/n | IIsSmtpServer

Values

Constant | Value | Description
MD_LOGFILE_PERIOD_MAXSIZE | 0x00000000 | Create new log file after reaching the maximum size.
MD_LOGFILE_PERIOD_DAILY | 0x00000001 | Create new log file daily.
MD_LOGFILE_PERIOD_WEEKLY | 0x00000002 | Create new log file weekly.
MD_LOGFILE_PERIOD_MONTHLY | 0x00000003 | Create new log file monthly.
MD_LOGFILE_PERIOD_HOURLY | 0X00000004 | Create a new log file hourly.

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.
Related Topics
LogFileTruncateSize


LogFileTruncateSize

The LogFileTruncateSize property specifies the maximum size of the log file (in bytes). A new log file is created if a logging event causes the original log file to exceed the size specified in this property.

note Note The minimum file size allowed is 131,072 bytes. If this property is set to a value less than 131,072 bytes, the default value is implicitly assumed as 131,072 bytes.

Attribute Name | Attribute Value
XML Data Type | DWORD
WMI Data Type | SINT32
ADSI Data Type | DWORD
ABO Data Type | DWORD
ABO Metabase Identifier | MD_LOGFILE_TRUNCATE_SIZE
Attributes | INHERIT
Default Value | 2000000
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 4004

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/W3SVC/n | IIsWebServer
/LM/MSFTPSVC/n | IIsFtpServer
/LM/W3SVC | IIsWebService
/LM/MSFTPSVC | IIsFtpService
/LM/NNTPSVC | IIsNntpService
/LM/NNTPSVC/n | IIsNntpServer
/LM/SMTPSVC | IIsSmtpService
/LM/SMTPSVC/n | IIsSmtpServer

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


LogModuleId

The LogModuleId property specifies the CLSID for the logging module.

Attribute Name | Attribute Value
XML Data Type | String
WMI Data Type | String
ADSI Data Type | String
ABO Data Type | String
ABO Metabase Identifier | MD_LOG_PLUGIN_MOD_ID
Attributes | INHERIT
Default Value | null
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 4005

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/logging/Microsoft IIS Log File Format /LM/logging/NCSA Common Log File Format /LM/logging/ODBC Logging /LM/logging/W3C Extended Log File Format | IIsLogModule

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.
Related Topics
LogModuleUiId


LogModuleList

The LogModuleList property specifies a string that contains a comma-delimited list that names the available logging modules.

Attribute Name | Attribute Value
XML Data Type | String
WMI Data Type | String
ADSI Data Type | String
ABO Data Type | String
ABO Metabase Identifier | MD_LOG_PLUGINS_AVAILABLE
Attributes | INHERIT
Default Value | NCSA common log file format, IIS log file format, W3C extended log file format
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 4012

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/W3SVC | IIsWebService
/LM/MSFTPSVC | IIsFtpService
/LM/W3SVC/Info | IIsWebInfo
/LM/MSFTPSVC/Info | IIsFtpInfo
/LM/NNTPSVC | IIsNntpService
/LM/NNTPSVC/Info | IIsNntpInfo
/LM/SMTPSVC | IIsSmtpService
/LM/SMTPSVC/Info | IIsSmtpInfo

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


LogModuleUiId

The LogModuleUiId property specifies the CLSID for the logging module's user interface.

Attribute Name | Attribute Value
XML Data Type | String
WMI Data Type | String
ADSI Data Type | String
ABO Data Type | String
ABO Metabase Identifier | MD_LOG_PLUGIN_UI_ID
Attributes | INHERIT
Default Value | null
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 4006

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/logging/Microsoft IIS Log File Format /LM/logging/NCSA Common Log File Format /LM/logging/ODBC Logging /LM/logging/W3C Extended Log File Format | IIsLogModule

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.
Related Topics
LogModuleId


LogNonAnonymous

The LogNonAnonymous property specifies whether non-anonymous hits are logged to the event log.

Attribute Name | Attribute Value
XML Data Type | Boolean
WMI Data Type | Boolean
ADSI Data Type | Boolean
ABO Data Type | Boolean
ABO Metabase Identifier | MD_LOG_NONANONYMOUS
Attributes | INHERIT
Default Value | false
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | 0
ID | 5008

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/MSFTPSVC/n | IIsFtpServer
/LM/MSFTPSVC | IIsFtpService

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


LogOdbcDataSource

The LogOdbcDataSource property specifies the name of the ODBC data source to which Microsoft Windows writes data during logging events.

important Important The logging module's CLSID determines whether Microsoft Windows logs to an ODBC data source or to the file system.

Attribute Name | Attribute Value
XML Data Type | String
WMI Data Type | String
ADSI Data Type | String
ABO Data Type | String
ABO Metabase Identifier | MD_LOGSQL_DATA_SOURCES
Attributes | INHERIT
Default Value | httplog
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 4007

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/W3SVC/n | IIsWebServer
/LM/MSFTPSVC/n | IIsFtpServer
/LM/W3SVC | IIsWebService
/LM/MSFTPSVC | IIsFtpService
/LM/NNTPSVC | IIsNntpService
/LM/NNTPSVC/n | IIsNntpServer
/LM/SMTPSVC | IIsSmtpService
/LM/SMTPSVC/n | IIsSmtpServer

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


LogOdbcPassword

The LogOdbcPassword property specifies the ODBC database password to be used when writing information to the database during logging events.

Attribute Name | Attribute Value
XML Data Type | String
WMI Data Type | String
ADSI Data Type | String
ABO Data Type | String
ABO Metabase Identifier | MD_LOGSQL_PASSWORD
Attributes | INHERIT | SECURE
Default Value | null
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 4010

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/W3SVC/n | IIsWebServer
/LM/MSFTPSVC/n | IIsFtpServer
/LM/W3SVC | IIsWebService
/LM/MSFTPSVC | IIsFtpService
/LM/NNTPSVC | IIsNntpService
/LM/NNTPSVC/n | IIsNntpServer
/LM/SMTPSVC | IIsSmtpService
/LM/SMTPSVC/n | IIsSmtpServer

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


LogOdbcTableName

The LogOdbcTableName property specifies the name of the ODBC database table to which Microsoft Windows writes information during logging events.

Attribute Name | Attribute Value
XML Data Type | String
WMI Data Type | String
ADSI Data Type | String
ABO Data Type | String
ABO Metabase Identifier | MD_LOGSQL_TABLE_NAME
Attributes | INHERIT
Default Value | internetlog
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 4008

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/W3SVC/n | IIsWebServer
/LM/MSFTPSVC/n | IIsFtpServer
/LM/W3SVC | IIsWebService
/LM/MSFTPSVC | IIsFtpService
/LM/NNTPSVC | IIsNntpService
/LM/NNTPSVC/n | IIsNntpServer
/LM/SMTPSVC | IIsSmtpService
/LM/SMTPSVC/n | IIsSmtpServer

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


LogOdbcUserName

The LogOdbcUserName property specifies the ODBC database user name to be used when writing information to the database during logging events.

Attribute Name | Attribute Value
XML Data Type | String
WMI Data Type | String
ADSI Data Type | String
ABO Data Type | String
ABO Metabase Identifier | MD_LOGSQL_USER_NAME
Attributes | INHERIT
Default Value | internetadmin
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 4009

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/W3SVC/n | IIsWebServer
/LM/MSFTPSVC/n | IIsFtpServer
/LM/W3SVC | IIsWebService
/LM/MSFTPSVC | IIsFtpService
/LM/NNTPSVC | IIsNntpService
/LM/NNTPSVC/n | IIsNntpServer
/LM/SMTPSVC | IIsSmtpService
/LM/SMTPSVC/n | IIsSmtpServer

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


LogonMethod

The LogonMethod property contains an integer that specifies the logon method for cleartext logons. Valid settings are:

  • 0 for interactive logon (defined in iiscnfg.h as MD_LOGON_INTERACTIVE).
  • 1 for batch logon (defined in iiscnfg.h as MD_LOGON_BATCH).
  • 2 for network logon (defined in iiscnfg.h as MD_LOGON_NETWORK).
  • 3 for cleartext logon (defined in iiscnfg.h as MD_LOGON_NETWORK_CLEARTEXT).
For more information about logon methods, see UNC Authentication.

Attribute Name | Attribute Value
XML Data Type | DWORD
WMI Data Type | SINT32
ADSI Data Type | DWORD
ABO Data Type | DWORD
ABO Metabase Identifier | MD_LOGON_METHOD
Attributes | INHERIT
Default Value | 3
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_FILE
StartingNumber | Not applicable
EndingNumber | 3
ID | 6013

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/W3SVC/n/ROOT /LM/W3SVC/n/ROOT/virtual_directory_name | IIsWebVirtualDir
/LM/W3SVC/n | IIsWebServer
/LM/W3SVC | IIsWebService
/LM/W3SVC/n/ROOT/file_name /LM/W3SVC/n/ROOT/virtual_directory_name/file_name | IIsWebFile
/LM/W3SVC/n/ROOT/physical_directory_name /LM/W3SVC/n/virtual_directory_name/physical_directory_name | IIsWebDirectory
/LM/W3SVC/AppPools/DefaultAppPool /LM/W3SVC/AppPools/DefaultAppPool/application_pool_name | IIsApplicationPool
/LM/W3SVC/AppPools | IIsApplicationPools

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


LogPluginClsid

The LogPluginClsid property specifies the order of precedence for the logging modules.

Attribute Name | Attribute Value
XML Data Type | String
WMI Data Type | String
ADSI Data Type | String
ABO Data Type | String
ABO Metabase Identifier | MD_LOG_PLUGIN_ORDER
Attributes | INHERIT
Default Value | null
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 4011

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/W3SVC/n | IIsWebServer
/LM/MSFTPSVC/n | IIsFtpServer
/LM/W3SVC | IIsWebService
/LM/MSFTPSVC | IIsFtpService
/LM/NNTPSVC | IIsNntpService
/LM/NNTPSVC/n | IIsNntpServer
/LM/SMTPSVC | IIsSmtpService
/LM/SMTPSVC/n | IIsSmtpServer

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


LogType

The LogType property indicates whether logging is enabled. A value of 0 indicates that logging is disabled, and a value of 1 indicates that logging is enabled. This property is read-write.

Attribute Name | Attribute Value
XML Data Type | DWORD
WMI Data Type | SINT32
ADSI Data Type | DWORD
ABO Data Type | DWORD
ABO Metabase Identifier | MD_LOG_TYPE
Attributes | INHERIT
Default Value | 1
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | 1
ID | 4000

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/W3SVC/n | IIsWebServer
/LM/MSFTPSVC/n | IIsFtpServer
/LM/W3SVC | IIsWebService
/LM/MSFTPSVC | IIsFtpService
/LM/NNTPSVC | IIsNntpService
/LM/NNTPSVC/n | IIsNntpServer
/LM/SMTPSVC | IIsSmtpService
/LM/SMTPSVC/n | IIsSmtpServer

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.
Related Topics
DontLog


MajorIIsVersionNumber

The MajorIIsVersionNumber property specifies the major version number of IIS.

important Important Because this property is internally configured by IIS, you should consider it to be read-only. Do not configure this property.

Attribute Name | Attribute Value
XML Data Type | DWORD
WMI Data Type | SINT32
ADSI Data Type | DWORD
ABO Data Type | DWORD
ABO Metabase Identifier | MD_SERVER_VERSION_MAJOR
Attributes | NO_ATTRIBUTES
Default Value | null
MetaFlagsEx | Not applicable
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 1101

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/W3SVC/Info | IIsWebInfo
/LM/MSFTPSVC/Info | IIsFtpInfo
/LM/NNTPSVC/Info | IIsNntpInfo
/LM/SMTPSVC/Info | IIsSmtpInfo

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


MasqueradeDomain

The MasqueradeDomain property specifies the domain name used for non-delivery reports
Attribute Name | Attribute Value
XML Data Type | String
WMI Data Type | String
ADSI Data Type | String
ABO Data Type | String
ABO Metabase Identifier | MD_MASQUERADE_NAME
Attributes | INHERIT
Default Value | null
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 36912

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/SMTPSVC | IIsSmtpService
/LM/SMTPSVC/n | IIsSmtpServer

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


MaxBandwidth

The MaxBandwidth property specifies the maximum network bandwidth used for IIS. You can use this setting to help prevent overloading the network with IIS activity. This is not an inheritable property, but the value set at the machine level is globally available to all server instances. MaxBandWidth can be set individually, so that specific server instances are used instead of the global value, and can exceed the global setting established at the machine level.

The World Wide Web Publishing Service (WWW service) must be restarted before changes to this property take effect.

The metabase represents unlimited as the DWORD value of 4294967295 (0xFFFFFFFF); however, VBScript represents unlimited in hexadecimal format as &HFFFFFFFF. Previous versions of IIS represented unlimited as -1.

Attribute Name | Attribute Value
XML Data Type | DWORD
WMI Data Type | SINT32
ADSI Data Type | DWORD
ABO Data Type | DWORD
ABO Metabase Identifier | MD_MAX_BANDWIDTH
Attributes | INHERIT
Default Value | 4294967295
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 1000

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/W3SVC/n | IIsWebServer
/LM | IIsComputer
/LM/W3SVC | IIsWebService
/LM/NNTPSVC | IIsNntpService
/LM/NNTPSVC/n | IIsNntpServer
/LM/SMTPSVC | IIsSmtpService
/LM/SMTPSVC/n | IIsSmtpServer

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


MaxBandwidthBlocked

The MaxBandwidthBlocked property specifies the maximum number of asynchronous requests to be queued in the outstanding idle queue when the maximum bandwidth of the server is exceeded. The value range for this property is 0 to 4294967295 (unlimited).

The metabase represents unlimited as the DWORD value of 4294967295 (0xFFFFFFFF); however, VBScript represents unlimited in hexadecimal format as &HFFFFFFFF. Previous versions of IIS represented unlimited as -1.

important Important This is not an inheritable property and cannot be set at child nodes. MaxBandwidthBlocked is set at the machine level, and is globally available to all server instances.

Attribute Name | Attribute Value
XML Data Type | DWORD
WMI Data Type | SINT32
ADSI Data Type | DWORD
ABO Data Type | DWORD
ABO Metabase Identifier | MD_MAX_BANDWIDTH_BLOCKED
Attributes | NO_ATTRIBUTES
Default Value | 4294967295
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | 0
ID | 1003

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/W3SVC/n | IIsWebServer
/LM | IIsComputer

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


MaxBatchedMessages

The MaxBatchedMessages limits the number of messages per connection.
Attribute Name | Attribute Value
XML Data Type | DWORD
WMI Data Type | SINT32
ADSI Data Type | DWORD
ABO Data Type | DWORD
ABO Metabase Identifier | No friendly named is defined for this identifier in iiscfng.h. Search the systemroot\System32\Inetsrv\MBSchema.xml file for this property and use the integer from its ID attribute.
Attributes | INHERIT
Default Value | 0
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_FILE
StartingNumber | Not applicable
EndingNumber | 0
ID | 36871

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/SMTPSVC | IIsSmtpService
/LM/SMTPSVC/n | IIsSmtpServer

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


MaxClientsMessage

The MaxClientsMessage property contains a string that is displayed to an FTP client when there are too many FTP clients accessing the server. You can configure the maximum number of FTP clients by using the MaxConnections property.
Attribute Name | Attribute Value
XML Data Type | String
WMI Data Type | String
ADSI Data Type | String
ABO Data Type | String
ABO Metabase Identifier | MD_MAX_CLIENTS_MESSAGE
Attributes | INHERIT
Default Value | null
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 5003

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/MSFTPSVC/n | IIsFtpServer
/LM/MSFTPSVC | IIsFtpService

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


MaxConnections

The MaxConnections property specifies the maximum number of simultaneous connections to a server. The valid range is 0 to 4294967295 (unlimited). The MaxClientsMessage property can be used to send a message to clients when this value has been exceeded.

The metabase represents unlimited as the DWORD value of 4294967295 (0xFFFFFFFF); however, Microsoft Visual Basic Scripting Edition (VBScript) represents unlimited in hexadecimal format as &HFFFFFFFF. Previous versions of IIS represented unlimited as -1.

Attribute Name | Attribute Value
XML Data Type | DWORD
WMI Data Type | SINT32
ADSI Data Type | DWORD
ABO Data Type | DWORD
ABO Metabase Identifier | MD_MAX_CONNECTIONS
Attributes | INHERIT
Default Value | 0
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 1014

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/W3SVC/n | IIsWebServer
/LM/MSFTPSVC/n | IIsFtpServer
/LM/W3SVC | IIsWebService
/LM/MSFTPSVC | IIsFtpService
/LM/NNTPSVC | IIsNntpService
/LM/NNTPSVC/n | IIsNntpServer
/LM/SMTPSVC | IIsSmtpService
/LM/SMTPSVC/n | IIsSmtpServer

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.
Related Topics
MaxClientsMessage


MaxDirChangeIOSize

The MaxDirChangeIOSize property determines the size of of the pickup directory buffer. This property is used for debugging purposes.

The metabase represents unlimited as the DWORD value of 4294967295 (0xFFFFFFFF); however, VBScript represents unlimited in hexadecimal format as &HFFFFFFFF. Previous versions of IIS represented unlimited as -1.

Attribute Name | Attribute Value
XML Data Type | DWORD
WMI Data Type | SINT32
ADSI Data Type | DWORD
ABO Data Type | DWORD
ABO Metabase Identifier | No friendly named is defined for this identifier in iiscfng.h. Search the systemroot\System32\Inetsrv\MBSchema.xml file for this property and use the integer from its ID attribute.
Attributes | INHERIT
Default Value | 4294967295
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | 0
ID | 36878

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/SMTPSVC | IIsSmtpService
/LM/SMTPSVC/n | IIsSmtpServer

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


MaxEndpointConnections

The MaxEndpointConnections property specifies the maximum number of "listen" sockets that will be aggregated on a network endpoint. For example, if this value is set to 15, then a maximum of 15 total connections can be made to a single port, even if more than one domain is bound to the port.

The metabase represents unlimited as the DWORD value of 4294967295 (0xFFFFFFFF); however, VBScript represents unlimited in hexadecimal format as &HFFFFFFFF. Previous versions of IIS represented unlimited as -1.

Attribute Name | Attribute Value
XML Data Type | DWORD
WMI Data Type | SINT32
ADSI Data Type | DWORD
ABO Data Type | DWORD
ABO Metabase Identifier | MD_MAX_ENDPOINT_CONNECTIONS
Attributes | INHERIT
Default Value | 4294967295
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | 0
ID | 1024

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/W3SVC/n | IIsWebServer
/LM/MSFTPSVC/n | IIsFtpServer
/LM/W3SVC | IIsWebService
/LM/MSFTPSVC | IIsFtpService
/LM/NNTPSVC | IIsNntpService
/LM/NNTPSVC/n | IIsNntpServer
/LM/SMTPSVC | IIsSmtpService
/LM/SMTPSVC/n | IIsSmtpServer

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


MaxErrorFiles

The MaxErrorFiles property specifies the maximum number of error files. When a syntax error occurs as a result of an edit to Metabase.XML, an error file is generated in systemroot\system32\inetsrv\history. If more than MaxErrorFiles files need to be created, the oldest files are deleted to ensure that this limit is not exceeded.
Attribute Name | Attribute Value
XML Data Type | DWORD
WMI Data Type | SINT32
ADSI Data Type | DWORD
ABO Data Type | DWORD
ABO Metabase Identifier | MD_MAX_ERROR_FILES
Attributes | NO_ATTRIBUTES
Default Value | 10
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 9988

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM | IIsComputer

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


MaxGlobalBandwidth

The MaxGlobalBandwidth property specifies the maximum total bandwidth for the server.

The metabase represents unlimited as the DWORD value of 4294967295 (0xFFFFFFFF); however, VBScript represents unlimited in hexadecimal format as &HFFFFFFFF. Previous versions of IIS represented unlimited as -1.

Attribute Name | Attribute Value
XML Data Type | DWORD
WMI Data Type | SINT32
ADSI Data Type | DWORD
ABO Data Type | DWORD
ABO Metabase Identifier | MD_MAX_GLOBAL_BANDWIDTH
Attributes | NO_ATTRIBUTES
Default Value | 4294967295
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 9201

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/W3SVC | IIsWebService

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


MaxHistoryFiles

The MaxHistoryFiles property specifies the maximum number of paired history files that are saved in the history folder. A pair of history files consists of a MetaBase.xml and a MBSchema.xml file, named with the same major and minor version number, and stored in the history folder.

important Important If the EnableEditWhileRunning property is set to true, the MaxHistoryFiles property should not be configured to a value less than 10. Setting the value of the MaxHistoryFiles property to a value lower than 10 may cause edit-while-running to fail, whereas setting the value too high may have an impact on disk capacity.

Before increasing the value of the MaxHistoryFiles property above the value of 10, ensure that you have adequate hard disk space on the drive volume that the history folder is located on. You can estimate the amount of hard disk space required by multiplying the average combined file size of the MetaBase.xml and MBSchema.xml files by the number of versions that you want to store in the history folder. For information about configuring metabase history, see Configuring the Metabase History Feature and About the Metabase History Feature.

Attribute Name | Attribute Value
XML Data Type | DWORD
WMI Data Type | SINT32
ADSI Data Type | DWORD
ABO Data Type | DWORD
ABO Metabase Identifier | MD_ROOT_MAX_HISTORY_FILES
Attributes | NO_ATTRIBUTES
Default Value | 10
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 9995

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM | IIsComputer

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.
Related Topics
EnableHistory


MaxMailObjects

The MaxMailObjects property specifies the number of inbound connections allowed at one time. This key is used for debugging purposes.

The metabase represents unlimited as the DWORD value of 4294967295 (0xFFFFFFFF); however, VBScript represents unlimited in hexadecimal format as &HFFFFFFFF. Previous versions of IIS represented unlimited as -1.

Attribute Name | Attribute Value
XML Data Type | DWORD
WMI Data Type | SINT32
ADSI Data Type | DWORD
ABO Data Type | DWORD
ABO Metabase Identifier | No friendly named is defined for this identifier in iiscfng.h. Search the systemroot\System32\Inetsrv\MBSchema.xml file for this property and use the integer from its ID attribute.
Attributes | INHERIT
Default Value | 4294967295
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | 0
ID | 36873

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/SMTPSVC | IIsSmtpService
/LM/SMTPSVC/n | IIsSmtpServer

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


MaxMessageSize

The MaxMessageSize property specifies the maximum message size the server accepts. MaxMessageSize is also the value sent by the SMTP service in response to the EHLO command.
Attribute Name | Attribute Value
XML Data Type | DWORD
WMI Data Type | SINT32
ADSI Data Type | DWORD
ABO Data Type | DWORD
ABO Metabase Identifier | MD_MAX_MSG_SIZE
Attributes | INHERIT
Default Value | 33554432
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | 0
ID | 36891

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/SMTPSVC | IIsSmtpService
/LM/SMTPSVC/n | IIsSmtpServer

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


MaxOutConnections

The MaxOutConnections property specifies the maximum number of concurrent outbound connections.
Attribute Name | Attribute Value
XML Data Type | DWORD
WMI Data Type | SINT32
ADSI Data Type | DWORD
ABO Data Type | DWORD
ABO Metabase Identifier | MD_MAX_OUTBOUND_CONNECTION
Attributes | INHERIT
Default Value | 0
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | 0
ID | 36894

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/SMTPSVC | IIsSmtpService
/LM/SMTPSVC/n | IIsSmtpServer

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


MaxOutConnectionsPerDomain

The MaxOutConnectionsPerDomain property specifies the maximum number of concurrent outbound connections per outbound domain.
Attribute Name | Attribute Value
XML Data Type | DWORD
WMI Data Type | SINT32
ADSI Data Type | DWORD
ABO Data Type | DWORD
ABO Metabase Identifier | MD_MAX_OUT_CONN_PER_DOMAIN
Attributes | INHERIT
Default Value | 0
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | 0
ID | 36925

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/SMTPSVC | IIsSmtpService
/LM/SMTPSVC/n | IIsSmtpServer

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


MaxProcesses

The MaxProcesses property determines the maximum number of worker processes an application pool allows to service requests for an application pool. A value of 0 indicates an unmanaged application pool that is not served by a worker process.

note Note A Web Garden is an application pool with a MaxProcesses setting higher than 1.

Attribute Name | Attribute Value
XML Data Type | DWORD
WMI Data Type | SINT32
ADSI Data Type | DWORD
ABO Data Type | DWORD
ABO Metabase Identifier | MD_APPPOOL_MAX_PROCESS_COUNT
Attributes | INHERIT
Default Value | 1
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | 4294967
ID | 9003

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/W3SVC/AppPools/DefaultAppPool /LM/W3SVC/AppPools/DefaultAppPool/application_pool_name | IIsApplicationPool
/LM/W3SVC/AppPools | IIsApplicationPools

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


MaxRecipients

The MaxRecipients property specifies the maximum number of recipients for a given message for a given virtual server.
Attribute Name | Attribute Value
XML Data Type | DWORD
WMI Data Type | SINT32
ADSI Data Type | DWORD
ABO Data Type | DWORD
ABO Metabase Identifier | No friendly named is defined for this identifier in iiscfng.h. Search the systemroot\System32\Inetsrv\MBSchema.xml file for this property and use the integer from its ID attribute.
Attributes | INHERIT
Default Value | 100
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | 0
ID | 36895

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/SMTPSVC | IIsSmtpService
/LM/SMTPSVC/n | IIsSmtpServer

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


MaxRequestEntityAllowed

The MaxRequestEntityAllowed property specifies the maximum number of bytes allowed in the entity body of a request. If a Content-Length header is present and specifies an amount of data greater than the value of MaxRequestEntityAllowed, IIS sends a 403 error response.

The metabase represents unlimited as the DWORD value of 4294967295 (0xFFFFFFFF); however, VBScript represents unlimited in hexadecimal format as &HFFFFFFFF. Previous versions of IIS represented unlimited as -1.

Attribute Name | Attribute Value
XML Data Type | DWORD
WMI Data Type | SINT32
ADSI Data Type | DWORD
ABO Data Type | DWORD
ABO Metabase Identifier | MD_MAX_REQUEST_ENTITY_ALLOWED
Attributes | INHERIT
Default Value | 4294967295
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_FILE
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 6051

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/W3SVC/n/ROOT /LM/W3SVC/n/ROOT/virtual_directory_name | IIsWebVirtualDir
/LM/W3SVC/n | IIsWebServer
/LM/W3SVC | IIsWebService
/LM/W3SVC/n/ROOT/file_name /LM/W3SVC/n/ROOT/virtual_directory_name/file_name | IIsWebFile
/LM/W3SVC/n/ROOT/physical_directory_name /LM/W3SVC/n/virtual_directory_name/physical_directory_name | IIsWebDirectory

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


MaxSearchResults

The MaxSearchResults property specifies the maximum number of results for a search command.
Attribute Name | Attribute Value
XML Data Type | DWORD
WMI Data Type | SINT32
ADSI Data Type | DWORD
ABO Data Type | DWORD
ABO Metabase Identifier | No friendly named is defined for this identifier in iiscfng.h. Search the systemroot\System32\Inetsrv\MBSchema.xml file for this property and use the integer from its ID attribute.
Attributes | INHERIT
Default Value | 0
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | 0
ID | 45181

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/NNTPSVC | IIsNntpService
/LM/NNTPSVC/n | IIsNntpServer

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


MaxSessionSize

The MaxSessionSize property specifies the maximum amount of data per SMTP session for a given virtual server.
Attribute Name | Attribute Value
XML Data Type | DWORD
WMI Data Type | SINT32
ADSI Data Type | DWORD
ABO Data Type | DWORD
ABO Metabase Identifier | No friendly named is defined for this identifier in iiscfng.h. Search the systemroot\System32\Inetsrv\MBSchema.xml file for this property and use the integer from its ID attribute.
Attributes | INHERIT
Default Value | 268435456
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | 0
ID | 36892

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/SMTPSVC | IIsSmtpService
/LM/SMTPSVC/n | IIsSmtpServer

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


MaxSmtpErrors

The MaxSmtpErrors property specifies the maximum number of SMTP errors that can occur in one session before the server drops the connection.

The metabase represents unlimited as the DWORD value of 4294967295 (0xFFFFFFFF); however, VBScript represents unlimited in hexadecimal format as &HFFFFFFFF. Previous versions of IIS represented unlimited as -1.

Attribute Name | Attribute Value
XML Data Type | DWORD
WMI Data Type | SINT32
ADSI Data Type | DWORD
ABO Data Type | DWORD
ABO Metabase Identifier | No friendly named is defined for this identifier in iiscfng.h. Search the systemroot\System32\Inetsrv\MBSchema.xml file for this property and use the integer from its ID attribute.
Attributes | INHERIT
Default Value | 4294967295
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | 0
ID | 36887

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/SMTPSVC | IIsSmtpService
/LM/SMTPSVC/n | IIsSmtpServer

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


MaxSmtpLogonErrors

The MaxSmtpLogonErrors property is used by Microsoft Exchange.
Attribute Name | Attribute Value
XML Data Type | DWORD
WMI Data Type | SINT32
ADSI Data Type | DWORD
ABO Data Type | DWORD
ABO Metabase Identifier | No friendly named is defined for this identifier in iiscfng.h. Search the systemroot\System32\Inetsrv\MBSchema.xml file for this property and use the integer from its ID attribute.
Attributes | INHERIT
Default Value | 4
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | 0
ID | 36945

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path IIS Admin Object Type

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


MD_0

The MD_0 property is used by IIS.

important Important Because this property is internally configured by IIS, you should consider it to be read-only. Do not configure this property.

Attribute Name | Attribute Value
XML Data Type | String
WMI Data Type | String
ADSI Data Type | String
ABO Data Type | String
ABO Metabase Identifier | No friendly named is defined for this identifier in iiscfng.h. Search the systemroot\System32\Inetsrv\MBSchema.xml file for this property and use the integer from its ID attribute.
Attributes | NO_ATTRIBUTES
Default Value | null
MetaFlagsEx | hidden
User Type | unknown_usertype
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 0

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path IIS Admin Object Type

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


MD_1001

The MD_1001 property is used by IIS.

important Important Because this property is internally configured by IIS, you should consider it to be read-only. Do not configure this property.

Attribute Name | Attribute Value
XML Data Type | DWORD
WMI Data Type | SINT32
ADSI Data Type | DWORD
ABO Data Type | DWORD
ABO Metabase Identifier | MD_MEMORY_CACHE_SIZE
Attributes | INHERIT
Default Value | null
MetaFlagsEx | hidden
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 1001

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM | IIsComputer

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


MD_APP_LAST_OUTPROC_PID

The MD_APP_LAST_OUTPROC_PID property contains a value that is stored in an application package ID to denote that the application package has been moved from out-of-process to in-process. In some cases, when an application is moved from out-of-process to in-process, the application's corresponding package may not be deleted by IIS. In this case, IIS stores the application package ID with the value of the MD_APP_LAST_OUTPROC_PID property so that if the application is later moved out-of-process, IIS can use the existing package in MTS/COM+.
Attribute Name | Attribute Value
XML Data Type | String
WMI Data Type | String
ADSI Data Type | String
ABO Data Type | String
ABO Metabase Identifier | MD_APP_LAST_OUTPROC_PID
Attributes | NO_ATTRIBUTES
Default Value | null
MetaFlagsEx | hidden
User Type | iis_md_ut_wam
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 2108

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/W3SVC | IIsWebService

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


MD_ETAG_CHANGENUMBER

The MD_ETAG_CHANGENUMBER property is used by IIS.

important Important Because this property is internally configured by IIS, you should consider it to be read-only. Do not configure this property.

Attribute Name | Attribute Value
XML Data Type | DWORD
WMI Data Type | SINT32
ADSI Data Type | DWORD
ABO Data Type | DWORD
ABO Metabase Identifier | MD_ETAG_CHANGE_NUMBER
Attributes | INHERIT
Default Value | null
MetaFlagsEx | hidden
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 2039

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/W3SVC | IIsWebService

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


MD_IISADMIN_EXTENSIONS

The MD_IISADMIN_EXTENSIONS property contains a list of CLSIDs for all registered administration extensions installed on the server.

important Important Because this property is internally configured by IIS, you should consider it to be read-only. Do not configure this property.

Attribute Name | Attribute Value
XML Data Type | MULTISZ
WMI Data Type | MULTISZ
ADSI Data Type | MULTISZ
ABO Data Type | MULTISZ
ABO Metabase Identifier | MD_SECURE_PORT
Attributes | NO_ATTRIBUTES
Default Value | null
MetaFlagsEx | hidden
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 1028

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path IIS Admin Object Type

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


MD_ISM_ACCESS_CHECK

The MD_ISM_ACCESS_CHECK property is used by IIS.

important Important Because this property is internally configured by IIS, you should consider it to be read-only. Do not configure this property.

Attribute Name | Attribute Value
XML Data Type | DWORD
WMI Data Type | SINT32
ADSI Data Type | DWORD
ABO Data Type | DWORD
ABO Metabase Identifier | MD_ISM_ACCESS_CHECK
Attributes | NO_ATTRIBUTES
Default Value | null
MetaFlagsEx | hidden
User Type | IIS_MD_UT_FILE
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 6269

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/W3SVC/n | IIsWebServer

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


MD_METADATA_ID_REGISTRATION

The MD_METADATA_ID_REGISTRATION property is used by IIS.

important Important Because this property is internally configured by IIS, you should consider it to be read-only. Do not configure this property.

Attribute Name | Attribute Value
XML Data Type | MULTISZ
WMI Data Type | MULTISZ
ADSI Data Type | MULTISZ
ABO Data Type | MULTISZ
ABO Metabase Identifier | MD_METADATA_ID_REGISTRATION
Attributes | INHERIT
Default Value | null
MetaFlagsEx | hidden
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 1030

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path IIS Admin Object Type

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


MD_SERVER_CAPABILITIES

The MD_SERVER_CAPABILITIES property is used by IIS.

important Important Because this property is internally configured by IIS, you should consider it to be read-only. Do not configure this property.

Attribute Name | Attribute Value
XML Data Type | DWORD
WMI Data Type | SINT32
ADSI Data Type | DWORD
ABO Data Type | DWORD
ABO Metabase Identifier | MD_SERVER_CAPABILITIES
Attributes | NO_ATTRIBUTES
Default Value | null
MetaFlagsEx | hidden
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 1103

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/W3SVC/Info | IIsWebInfo
/LM/MSFTPSVC/Info | IIsFtpInfo
/LM/NNTPSVC/Info | IIsNntpInfo
/LM/SMTPSVC/Info | IIsSmtpInfo

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


MD_SERVER_PLATFORM

The MD_SERVER_PLATFORM property is used by IIS.

important Important Because this property is internally configured by IIS, you should consider it to be read-only. Do not configure this property.

Attribute Name | Attribute Value
XML Data Type | DWORD
WMI Data Type | SINT32
ADSI Data Type | DWORD
ABO Data Type | DWORD
ABO Metabase Identifier | MD_SERVER_PLATFORM
Attributes | NO_ATTRIBUTES
Default Value | null
MetaFlagsEx | hidden
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 1100

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/W3SVC/Info | IIsWebInfo
/LM/MSFTPSVC/Info | IIsFtpInfo
/LM/NNTPSVC/Info | IIsNntpInfo
/LM/SMTPSVC/Info | IIsSmtpInfo

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


MimeMap

The MimeMap property provides a list of the file name extensions for Multipurpose Internet Mail Extensions (MIME) mappings. The MimeMap key at the local machine level of the metabase establishes the default list, which can be overridden at the World Wide Web Publishing Service (WWW service) and Web server level keys. See the IIsMimeMap (ADSI) object for details on managing this property.

Attribute Name | Attribute Value
XML Data Type | MIMEMAP
WMI Data Type | MIMEMAP
ADSI Data Type | MIMEMAP
ABO Data Type | MIMEMAP
ABO Metabase Identifier | MD_MIME_MAP
Attributes | INHERIT
Default Value | null
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_FILE
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 6015

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/W3SVC/n/ROOT /LM/W3SVC/n/ROOT/virtual_directory_name | IIsWebVirtualDir
/LM/W3SVC/n | IIsWebServer
/LM | IIsComputer
/LM/W3SVC | IIsWebService
/LM/W3SVC/n/ROOT/file_name /LM/W3SVC/n/ROOT/virtual_directory_name/file_name | IIsWebFile
/LM/W3SVC/n/ROOT/physical_directory_name /LM/W3SVC/n/virtual_directory_name/physical_directory_name | IIsWebDirectory
/LM/MimeMap | IIsMimeMap

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


MinFileBytesPerSec

The MinFileBytesPerSec property is used to configure the minimum throughput rate that HTTP.sys enforces when sending data from the client to the server, and back from the server to the client. The MinFileBytesPerSec property prevents malicious or malfunctioning software clients from consuming resources by holding a connection open with minimal data. If the throughput rate is below the MinFileBytesPerSec setting, the connection is terminated.

Attribute Name | Attribute Value
XML Data Type | DWORD
WMI Data Type | SINT32
ADSI Data Type | DWORD
ABO Data Type | DWORD
ABO Metabase Identifier | MD_MIN_FILE_BYTES_PER_SEC
Attributes | INHERIT
Default Value | 240
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 9205

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/W3SVC | IIsWebService

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


MinorIIsVersionNumber

The MinorIIsVersionNumber property specifies the minor version number of IIS.

important Important Because this property is internally configured by IIS, you should consider it to be read-only. Do not configure this property.

Attribute Name | Attribute Value
XML Data Type | DWORD
WMI Data Type | SINT32
ADSI Data Type | DWORD
ABO Data Type | DWORD
ABO Metabase Identifier | No friendly named is defined for this identifier in iiscfng.h. Search the systemroot\System32\Inetsrv\MBSchema.xml file for this property and use the integer from its ID attribute.
Attributes | NO_ATTRIBUTES
Default Value | null
MetaFlagsEx | Not applicable
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 1102

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/W3SVC/Info | IIsWebInfo
/LM/MSFTPSVC/Info | IIsFtpInfo
/LM/NNTPSVC/Info | IIsNntpInfo
/LM/SMTPSVC/Info | IIsSmtpInfo

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


ModeratorFile

The ModeratorFile property is used by Microsoft Exchange.
Attribute Name | Attribute Value
XML Data Type | String
WMI Data Type | String
ADSI Data Type | String
ABO Data Type | String
ABO Metabase Identifier | No friendly named is defined for this identifier in iiscfng.h. Search the systemroot\System32\Inetsrv\MBSchema.xml file for this property and use the integer from its ID attribute.
Attributes | INHERIT
Default Value | null
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 45160

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/NNTPSVC/n | IIsNntpServer

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


MSDOSDirOutput

The MSDOSDirOutput property specifies the style of directory output for a list operation request from an FTP client. If the value is true, the format is in MS-DOS® style, if false, it is produced in UNIX style.

Attribute Name | Attribute Value
XML Data Type | Boolean
WMI Data Type | Boolean
ADSI Data Type | Boolean
ABO Data Type | Boolean
ABO Metabase Identifier | MD_MSDOS_DIR_OUTPUT
Attributes | INHERIT
Default Value | true
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | 0
ID | 5004

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/MSFTPSVC/n | IIsFtpServer
/LM/MSFTPSVC | IIsFtpService

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


NameResolutionType

The NameResolutionType property tells SMTP how to resolve a host name. The default is 1. Valid values are:
1= UNCACHEDNS
2= GETHOSTBYNAME
3= DNS_GETHOSTBYNAME

Attribute Name | Attribute Value
XML Data Type | DWORD
WMI Data Type | SINT32
ADSI Data Type | DWORD
ABO Data Type | DWORD
ABO Metabase Identifier | No friendly named is defined for this identifier in iiscfng.h. Search the systemroot\System32\Inetsrv\MBSchema.xml file for this property and use the integer from its ID attribute.
Attributes | INHERIT
Default Value | 1
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | 0
ID | 36885

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/SMTPSVC | IIsSmtpService
/LM/SMTPSVC/n | IIsSmtpServer

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


NewsCrawlerTime

The NewsCrawlerTime property specifies the time between expiration runs, in minutes.
Attribute Name | Attribute Value
XML Data Type | DWORD
WMI Data Type | SINT32
ADSI Data Type | DWORD
ABO Data Type | DWORD
ABO Metabase Identifier | No friendly named is defined for this identifier in iiscfng.h. Search the systemroot\System32\Inetsrv\MBSchema.xml file for this property and use the integer from its ID attribute.
Attributes | INHERIT
Default Value | null
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | 0
ID | 45069

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/NNTPSVC | IIsNntpService
/LM/NNTPSVC/n | IIsNntpServer

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


NewsDropDirectory

The NewsDropDirectory property specifies the directory where NNTP puts mail that needs to go out.
Attribute Name | Attribute Value
XML Data Type | String
WMI Data Type | String
ADSI Data Type | String
ABO Data Type | String
ABO Metabase Identifier | No friendly named is defined for this identifier in iiscfng.h. Search the systemroot\System32\Inetsrv\MBSchema.xml file for this property and use the integer from its ID attribute.
Attributes | INHERIT
Default Value | null
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 45176

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/NNTPSVC/n | IIsNntpServer

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


NewsFailedPickupDirectory

The NewsFailedPickupDirectory property specifies the directory where NNTP puts invalid posts from the pickup directory.
Attribute Name | Attribute Value
XML Data Type | String
WMI Data Type | String
ADSI Data Type | String
ABO Data Type | String
ABO Metabase Identifier | No friendly named is defined for this identifier in iiscfng.h. Search the systemroot\System32\Inetsrv\MBSchema.xml file for this property and use the integer from its ID attribute.
Attributes | INHERIT
Default Value | null
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 45174

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/NNTPSVC/n | IIsNntpServer

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


NewsPickupDirectory

The NewsPickupDirectory property specifies the directory where NNTP looks to pick up posts.
Attribute Name | Attribute Value
XML Data Type | String
WMI Data Type | String
ADSI Data Type | String
ABO Data Type | String
ABO Metabase Identifier | No friendly named is defined for this identifier in iiscfng.h. Search the systemroot\System32\Inetsrv\MBSchema.xml file for this property and use the integer from its ID attribute.
Attributes | INHERIT
Default Value | null
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 45173

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/NNTPSVC/n | IIsNntpServer

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


NntpClearTextProvider

The NntpClearTextProvider property specifies the cleartext authentication provider.
Attribute Name | Attribute Value
XML Data Type | String
WMI Data Type | String
ADSI Data Type | String
ABO Data Type | String
ABO Metabase Identifier | No friendly named is defined for this identifier in iiscfng.h. Search the systemroot\System32\Inetsrv\MBSchema.xml file for this property and use the integer from its ID attribute.
Attributes | INHERIT
Default Value | null
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 45179

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/NNTPSVC/n | IIsNntpServer

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


NntpCommandLogMask

The NntpCommandLogMask property specifies the path to the moderatr.txt file, currently unused.

The metabase represents unlimited as the DWORD value of 4294967295 (0xFFFFFFFF); however, VBScript represents unlimited in hexadecimal format as &HFFFFFFFF. Previous versions of IIS represented unlimited as -1.

Attribute Name | Attribute Value
XML Data Type | DWORD
WMI Data Type | SINT32
ADSI Data Type | DWORD
ABO Data Type | DWORD
ABO Metabase Identifier | No friendly named is defined for this identifier in iiscfng.h. Search the systemroot\System32\Inetsrv\MBSchema.xml file for this property and use the integer from its ID attribute.
Attributes | INHERIT
Default Value | 4294967295
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | 0
ID | 45067

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/NNTPSVC | IIsNntpService
/LM/NNTPSVC/n | IIsNntpServer

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


NntpOrganization

The NntpOrganization property is used by Microsoft Exchange.
Attribute Name | Attribute Value
XML Data Type | String
WMI Data Type | String
ADSI Data Type | String
ABO Data Type | String
ABO Metabase Identifier | No friendly named is defined for this identifier in iiscfng.h. Search the systemroot\System32\Inetsrv\MBSchema.xml file for this property and use the integer from its ID attribute.
Attributes | INHERIT
Default Value | null
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 45171

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/NNTPSVC/n | IIsNntpServer

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


NntpServiceVersion

The NntpServiceVersion property is used by Microsoft Exchange.
Attribute Name | Attribute Value
XML Data Type | DWORD
WMI Data Type | SINT32
ADSI Data Type | DWORD
ABO Data Type | DWORD
ABO Metabase Identifier | No friendly named is defined for this identifier in iiscfng.h. Search the systemroot\System32\Inetsrv\MBSchema.xml file for this property and use the integer from its ID attribute.
Attributes | INHERIT
Default Value | 0
MetaFlagsEx | CACHE_PROPERTY_CLEARED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | 0
ID | 45175

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/NNTPSVC | IIsNntpService
/LM/NNTPSVC/n | IIsNntpServer

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


NntpUucpName

The NntpUucpName property contains the NNTP hub name (UUCP name).
Attribute Name | Attribute Value
XML Data Type | String
WMI Data Type | String
ADSI Data Type | String
ABO Data Type | String
ABO Metabase Identifier | No friendly named is defined for this identifier in iiscfng.h. Search the systemroot\System32\Inetsrv\MBSchema.xml file for this property and use the integer from its ID attribute.
Attributes | INHERIT
Default Value | null
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 45170

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/NNTPSVC/n | IIsNntpServer

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


NotDeletable

The NotDeletable property indicates whether a server can be deleted using IIS Manager. If this property is set to true, any attempt to delete the affected server instance results in an error. This property is used on versions of IIS prior to IIS 6.0.
Attribute Name | Attribute Value
XML Data Type | Boolean
WMI Data Type | Boolean
ADSI Data Type | Boolean
ABO Data Type | Boolean
ABO Metabase Identifier | MD_NOT_DELETABLE
Attributes | INHERIT
Default Value | false
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | 0
ID | 2116

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


NTAuthenticationProviders

The NTAuthenticationProviders property contains a comma-delimited list of Windows authentication providers, such as Integrated Windows authentication (also known as NTLM).

Attribute Name | Attribute Value
XML Data Type | String
WMI Data Type | String
ADSI Data Type | String
ABO Data Type | String
ABO Metabase Identifier | MD_NTAUTHENTICATION_PROVIDERS
Attributes | INHERIT
Default Value | null
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_FILE
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 6032

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/W3SVC/n | IIsWebServer
/LM/W3SVC | IIsWebService
/LM/NNTPSVC | IIsNntpService
/LM/NNTPSVC/n | IIsNntpServer
/LM/SMTPSVC | IIsSmtpService
/LM/SMTPSVC/n | IIsSmtpServer

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


OrphanActionExe

The OrphanActionExe property specifies an executable to run when the World Wide Web Publishing Service (WWW Service) orphans a worker process.
Attribute Name | Attribute Value
XML Data Type | String
WMI Data Type | String
ADSI Data Type | String
ABO Data Type | String
ABO Metabase Identifier | MD_APPPOOL_ORPHAN_ACTION_EXE
Attributes | INHERIT
Default Value | null
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 9031

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/W3SVC/AppPools/DefaultAppPool /LM/W3SVC/AppPools/DefaultAppPool/application_pool_name | IIsApplicationPool
/LM/W3SVC/AppPools | IIsApplicationPools

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


OrphanActionParams

The OrphanActionParams property specifies command-line parameters for the executable specified by the OrphanActionExe property.
Attribute Name | Attribute Value
XML Data Type | String
WMI Data Type | String
ADSI Data Type | String
ABO Data Type | String
ABO Metabase Identifier | MD_APPPOOL_ORPHAN_ACTION_PARAMS
Attributes | INHERIT
Default Value | null
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 9032

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/W3SVC/AppPools/DefaultAppPool /LM/W3SVC/AppPools/DefaultAppPool/application_pool_name | IIsApplicationPool
/LM/W3SVC/AppPools | IIsApplicationPools

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.
Related Topics
OrphanActionExe


OrphanWorkerProcess

The OrphanWorkerProcess property, when set to true, notifies the World Wide Web Publishing Service (WWW Service) not to terminate a worker process that fails to respond to pings, but to instead orphan the worker process in the application pool if the worker process suffers fatal errors.
Attribute Name | Attribute Value
XML Data Type | Boolean
WMI Data Type | Boolean
ADSI Data Type | Boolean
ABO Data Type | Boolean
ABO Metabase Identifier | MD_APPPOOL_ORPHAN_PROCESSES_FOR_DEBUGGING
Attributes | INHERIT
Default Value | false
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 9009

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/W3SVC/AppPools/DefaultAppPool /LM/W3SVC/AppPools/DefaultAppPool/application_pool_name | IIsApplicationPool
/LM/W3SVC/AppPools | IIsApplicationPools

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


PassivePortRange

The PassivePortRange property specifies the range of data ports to be used by the FTP service in response to PASV commands.

PASV FTP requires the server to open a data port for the client to make a second connection. This is a separate connection than the typical port 21 that is used for the control channel. The second connection is used when data files are transferred back to the client. By configuring the port range, you can write firewall and router rules to allow external clients access only to the ports they need and reduce the attack surface available to malicious users. In other words, if you have applications other than FTP that are using the default port range of 1025-5000, and do not want to expose these ports through your firewall in order to enable PASV FTP, you can use this value to change the range that you must open through your firewall. If this value is not specified, or is set to an empty string, the default value of 1025-5000, as specified by Winsock, is used. If this property is specified, the valid range that FTP will validate is from 5001 to 65535 (see StartingNumber and EndingNumber below), and may be a range or a single number.

important Important This property can be set only at the service level. In order to make the changes effective, the service must be restarted. If the value is invalid, the service will invalidate it and will not restart.

For more information, see Modes and Data Transmission.

Attribute Name | Attribute Value
XML Data Type | String
WMI Data Type | String
ADSI Data Type | String
ABO Data Type | String
ABO Metabase Identifier | MD_PASSIVE_PORT_RANGE
Attributes | INHERIT
Default Value | 1025-5000
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | 5001
EndingNumber | 65535
ID | 5016

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/MSFTPSVC | IIsFtpService

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


PassportRequireADMapping

The PassportRequireADMapping property specifies how IIS handles Microsoft .NET Passport authentication and Active Directory mapping.

By default, IIS 6.0 with .NET Passport authentication enabled tries to map the .NET Passport user to an account in Active Directory. This default behavior can create performance overhead for sites that do not accept .NET Passport Active Directory mapping. The mapping behavior can be controlled by the PassportRequireADMapping flag. The flag values are:

  • PassportRequireADMapping set to 0: IIS does not attempt Active Directory mapping. The request is handled as Anonymous User.
  • PassportRequireADMapping set to 1 (default setting): In this situation, the worker process must have TCB privileges (meaning, the worker process acts as part of the operating system). IIS then attempts to map to an Active Directory account (called LsaLogonUser). If this attempt fails, the request is handled as Anonymous User.
  • PassportRequireADMapping set to 2: IIS enforces a mapping from the .NET Passport account to an Active Directory account before returning the requested Web page. If the mapping fails, IIS returns a 401 error.

For more information, see Setting Up .NET Passport in IIS. Also, the AuthFlags property contains the available settings for Windows authentication schemes and the file access authentication flags.

Attribute Name | Attribute Value
XML Data Type | DWORD
WMI Data Type | SINT32
ADSI Data Type | DWORD
ABO Data Type | DWORD
ABO Metabase Identifier | MD_PASSPORT_REQUIRE_AD_MAPPING
Attributes | INHERIT
Default Value | 1
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_FILE
StartingNumber | 0
EndingNumber | 2
ID | 6052

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/W3SVC/n/ROOT /LM/W3SVC/n/ROOT/virtual_directory_name | IIsWebVirtualDir
/LM/W3SVC/n | IIsWebServer
/LM/W3SVC | IIsWebService
/LM/W3SVC/n/ROOT/file_name /LM/W3SVC/n/ROOT/virtual_directory_name/file_name | IIsWebFile
/LM/W3SVC/n/ROOT/physical_directory_name /LM/W3SVC/n/virtual_directory_name/physical_directory_name | IIsWebDirectory

Code Example

For general code examples, please see Code Examples to Configure Metabase Properties


PasswordCacheTTL

The PasswordCacheTTL property is used for password types of security authentication schemes. The value specifies the amount of time (in seconds) that an expired password will be held in the memory cache.

Attribute Name | Attribute Value
XML Data Type | DWORD
WMI Data Type | SINT32
ADSI Data Type | DWORD
ABO Data Type | DWORD
ABO Metabase Identifier | MD_ADV_CACHE_TTL
Attributes | INHERIT
Default Value | 600
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | 0
ID | 2064

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/W3SVC/n | IIsWebServer
/LM/W3SVC | IIsWebService

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.
Related Topics
PasswordExpirePrenotifyDays


PasswordChangeFlags

The PasswordChangeFlags property contains flags, as seen in the Flags section, that control password expiration and password change processing between the server and client. A value of 0, which is the default, indicates that an SSL connection is required, 1 indicates that changing is allowed on nonsecure ports, 2 indicates that changing is disabled, and 4 indicates that password expiration notification is disabled.
Attribute Name | Attribute Value
XML Data Type | DWORD
WMI Data Type | SINT32
ADSI Data Type | DWORD
ABO Data Type | DWORD
ABO Metabase Identifier | MD_AUTH_CHANGE_FLAGS
Attributes | INHERIT
Default Value | 0
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | 0
ID | 2068

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/W3SVC/n | IIsWebServer
/LM/W3SVC | IIsWebService

Flags

Flag Name | AuthChangeUnsecure
Description | Password changing allowed on nonsecure ports.
Metabase Bitmask Identifier | MD_AUTH_CHANGE_UNSECURE
Decimal Value | 1
Hex Value | 0x00000001
Flag Name | AuthChangeDisable
Description | Password changing disabled.
Metabase Bitmask Identifier | MD_AUTH_CHANGE_DISABLE
Decimal Value | 2
Hex Value | 0x00000002
Flag Name | AuthAdvNotifyDisable
Description | Advance notification of password expiration disabled.
Metabase Bitmask Identifier | MD_AUTH_ADVNOTIFY_DISABLE
Decimal Value | 4
Hex Value | 0x00000004

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.
Related Topics
PasswordExpirePrenotifyDays


PasswordExpirePrenotifyDays

The PasswordExpirePrenotifyDays property specifies the number of days remaining before the client's password expires, and indicates when a password prenotification message is sent.

note Note This property is dependant on the PasswordChangeFlags property being enabled.

Attribute Name | Attribute Value
XML Data Type | DWORD
WMI Data Type | SINT32
ADSI Data Type | DWORD
ABO Data Type | DWORD
ABO Metabase Identifier | MD_ADV_NOTIFY_PWD_EXP_IN_DAYS
Attributes | INHERIT
Default Value | 0
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | 0
ID | 2063

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/W3SVC/n | IIsWebServer
/LM/W3SVC | IIsWebService

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.
Related Topics
PasswordChangeFlags


Path

The Path property specifies the physical path associated with a virtual directory.
Attribute Name | Attribute Value
XML Data Type | String
WMI Data Type | String
ADSI Data Type | String
ABO Data Type | String
ABO Metabase Identifier | MD_VR_PATH
Attributes | INHERIT
Default Value | null
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_FILE
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 3001

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/W3SVC/n/ROOT /LM/W3SVC/n/ROOT/virtual_directory_name | IIsWebVirtualDir
/LM/MSFTPSVC/n/ROOT /LM/MSFTPSVC/n/ROOT/virtual_directory_name | IIsFtpVirtualDir
/LM/NNTPSVC/n/ROOT /LM/NNTPSVC/n/ROOT/virtual_directory_name | IIsNntpVirtualDir
/LM/SMTPSVC/n/ROOT /LM/SMTPSVC/n/ROOT/virtual_directory_name | IIsSmtpVirtualDir

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


PeriodicRestartMemory

The PeriodicRestartMemory property specifies the amount of memory that a worker process can use before the worker process recycles. The maximum value supported for this property is 4,294,967.
Attribute Name | Attribute Value
XML Data Type | DWORD
WMI Data Type | SINT32
ADSI Data Type | DWORD
ABO Data Type | DWORD
ABO Metabase Identifier | MD_APPPOOL_PERIODIC_RESTART_MEMORY
Attributes | INHERIT
Default Value | 512000
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | 4194303
ID | 9024

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/W3SVC/AppPools/DefaultAppPool /LM/W3SVC/AppPools/DefaultAppPool/application_pool_name | IIsApplicationPool
/LM/W3SVC/AppPools | IIsApplicationPools

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


PeriodicRestartPrivateMemory

The PeriodicRestartPrivateMemory property specifies the amount of memory (in MB) which can be in use by an application pool before the pool is recycled.
Attribute Name | Attribute Value
XML Data Type | DWORD
WMI Data Type | SINT32
ADSI Data Type | DWORD
ABO Data Type | DWORD
ABO Metabase Identifier | MD_APPPOOL_PERIODIC_RESTART_PRIVATE_MEMORY
Attributes | INHERIT
Default Value | 0
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | 3145728
ID | 9038

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/W3SVC/AppPools/DefaultAppPool /LM/W3SVC/AppPools/DefaultAppPool/application_pool_name | IIsApplicationPool
/LM/W3SVC/AppPools | IIsApplicationPools

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


PeriodicRestartRequests

The PeriodicRestartRequests property indicates the number of requests the OOP application should process, after which it is recycled.

Attribute Name | Attribute Value
XML Data Type | DWORD
WMI Data Type | SINT32
ADSI Data Type | DWORD
ABO Data Type | DWORD
ABO Metabase Identifier | MD_APPPOOL_PERIODIC_RESTART_REQUEST_COUNT
Attributes | INHERIT
Default Value | 10000
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 9002

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/W3SVC/AppPools/DefaultAppPool /LM/W3SVC/AppPools/DefaultAppPool/application_pool_name | IIsApplicationPool
/LM/W3SVC/AppPools | IIsApplicationPools

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


PeriodicRestartSchedule

The PeriodicRestartSchedule property specifies the time (in 24 hour format) that the application will be rotated. Each time is in local time and is specified in the following format:

PeriodicRestartSchedule="hh:mm""hh:mm""hh:mm"
Attribute Name | Attribute Value
XML Data Type | MULTISZ
WMI Data Type | MULTISZ
ADSI Data Type | MULTISZ
ABO Data Type | MULTISZ
ABO Metabase Identifier | MD_APPPOOL_PERIODIC_RESTART_SCHEDULE
Attributes | INHERIT
Default Value | null
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 9020

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/W3SVC/AppPools/DefaultAppPool /LM/W3SVC/AppPools/DefaultAppPool/application_pool_name | IIsApplicationPool
/LM/W3SVC/AppPools | IIsApplicationPools

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


PeriodicRestartTime

The PeriodicRestartTime property specifies the period of time, in minutes, after which IIS rotates an isolated OOP application. Setting the value of this property to 0 disables the property. The maximum supported value for this property is 71,582.

note Note If the value of this property is less than the value of the IdleTimeout value, IIS sets both properties to their default values.

Attribute Name | Attribute Value
XML Data Type | DWORD
WMI Data Type | SINT32
ADSI Data Type | DWORD
ABO Data Type | DWORD
ABO Metabase Identifier | MD_APPPOOL_PERIODIC_RESTART_TIME
Attributes | INHERIT
Default Value | 60
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | 71582
ID | 9001

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/W3SVC/AppPools/DefaultAppPool /LM/W3SVC/AppPools/DefaultAppPool/application_pool_name | IIsApplicationPool
/LM/W3SVC/AppPools | IIsApplicationPools

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.
Related Topics

IdleTimeout


PickupDirectory

The PickupDirectory property specifies the path to the directory that is used to pick up inbound mail.
Attribute Name | Attribute Value
XML Data Type | String
WMI Data Type | String
ADSI Data Type | String
ABO Data Type | String
ABO Metabase Identifier | MD_MAIL_PICKUP_DIR
Attributes | INHERIT
Default Value | null
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 36880

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/SMTPSVC | IIsSmtpService
/LM/SMTPSVC/n | IIsSmtpServer

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


PingingEnabled

The PingingEnabled property specifies whether the World Wide Web Publishing Service (WWW Service) should periodically monitor the health of a worker process. Setting the value of this property to true indicates to the WWW service to monitor the worker processes to ensure that the they are running and healthy.
Attribute Name | Attribute Value
XML Data Type | Boolean
WMI Data Type | Boolean
ADSI Data Type | Boolean
ABO Data Type | Boolean
ABO Metabase Identifier | MD_APPPOOL_PINGING_ENABLED
Attributes | INHERIT
Default Value | true
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 9004

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/W3SVC/AppPools/DefaultAppPool /LM/W3SVC/AppPools/DefaultAppPool/application_pool_name | IIsApplicationPool
/LM/W3SVC/AppPools | IIsApplicationPools

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


PingInterval

The PingInterval property specifies the period of time (in seconds) between health-monitoring pings that the World Wide Web Publishing Service (WWW Service) sends to a worker process.
Attribute Name | Attribute Value
XML Data Type | DWORD
WMI Data Type | SINT32
ADSI Data Type | DWORD
ABO Data Type | DWORD
ABO Metabase Identifier | MD_APPPOOL_PING_INTERVAL
Attributes | INHERIT
Default Value | 240
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | 4294967
ID | 9013

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/W3SVC/AppPools/DefaultAppPool /LM/W3SVC/AppPools/DefaultAppPool/application_pool_name | IIsApplicationPool
/LM/W3SVC/AppPools | IIsApplicationPools

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


PingResponseTime

The PingResponseTime property specifies the amount of time (in seconds) that a worker process is given to respond to a health monitoring ping. After the time limit is exceeded, the World Wide Web Publishing Service (WWW Service) terminates the worker process.
Attribute Name | Attribute Value
XML Data Type | DWORD
WMI Data Type | SINT32
ADSI Data Type | DWORD
ABO Data Type | DWORD
ABO Metabase Identifier | MD_APPPOOL_PING_RESPONSE_TIMELIMIT
Attributes | INHERIT
Default Value | 60
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | 4294967
ID | 9014

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/W3SVC/AppPools/DefaultAppPool /LM/W3SVC/AppPools/DefaultAppPool/application_pool_name | IIsApplicationPool
/LM/W3SVC/AppPools | IIsApplicationPools

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


PoolIdcTimeout

The PoolIdcTimeout property specifies the timeout value (in seconds) for Internet database connection pooling. A value of 0 (zero) specifies that no pooling is implemented.

Attribute Name | Attribute Value
XML Data Type | DWORD
WMI Data Type | SINT32
ADSI Data Type | DWORD
ABO Data Type | DWORD
ABO Metabase Identifier | MD_POOL_IDC_TIMEOUT
Attributes | INHERIT
Default Value | 0
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_FILE
StartingNumber | Not applicable
EndingNumber | 0
ID | 6037

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/W3SVC/n/ROOT /LM/W3SVC/n/ROOT/virtual_directory_name | IIsWebVirtualDir
/LM/W3SVC/n | IIsWebServer
/LM/W3SVC | IIsWebService
/LM/W3SVC/n/ROOT/file_name /LM/W3SVC/n/ROOT/virtual_directory_name/file_name | IIsWebFile
/LM/W3SVC/n/ROOT/physical_directory_name /LM/W3SVC/n/virtual_directory_name/physical_directory_name | IIsWebDirectory

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


Pop3ClearTextProvider

The Pop3ClearTextProvider property is used by Microsoft Exchange.
Attribute Name | Attribute Value
XML Data Type | String
WMI Data Type | String
ADSI Data Type | String
ABO Data Type | String
ABO Metabase Identifier | No friendly named is defined for this identifier in iiscfng.h. Search the systemroot\System32\Inetsrv\MBSchema.xml file for this property and use the integer from its ID attribute.
Attributes | INHERIT
Default Value | null
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 41182

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path IIS Admin Object Type

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


Pop3DefaultDomain

The Pop3DefaultDomain property is used by Microsoft Exchange.
Attribute Name | Attribute Value
XML Data Type | String
WMI Data Type | String
ADSI Data Type | String
ABO Data Type | String
ABO Metabase Identifier | No friendly named is defined for this identifier in iiscfng.h. Search the systemroot\System32\Inetsrv\MBSchema.xml file for this property and use the integer from its ID attribute.
Attributes | INHERIT
Default Value | null
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 41176

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path IIS Admin Object Type

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


Pop3DsAccount

The Pop3DsAccount property is used by Microsoft Exchange.
Attribute Name | Attribute Value
XML Data Type | String
WMI Data Type | String
ADSI Data Type | String
ABO Data Type | String
ABO Metabase Identifier | No friendly named is defined for this identifier in iiscfng.h. Search the systemroot\System32\Inetsrv\MBSchema.xml file for this property and use the integer from its ID attribute.
Attributes | INHERIT
Default Value | null
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 41190

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path IIS Admin Object Type

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


Pop3DsBindType

The Pop3DsBindType property is used by Microsoft Exchange.
Attribute Name | Attribute Value
XML Data Type | String
WMI Data Type | String
ADSI Data Type | String
ABO Data Type | String
ABO Metabase Identifier | No friendly named is defined for this identifier in iiscfng.h. Search the systemroot\System32\Inetsrv\MBSchema.xml file for this property and use the integer from its ID attribute.
Attributes | INHERIT
Default Value | null
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 41186

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path IIS Admin Object Type

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


Pop3DsDataDirectory

The Pop3DsDataDirectory property is used by Microsoft Exchange.
Attribute Name | Attribute Value
XML Data Type | String
WMI Data Type | String
ADSI Data Type | String
ABO Data Type | String
ABO Metabase Identifier | No friendly named is defined for this identifier in iiscfng.h. Search the systemroot\System32\Inetsrv\MBSchema.xml file for this property and use the integer from its ID attribute.
Attributes | INHERIT
Default Value | null
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 41184

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path IIS Admin Object Type

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


Pop3DsDefaultMailRoot

The Pop3DsDefaultMailRoot property is used by Microsoft Exchange.
Attribute Name | Attribute Value
XML Data Type | String
WMI Data Type | String
ADSI Data Type | String
ABO Data Type | String
ABO Metabase Identifier | No friendly named is defined for this identifier in iiscfng.h. Search the systemroot\System32\Inetsrv\MBSchema.xml file for this property and use the integer from its ID attribute.
Attributes | INHERIT
Default Value | null
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 41185

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path IIS Admin Object Type

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


Pop3DsHost

The Pop3DsHost property is used by Microsoft Exchange.
Attribute Name | Attribute Value
XML Data Type | String
WMI Data Type | String
ADSI Data Type | String
ABO Data Type | String
ABO Metabase Identifier | No friendly named is defined for this identifier in iiscfng.h. Search the systemroot\System32\Inetsrv\MBSchema.xml file for this property and use the integer from its ID attribute.
Attributes | INHERIT
Default Value | null
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 41188

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path IIS Admin Object Type

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


Pop3DsNamingContext

The Pop3DsNamingContext property is used by Microsoft Exchange.
Attribute Name | Attribute Value
XML Data Type | String
WMI Data Type | String
ADSI Data Type | String
ABO Data Type | String
ABO Metabase Identifier | No friendly named is defined for this identifier in iiscfng.h. Search the systemroot\System32\Inetsrv\MBSchema.xml file for this property and use the integer from its ID attribute.
Attributes | INHERIT
Default Value | null
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 41189

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path IIS Admin Object Type

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


Pop3DsPassword

The Pop3DsPassword property is used by Microsoft Exchange.
Attribute Name | Attribute Value
XML Data Type | String
WMI Data Type | String
ADSI Data Type | String
ABO Data Type | String
ABO Metabase Identifier | No friendly named is defined for this identifier in iiscfng.h. Search the systemroot\System32\Inetsrv\MBSchema.xml file for this property and use the integer from its ID attribute.
Attributes | INHERIT | SECURE
Default Value | null
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 41191

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path IIS Admin Object Type

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


Pop3DsSchemaType

The Pop3DsSchemaType property is used by Microsoft Exchange.
Attribute Name | Attribute Value
XML Data Type | String
WMI Data Type | String
ADSI Data Type | String
ABO Data Type | String
ABO Metabase Identifier | No friendly named is defined for this identifier in iiscfng.h. Search the systemroot\System32\Inetsrv\MBSchema.xml file for this property and use the integer from its ID attribute.
Attributes | INHERIT
Default Value | null
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 41187

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path IIS Admin Object Type

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


Pop3ExpireDelay

Th Pop3ExpireDelay property is used by Microsoft Exchange.
Attribute Name | Attribute Value
XML Data Type | DWORD
WMI Data Type | SINT32
ADSI Data Type | DWORD
ABO Data Type | DWORD
ABO Metabase Identifier | No friendly named is defined for this identifier in iiscfng.h. Search the systemroot\System32\Inetsrv\MBSchema.xml file for this property and use the integer from its ID attribute.
Attributes | INHERIT
Default Value | 1440
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | 0
ID | 41178

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path IIS Admin Object Type

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


Pop3ExpireMail

The Pop3ExpireMail property is used by Microsoft Exchange.
Attribute Name | Attribute Value
XML Data Type | DWORD
WMI Data Type | SINT32
ADSI Data Type | DWORD
ABO Data Type | DWORD
ABO Metabase Identifier | No friendly named is defined for this identifier in iiscfng.h. Search the systemroot\System32\Inetsrv\MBSchema.xml file for this property and use the integer from its ID attribute.
Attributes | INHERIT
Default Value | 0
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | 0
ID | 41181

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path IIS Admin Object Type

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


Pop3ExpireStart

The Pop3ExpireStart property is used by Microsoft Exchange.
Attribute Name | Attribute Value
XML Data Type | DWORD
WMI Data Type | SINT32
ADSI Data Type | DWORD
ABO Data Type | DWORD
ABO Metabase Identifier | No friendly named is defined for this identifier in iiscfng.h. Search the systemroot\System32\Inetsrv\MBSchema.xml file for this property and use the integer from its ID attribute.
Attributes | INHERIT
Default Value | 0
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | 0
ID | 41179

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path IIS Admin Object Type

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


Pop3MailExpirationTime

The Pop3MailExpirationTime property is used by Microsoft Exchange.
Attribute Name | Attribute Value
XML Data Type | DWORD
WMI Data Type | SINT32
ADSI Data Type | DWORD
ABO Data Type | DWORD
ABO Metabase Identifier | No friendly named is defined for this identifier in iiscfng.h. Search the systemroot\System32\Inetsrv\MBSchema.xml file for this property and use the integer from its ID attribute.
Attributes | INHERIT
Default Value | 0
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | 0
ID | 40961

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path IIS Admin Object Type

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


Pop3RoutingDll

The Pop3RoutingDll property is used by Microsoft Exchange.
Attribute Name | Attribute Value
XML Data Type | String
WMI Data Type | String
ADSI Data Type | String
ABO Data Type | String
ABO Metabase Identifier | No friendly named is defined for this identifier in iiscfng.h. Search the systemroot\System32\Inetsrv\MBSchema.xml file for this property and use the integer from its ID attribute.
Attributes | INHERIT
Default Value | null
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 41177

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path IIS Admin Object Type

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


Pop3RoutingSources

The Pop3RoutingSources property is used by Microsoft Exchange.
Attribute Name | Attribute Value
XML Data Type | MULTISZ
WMI Data Type | MULTISZ
ADSI Data Type | MULTISZ
ABO Data Type | MULTISZ
ABO Metabase Identifier | No friendly named is defined for this identifier in iiscfng.h. Search the systemroot\System32\Inetsrv\MBSchema.xml file for this property and use the integer from its ID attribute.
Attributes | INHERIT
Default Value | null
MetaFlagsEx | CACHE_PROPERTY_CLEARED
User Type | iis_md_ut_wam
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 41174

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path IIS Admin Object Type

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


Pop3RoutingTableType

The Pop3RoutingTableType property is used by Microsoft Exchange.
Attribute Name | Attribute Value
XML Data Type | String
WMI Data Type | String
ADSI Data Type | String
ABO Data Type | String
ABO Metabase Identifier | No friendly named is defined for this identifier in iiscfng.h. Search the systemroot\System32\Inetsrv\MBSchema.xml file for this property and use the integer from its ID attribute.
Attributes | INHERIT
Default Value | ldap
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 41183

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path IIS Admin Object Type

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


Pop3ServiceVersion

The Pop3ServiceVersion property is used by Microsoft Exchange.
Attribute Name | Attribute Value
XML Data Type | DWORD
WMI Data Type | SINT32
ADSI Data Type | DWORD
ABO Data Type | DWORD
ABO Metabase Identifier | No friendly named is defined for this identifier in iiscfng.h. Search the systemroot\System32\Inetsrv\MBSchema.xml file for this property and use the integer from its ID attribute.
Attributes | INHERIT
Default Value | 0
MetaFlagsEx | CACHE_PROPERTY_CLEARED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | 0
ID | 41460

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path IIS Admin Object Type

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


PostmasterEmail

The PostmasterEmail property is used by Microsoft Exchange.
Attribute Name | Attribute Value
XML Data Type | String
WMI Data Type | String
ADSI Data Type | String
ABO Data Type | String
ABO Metabase Identifier | No friendly named is defined for this identifier in iiscfng.h. Search the systemroot\System32\Inetsrv\MBSchema.xml file for this property and use the integer from its ID attribute.
Attributes | INHERIT
Default Value | null
MetaFlagsEx | Not applicable
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 36917

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/SMTPSVC/n | IIsSmtpServer

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


PostmasterName

The PostmasterName property is used by Microsoft Exchange.
Attribute Name | Attribute Value
XML Data Type | String
WMI Data Type | String
ADSI Data Type | String
ABO Data Type | String
ABO Metabase Identifier | No friendly named is defined for this identifier in iiscfng.h. Search the systemroot\System32\Inetsrv\MBSchema.xml file for this property and use the integer from its ID attribute.
Attributes | INHERIT
Default Value | null
MetaFlagsEx | Not applicable
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 36916

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/SMTPSVC/n | IIsSmtpServer

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


PrettyNamesFile

The PrettyNamesFile property contains the path to the prettynm.txt file, which is currently unused.
Attribute Name | Attribute Value
XML Data Type | String
WMI Data Type | String
ADSI Data Type | String
ABO Data Type | String
ABO Metabase Identifier | No friendly named is defined for this identifier in iiscfng.h. Search the systemroot\System32\Inetsrv\MBSchema.xml file for this property and use the integer from its ID attribute.
Attributes | INHERIT
Default Value | null
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 45178

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/NNTPSVC/n | IIsNntpServer

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


ProcessNTCRIfLoggedOn

The ProcessNTCRIfLoggedOn property enables processing of Integrated Windows authentication (NTLM) , even if a user has already logged on using an alternate authentication scheme.

Attribute Name | Attribute Value
XML Data Type | Boolean
WMI Data Type | Boolean
ADSI Data Type | Boolean
ABO Data Type | Boolean
ABO Metabase Identifier | MD_PROCESS_NTCR_IF_LOGGED_ON
Attributes | INHERIT
Default Value | true
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | 0
ID | 2070

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/W3SVC/n | IIsWebServer
/LM/W3SVC | IIsWebService

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


QueueDirectory

The QueueDirectory property designates the directory where mail queues are held.
Attribute Name | Attribute Value
XML Data Type | String
WMI Data Type | String
ADSI Data Type | String
ABO Data Type | String
ABO Metabase Identifier | No friendly named is defined for this identifier in iiscfng.h. Search the systemroot\System32\Inetsrv\MBSchema.xml file for this property and use the integer from its ID attribute.
Attributes | INHERIT
Default Value | null
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 36875

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/SMTPSVC | IIsSmtpService
/LM/SMTPSVC/n | IIsSmtpServer

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


RapidFailProtection

Setting the RapidFailProtection property to true indicates that the World Wide Web Publishing Service (WWW Service) should put all applications in an application pool out of service if there have been five worker process crashes within a 10 minute time period.
Attribute Name | Attribute Value
XML Data Type | Boolean
WMI Data Type | Boolean
ADSI Data Type | Boolean
ABO Data Type | Boolean
ABO Metabase Identifier | MD_APPPOOL_RAPID_FAIL_PROTECTION_ENABLED
Attributes | INHERIT
Default Value | true
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 9006

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/W3SVC/AppPools/DefaultAppPool /LM/W3SVC/AppPools/DefaultAppPool/application_pool_name | IIsApplicationPool
/LM/W3SVC/AppPools | IIsApplicationPools

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


RapidFailProtectionInterval

The RapidFailProtectionInterval property specifies the number of minutes before the failure count for a process is reset.
Attribute Name | Attribute Value
XML Data Type | DWORD
WMI Data Type | SINT32
ADSI Data Type | DWORD
ABO Data Type | DWORD
ABO Metabase Identifier | MD_RAPID_FAIL_PROTECTION_INTERVAL
Attributes | INHERIT
Default Value | 5
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | 71582
ID | 9029

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/W3SVC | IIsWebService
/LM/W3SVC/AppPools/DefaultAppPool /LM/W3SVC/AppPools/DefaultAppPool/application_pool_name | IIsApplicationPool
/LM/W3SVC/AppPools | IIsApplicationPools

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


RapidFailProtectionMaxCrashes

The RapidFailProtectionMaxCrashes property specifies the maximum number of failures allowed within RapidFailProtectionInterval minutes.
Attribute Name | Attribute Value
XML Data Type | DWORD
WMI Data Type | SINT32
ADSI Data Type | DWORD
ABO Data Type | DWORD
ABO Metabase Identifier | MD_RAPID_FAIL_PROTECTION_MAX_CRASHES
Attributes | INHERIT
Default Value | 5
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 9030

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/W3SVC | IIsWebService
/LM/W3SVC/AppPools/DefaultAppPool /LM/W3SVC/AppPools/DefaultAppPool/application_pool_name | IIsApplicationPool
/LM/W3SVC/AppPools | IIsApplicationPools

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.
Related Topics

RapidFailProtectionInterval


Realm

The Realm property specifies the realm that IIS should use to authenticate a client that is attempting to access a resource secured with Digest authentication or Advanced Digest authentication.
Attribute Name | Attribute Value
XML Data Type | String
WMI Data Type | String
ADSI Data Type | String
ABO Data Type | String
ABO Metabase Identifier | MD_REALM
Attributes | INHERIT
Default Value | null
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_FILE
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 6001

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/W3SVC/n/ROOT /LM/W3SVC/n/ROOT/virtual_directory_name | IIsWebVirtualDir
/LM/W3SVC/n | IIsWebServer
/LM/MSFTPSVC/n | IIsFtpServer
/LM/W3SVC | IIsWebService
/LM/MSFTPSVC | IIsFtpService
/LM/W3SVC/n/ROOT/file_name /LM/W3SVC/n/ROOT/virtual_directory_name/file_name | IIsWebFile
/LM/W3SVC/n/ROOT/physical_directory_name /LM/W3SVC/n/virtual_directory_name/physical_directory_name | IIsWebDirectory
/LM/SMTPSVC | IIsSmtpService
/LM/SMTPSVC/n | IIsSmtpServer

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


RedirectHeaders

The RedirectHeaders property specifies additional redirection headers. Each string in the string array represents a header and its value.

Attribute Name | Attribute Value
XML Data Type | MULTISZ
WMI Data Type | MULTISZ
ADSI Data Type | MULTISZ
ABO Data Type | MULTISZ
ABO Metabase Identifier | MD_REDIRECT_HEADERS
Attributes | INHERIT
Default Value | null
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_FILE
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 6044

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/W3SVC/n/ROOT /LM/W3SVC/n/ROOT/virtual_directory_name | IIsWebVirtualDir
/LM/W3SVC/n | IIsWebServer
/LM/W3SVC | IIsWebService
/LM/W3SVC/n/ROOT/file_name /LM/W3SVC/n/ROOT/virtual_directory_name/file_name | IIsWebFile
/LM/W3SVC/n/ROOT/physical_directory_name /LM/W3SVC/n/virtual_directory_name/physical_directory_name | IIsWebDirectory

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


RelayForAuth

The RelayForAuth property corresponds to the Allow all computers which successfully authenticate to relay, regardless of the list above check box in the Relay Restrictions dialog box. This value is set to -1 if the check box is selected (that is, allow relay to all those who have authenticated) and is set to 0 if the check box is not selected.
Attribute Name | Attribute Value
XML Data Type | DWORD
WMI Data Type | SINT32
ADSI Data Type | DWORD
ABO Data Type | DWORD
ABO Metabase Identifier | No friendly named is defined for this identifier in iiscfng.h. Search the systemroot\System32\Inetsrv\MBSchema.xml file for this property and use the integer from its ID attribute.
Attributes | INHERIT
Default Value | 0
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | 0
ID | 36973

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/SMTPSVC | IIsSmtpService
/LM/SMTPSVC/n | IIsSmtpServer
/LM/SMTPSVC/n/Domain | IIsSmtpDomain

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


RelayIpList

The RelayIpList property is an octet string containing a list of IPs allowed or denied for relay listed in the Relay Restrictions dialog box.
Attribute Name | Attribute Value
XML Data Type | IPSECLIST
WMI Data Type | IPSECLIST
ADSI Data Type | IPSECLIST
ABO Data Type | IPSECLIST
ABO Metabase Identifier | No friendly named is defined for this identifier in iiscfng.h. Search the systemroot\System32\Inetsrv\MBSchema.xml file for this property and use the integer from its ID attribute.
Attributes | inherit | reference
Default Value | null
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_FILE
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 36970

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/SMTPSVC | IIsSmtpService
/LM/SMTPSVC/n | IIsSmtpServer
/LM/SMTPSVC/n/Domain | IIsSmtpDomain

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


RemoteRetryAttempts

The RemoteRetryAttempts property is used by Microsoft Exchange.
Attribute Name | Attribute Value
XML Data Type | DWORD
WMI Data Type | SINT32
ADSI Data Type | DWORD
ABO Data Type | DWORD
ABO Metabase Identifier | No friendly named is defined for this identifier in iiscfng.h. Search the systemroot\System32\Inetsrv\MBSchema.xml file for this property and use the integer from its ID attribute.
Attributes | INHERIT
Default Value | 48
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | 0
ID | 36898

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/SMTPSVC | IIsSmtpService
/LM/SMTPSVC/n | IIsSmtpServer

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


RemoteRetryInterval

The RemoteRetryInterval property is used by Microsoft Exchange.
Attribute Name | Attribute Value
XML Data Type | DWORD
WMI Data Type | SINT32
ADSI Data Type | DWORD
ABO Data Type | DWORD
ABO Metabase Identifier | No friendly named is defined for this identifier in iiscfng.h. Search the systemroot\System32\Inetsrv\MBSchema.xml file for this property and use the integer from its ID attribute.
Attributes | INHERIT
Default Value | 60
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | 0
ID | 36899

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/SMTPSVC | IIsSmtpService
/LM/SMTPSVC/n | IIsSmtpServer

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


RemoteSmtpPort

The RemoteSmtpPort property determines which port is used when a virtual server connects to a remote server.
Attribute Name | Attribute Value
XML Data Type | DWORD
WMI Data Type | SINT32
ADSI Data Type | DWORD
ABO Data Type | DWORD
ABO Metabase Identifier | No friendly named is defined for this identifier in iiscfng.h. Search the systemroot\System32\Inetsrv\MBSchema.xml file for this property and use the integer from its ID attribute.
Attributes | INHERIT
Default Value | 25
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | 0
ID | 36914

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/SMTPSVC | IIsSmtpService
/LM/SMTPSVC/n | IIsSmtpServer

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


RemoteSmtpSecurePort

The RemoteSmtpSecurePort property is obsolete.
Attribute Name | Attribute Value
XML Data Type | DWORD
WMI Data Type | SINT32
ADSI Data Type | DWORD
ABO Data Type | DWORD
ABO Metabase Identifier | No friendly named is defined for this identifier in iiscfng.h. Search the systemroot\System32\Inetsrv\MBSchema.xml file for this property and use the integer from its ID attribute.
Attributes | INHERIT
Default Value | 465
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | 0
ID | 36929

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/SMTPSVC | IIsSmtpService
/LM/SMTPSVC/n | IIsSmtpServer

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


RemoteTimeout

The RemoteTimeout property sets the timeout for outbound connections, which correspond to the timeout value in the Outbound Connections dialog box.
Attribute Name | Attribute Value
XML Data Type | DWORD
WMI Data Type | SINT32
ADSI Data Type | DWORD
ABO Data Type | DWORD
ABO Metabase Identifier | No friendly named is defined for this identifier in iiscfng.h. Search the systemroot\System32\Inetsrv\MBSchema.xml file for this property and use the integer from its ID attribute.
Attributes | INHERIT
Default Value | 0
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | 0
ID | 36921

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/SMTPSVC | IIsSmtpService
/LM/SMTPSVC/n | IIsSmtpServer

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


RevocationFreshnessTime

If the RevocationFreshnessTime property is set to 1 (true), then the certificate revocation list (CRL) on the certificate client is updated by the CRL from the remote location, even if the CRL that is cached on the certificate client is valid. The default timeout interval is one day unless you use the RevocationURLRetrievalTimeout to specify a different timeout interval (in minutes).

Attribute Name | Attribute Value
XML Data Type | DWORD
WMI Data Type | SINT32
ADSI Data Type | DWORD
ABO Data Type | DWORD
ABO Metabase Identifier | MD_REVOCATION_FRESHNESS_TIME
Attributes | INHERIT
Default Value | 86400
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 2161

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/W3SVC/n | IIsWebServer
/LM/W3SVC | IIsWebService

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.
Related Topics

RevocationURLRetrievalTimeout


RevocationURLRetrievalTimeout

If the RevocationFreshnessTime property is set to 1 (true), then the certificate revocation list (CRL) on the certificate client is updated by the CRL from the remote location, even if the CRL that is cached on the certificate client is valid. The default timeout interval is one day unless you use this property, RevocationURLRetrievalTimeout, to specify a different timeout interval (in minutes).

Attribute Name | Attribute Value
XML Data Type | DWORD
WMI Data Type | SINT32
ADSI Data Type | DWORD
ABO Data Type | DWORD
ABO Metabase Identifier | MD_REVOCATION_URL_RETRIEVAL_TIMEOUT
Attributes | INHERIT
Default Value | 0
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 2162

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/W3SVC/n | IIsWebServer
/LM/W3SVC | IIsWebService

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


RouteAction

The RouteAction property flags the various SMTP options. This gives properties to a connector.
Attribute Name | Attribute Value
XML Data Type | DWORD
WMI Data Type | SINT32
ADSI Data Type | DWORD
ABO Data Type | DWORD
ABO Metabase Identifier | No friendly named is defined for this identifier in iiscfng.h. Search the systemroot\System32\Inetsrv\MBSchema.xml file for this property and use the integer from its ID attribute.
Attributes | INHERIT
Default Value | 0
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | 0
ID | 36946

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/SMTPSVC | IIsSmtpService
/LM/SMTPSVC/n | IIsSmtpServer
/LM/SMTPSVC/n/Domain | IIsSmtpDomain

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


RouteActionString

The RouteActionstring property is used by Microsoft Exchange.
Attribute Name | Attribute Value
XML Data Type | String
WMI Data Type | String
ADSI Data Type | String
ABO Data Type | String
ABO Metabase Identifier | No friendly named is defined for this identifier in iiscfng.h. Search the systemroot\System32\Inetsrv\MBSchema.xml file for this property and use the integer from its ID attribute.
Attributes | INHERIT
Default Value | null
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 36947

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/SMTPSVC/n/Domain | IIsSmtpDomain

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


RoutePassword

For outbound connections, the RoutePassword property sets the password used to connect to a remote server (this value is listed for a given connector, for example /smtpsvc/1/domain/username.com).
Attribute Name | Attribute Value
XML Data Type | String
WMI Data Type | String
ADSI Data Type | String
ABO Data Type | String
ABO Metabase Identifier | No friendly named is defined for this identifier in iiscfng.h. Search the systemroot\System32\Inetsrv\MBSchema.xml file for this property and use the integer from its ID attribute.
Attributes | INHERIT | SECURE
Default Value | null
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 36949

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/SMTPSVC | IIsSmtpService
/LM/SMTPSVC/n | IIsSmtpServer
/LM/SMTPSVC/n/Domain | IIsSmtpDomain

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


RouteUserName

For outbound connections, the RouteUserName property sets the account name used to connect to a remote server (this value is listed for a given connector, for example /smtpsvc/1/domain/username.com).
Attribute Name | Attribute Value
XML Data Type | String
WMI Data Type | String
ADSI Data Type | String
ABO Data Type | String
ABO Metabase Identifier | No friendly named is defined for this identifier in iiscfng.h. Search the systemroot\System32\Inetsrv\MBSchema.xml file for this property and use the integer from its ID attribute.
Attributes | INHERIT
Default Value | null
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 36948

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/SMTPSVC | IIsSmtpService
/LM/SMTPSVC/n | IIsSmtpServer
/LM/SMTPSVC/n/Domain | IIsSmtpDomain

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


RoutingDll

The RoutingDll property is obsolete.
Attribute Name | Attribute Value
XML Data Type | String
WMI Data Type | String
ADSI Data Type | String
ABO Data Type | String
ABO Metabase Identifier | No friendly named is defined for this identifier in iiscfng.h. Search the systemroot\System32\Inetsrv\MBSchema.xml file for this property and use the integer from its ID attribute.
Attributes | INHERIT
Default Value | null
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 36883

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/SMTPSVC | IIsSmtpService
/LM/SMTPSVC/n | IIsSmtpServer

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


RoutingSources

The RoutingSources property is obsolete.
Attribute Name | Attribute Value
XML Data Type | MULTISZ
WMI Data Type | MULTISZ
ADSI Data Type | MULTISZ
ABO Data Type | MULTISZ
ABO Metabase Identifier | No friendly named is defined for this identifier in iiscfng.h. Search the systemroot\System32\Inetsrv\MBSchema.xml file for this property and use the integer from its ID attribute.
Attributes | INHERIT
Default Value | null
MetaFlagsEx | CACHE_PROPERTY_CLEARED
User Type | iis_md_ut_wam
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 36910

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/SMTPSVC | IIsSmtpService
/LM/SMTPSVC/n | IIsSmtpServer

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


SaslLogonDomain

The SaslLogonDomain property is used by Microsoft Exchange.
Attribute Name | Attribute Value
XML Data Type | String
WMI Data Type | String
ADSI Data Type | String
ABO Data Type | String
ABO Metabase Identifier | No friendly named is defined for this identifier in iiscfng.h. Search the systemroot\System32\Inetsrv\MBSchema.xml file for this property and use the integer from its ID attribute.
Attributes | INHERIT
Default Value | null
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 36940

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/SMTPSVC | IIsSmtpService
/LM/SMTPSVC/n | IIsSmtpServer

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


ScriptMaps

The ScriptMaps property specifies the file name extensions of applications used for script processor mappings. The list string is written in the following format:

"Extension, ScriptProcessor, Flags, IncludedVerbs"

Where Extension is the file name extension, such as .htm, ScriptProcessor is the full path to the DLL, Flags is the integer value corresponding to the requested behavior described in the Bitmask Table, and IncludedVerbs is a list of the verbs that a particular ISAPI DLL processes.

For example, to specify the file extension for the ISAPI "Test.dll" with a file extension of ".htm", you might provide the following list (string):

 ".htm,C:\Windows40\System32\Inetsrv\Test.dll,5,GET, HEAD, POST"

note Note IIS allows an "*" in place of the file name extension, which effectively routes all requests though the designated ScriptProcessor. This feature is useful when applying a custom ISAPI extension that will handle requests from all file types.

In IIS version 4.0 and earlier, the syntax was to list excluded verbs rather than included verbs. In version 5.0 and later, if no verbs are listed, a value of "all verbs" is assumed. You should list the verbs you want your ISAPI filter or extension to handle.

Attribute Name | Attribute Value
XML Data Type | MULTISZ
WMI Data Type | MULTISZ
ADSI Data Type | MULTISZ
ABO Data Type | MULTISZ
ABO Metabase Identifier | MD_SCRIPT_MAPS
Attributes | INHERIT
Default Value | null
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_FILE
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 6014

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/W3SVC/n/ROOT /LM/W3SVC/n/ROOT/virtual_directory_name | IIsWebVirtualDir
/LM/W3SVC/n | IIsWebServer
/LM/W3SVC | IIsWebService
/LM/W3SVC/n/ROOT/file_name /LM/W3SVC/n/ROOT/virtual_directory_name/file_name | IIsWebFile
/LM/W3SVC/n/ROOT/physical_directory_name /LM/W3SVC/n/virtual_directory_name/physical_directory_name | IIsWebDirectory

Values

Constant | Value | Description
MD_SCRIPTMAPFLAG_SCRIPT | 0x00000001 | Scripts are allowed to run in directories given Script permission. If this value is not set, then the script can only be run in directories that are flagged for Execute permission.
MD_SCRIPTMAPFLAG_CHECK_PATH_INFO | 0x00000004 | The server attempts to access the PATH_INFO portion of the URL, as a file, before starting the scripting engine. If the file can't be opened, or doesn't exist, an error is returned to the client.

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


SecureBindings

The SecureBindings property specifies a string that is used by IIS to determine which secure network endpoints are used by the server instance. The string format is IP:Port.

note Note The IP component of each string is optional. If it is not provided, IIS assumes that any IP address is allowable (wildcard).

Attribute Name | Attribute Value
XML Data Type | MULTISZ
WMI Data Type | MULTISZ
ADSI Data Type | MULTISZ
ABO Data Type | MULTISZ
ABO Metabase Identifier | MD_SECURE_BINDINGS
Attributes | NO_ATTRIBUTES
Default Value | null
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 2021

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/W3SVC/n | IIsWebServer
/LM/NNTPSVC/n | IIsNntpServer
/LM/SMTPSVC/n | IIsSmtpServer

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.
Related Topics
ServerBindings


SecuritySetupRequired

The SecuritySetupRequired property is used by IIS.
Attribute Name | Attribute Value
XML Data Type | Boolean
WMI Data Type | Boolean
ADSI Data Type | Boolean
ABO Data Type | Boolean
ABO Metabase Identifier | No friendly named is defined for this identifier in iiscfng.h. Search the systemroot\System32\Inetsrv\MBSchema.xml file for this property and use the integer from its ID attribute.
Attributes | NO_ATTRIBUTES
Default Value | null
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 2166

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


SendBadTo

The SendBadTo property sets the alias to which bad mail is sent. The default is "Postmaster."
Attribute Name | Attribute Value
XML Data Type | String
WMI Data Type | String
ADSI Data Type | String
ABO Data Type | String
ABO Metabase Identifier | No friendly named is defined for this identifier in iiscfng.h. Search the systemroot\System32\Inetsrv\MBSchema.xml file for this property and use the integer from its ID attribute.
Attributes | INHERIT
Default Value | null
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 36923

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/SMTPSVC | IIsSmtpService
/LM/SMTPSVC/n | IIsSmtpServer

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


SendNdrTo

The SendNdrTo property corresponds to "Send copy of Non-Delivery Report to" on the Messages tab.
Attribute Name | Attribute Value
XML Data Type | String
WMI Data Type | String
ADSI Data Type | String
ABO Data Type | String
ABO Metabase Identifier | No friendly named is defined for this identifier in iiscfng.h. Search the systemroot\System32\Inetsrv\MBSchema.xml file for this property and use the integer from its ID attribute.
Attributes | INHERIT
Default Value | null
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 36922

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/SMTPSVC | IIsSmtpService
/LM/SMTPSVC/n | IIsSmtpServer

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


ServerAutoStart

The ServerAutoStart property indicates if the server instance should start automatically when the service is started.

This property is reset automatically when a server instance is stopped or restarted, to maintain state across service restarts. For example, if a server is stopped, the value of this property is set to false so that if the service is stopped and restarted, the server will remain stopped. Likewise, if a server is started, this property is set to true, allowing the server to remain running whenever the service is running.

Attribute Name | Attribute Value
XML Data Type | Boolean
WMI Data Type | Boolean
ADSI Data Type | Boolean
ABO Data Type | Boolean
ABO Metabase Identifier | MD_SERVER_AUTOSTART
Attributes | NO_ATTRIBUTES
Default Value | true
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 1017

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/W3SVC/n | IIsWebServer
/LM/MSFTPSVC/n | IIsFtpServer
/LM/W3SVC | IIsWebService
/LM/MSFTPSVC | IIsFtpService
/LM/NNTPSVC | IIsNntpService
/LM/NNTPSVC/n | IIsNntpServer
/LM/SMTPSVC | IIsSmtpService
/LM/SMTPSVC/n | IIsSmtpServer

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


ServerBindings

The ServerBindings property specifies a string that IIS uses to determine which network endpoints are used by the server instance. The string format is IP:Port:Hostname.

note Note Both the IP and Hostname parameters of the string are optional. Any unspecified parameters default to an all-inclusive wildcard.

Attribute Name | Attribute Value
XML Data Type | MULTISZ
WMI Data Type | MULTISZ
ADSI Data Type | MULTISZ
ABO Data Type | MULTISZ
ABO Metabase Identifier | MD_SERVER_BINDINGS
Attributes | NO_ATTRIBUTES
Default Value | null
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 1023

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/W3SVC/n | IIsWebServer
/LM/MSFTPSVC/n | IIsFtpServer
/LM/W3SVC | IIsWebService
/LM/MSFTPSVC | IIsFtpService
/LM/NNTPSVC/n | IIsNntpServer
/LM/SMTPSVC/n | IIsSmtpServer

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.
Related Topics
SecureBindings


ServerCommand

The ServerCommand property can be set to start, stop, continue, or pause a site. The commands, and the corresponding codes, are listed in the Bitmask Values table.
Attribute Name | Attribute Value
XML Data Type | DWORD
WMI Data Type | SINT32
ADSI Data Type | DWORD
ABO Data Type | DWORD
ABO Metabase Identifier | MD_SERVER_COMMAND
Attributes | VOLATILE
Default Value | null
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 1012

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/W3SVC/n | IIsWebServer
/LM/MSFTPSVC/n | IIsFtpServer
/LM/MSFTPSVC | IIsFtpService

Bitmask Values

Value | Description
1 | Start site.
2 | Stop site.
4 | Pause site.
8 | Continue site.

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


ServerComment

The ServerComment property specifies a comment for the server instance.

Attribute Name | Attribute Value
XML Data Type | String
WMI Data Type | String
ADSI Data Type | String
ABO Data Type | String
ABO Metabase Identifier | MD_SERVER_COMMENT
Attributes | INHERIT
Default Value | null
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 1015

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/W3SVC/n | IIsWebServer
/LM/MSFTPSVC/n | IIsFtpServer
/LM/W3SVC | IIsWebService
/LM/MSFTPSVC | IIsFtpService
/LM/NNTPSVC | IIsNntpService
/LM/NNTPSVC/n | IIsNntpServer
/LM/SMTPSVC | IIsSmtpService
/LM/SMTPSVC/n | IIsSmtpServer

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


ServerConfigFlags

The ServerConfigFlags property contains flags, as seen in the Flags section, that specify the server configuration established at startup.

Attribute Name | Attribute Value
XML Data Type | DWORD
WMI Data Type | SINT32
ADSI Data Type | DWORD
ABO Data Type | DWORD
ABO Metabase Identifier | MD_SERVER_CONFIGURATION_INFO
Attributes | NO_ATTRIBUTES
Default Value | 0
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | 0
ID | 1027

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/W3SVC/Info | IIsWebInfo

Flags

Flag Name | ServerConfigSSL40
Description | A value of true indicates that 40-bit Secure Sockets Layer (SSL) processing is installed on the server.
Metabase Bitmask Identifier | MD_SERVER_CONFIG_SSL_40
Decimal Value | 1
Hex Value | 0x00000001
Flag Name | ServerConfigSSL128
Description | A value of true indicates that 128-bit Secure Sockets Layer (SSL) processing is installed on the server.
Metabase Bitmask Identifier | MD_SERVER_CONFIG_SSL_128
Decimal Value | 2
Hex Value | 0x00000002
Flag Name | ServerConfigSSLAllowEncrypt
Description | A value of true indicates that the locality allows encryption.
Metabase Bitmask Identifier | MD_SERVER_CONFIG_ALLOW_ENCRYPT
Decimal Value | 4
Hex Value | 0x00000004
Flag Name | ServerConfigAutoPWSync
Description | A value of true indicates that the server can perform automatic anonymous user password synchronization between the Web authentication manager (WAM) and the Microsoft Windows authentication manager.
Metabase Bitmask Identifier | MD_SERVER_CONFIG_AUTO_PW_SYNC
Decimal Value | 8
Hex Value | 0x00000008

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


ServerListenBacklog

The ServerListenBacklog property specifies the number of outstanding sockets that can be queued. The value is based on the AcceptEx operating system parameter, and the server size specified in the ServerSize property. Valid values for this property range from 5 to 500.

Attribute Name | Attribute Value
XML Data Type | DWORD
WMI Data Type | SINT32
ADSI Data Type | DWORD
ABO Data Type | DWORD
ABO Metabase Identifier | MD_SERVER_LISTEN_BACKLOG
Attributes | INHERIT
Default Value | 40
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | 0
ID | 1019

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/W3SVC/n | IIsWebServer
/LM/MSFTPSVC/n | IIsFtpServer
/LM/W3SVC | IIsWebService
/LM/MSFTPSVC | IIsFtpService
/LM/NNTPSVC | IIsNntpService
/LM/NNTPSVC/n | IIsNntpServer
/LM/SMTPSVC/n | IIsSmtpServer

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.
Related Topics

ServerSize


ServerListenTimeout

The ServerListenTimeout property specifies the amount of time (in seconds) the server waits for a client to send data. After the allotted amount of time passes, the server disconnects the client.

Attribute Name | Attribute Value
XML Data Type | DWORD
WMI Data Type | SINT32
ADSI Data Type | DWORD
ABO Data Type | DWORD
ABO Metabase Identifier | MD_SERVER_LISTEN_TIMEOUT
Attributes | INHERIT
Default Value | 120
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 1020

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/W3SVC/n | IIsWebServer
/LM/MSFTPSVC/n | IIsFtpServer
/LM/W3SVC | IIsWebService
/LM/MSFTPSVC | IIsFtpService
/LM/NNTPSVC | IIsNntpService
/LM/NNTPSVC/n | IIsNntpServer
/LM/SMTPSVC | IIsSmtpService
/LM/SMTPSVC/n | IIsSmtpServer

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


ServerSize

The ServerSize property specifies the general size of the server, in terms of the number of client requests processed per day. A value of 0 (zero) indicates a small Web site that expects to receive fewer than 10,000 requests per day; a value of 1 indicates a medium site handling between 10,000 and 100,000 requests per day; and a value of 2 designates a large site, processing more than 100,000 requests a day. The value of this property is used in calculating the value for the ServerListenBacklog property.

Attribute Name | Attribute Value
XML Data Type | DWORD
WMI Data Type | SINT32
ADSI Data Type | DWORD
ABO Data Type | DWORD
ABO Metabase Identifier | MD_SERVER_SIZE
Attributes | INHERIT
Default Value | 1
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | 0
ID | 1018

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/W3SVC/n | IIsWebServer
/LM/MSFTPSVC/n | IIsFtpServer
/LM/W3SVC | IIsWebService
/LM/MSFTPSVC | IIsFtpService

Values

Constant | Value | Description
MD_SERVER_SIZE_SMALL | 0x00000000 | Anticipate fewer than 10,000 requests per day.
MD_SERVER_SIZE_MEDIUM | 0x00000001 | Anticipate 10,000 to 100,000 requests per day.
MD_SERVER_SIZE_LARGE | 0x00000002 | Anticipate more than 100,000 requests per day.

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.
Related Topics

ServerListenBacklog


ServerState

The ServerState property presents the current state of the server instance. The states, and the corresponding state codes, are listed in the Bitmask Values table.

note Note When working with the IIS Admin Base Object, use the MD_SERVER_COMMAND property to send commands to the server.

Attribute Name | Attribute Value
XML Data Type | DWORD
WMI Data Type | SINT32
ADSI Data Type | DWORD
ABO Data Type | DWORD
ABO Metabase Identifier | MD_SERVER_STATE
Attributes | VOLATILE
Default Value | 4
MetaFlagsEx | CACHE_PROPERTY_CLEARED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 1016

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/W3SVC/n | IIsWebServer
/LM/MSFTPSVC/n | IIsFtpServer
/LM/NNTPSVC/n | IIsNntpServer
/LM/SMTPSVC/n | IIsSmtpServer

Bitmask Values

Constant | Value | Description
MD_SERVER_STATE_STARTING | 0x00000001 | Server starting.
MD_SERVER_STATE_STARTED | 0x00000002 | Server started.
MD_SERVER_STATE_STOPPING | 0x00000003 | Server stopping.
MD_SERVER_STATE_STOPPED | 0x00000004 | Server stopped.
MD_SERVER_STATE_PAUSING | 0x00000005 | Server pausing.
MD_SERVER_STATE_PAUSED | 0x00000006 | Server paused.
MD_SERVER_STATE_CONTINUING | 0x00000007 | Server continuing.

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


SessionKey

The SessionKey property is used for the encryption of secure metabase properties.

important Important Because this property is internally configured by IIS, you should consider it to be read-only. Do not configure this property.

Attribute Name | Attribute Value
XML Data Type | binary
WMI Data Type | binary
ADSI Data Type | binary
ABO Data Type | binary
ABO Metabase Identifier | MD_GLOBAL_SESSIONKEY
Attributes | NO_ATTRIBUTES
Default Value | null
MetaFlagsEx | Not applicable
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 9999

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
. | IIS_Global

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


ShouldDeliver

The ShouldDeliver property is used by Microsoft Exchange.
Attribute Name | Attribute Value
XML Data Type | Boolean
WMI Data Type | Boolean
ADSI Data Type | Boolean
ABO Data Type | Boolean
ABO Metabase Identifier | No friendly named is defined for this identifier in iiscfng.h. Search the systemroot\System32\Inetsrv\MBSchema.xml file for this property and use the integer from its ID attribute.
Attributes | INHERIT
Default Value | true
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | 0
ID | 36881

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/SMTPSVC | IIsSmtpService
/LM/SMTPSVC/n | IIsSmtpServer

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


ShouldPickupMail

The ShouldPickupMail property determines if mail is picked up from the Pickup directory.
Attribute Name | Attribute Value
XML Data Type | Boolean
WMI Data Type | Boolean
ADSI Data Type | Boolean
ABO Data Type | Boolean
ABO Metabase Identifier | No friendly named is defined for this identifier in iiscfng.h. Search the systemroot\System32\Inetsrv\MBSchema.xml file for this property and use the integer from its ID attribute.
Attributes | INHERIT
Default Value | true
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | 0
ID | 36876

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/SMTPSVC | IIsSmtpService
/LM/SMTPSVC/n | IIsSmtpServer

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


ShouldPipelineIn

The ShouldPipelineIn property allows pipelining of incoming commands (Boolean value).
Attribute Name | Attribute Value
XML Data Type | Boolean
WMI Data Type | Boolean
ADSI Data Type | Boolean
ABO Data Type | Boolean
ABO Metabase Identifier | No friendly named is defined for this identifier in iiscfng.h. Search the systemroot\System32\Inetsrv\MBSchema.xml file for this property and use the integer from its ID attribute.
Attributes | INHERIT
Default Value | true
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | 0
ID | 36902

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/SMTPSVC | IIsSmtpService
/LM/SMTPSVC/n | IIsSmtpServer

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


ShouldPipelineOut

The ShouldPipelineOut property allows pipelining of outgoing commands (Boolean value).
Attribute Name | Attribute Value
XML Data Type | Boolean
WMI Data Type | Boolean
ADSI Data Type | Boolean
ABO Data Type | Boolean
ABO Metabase Identifier | No friendly named is defined for this identifier in iiscfng.h. Search the systemroot\System32\Inetsrv\MBSchema.xml file for this property and use the integer from its ID attribute.
Attributes | INHERIT
Default Value | true
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | 0
ID | 36901

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/SMTPSVC | IIsSmtpService
/LM/SMTPSVC/n | IIsSmtpServer

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


ShutdownLatency

The ShutdownLatency property is used by Microsoft Exchange.
Attribute Name | Attribute Value
XML Data Type | DWORD
WMI Data Type | SINT32
ADSI Data Type | DWORD
ABO Data Type | DWORD
ABO Metabase Identifier | No friendly named is defined for this identifier in iiscfng.h. Search the systemroot\System32\Inetsrv\MBSchema.xml file for this property and use the integer from its ID attribute.
Attributes | INHERIT
Default Value | 0
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | 0
ID | 45070

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/NNTPSVC | IIsNntpService
/LM/NNTPSVC/n | IIsNntpServer

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


ShutdownTimeLimit

The ShutdownTimeLimit property specifies the amount of time (in seconds) after a recycle threshold has been reached that IIS waits for all old requests to finish running in a worker process before terminating the worker process.

Attribute Name | Attribute Value
XML Data Type | DWORD
WMI Data Type | SINT32
ADSI Data Type | DWORD
ABO Data Type | DWORD
ABO Metabase Identifier | MD_APPPOOL_SHUTDOWN_TIMELIMIT
Attributes | INHERIT
Default Value | 90
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | 4294967
ID | 9012

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/W3SVC/n/ROOT /LM/W3SVC/n/ROOT/virtual_directory_name | IIsWebVirtualDir
/LM/W3SVC/n | IIsWebServer
/LM/W3SVC | IIsWebService
/LM/W3SVC/n/ROOT/physical_directory_name /LM/W3SVC/n/virtual_directory_name/physical_directory_name | IIsWebDirectory
/LM/W3SVC/AppPools/DefaultAppPool /LM/W3SVC/AppPools/DefaultAppPool/application_pool_name | IIsApplicationPool
/LM/W3SVC/AppPools | IIsApplicationPools

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


SmartHost

The SmartHost property corresponds to "Smart host" in the Advanced Delivery dialog box (for a given virtual server, not in the general SmtpSvc container).
Attribute Name | Attribute Value
XML Data Type | String
WMI Data Type | String
ADSI Data Type | String
ABO Data Type | String
ABO Metabase Identifier | No friendly named is defined for this identifier in iiscfng.h. Search the systemroot\System32\Inetsrv\MBSchema.xml file for this property and use the integer from its ID attribute.
Attributes | INHERIT
Default Value | null
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 36906

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/SMTPSVC | IIsSmtpService
/LM/SMTPSVC/n | IIsSmtpServer

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


SmartHostType

The SmartHostType property corresponds to the "Attempt direct delivery before sending to smart host" check box in the Advanced Delivery dialog box. If no smart host is specified in the smart host text box, SmartHostType will be set to 0. When the smart host is specified and the check box is not selected, SmartHostType will be set to 2 (always) and the smart host will be used to send mail without consulting the DNS server. When the smart host is specified and the check box is selected, SmartHostType will be set to 1 (that is, direct delivery through DNS lookup first; if DNS fails to look up the domains of the recipients, the smart host entry of the SMTP virtual server is used).
Attribute Name | Attribute Value
XML Data Type | DWORD
WMI Data Type | SINT32
ADSI Data Type | DWORD
ABO Data Type | DWORD
ABO Metabase Identifier | No friendly named is defined for this identifier in iiscfng.h. Search the systemroot\System32\Inetsrv\MBSchema.xml file for this property and use the integer from its ID attribute.
Attributes | INHERIT
Default Value | 0
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | 0
ID | 36905

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/SMTPSVC | IIsSmtpService
/LM/SMTPSVC/n | IIsSmtpServer

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


SMPAffinitized

Setting the SMPAffinitized property to true indicates that a particular worker process assigned to an application pool should be assigned to a given CPU. This property is used in conjunction with the SMPProcessorAffinityMask property to configure a particular processor a worker process will be assigned to.
Attribute Name | Attribute Value
XML Data Type | Boolean
WMI Data Type | Boolean
ADSI Data Type | Boolean
ABO Data Type | Boolean
ABO Metabase Identifier | MD_APPPOOL_SMP_AFFINITIZED
Attributes | INHERIT
Default Value | false
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 9007

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/W3SVC/AppPools/DefaultAppPool /LM/W3SVC/AppPools/DefaultAppPool/application_pool_name | IIsApplicationPool
/LM/W3SVC/AppPools | IIsApplicationPools

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.
Related Topics

SMPProcessorAffinityMask


SMPProcessorAffinityMask

The SMPProcessorAffinityMask property configures the hexadecimal processor mask. The hexadecimal processor mask indicates to which CPU the worker processes in an application pool should be bound. Before this property takes affect, the SMPAffinitized property must be set to true for the application pool.

note Note Setting the value of this property to zero means that no SMP affinity is configured. In this case, worker processes can be run on any CPU.

The metabase represents unlimited as the DWORD value of 4294967295 (0xFFFFFFFF); however, VBScript represents unlimited in hexadecimal format as &HFFFFFFFF. Previous versions of IIS represented unlimited as -1.

Attribute Name | Attribute Value
XML Data Type | DWORD
WMI Data Type | SINT32
ADSI Data Type | DWORD
ABO Data Type | DWORD
ABO Metabase Identifier | MD_APPPOOL_SMP_AFFINITIZED_PROCESSOR_MASK
Attributes | INHERIT
Default Value | 4294967295
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 9008

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/W3SVC/AppPools/DefaultAppPool /LM/W3SVC/AppPools/DefaultAppPool/application_pool_name | IIsApplicationPool
/LM/W3SVC/AppPools | IIsApplicationPools

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.
Related Topics

SMPAffinitized


SmtpAdvQueueDll

The SmtpAdvQueueDll property indicates the string containing the location of the advanced queuing DLL. The default is systemroot\Inetsrv\Aqueue.dll.
Attribute Name | Attribute Value
XML Data Type | String
WMI Data Type | String
ADSI Data Type | String
ABO Data Type | String
ABO Metabase Identifier | No friendly named is defined for this identifier in iiscfng.h. Search the systemroot\System32\Inetsrv\MBSchema.xml file for this property and use the integer from its ID attribute.
Attributes | INHERIT
Default Value | null
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 36987

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/SMTPSVC | IIsSmtpService

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


SmtpAqueueWait

The SmtpAqueueWait property key is for debugging purposes only.

The metabase represents unlimited as the DWORD value of 4294967295 (0xFFFFFFFF); however, VBScript represents unlimited in hexadecimal format as &HFFFFFFFF. Previous versions of IIS represented unlimited as -1.

Attribute Name | Attribute Value
XML Data Type | DWORD
WMI Data Type | SINT32
ADSI Data Type | DWORD
ABO Data Type | DWORD
ABO Metabase Identifier | No friendly named is defined for this identifier in iiscfng.h. Search the systemroot\System32\Inetsrv\MBSchema.xml file for this property and use the integer from its ID attribute.
Attributes | INHERIT
Default Value | 4294967295
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | 0
ID | 36990

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/SMTPSVC | IIsSmtpService
/LM/SMTPSVC/n | IIsSmtpServer

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


SmtpAuthTimeout

The SmtpAuthTimeout property sets the amount of time the server waits after a client issues this command before hanging up because of inactivity.
Attribute Name | Attribute Value
XML Data Type | DWORD
WMI Data Type | SINT32
ADSI Data Type | DWORD
ABO Data Type | DWORD
ABO Metabase Identifier | No friendly named is defined for this identifier in iiscfng.h. Search the systemroot\System32\Inetsrv\MBSchema.xml file for this property and use the integer from its ID attribute.
Attributes | INHERIT
Default Value | 0
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | 0
ID | 37006

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/SMTPSVC | IIsSmtpService
/LM/SMTPSVC/n | IIsSmtpServer

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


SmtpBdatTimeout

The SmtpBdatTimeout property sets the amount of time the server waits after a client issues this command before hanging up because of inactivity.
Attribute Name | Attribute Value
XML Data Type | DWORD
WMI Data Type | SINT32
ADSI Data Type | DWORD
ABO Data Type | DWORD
ABO Metabase Identifier | No friendly named is defined for this identifier in iiscfng.h. Search the systemroot\System32\Inetsrv\MBSchema.xml file for this property and use the integer from its ID attribute.
Attributes | INHERIT
Default Value | 0
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | 0
ID | 37005

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/SMTPSVC | IIsSmtpService
/LM/SMTPSVC/n | IIsSmtpServer

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


SmtpClearTextProvider

The SmtpClearTextProvider property is used by Microsoft Exchange.
Attribute Name | Attribute Value
XML Data Type | String
WMI Data Type | String
ADSI Data Type | String
ABO Data Type | String
ABO Metabase Identifier | No friendly named is defined for this identifier in iiscfng.h. Search the systemroot\System32\Inetsrv\MBSchema.xml file for this property and use the integer from its ID attribute.
Attributes | INHERIT
Default Value | null
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 36942

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/SMTPSVC | IIsSmtpService
/LM/SMTPSVC/n | IIsSmtpServer

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


SmtpCommandLogMask

The SmtpCommandLogMask property is used by Microsoft Exchange.
Attribute Name | Attribute Value
XML Data Type | DWORD
WMI Data Type | SINT32
ADSI Data Type | DWORD
ABO Data Type | DWORD
ABO Metabase Identifier | No friendly named is defined for this identifier in iiscfng.h. Search the systemroot\System32\Inetsrv\MBSchema.xml file for this property and use the integer from its ID attribute.
Attributes | INHERIT
Default Value | 0
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | 0
ID | 36864

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/SMTPSVC | IIsSmtpService

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


SmtpConnectTimeout

The SmtpConnectTimeout property sets the amount of time, after a client makes a connection, that the server will wait before hanging up because of inactivity.
Attribute Name | Attribute Value
XML Data Type | DWORD
WMI Data Type | SINT32
ADSI Data Type | DWORD
ABO Data Type | DWORD
ABO Metabase Identifier | No friendly named is defined for this identifier in iiscfng.h. Search the systemroot\System32\Inetsrv\MBSchema.xml file for this property and use the integer from its ID attribute.
Attributes | INHERIT
Default Value | 0
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | 0
ID | 37001

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/SMTPSVC | IIsSmtpService
/LM/SMTPSVC/n | IIsSmtpServer

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


SmtpDataTimeout

The SmtpDataTimeout property sets the amount of time, after a client issues this command, that the server will wait before hanging up because of inactivity.
Attribute Name | Attribute Value
XML Data Type | DWORD
WMI Data Type | SINT32
ADSI Data Type | DWORD
ABO Data Type | DWORD
ABO Metabase Identifier | No friendly named is defined for this identifier in iiscfng.h. Search the systemroot\System32\Inetsrv\MBSchema.xml file for this property and use the integer from its ID attribute.
Attributes | INHERIT
Default Value | 0
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | 0
ID | 37004

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/SMTPSVC | IIsSmtpService
/LM/SMTPSVC/n | IIsSmtpServer

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


SmtpDisableRelay

The SmtpDisableRelay property controls whether mail may be relayed. Note that the Boolean flag value is reversed.
Attribute Name | Attribute Value
XML Data Type | Boolean
WMI Data Type | Boolean
ADSI Data Type | Boolean
ABO Data Type | Boolean
ABO Metabase Identifier | No friendly named is defined for this identifier in iiscfng.h. Search the systemroot\System32\Inetsrv\MBSchema.xml file for this property and use the integer from its ID attribute.
Attributes | INHERIT
Default Value | true
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | 0
ID | 36974

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/SMTPSVC | IIsSmtpService
/LM/SMTPSVC/n | IIsSmtpServer

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


SmtpDomainValidationFlags

Setting the SmtpDomainValidationFlags property key to a nonzero value causes the domain passed to the EHLO command to be checked to determine if it is well formatted.

The metabase represents unlimited as the DWORD value of 4294967295 (0xFFFFFFFF); however, VBScript represents unlimited in hexadecimal format as &HFFFFFFFF. Previous versions of IIS represented unlimited as -1.

Attribute Name | Attribute Value
XML Data Type | DWORD
WMI Data Type | SINT32
ADSI Data Type | DWORD
ABO Data Type | DWORD
ABO Metabase Identifier | No friendly named is defined for this identifier in iiscfng.h. Search the systemroot\System32\Inetsrv\MBSchema.xml file for this property and use the integer from its ID attribute.
Attributes | INHERIT
Default Value | 4294967295
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | 0
ID | 36992

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/SMTPSVC | IIsSmtpService
/LM/SMTPSVC/n | IIsSmtpServer

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


SmtpDotStuffPickupDirFiles

The SmtpDotStuffPickupDirFiles property specifies if SMTP will process dotstuffed files in the Pickup directory.
Attribute Name | Attribute Value
XML Data Type | Boolean
WMI Data Type | Boolean
ADSI Data Type | Boolean
ABO Data Type | Boolean
ABO Metabase Identifier | No friendly named is defined for this identifier in iiscfng.h. Search the systemroot\System32\Inetsrv\MBSchema.xml file for this property and use the integer from its ID attribute.
Attributes | INHERIT
Default Value | true
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | 0
ID | 37030

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/SMTPSVC | IIsSmtpService
/LM/SMTPSVC/n | IIsSmtpServer

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


SmtpDsAccount

The SmtpDsAccount property is used by Microsoft Exchange.
Attribute Name | Attribute Value
XML Data Type | String
WMI Data Type | String
ADSI Data Type | String
ABO Data Type | String
ABO Metabase Identifier | No friendly named is defined for this identifier in iiscfng.h. Search the systemroot\System32\Inetsrv\MBSchema.xml file for this property and use the integer from its ID attribute.
Attributes | INHERIT
Default Value | null
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 36957

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/SMTPSVC/n/RoutingSources | IIsSmtpRoutingSource

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


SmtpDsBindType

The SmtpDsBindType property specifies whether to authenticate to a remote LDAP server or not.
Attribute Name | Attribute Value
XML Data Type | String
WMI Data Type | String
ADSI Data Type | String
ABO Data Type | String
ABO Metabase Identifier | No friendly named is defined for this identifier in iiscfng.h. Search the systemroot\System32\Inetsrv\MBSchema.xml file for this property and use the integer from its ID attribute.
Attributes | INHERIT
Default Value | null
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 36953

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/SMTPSVC/n/RoutingSources | IIsSmtpRoutingSource

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


SmtpDsDataDirectory

The SmtpDsDataDirectory property is obsolete.
Attribute Name | Attribute Value
XML Data Type | String
WMI Data Type | String
ADSI Data Type | String
ABO Data Type | String
ABO Metabase Identifier | No friendly named is defined for this identifier in iiscfng.h. Search the systemroot\System32\Inetsrv\MBSchema.xml file for this property and use the integer from its ID attribute.
Attributes | INHERIT
Default Value | null
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 36951

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/SMTPSVC/n/RoutingSources | IIsSmtpRoutingSource

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


SmtpDsDefaultMailRoot

The SmtpDsDefaultMailRoot property is obsolete.
Attribute Name | Attribute Value
XML Data Type | String
WMI Data Type | String
ADSI Data Type | String
ABO Data Type | String
ABO Metabase Identifier | No friendly named is defined for this identifier in iiscfng.h. Search the systemroot\System32\Inetsrv\MBSchema.xml file for this property and use the integer from its ID attribute.
Attributes | INHERIT
Default Value | null
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 36952

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/SMTPSVC/n/RoutingSources | IIsSmtpRoutingSource

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


SmtpDsDomain

The SmtpDsDomain property sets the domain to use to authenticate to a remote LDAP server.
Attribute Name | Attribute Value
XML Data Type | String
WMI Data Type | String
ADSI Data Type | String
ABO Data Type | String
ABO Metabase Identifier | No friendly named is defined for this identifier in iiscfng.h. Search the systemroot\System32\Inetsrv\MBSchema.xml file for this property and use the integer from its ID attribute.
Attributes | INHERIT
Default Value | null
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 36993

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/SMTPSVC/n/RoutingSources | IIsSmtpRoutingSource

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


SmtpDsFlags

The SmtpDsFlags propertys determines special flags passed to set options on an LDAP connection.
Attribute Name | Attribute Value
XML Data Type | DWORD
WMI Data Type | SINT32
ADSI Data Type | DWORD
ABO Data Type | DWORD
ABO Metabase Identifier | No friendly named is defined for this identifier in iiscfng.h. Search the systemroot\System32\Inetsrv\MBSchema.xml file for this property and use the integer from its ID attribute.
Attributes | INHERIT
Default Value | 0
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | 0
ID | 37024

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/SMTPSVC/n/RoutingSources | IIsSmtpRoutingSource

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


SmtpDsHost

The SmtpDsHost property sets the host name of a remote LDAP server.
Attribute Name | Attribute Value
XML Data Type | String
WMI Data Type | String
ADSI Data Type | String
ABO Data Type | String
ABO Metabase Identifier | No friendly named is defined for this identifier in iiscfng.h. Search the systemroot\System32\Inetsrv\MBSchema.xml file for this property and use the integer from its ID attribute.
Attributes | INHERIT
Default Value | null
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 36955

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/SMTPSVC/n/RoutingSources | IIsSmtpRoutingSource

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


SmtpDsNamingContext

The SmtpDsNamingContext property sets the LDAP base naming context to search in on a remote LDAP server.
Attribute Name | Attribute Value
XML Data Type | String
WMI Data Type | String
ADSI Data Type | String
ABO Data Type | String
ABO Metabase Identifier | No friendly named is defined for this identifier in iiscfng.h. Search the systemroot\System32\Inetsrv\MBSchema.xml file for this property and use the integer from its ID attribute.
Attributes | INHERIT
Default Value | null
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 36956

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/SMTPSVC/n/RoutingSources | IIsSmtpRoutingSource

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


SmtpDSNLanguageID

The SmtpDSNLanguageID property indicates the language ID that the SMTP virtual server uses when sending Delivery Status Notifications.
Attribute Name | Attribute Value
XML Data Type | DWORD
WMI Data Type | SINT32
ADSI Data Type | DWORD
ABO Data Type | DWORD
ABO Metabase Identifier | No friendly named is defined for this identifier in iiscfng.h. Search the systemroot\System32\Inetsrv\MBSchema.xml file for this property and use the integer from its ID attribute.
Attributes | INHERIT
Default Value | 0
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | 0
ID | 37022

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/SMTPSVC | IIsSmtpService
/LM/SMTPSVC/n | IIsSmtpServer

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


SmtpDSNOptions

The SmtpDSNOptions property is used by Microsoft Exchange.
Attribute Name | Attribute Value
XML Data Type | DWORD
WMI Data Type | SINT32
ADSI Data Type | DWORD
ABO Data Type | DWORD
ABO Metabase Identifier | No friendly named is defined for this identifier in iiscfng.h. Search the systemroot\System32\Inetsrv\MBSchema.xml file for this property and use the integer from its ID attribute.
Attributes | INHERIT
Default Value | 0
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | 0
ID | 37021

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/SMTPSVC | IIsSmtpService
/LM/SMTPSVC/n | IIsSmtpServer

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


SmtpDsPassword

The SmtpDsPassword property sets the password to use to bind to a remote LDAP server.
Attribute Name | Attribute Value
XML Data Type | String
WMI Data Type | String
ADSI Data Type | String
ABO Data Type | String
ABO Metabase Identifier | No friendly named is defined for this identifier in iiscfng.h. Search the systemroot\System32\Inetsrv\MBSchema.xml file for this property and use the integer from its ID attribute.
Attributes | INHERIT | SECURE
Default Value | null
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 36958

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/SMTPSVC/n/RoutingSources | IIsSmtpRoutingSource

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


SmtpDsPort

The SmtpDsPort property sets the port on which a remote LDAP server listens.
Attribute Name | Attribute Value
XML Data Type | DWORD
WMI Data Type | SINT32
ADSI Data Type | DWORD
ABO Data Type | DWORD
ABO Metabase Identifier | No friendly named is defined for this identifier in iiscfng.h. Search the systemroot\System32\Inetsrv\MBSchema.xml file for this property and use the integer from its ID attribute.
Attributes | INHERIT
Default Value | 0
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | 0
ID | 37023

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/SMTPSVC/n/RoutingSources | IIsSmtpRoutingSource

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


SmtpDsSchemaType

The SmtpDsSchemaType property specifies which directory schema to use.
Attribute Name | Attribute Value
XML Data Type | String
WMI Data Type | String
ADSI Data Type | String
ABO Data Type | String
ABO Metabase Identifier | No friendly named is defined for this identifier in iiscfng.h. Search the systemroot\System32\Inetsrv\MBSchema.xml file for this property and use the integer from its ID attribute.
Attributes | INHERIT
Default Value | null
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 36954

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/SMTPSVC/n/RoutingSources | IIsSmtpRoutingSource

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


SmtpDsUseCat

The SmtpDsUseCat property enables the Categorizer.
Attribute Name | Attribute Value
XML Data Type | DWORD
WMI Data Type | SINT32
ADSI Data Type | DWORD
ABO Data Type | DWORD
ABO Metabase Identifier | No friendly named is defined for this identifier in iiscfng.h. Search the systemroot\System32\Inetsrv\MBSchema.xml file for this property and use the integer from its ID attribute.
Attributes | INHERIT
Default Value | 0
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | 0
ID | 36994

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/SMTPSVC/n/RoutingSources | IIsSmtpRoutingSource

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


SmtpEventlogLevel

The SmtpEventlogLevel property sets the event logging level:
  • 0=none
  • 1=minimum
  • 3=medium
  • 5=maximum
  • 7=field engineering

The metabase represents unlimited as the DWORD value of 4294967295 (0xFFFFFFFF); however, VBScript represents unlimited in hexadecimal format as &HFFFFFFFF. Previous versions of IIS represented unlimited as -1.

Attribute Name | Attribute Value
XML Data Type | DWORD
WMI Data Type | SINT32
ADSI Data Type | DWORD
ABO Data Type | DWORD
ABO Metabase Identifier | No friendly named is defined for this identifier in iiscfng.h. Search the systemroot\System32\Inetsrv\MBSchema.xml file for this property and use the integer from its ID attribute.
Attributes | INHERIT
Default Value | 4294967295
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | 0
ID | 37027

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/SMTPSVC | IIsSmtpService
/LM/SMTPSVC/n | IIsSmtpServer

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


SmtpFlushMailFile

The SmtpFlushMailFile property is used by Microsoft Exchange.
Attribute Name | Attribute Value
XML Data Type | DWORD
WMI Data Type | SINT32
ADSI Data Type | DWORD
ABO Data Type | DWORD
ABO Metabase Identifier | No friendly named is defined for this identifier in iiscfng.h. Search the systemroot\System32\Inetsrv\MBSchema.xml file for this property and use the integer from its ID attribute.
Attributes | INHERIT
Default Value | 0
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | 0
ID | 36866

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/SMTPSVC | IIsSmtpService

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


SmtpHeloNoDomain

The SmtpHeloNoDomain property is used by Microsoft Exchange.
Attribute Name | Attribute Value
XML Data Type | Boolean
WMI Data Type | Boolean
ADSI Data Type | Boolean
ABO Data Type | Boolean
ABO Metabase Identifier | No friendly named is defined for this identifier in iiscfng.h. Search the systemroot\System32\Inetsrv\MBSchema.xml file for this property and use the integer from its ID attribute.
Attributes | INHERIT
Default Value | true
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | 0
ID | 36981

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/SMTPSVC | IIsSmtpService
/LM/SMTPSVC/n | IIsSmtpServer

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


SmtpHeloTimeout

The SmtpHeloTimeout property determines how long the server waits, after a client issues this command, before hanging up because of inactivity.
Attribute Name | Attribute Value
XML Data Type | DWORD
WMI Data Type | SINT32
ADSI Data Type | DWORD
ABO Data Type | DWORD
ABO Metabase Identifier | No friendly named is defined for this identifier in iiscfng.h. Search the systemroot\System32\Inetsrv\MBSchema.xml file for this property and use the integer from its ID attribute.
Attributes | INHERIT
Default Value | 0
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | 0
ID | 37012

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/SMTPSVC | IIsSmtpService
/LM/SMTPSVC/n | IIsSmtpServer

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


SmtpInboundCommandSupportOptions

The SmtpInboundCommandSupportOptions property is used by Microsoft Exchange.
Attribute Name | Attribute Value
XML Data Type | DWORD
WMI Data Type | SINT32
ADSI Data Type | DWORD
ABO Data Type | DWORD
ABO Metabase Identifier | No friendly named is defined for this identifier in iiscfng.h. Search the systemroot\System32\Inetsrv\MBSchema.xml file for this property and use the integer from its ID attribute.
Attributes | INHERIT
Default Value | 7697601
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | 0
ID | 36998

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/SMTPSVC | IIsSmtpService
/LM/SMTPSVC/n | IIsSmtpServer

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


SmtpIpRestrictionFlag

The SmtpIpRestrictionFlag property is used by Microsoft Exchange.
Attribute Name | Attribute Value
XML Data Type | DWORD
WMI Data Type | SINT32
ADSI Data Type | DWORD
ABO Data Type | DWORD
ABO Metabase Identifier | No friendly named is defined for this identifier in iiscfng.h. Search the systemroot\System32\Inetsrv\MBSchema.xml file for this property and use the integer from its ID attribute.
Attributes | INHERIT
Default Value | 0
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 37031

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/SMTPSVC | IIsSmtpService
/LM/SMTPSVC/n | IIsSmtpServer

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


SmtpLocalDelayExpireMinutes

The SmtpLocalDelayExpireMinutes property corresponds to where users set the local "Delay notification" time period on the Delivery tab. The value in the key is in minutes. This property is listed for both the \smtpsvc and \smtpsvc\1. Changing the setting changes the value of the key for the individual virtual server.
Attribute Name | Attribute Value
XML Data Type | DWORD
WMI Data Type | SINT32
ADSI Data Type | DWORD
ABO Data Type | DWORD
ABO Metabase Identifier | No friendly named is defined for this identifier in iiscfng.h. Search the systemroot\System32\Inetsrv\MBSchema.xml file for this property and use the integer from its ID attribute.
Attributes | INHERIT
Default Value | 60
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | 0
ID | 37017

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/SMTPSVC | IIsSmtpService
/LM/SMTPSVC/n | IIsSmtpServer

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


SmtpLocalNDRExpireMinutes

The SmtpLocalNDRExpireMinutes property corresponds to where users set the local "Expiration timeout" time period on the Delivery tab. The value in the key is in minutes. This property is listed for both the \smtpsvc and \smtpsvc\1. Changing the setting changes the value of the key for the individual virtual server.
Attribute Name | Attribute Value
XML Data Type | DWORD
WMI Data Type | SINT32
ADSI Data Type | DWORD
ABO Data Type | DWORD
ABO Metabase Identifier | No friendly named is defined for this identifier in iiscfng.h. Search the systemroot\System32\Inetsrv\MBSchema.xml file for this property and use the integer from its ID attribute.
Attributes | INHERIT
Default Value | 2880
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | 0
ID | 37018

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/SMTPSVC | IIsSmtpService
/LM/SMTPSVC/n | IIsSmtpServer

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


SmtpMailFromTimeout

The SmtpMailFromTimeout property determines how long the server will wait, after a client issues this command, before hanging up because of inactivity.
Attribute Name | Attribute Value
XML Data Type | DWORD
WMI Data Type | SINT32
ADSI Data Type | DWORD
ABO Data Type | DWORD
ABO Metabase Identifier | No friendly named is defined for this identifier in iiscfng.h. Search the systemroot\System32\Inetsrv\MBSchema.xml file for this property and use the integer from its ID attribute.
Attributes | INHERIT
Default Value | 0
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | 0
ID | 37002

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/SMTPSVC | IIsSmtpService
/LM/SMTPSVC/n | IIsSmtpServer

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


SmtpMailNoHelo

The SmtpMailNoHelo property allows a "mail from" to be issued without issuing an EHLO (or HELO).
Attribute Name | Attribute Value
XML Data Type | Boolean
WMI Data Type | Boolean
ADSI Data Type | Boolean
ABO Data Type | Boolean
ABO Metabase Identifier | No friendly named is defined for this identifier in iiscfng.h. Search the systemroot\System32\Inetsrv\MBSchema.xml file for this property and use the integer from its ID attribute.
Attributes | INHERIT
Default Value | true
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | 0
ID | 36982

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/SMTPSVC | IIsSmtpService
/LM/SMTPSVC/n | IIsSmtpServer

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


SmtpMaxRemoteQThreads

The SmtpMaxRemoteQThreads property is for debugging purposes only.

The metabase represents unlimited as the DWORD value of 4294967295 (0xFFFFFFFF); however, VBScript represents unlimited in hexadecimal format as &HFFFFFFFF. Previous versions of IIS represented unlimited as -1.

Attribute Name | Attribute Value
XML Data Type | DWORD
WMI Data Type | SINT32
ADSI Data Type | DWORD
ABO Data Type | DWORD
ABO Metabase Identifier | No friendly named is defined for this identifier in iiscfng.h. Search the systemroot\System32\Inetsrv\MBSchema.xml file for this property and use the integer from its ID attribute.
Attributes | INHERIT
Default Value | 4294967295
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | 0
ID | 36964

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/SMTPSVC | IIsSmtpService
/LM/SMTPSVC/n | IIsSmtpServer

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


SmtpOutboundCommandSupportOptions

The SmtpOutboundCommandSupportOptions property is used by Microsoft Exchange.
Attribute Name | Attribute Value
XML Data Type | DWORD
WMI Data Type | SINT32
ADSI Data Type | DWORD
ABO Data Type | DWORD
ABO Metabase Identifier | No friendly named is defined for this identifier in iiscfng.h. Search the systemroot\System32\Inetsrv\MBSchema.xml file for this property and use the integer from its ID attribute.
Attributes | INHERIT
Default Value | 7697601
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | 0
ID | 36999

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/SMTPSVC | IIsSmtpService
/LM/SMTPSVC/n | IIsSmtpServer

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


SmtpRcptToTimeout

The SmtpRcptToTimeout property determines how long the server waits, after a client issues this command, before hanging up because of inactivity.
Attribute Name | Attribute Value
XML Data Type | DWORD
WMI Data Type | SINT32
ADSI Data Type | DWORD
ABO Data Type | DWORD
ABO Metabase Identifier | No friendly named is defined for this identifier in iiscfng.h. Search the systemroot\System32\Inetsrv\MBSchema.xml file for this property and use the integer from its ID attribute.
Attributes | INHERIT
Default Value | 0
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | 0
ID | 37003

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/SMTPSVC | IIsSmtpService
/LM/SMTPSVC/n | IIsSmtpServer

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


SmtpRemoteDelayExpireMinutes

The SmtpRemoteDelayExpireMinutes property corresponds to where users set the remote "Delay notification" time period on the Delivery tab. The value in the key is in minutes. This property is listed for both the \smtpsvc and \smtpsvc\1. Changing the setting changes the value of the key for the individual virtual server.
Attribute Name | Attribute Value
XML Data Type | DWORD
WMI Data Type | SINT32
ADSI Data Type | DWORD
ABO Data Type | DWORD
ABO Metabase Identifier | No friendly named is defined for this identifier in iiscfng.h. Search the systemroot\System32\Inetsrv\MBSchema.xml file for this property and use the integer from its ID attribute.
Attributes | INHERIT
Default Value | 60
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | 0
ID | 37019

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/SMTPSVC | IIsSmtpService
/LM/SMTPSVC/n | IIsSmtpServer

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


SmtpRemoteNDRExpireMinutes

The SmtpRemoteNDRExpireMinutes property corresponds to where users set the remote "Expiration timeout" time period on the Delivery tab. The value in the key is in minutes. This property is listed for both the \smtpsvc and \smtpsvc\1. Changing the setting changes the value of the key for the individual virtual server.
Attribute Name | Attribute Value
XML Data Type | DWORD
WMI Data Type | SINT32
ADSI Data Type | DWORD
ABO Data Type | DWORD
ABO Metabase Identifier | No friendly named is defined for this identifier in iiscfng.h. Search the systemroot\System32\Inetsrv\MBSchema.xml file for this property and use the integer from its ID attribute.
Attributes | INHERIT
Default Value | 2880
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | 0
ID | 37020

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/SMTPSVC | IIsSmtpService
/LM/SMTPSVC/n | IIsSmtpServer

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


SmtpRemoteProgressiveRetry

The SmtpRemoteProgressiveRetry property corresponds to where users set "First retry interval," "Second retry interval," "Third retry interval," and "Subsequent retry interval" for an SMTP message on the Delivery tab. This property exists for \smtpsvc and \smtpsvc\1. Setting the value changes the metabase setting for the individual virtual server, not the whole smtpsvc.
Attribute Name | Attribute Value
XML Data Type | String
WMI Data Type | String
ADSI Data Type | String
ABO Data Type | String
ABO Metabase Identifier | No friendly named is defined for this identifier in iiscfng.h. Search the systemroot\System32\Inetsrv\MBSchema.xml file for this property and use the integer from its ID attribute.
Attributes | INHERIT
Default Value | null
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 36996

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/SMTPSVC | IIsSmtpService
/LM/SMTPSVC/n | IIsSmtpServer

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


SmtpRemoteRetryThreshold

The SmtpRemoteRetryThreshold property is used by Microsoft Exchange.
Attribute Name | Attribute Value
XML Data Type | DWORD
WMI Data Type | SINT32
ADSI Data Type | DWORD
ABO Data Type | DWORD
ABO Metabase Identifier | No friendly named is defined for this identifier in iiscfng.h. Search the systemroot\System32\Inetsrv\MBSchema.xml file for this property and use the integer from its ID attribute.
Attributes | INHERIT
Default Value | 3
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | 0
ID | 36995

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/SMTPSVC | IIsSmtpService
/LM/SMTPSVC/n | IIsSmtpServer

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


SmtpRoutingTableType

The SmtpRoutingTableType property is obsolete.
Attribute Name | Attribute Value
XML Data Type | String
WMI Data Type | String
ADSI Data Type | String
ABO Data Type | String
ABO Metabase Identifier | No friendly named is defined for this identifier in iiscfng.h. Search the systemroot\System32\Inetsrv\MBSchema.xml file for this property and use the integer from its ID attribute.
Attributes | INHERIT
Default Value | ldap
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 36950

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/SMTPSVC/n/RoutingSources | IIsSmtpRoutingSource

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


SmtpRsetTimeout

The SmtpRsetTimeout property determines how long the server waits, after a client issues this command, before hanging up because of inactivity.
Attribute Name | Attribute Value
XML Data Type | DWORD
WMI Data Type | SINT32
ADSI Data Type | DWORD
ABO Data Type | DWORD
ABO Metabase Identifier | No friendly named is defined for this identifier in iiscfng.h. Search the systemroot\System32\Inetsrv\MBSchema.xml file for this property and use the integer from its ID attribute.
Attributes | INHERIT
Default Value | 0
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | 0
ID | 37010

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/SMTPSVC | IIsSmtpService
/LM/SMTPSVC/n | IIsSmtpServer

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


SmtpSaslTimeout

The SmtpSaslTimeout property determines how long the server waits, after a client issues this command, before hanging up because of inactivity.
Attribute Name | Attribute Value
XML Data Type | DWORD
WMI Data Type | SINT32
ADSI Data Type | DWORD
ABO Data Type | DWORD
ABO Metabase Identifier | No friendly named is defined for this identifier in iiscfng.h. Search the systemroot\System32\Inetsrv\MBSchema.xml file for this property and use the integer from its ID attribute.
Attributes | INHERIT
Default Value | 0
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | 0
ID | 37007

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/SMTPSVC | IIsSmtpService
/LM/SMTPSVC/n | IIsSmtpServer

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


SmtpServer

The SmtpServer property contains the address of the SMTP server for use when sending e-mail to a moderator.
Attribute Name | Attribute Value
XML Data Type | String
WMI Data Type | String
ADSI Data Type | String
ABO Data Type | String
ABO Metabase Identifier | No friendly named is defined for this identifier in iiscfng.h. Search the systemroot\System32\Inetsrv\MBSchema.xml file for this property and use the integer from its ID attribute.
Attributes | INHERIT
Default Value | null
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 45059

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/NNTPSVC | IIsNntpService
/LM/NNTPSVC/n | IIsNntpServer

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


SmtpServiceVersion

The SmtpServiceVersion property is used by Microsoft Exchange.
Attribute Name | Attribute Value
XML Data Type | DWORD
WMI Data Type | SINT32
ADSI Data Type | DWORD
ABO Data Type | DWORD
ABO Metabase Identifier | No friendly named is defined for this identifier in iiscfng.h. Search the systemroot\System32\Inetsrv\MBSchema.xml file for this property and use the integer from its ID attribute.
Attributes | INHERIT
Default Value | 0
MetaFlagsEx | CACHE_PROPERTY_CLEARED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | 0
ID | 36931

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/SMTPSVC | IIsSmtpService
/LM/SMTPSVC/n | IIsSmtpServer

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


SmtpSSLCertHostnameValidation

Certificates have a "common name" that matches the name of the computer that owns it. The SmtpSSLCertHostnameValidation property verifies that the "common name" of a certificate matches the name of the remote computer that sent the certificate.
Attribute Name | Attribute Value
XML Data Type | Boolean
WMI Data Type | Boolean
ADSI Data Type | Boolean
ABO Data Type | Boolean
ABO Metabase Identifier | No friendly named is defined for this identifier in iiscfng.h. Search the systemroot\System32\Inetsrv\MBSchema.xml file for this property and use the integer from its ID attribute.
Attributes | INHERIT
Default Value | true
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | 0
ID | 37026

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/SMTPSVC | IIsSmtpService
/LM/SMTPSVC/n | IIsSmtpServer

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


SmtpSSLRequireTrustedCA

The SmtpSSLRequireTrustedCA property enables verification of a certificate that a remote host gives you when you connect to it. It makes sure this certificate is in your trusted certificate root on your computer. If not, it kills the SSL session and the handshake is rejected.
Attribute Name | Attribute Value
XML Data Type | Boolean
WMI Data Type | Boolean
ADSI Data Type | Boolean
ABO Data Type | Boolean
ABO Metabase Identifier | No friendly named is defined for this identifier in iiscfng.h. Search the systemroot\System32\Inetsrv\MBSchema.xml file for this property and use the integer from its ID attribute.
Attributes | INHERIT
Default Value | true
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | 0
ID | 37025

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/SMTPSVC | IIsSmtpService
/LM/SMTPSVC/n | IIsSmtpServer

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


SmtpTurnTimeout

The SmtpTurnTimeout property determines how long the server waits, after a client issues this command, before hanging up because of inactivity.
Attribute Name | Attribute Value
XML Data Type | DWORD
WMI Data Type | SINT32
ADSI Data Type | DWORD
ABO Data Type | DWORD
ABO Metabase Identifier | No friendly named is defined for this identifier in iiscfng.h. Search the systemroot\System32\Inetsrv\MBSchema.xml file for this property and use the integer from its ID attribute.
Attributes | INHERIT
Default Value | 0
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | 0
ID | 37009

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/SMTPSVC | IIsSmtpService
/LM/SMTPSVC/n | IIsSmtpServer

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


SmtpUseTcpDns

The SmtpUseTcpDns property specifies if SMTP uses TCP for DNS. The value can be 0 (IE UDP only), 1 (TCP only), 2 (try UDP and then TCP), or others.

The metabase represents unlimited as the DWORD value of 4294967295 (0xFFFFFFFF); however, VBScript represents unlimited in hexadecimal format as &HFFFFFFFF. Previous versions of IIS represented unlimited as -1.

Attribute Name | Attribute Value
XML Data Type | DWORD
WMI Data Type | Boolean
ADSI Data Type | DWORD
ABO Data Type | DWORD
ABO Metabase Identifier | No friendly named is defined for this identifier in iiscfng.h. Search the systemroot\System32\Inetsrv\MBSchema.xml file for this property and use the integer from its ID attribute.
Attributes | INHERIT
Default Value | 4294967295
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | 0
ID | 36997

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/SMTPSVC | IIsSmtpService
/LM/SMTPSVC/n | IIsSmtpServer

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


SSIExecDisable

The SSIExecDisable property specifies whether server-side include (SSI) #exec directives are disabled under this path.

Attribute Name | Attribute Value
XML Data Type | Boolean
WMI Data Type | Boolean
ADSI Data Type | Boolean
ABO Data Type | Boolean
ABO Metabase Identifier | MD_SSI_EXEC_DISABLED
Attributes | INHERIT
Default Value | false
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_FILE
StartingNumber | Not applicable
EndingNumber | 0
ID | 6028

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/W3SVC/n/ROOT /LM/W3SVC/n/ROOT/virtual_directory_name | IIsWebVirtualDir
/LM/W3SVC/n | IIsWebServer
/LM/W3SVC | IIsWebService
/LM/W3SVC/n/ROOT/file_name /LM/W3SVC/n/ROOT/virtual_directory_name/file_name | IIsWebFile
/LM/W3SVC/n/ROOT/physical_directory_name /LM/W3SVC/n/virtual_directory_name/physical_directory_name | IIsWebDirectory

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


SSLAlwaysNegoClientCert

The SSLAlwaysNegoClientCert property controls SSL client connection negotiations. If this property is set to true, any time SSL connections are negotiated, the server will immediately negotiate a client certificate, preventing an expensive renegotiation. Setting SSLAlwaysNegoClientCert also helps eliminate client certificate renegotiation deadlocks, which may occur when a client is blocked on sending a large request body when a renegotiation request is received.
Attribute Name | Attribute Value
XML Data Type | BOOL
WMI Data Type | BOOL
ADSI Data Type | BOOL
ABO Data Type | BOOL
ABO Metabase Identifier | MD_SSL_ALWAYS_NEGO_CLIENT_CERT
Attributes | INHERIT
Default Value | FALSE
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | 0
EndingNumber | 1
ID | 5521

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/W3SVC/n | IIsWebServer
/LM/W3SVC | IIsWebService

Code Example

For general code examples, please see Code Examples to Configure Metabase Properties


SSLCertHash

The SSLCertHash property is used by Microsoft Exchange.
Attribute Name | Attribute Value
XML Data Type | binary
WMI Data Type | binary
ADSI Data Type | binary
ABO Data Type | binary
ABO Metabase Identifier | MD_SSL_CERT_HASH
Attributes | INHERIT
Default Value | null
MetaFlagsEx | CACHE_PROPERTY_CLEARED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 5506

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/W3SVC/n | IIsWebServer
/LM/W3SVC | IIsWebService
/LM/NNTPSVC/n | IIsNntpServer
/LM/SMTPSVC/n | IIsSmtpServer

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


SslCtlIdentifier

The SslCtlIdentifier property contains a unique value that identifies a specific certificate trust list (CTL). It must be used with SslCtlStoreName to accurately reference a CTL.
Attribute Name | Attribute Value
XML Data Type | STRING
WMI Data Type | STRING
ADSI Data Type | STRING
ABO Data Type | STRING
ABO Metabase Identifier | No friendly named is defined for this identifier in iiscfng.h. Search the systemroot\System32\Inetsrv\MBSchema.xml file for this property and use the integer from its ID attribute.
Attributes | NO_ATTRIBUTES
Default Value | null
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 5512

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/W3SVC/n | IIsWebServer

Code Example

For general code examples, please see Code Examples to Configure Metabase Properties
Related Topics

SslCtlStoreName


SslCtlStoreName

The SslCtlStoreName property contains the name of the CAPI store that contains certificate trust lists (CTL). It must be used with SslCtlIdentifier to accurately reference a CTL.
Attribute Name | Attribute Value
XML Data Type | STRING
WMI Data Type | STRING
ADSI Data Type | STRING
ABO Data Type | STRING
ABO Metabase Identifier | No friendly named is defined for this identifier in iiscfng.h. Search the systemroot\System32\Inetsrv\MBSchema.xml file for this property and use the integer from its ID attribute.
Attributes | NO_ATTRIBUTES
Default Value | null
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 5517

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/W3SVC/n | IIsWebServer

Code Example

For general code examples, please see Code Examples to Configure Metabase Properties
Related Topics

SslCtlIdentifier


SSLStoreName

The SSLStoreName property is used by Microsoft Exchange.
Attribute Name | Attribute Value
XML Data Type | String
WMI Data Type | String
ADSI Data Type | String
ABO Data Type | String
ABO Metabase Identifier | MD_SSL_CERT_STORE_NAME
Attributes | INHERIT
Default Value | null
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 5511

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/W3SVC/n | IIsWebServer
/LM/W3SVC | IIsWebService

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


SslUseDsMapper

The SslUseDsMapper property specifies whether IIS is to use the Windows Directory Service certificate mapper or IIS certificate mapper. If SSLUseDSMapper is set to false, IIS uses the IIS certificate mapper.

Attribute Name | Attribute Value
XML Data Type | Boolean
WMI Data Type | Boolean
ADSI Data Type | Boolean
ABO Data Type | Boolean
ABO Metabase Identifier | MD_SSL_USE_DS_MAPPER
Attributes | INHERIT
Default Value | false
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | 0
ID | 5519

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/W3SVC | IIsWebService

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.
Related Topics
AccessSSLFlags


StartupTimeLimit

The value of the StartupTimeLimit property specifies the amount of time (in seconds) that the World Wide Web Publishing Service (WWW Service) should wait for a worker process to finish starting up and reporting to the WWW Service.
Attribute Name | Attribute Value
XML Data Type | DWORD
WMI Data Type | SINT32
ADSI Data Type | DWORD
ABO Data Type | DWORD
ABO Metabase Identifier | MD_APPPOOL_STARTUP_TIMELIMIT
Attributes | INHERIT
Default Value | 90
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | 4294967
ID | 9011

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/W3SVC/AppPools/DefaultAppPool /LM/W3SVC/AppPools/DefaultAppPool/application_pool_name | IIsApplicationPool
/LM/W3SVC/AppPools | IIsApplicationPools

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


UNCPassword

The UNCPassword property specifies the encrypted password used to gain access to UNC (Universal Naming Convention) virtual roots.

Attribute Name | Attribute Value
XML Data Type | String
WMI Data Type | String
ADSI Data Type | String
ABO Data Type | String
ABO Metabase Identifier | MD_VR_PASSWORD
Attributes | INHERIT | SECURE
Default Value | null
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_FILE
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 3003

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/W3SVC/n/ROOT /LM/W3SVC/n/ROOT/virtual_directory_name | IIsWebVirtualDir
/LM/MSFTPSVC/n/ROOT /LM/MSFTPSVC/n/ROOT/virtual_directory_name | IIsFtpVirtualDir
/LM/NNTPSVC/n/ROOT /LM/NNTPSVC/n/ROOT/virtual_directory_name | IIsNntpVirtualDir
/LM/SMTPSVC/n/ROOT /LM/SMTPSVC/n/ROOT/virtual_directory_name | IIsSmtpVirtualDir

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


UNCUserName

The UNCUserName property specifies the user name for Universal Naming Convention (UNC) virtual roots. Use this property only as a flag for authentication schemes that support delegation.

note Note Integrated Windows authentication (NTLM) does not support delegation.

When a request comes in to the IIS server, IIS looks at the UNCUserName property on the virtual directory. If the property exists and it is not an empty string, then the UNC user name and password are used for authentication. If authentication fails, a 401.2 error is returned to the client. If authentication passes, then the client's original credentials are passed through to the resources that were requested.

Attribute Name | Attribute Value
XML Data Type | String
WMI Data Type | String
ADSI Data Type | String
ABO Data Type | String
ABO Metabase Identifier | MD_VR_USERNAME
Attributes | INHERIT
Default Value | null
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_FILE
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 3002

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/W3SVC/n/ROOT /LM/W3SVC/n/ROOT/virtual_directory_name | IIsWebVirtualDir
/LM/MSFTPSVC/n/ROOT /LM/MSFTPSVC/n/ROOT/virtual_directory_name | IIsFtpVirtualDir
/LM/NNTPSVC/n/ROOT /LM/NNTPSVC/n/ROOT/virtual_directory_name | IIsNntpVirtualDir
/LM/SMTPSVC/n/ROOT /LM/SMTPSVC/n/ROOT/virtual_directory_name | IIsSmtpVirtualDir

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.
Related Topics
UNCPassword
Path


UpdatedDefaultDomain

The UpdatedDefaultDomain property is used by Microsoft Exchange.
Attribute Name | Attribute Value
XML Data Type | Boolean
WMI Data Type | Boolean
ADSI Data Type | Boolean
ABO Data Type | Boolean
ABO Metabase Identifier | No friendly named is defined for this identifier in iiscfng.h. Search the systemroot\System32\Inetsrv\MBSchema.xml file for this property and use the integer from its ID attribute.
Attributes | INHERIT
Default Value | true
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | 0
ID | 36937

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/SMTPSVC | IIsSmtpService
/LM/SMTPSVC/n | IIsSmtpServer

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


UpdatedFQDN

The UpdatedFQDN property is used by Microsoft Exchange.
Attribute Name | Attribute Value
XML Data Type | Boolean
WMI Data Type | Boolean
ADSI Data Type | Boolean
ABO Data Type | Boolean
ABO Metabase Identifier | No friendly named is defined for this identifier in iiscfng.h. Search the systemroot\System32\Inetsrv\MBSchema.xml file for this property and use the integer from its ID attribute.
Attributes | INHERIT
Default Value | true
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | 0
ID | 36936

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/SMTPSVC | IIsSmtpService
/LM/SMTPSVC/n | IIsSmtpServer

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


UploadReadAheadSize

The UploadReadAheadSize property establishes the number of bytes a Web server will read into a buffer and pass to an ISAPI extension. This occurs once per client request. The ISAPI extension receives any additional data directly from the client. The range is 0 to &HFFFFFFFF (4 GB).

Attribute Name | Attribute Value
XML Data Type | DWORD
WMI Data Type | SINT32
ADSI Data Type | DWORD
ABO Data Type | DWORD
ABO Metabase Identifier | MD_UPLOAD_READAHEAD_SIZE
Attributes | INHERIT
Default Value | 49152
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_FILE
StartingNumber | Not applicable
EndingNumber | 0
ID | 6045

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/W3SVC/n/ROOT /LM/W3SVC/n/ROOT/virtual_directory_name | IIsWebVirtualDir
/LM/W3SVC/n | IIsWebServer
/LM/W3SVC | IIsWebService
/LM/W3SVC/n/ROOT/file_name /LM/W3SVC/n/ROOT/virtual_directory_name/file_name | IIsWebFile
/LM/W3SVC/n/ROOT/physical_directory_name /LM/W3SVC/n/virtual_directory_name/physical_directory_name | IIsWebDirectory

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


UseDigestSSP

The UseDigestSSP property is used by Advanced Digest authentication to switch between Digest and Advanced Digest security support provider interface (SSPI) code. If this property is set to true, the SSPI code for Advanced Digest is used. In all other cases (false, empty or not set), IIS uses the Digest SSPI code.

important Important If Digest SSPI code is used and dedicated application mode is selected, the LocalSystem account must be used as the identity.

Attribute Name | Attribute Value
XML Data Type | Boolean
WMI Data Type | Boolean
ADSI Data Type | Boolean
ABO Data Type | Boolean
ABO Metabase Identifier | MD_USE_DIGEST_SSP
Attributes | INHERIT
Default Value | false
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_FILE
StartingNumber | Not applicable
EndingNumber | 0
ID | 6047

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/W3SVC/n/ROOT /LM/W3SVC/n/ROOT/virtual_directory_name | IIsWebVirtualDir
/LM/W3SVC/n | IIsWebServer
/LM/W3SVC | IIsWebService
/LM/W3SVC/n/ROOT/file_name /LM/W3SVC/n/ROOT/virtual_directory_name/file_name | IIsWebFile
/LM/W3SVC/n/ROOT/physical_directory_name /LM/W3SVC/n/virtual_directory_name/physical_directory_name | IIsWebDirectory

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


UserIsolationMode

The UserIsolationMode property defines the isolation type desired on the corresponding FTP site.

If UserIsolationMode is set to 0, there is no user isolation. This setting is the default and is backwards-compatible.

If the property is set to 1, a client authenticates using local or domain accounts, then is sent to a folder under the root matching the user name. This setting is known as "Isolated (Locally)", and supports users who do not want to use Active Directory (AD).

If the property is set to 2, user isolation is dependent on Active Directory. This setting is known as "Isolated (Active Directory)" and is primarily of use to Internet service providers (ISPs) and other customers who want to set up large numbers of FTP accounts.

If you set this property to 2, you should also set DefaultLogonDomain, ADConnectionsPassword, and ADConnectionsUserName.

Attribute Name | Attribute Value
XML Data Type | DWORD
WMI Data Type | SINT32
ADSI Data Type | DWORD
ABO Data Type | DWORD
ABO Metabase Identifier | MD_USER_ISOLATION
Attributes | INHERIT
Default Value | 0
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | 2
ID | 5012

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/MSFTPSVC/n | IIsFtpServer
/LM/MSFTPSVC | IIsFtpService

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


VrDoExpire

The VrDoExpire property controls whether the virtual root uses its own expiration policy.
Attribute Name | Attribute Value
XML Data Type | Boolean
WMI Data Type | Boolean
ADSI Data Type | Boolean
ABO Data Type | Boolean
ABO Metabase Identifier | No friendly named is defined for this identifier in iiscfng.h. Search the systemroot\System32\Inetsrv\MBSchema.xml file for this property and use the integer from its ID attribute.
Attributes | INHERIT
Default Value | false
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | 0
ID | 46161

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/NNTPSVC/n/ROOT /LM/NNTPSVC/n/ROOT/virtual_directory_name | IIsNntpVirtualDir

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


VrDriverClsid

The VrDriverClsid property is used by Microsoft Exchange.
Attribute Name | Attribute Value
XML Data Type | String
WMI Data Type | String
ADSI Data Type | String
ABO Data Type | String
ABO Metabase Identifier | No friendly named is defined for this identifier in iiscfng.h. Search the systemroot\System32\Inetsrv\MBSchema.xml file for this property and use the integer from its ID attribute.
Attributes | INHERIT
Default Value | null
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 46156

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/NNTPSVC/n/ROOT /LM/NNTPSVC/n/ROOT/virtual_directory_name | IIsNntpVirtualDir

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


VrDriverProgid

The VrDriverProgid property is used by Microsoft Exchange.
Attribute Name | Attribute Value
XML Data Type | String
WMI Data Type | String
ADSI Data Type | String
ABO Data Type | String
ABO Metabase Identifier | No friendly named is defined for this identifier in iiscfng.h. Search the systemroot\System32\Inetsrv\MBSchema.xml file for this property and use the integer from its ID attribute.
Attributes | INHERIT
Default Value | null
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 46157

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/NNTPSVC/n/ROOT /LM/NNTPSVC/n/ROOT/virtual_directory_name | IIsNntpVirtualDir

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


VrOwnModerator

The VrOwnModerator property is used by Microsoft Exchange.
Attribute Name | Attribute Value
XML Data Type | Boolean
WMI Data Type | Boolean
ADSI Data Type | Boolean
ABO Data Type | Boolean
ABO Metabase Identifier | No friendly named is defined for this identifier in iiscfng.h. Search the systemroot\System32\Inetsrv\MBSchema.xml file for this property and use the integer from its ID attribute.
Attributes | INHERIT
Default Value | null
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | 0
ID | 46163

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/NNTPSVC/n/ROOT /LM/NNTPSVC/n/ROOT/virtual_directory_name | IIsNntpVirtualDir

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


VrUseAccount

The VrUseAccount property controls wither the virtual root account is used to log on.
Attribute Name | Attribute Value
XML Data Type | DWORD
WMI Data Type | SINT32
ADSI Data Type | DWORD
ABO Data Type | DWORD
ABO Metabase Identifier | No friendly named is defined for this identifier in iiscfng.h. Search the systemroot\System32\Inetsrv\MBSchema.xml file for this property and use the integer from its ID attribute.
Attributes | INHERIT
Default Value | null
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | 0
ID | 46160

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/NNTPSVC/n/ROOT /LM/NNTPSVC/n/ROOT/virtual_directory_name | IIsNntpVirtualDir

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


WAMUserName

The WAMUserName property specifies the account user name that IIS uses by default as the COM+ application identity for newly created IIS out-of-process applications. The values of this property and its companion property, WAMUserPass, are set when IIS is installed, and match the user name and password values in the Microsoft Windows user account, which is established at the same time. Changing the value of this property is not recommended. If you do, change it to a valid Windows user account, and change WAMUserPass to the corresponding password for the new account.

important Important Changes to WAMUserName and WAMUserPass may disrupt the operation of existing IIS out-of-process applications. You can synchronize application identities using Component Services to edit the user name and password values, found on the Identity tab of the property sheet for each package.

In-process applications are not affected by these property values.

Attribute Name | Attribute Value
XML Data Type | String
WMI Data Type | String
ADSI Data Type | String
ABO Data Type | String
ABO Metabase Identifier | MD_WAM_USER_NAME
Attributes | INHERIT
Default Value | null
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_FILE
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 7501

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/W3SVC | IIsWebService
/LM/W3SVC/AppPools/DefaultAppPool /LM/W3SVC/AppPools/DefaultAppPool/application_pool_name | IIsApplicationPool
/LM/W3SVC/AppPools | IIsApplicationPools

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.
Related Topics
WAMUserPass


WAMUserPass

The WAMUserPass property specifies the password for the account that IIS uses by default as the COM+ application identity for newly created IIS out-of-process applications. The values of this property and its companion property, WAMUserName, are set when IIS is installed, and match the password and user name values in the Microsoft Windows user account (IWAM_MachineName, where MachineName is the name of the machine on which IIS is installed) established at the same time.

important Important Changing the value of this property is not recommended. If you do, you must change the Windows account password to the identical value. You must also synchronize existing IIS out-of-process application identities, using Component Services to edit the user name and password values, which are found on the Identity tab of the property sheet for each package.

In-process applications are not affected by these property values.

Attribute Name | Attribute Value
XML Data Type | String
WMI Data Type | String
ADSI Data Type | String
ABO Data Type | String
ABO Metabase Identifier | MD_VR_PATH_DELIMITER_string
Attributes | INHERIT | SECURE
Default Value | null
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_FILE
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 7502

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/W3SVC | IIsWebService
/LM/W3SVC/AppPools/DefaultAppPool /LM/W3SVC/AppPools/DefaultAppPool/application_pool_name | IIsApplicationPool
/LM/W3SVC/AppPools | IIsApplicationPools

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.
Related Topics
WAMUserName


WebSvcExtRestrictionList

The WebSvcExtRestrictionList property contains a multi-string list of ISAPIs and CGIs used by applications on the Web server, including their location, descriptive information, and a flag for determining whether the Web service extension is enabled or disabled. The WebSvcExtRestrictionList property is used by the Web server to determine whether an ISAPI extension is permitted to run.

Each string element is written as: AllowDenyFlag,ExtensionPhysicalPath,UIDeletableFlag,GroupID,Description

  • AllowDenyFlag is "0" if the extension is not allowed or "1" if the extension is allowed.
  • ExtensionPhysicalPath is the full path to the extension. If the last four characters of the physical path are ".dll" (case insensitive), then the extension is an ISAPI, otherwise it is a CGI. In the case of CGI script mappings, the physical path must contain the physical path from the mapping (i.e. "c:\windows\system32\cmd.exe %s %s").
  • UIDeletableFlag is "1" if the UI is allowed to delete the extension from the list or "0" if the UI is not allowed to delete it.
  • GroupID is a non-localizable string used to identify groups of extensions.
  • Description is a localizable description of the extension.

Example

Some examples of elements in this property are shown below. The first two entries, for *.dll and *.exe are special cases, referring to 'All Unlisted ISAPIs' and 'All Unlisted CGIs', respectively. The Web server core enables or disables all ISAPIs or all CGIs depending on the setting, if these entries are present:

"0,*.dll"
"0,*.exe"
"0,c:\windows\system32\inetsrv\asp.dll,0,ASP,Active Server Pages"
"0,c:\windows\system32\inetsrv\httpodbc.dll,0,HTTPODBC,Internet Data Connector"
"0,c:\windows\system32\inetsrv\ssinc.dll,1,SSINC,Server Side Includes"

Attribute Name | Attribute Value
XML Data Type | MULTISZ
WMI Data Type | MULTISZ
ADSI Data Type | MULTISZ
ABO Data Type | MULTISZ
ABO Metabase Identifier | MD_WEB_SVC_EXT_RESTRICTION_LIST
Attributes | NO_ATTRIBUTES
Default Value | null
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 2168

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/W3SVC | IIsWebService

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


Win32Error

The Win32Error property indicates the Microsoft Win32 error status code. For more information on Microsoft Win32 error codes, see Win32 Error Codes in Windows Help or MSDN Online on the Web.

Attribute Name | Attribute Value
XML Data Type | DWORD
WMI Data Type | SINT32
ADSI Data Type | DWORD
ABO Data Type | DWORD
ABO Metabase Identifier | MD_WIN32_ERROR
Attributes | VOLATILE
Default Value | 0
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 1099

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/W3SVC/n/ROOT /LM/W3SVC/n/ROOT/virtual_directory_name | IIsWebVirtualDir
/LM/W3SVC/n | IIsWebServer
/LM/MSFTPSVC/n | IIsFtpServer
/LM/MSFTPSVC/n/ROOT /LM/MSFTPSVC/n/ROOT/virtual_directory_name | IIsFtpVirtualDir
/LM/W3SVC/Filters/filter_name /LM/W3SVC/n/Filters/filter_name | IIsFilter
/LM/NNTPSVC/n | IIsNntpServer
/LM/NNTPSVC/n/ROOT /LM/NNTPSVC/n/ROOT/virtual_directory_name | IIsNntpVirtualDir
/LM/SMTPSVC/n | IIsSmtpServer
/LM/SMTPSVC/n/ROOT /LM/SMTPSVC/n/ROOT/virtual_directory_name | IIsSmtpVirtualDir
/LM/W3SVC/AppPools/DefaultAppPool /LM/W3SVC/AppPools/DefaultAppPool/application_pool_name | IIsApplicationPool
/LM/W3SVC/AppPools | IIsApplicationPools

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


XMLSchemaTimeStamp

The XMLSchemaTimeStamp property keeps the MBSchema.xml file in sync with the binary schema file.

important Important Because this property is internally configured by IIS, you should consider it to be read-only. Do not configure this property.

Attribute Name | Attribute Value
XML Data Type | binary
WMI Data Type | binary
ADSI Data Type | binary
ABO Data Type | binary
ABO Metabase Identifier | MD_GLOBAL_XMLSCHEMATIMESTAMP
Attributes | NO_ATTRIBUTES
Default Value | null
MetaFlagsEx | Not applicable
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 9992

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
. | IIS_Global

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


XoverTableFile

The XoverTableFile property specifies the Xover hash file.
Attribute Name | Attribute Value
XML Data Type | String
WMI Data Type | String
ADSI Data Type | String
ABO Data Type | String
ABO Metabase Identifier | No friendly named is defined for this identifier in iiscfng.h. Search the systemroot\System32\Inetsrv\MBSchema.xml file for this property and use the integer from its ID attribute.
Attributes | INHERIT
Default Value | null
MetaFlagsEx | CACHE_PROPERTY_MODIFIED
User Type | IIS_MD_UT_SERVER
StartingNumber | Not applicable
EndingNumber | Not applicable
ID | 45161

Configurable Locations

You can configure this property at the following locations in the IIS metabase.

Metabase Path | IIS Admin Object Type
/LM/NNTPSVC/n | IIsNntpServer

Code Example

For general code examples, see Code Examples to Configure Metabase Properties.


Registry Reference

The configuration registry stores entries that define the working environment for the Microsoft® Windows® operating system and any services that are installed on a computer running Windows. You can use graphical tools (such as Control Panel or Setup) to change these values, or you can use the Registry Editor (Regedit.exe) utility that is included in Windows to modify the configuration registry directly.

This section includes the following information:

  • About the Registry: Provides conceptual topics related to the registry.
  • Global Registry Entries: Specifies entries used for global control of Internet services.
  • Service-Specific Registry Entries: Specifies entries stored in the registry by Internet services for service-specific behavior.
  • WWW Service Registry Entries: Specifies entries for the World Wide Web Publishing Service (WWW service) only.
  • FTP Service Registry Entries: Specifies entries for FTP services only.
Related Topics
  • For information on the metabase, see IIS Metabase.
  • For information on routine server administration tasks, see Server Administration Guide.
(The following words are used by Search; they are not intended to be displayed on the page.) W3SVC


About the Registry

The registry is a repository for information about a computer's configuration, such as profiles for each user and the programs that are installed. The registry is organized hierarchically and is made up of keys and their subkeys, hives, and entries.

Many entries that existed in the registry for previous versions of Internet Information Services (IIS) were migrated to a fast-access, hierarchical database, called the metabase. Entries that were migrated to the metabase are known as metabase properties. Most of the remaining registry keys are used to initiate Internet services and enable backward compatibility with previous versions of IIS, are specific to a service, or are global to IIS and all services. Any new configuration for IIS should be written to the metabase.

Windows includes Registry Editor, which can be used to configure the registry. For information about using Registry Editor, see Registry Editor in Windows Help.

important Important For a registry change to take effect, you must restart the service that is affected by the change. For global changes to take effect, you must restart all services.

Related Topics

  • For more information on the registry, see Registry structure in Windows Help.
  • For information on how to restart IIS, see Restarting IIS.
  • For more information on the IIS metabase, see IIS Metabase.


Global Registry Entries

The following registry entries affect all of the IIS services, without having to be set for each individual service. On a default installation of IIS, you might not see some of these registry entries, which indicates the default values are being used. To set these entries to other than default values, you must manually create the keys and set them.

IncrementalSiteIDCreation
Registry Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\InetMgr\Parameters
Data Type: REG_DWORD
Default value: Key is not created by default, and therefore site identifiers are large, unique, randomly generated numbers.
Range: 0 - 1

When a new site is created on IIS 6.0, a site identification number is randomly generated using the name of the Web site. This ensures that all IIS 6.0 servers in a Web farm have a good chance of generating the same site identification number for sites of the same name. With IIS 5.1 and previous versions, site identification numbers were incremental. For example, because the default Web site is created first, its site identification number is 1, and the next site to be created is identified as 2.

If you have administration scripts that depend upon the IIS 5.1 method of generating site identification numbers, you can create the IncrementalSiteIDCreation key at the path specified above, and set it to 1 to force IIS to use incremental site identification numbers.

note Note When you remotely administer another IIS server, the value of the registry key of the local server is used to determine the generation of site identification numbers on the remote server.

To choose the identification number of your Web site, create the site programmatically using the IIsWebService.CreateNewSite or IIsFtpService.CreateNewSite WMI method, whose optional fourth parameter holds a user-chosen site identification number.
DisableLazyContentPropagation
Registry Path: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ASP\Parameters
Data Type: REG_DWORD
Defaultvalue: 0 (lazy propogation enabled)
Range: 0 - 1
Lazy propogation refers to the action that IIS takes when a large amount of content is updated at one time.

IIS has an internal limit of how much content can be updated in the in-memory template cache. If the size of the updated content exceeds that limit, IIS marks each of the files in the in-memory template cache as invalid. On the first request to an invalid file, IIS begins to compile a new template but the expired template is served and is continued to be served until the new template is compiled.

If you set DisableLazyContentPropagation to 1, IIS behaves as it does for IIS 5.0 and IIS 5.1 when a large amount of content is updated at one time. IIS flushes the in-memory template cache, and performance can slow to a standstill as each new request to the server forces IIS to compile new templates.

If you are developing Web pages and making changes to a few files at a time, you do not have to refresh your pages twice to see new changes because lazy propogation only applies when a large amount of content is updated at one time.

CacheSecurityDescriptor
Registry Path: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\InetInfo\Parameters
Data Type: REG_DWORD
Defaultvalue: 1 (enabled)
Range: 0 - 1
Specifies whether security descriptors are cached for file objects. When CacheSecurityDescriptor is enabled, IIS retrieves security permissions when caching a file object and does not need to gain access to the file object to check access rights for new users. The feature is useful only if you have more than one user account (Web server does not use only Anonymous authentication).
CheckCertRevocation
Registry Path: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\InetInfo\Parameters
Data Type: REG_DWORD
Default value: 0 (disabled)
Range: 0 - 1
Specifies whether client certificates are checked for revocation by IIS. CheckCertRevocation is disabled by default because checking for common certificate issuers is typically done over the Internet and has severe performance impact. However, enabling CheckCertRevocation may be useful if you issue your own certificates and the revocation process is local.
DisableMemoryCache
Registry Path: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\InetInfo\Parameters
Data Type: REG_DWORD
Default value: 0 (disabled)
Range: 0 - 1
Disables server caching.
ListenBackLog
Registry Path: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\InetInfo\Parameters
Data Type: REG_DWORD
Default value: 15
Range: 1 - 250
Specifies the maximum number of active connections to hold in the queue while they wait for server attention. Enhanced IIS functionality generally makes it unnecessary to use or modify this entry, although extremely heavy traffic might benefit by increasing this value up to 50.
LogBufferSize
Registry Path: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Http\Parameters\LogBufferSize
Data Type: REG_DWORD
Default value: N/A
Range: 12,288 - 65,536 (12K - 64K)
Overrides the default logging buffer (per site) of 64K. Using this key, administrators can prevent exessive memory usage when running many thousands of sites on a server. This registry key does not exist by default and must be added to the registry.
MaxCachedFileSize
Registry Path: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\InetInfo\Parameters
Data Type: REG_DWORD
Default value: 256 KB (262,144 bytes)
Controls the maximum size of cache files. The default is 256 KB if no value is present.
MaxConcurrency
Registry Path: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\InetInfo\Parameters
Data Type: REG_DWORD
Default value: 0
Range: 0 - 4,294,967,295 (unlimited)
Specifies the amount of concurrency that a system should provide. IIS uses completion ports to handle input-output (I/O). In general, have more than one thread running and conflicting on shared memory or locks. This key specifies how many threads per processor should be allowed to run simultaneously, if there is a pending I/O operation. A value of 0 allows the system to make the intelligent choice of the number of threads to use. Any nonzero value specifies that the system should allow that many threads per processor to run simultaneously.
MaxPoolThreads
Registry Path: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\InetInfo\Parameters
Data Type: REG_DWORD
Default value: 4
Range: 0 - 4,294,967,295 (unlimited)
Specifies the number of pool threads to create per processor. Pool threads watch for the network for requests and process incoming requests. The MaxPoolThreads count does not include threads that are consumed by ISAPI applications. By default, only four CGI applets can run concurrently. If you run more than four CGI applications, you should increase this value in order to increase the throughput. Optionally, you could set the UsePoolThreadForCGI value to FALSE (0), but this is somewhat dangerous because it can significantly decrease performance during high usage of CGI applications. Generally, you should not create more than 20 threads per processor.
MemCacheSize
Registry Path: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\InetInfo\Parameters
Data Type: REG_DWORD
Default Value: approximately one half the available physical memory and calibrated in megabytes
Range: 0 - 2500MB
Controls the size of the cache. The default value dynamically adjusts every 60 seconds.
PoolThreadLimit
Registry Path: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\InetInfo\Parameters
Data Type: REG_DWORD
Default value: 2 * # MB
Range: 0 - 4,294,967,295 (unlimited)
Specifies the maximum number of pool threads that can be created in the system. Pool threads watch the network for requests and process incoming requests. PoolThreadLimit is a hard limit that includes all IIS threads and is always greater than or equal to MaxPoolThreads.
MinFileBytesPerSec
Registry Path: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\InetInfo\Parameters
Data Type: REG_DWORD
Default value: 240
Range: 1 - 8192
When a Web server sends a file to a client, a timeout is established for how long the server will allow the transfer to continue before ending the connection. The timeout chosen is the maximum of the connection timeout specified in IIS Manager plus the size of the file, and divided by the value specified for MinFileBytesPerSec. For example, a file size of 100 KB is given a timeout of 100 seconds, or the connection timeout if the latter is greater.
ObjectCacheTTL
Registry Path: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\InetInfo\Parameters
Data Type: REG_DWORD
Default Value: 30 (seconds)
Range: 0 - 4,294,967,295 (unlimited)
Controls the Time To Live (TTL) setting, which defines the length of time that objects are held in cached memory. If an object in the memory cache has not been referenced for the defined period, that object will be phased out of the cache. If system memory is limited, or the server's contents are dynamic, you can use a lower TTL to prevent system memory from being used to cache a large number of volatile objects. Setting ObjectCacheTTL to 0xFFFFFFFF disables the object-cache scavenger and allows cached objects to remain in the cache until they are overwritten. Disabling the cache scavenger is useful if your server has ample system memory and your data is relatively static.
ThreadTimeout
Registry Path: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\InetInfo\Parameters
Data Type: REG_DWORD
Default value: 24 * 60 * 60 (24 hours, expressed in seconds)
Range: 0 - 4,294,967,295 (unlimited)
Specifies the amount of time an input-output (I/O) processing thread should be maintained, even if there is no I/O activity on the system. In general, when there is no I/O activity and no requests outstanding, the server remains idle and does not consume memory. But if the server continues and exceeds the ThreadTimeout interval, the I/O processing thread is stopped. Units are in seconds.
UserTokenTTL
Registry Path: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\InetInfo\Parameters
Data Type: REG_DWORD
Default value: 15 * 60 (15 Minutes, expressed in seconds)
Range: 0 - 0x7FFFFFFF
When a request is made to the server, the security credentials for the request (or the configured anonymous user) are used to create a user token on the server. The server impersonates this user token when accessing files or other system resources (see CacheSecurityDescriptor). The token is cached so that the Windows log on takes place only the first time the user accesses the system or after the user's token has fallen out of the cache. Integrated Windows authentication tokens are not cached. Units are in seconds.


Service-Specific Registry Entries

The following entries are stored in the registry per service (for service-specific behavior) but have the same entry name for each service.

Registry path:

HKEY_LOCAL_MACHINE\SYSTEM
\CurrentControlSet
\Services
\ServiceName
\Parameters

where ServiceName is FTP service or World Wide Web Publishing Service (WWW service).

AllowGuestAccess
Registry Path: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ServiceName\Parameters
where ServiceName is FTP service or World Wide Web Publishing Service (WWW service).
Data Type: REG_DWORD
Default value: 1 (enabled)
Range: 0 -1
Specifies whether Guest log ons are allowed for Internet services. When a new user logs on, the server checks to see if the user is logged on as a Windows Guest user. For a Guest connection, based on the value of this entry, the Internet service either rejects or accepts the new connection. Allowing Guest access has been known to cause problems in a poorly managed site. Under the default installation of Windows systems, the Guest account is granted permissions for all types of access on the system. Because this default could easily compromise security, you should change the value of AllowGuestAccess to 0.
EnableSvcLoc
Registry Path: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ServiceName\Parameters
where ServiceName is FTP service or World Wide Web Publishing Service (WWW service).
Data Type: REG_DWORD
Default value: 1 (enabled)
Range: 0 -1
IIS services register themselves with a service locator so that the service can be discovered by the IIS service. EnableSvcLoc controls this registration process. If EnableSvcLoc is set to 0, the service locator will not register the IIS service. If set to 1, the service locator registers the IIS service for service location.

The following registry key, LanguageEngines, is not installed by default. You must create this key in the following location in order to use it.

HKEY_LOCAL_MACHINE\SYSTEM
\CurrentControlSet
\Services
\W3SVC
\ASP
\LanguageEngines
\LanguageName

Value: Write REG_SZ: Response.WriteEquiv |
Value: WriteBlock REG_SZ: Response.WriteBlockEquiv |

LanguageEngines
Registry Path: (See above)
Data Type: REG_STRING
Default value: Not applicable
Specifies a scripting language that does not support the Object.Method syntax as the Active Server Pages (ASP) primary scripting language (the language used within the ASP script delimiters <% ... %>). LanguageName is the name of the chosen language. Response.WriteEquiv is the language's equivalent of Response.Write; and Response.WriteBlockEquiv is the language's equivalent of Response.WriteBlock. The pipe symbol (|) is an insertion used by ASP to send expressions and HTML blocks that are normally processed with Response.Write and Response.WriteBlock methods. This can be done automatically when installing additional scripting languages. If your scripting language is sensitive to white space or newline characters, you may not be able to use it as the primary scripting language even when this registry value is set. As an alternative, you can manually write HTML blocks to the browser or write that language's functions within tagged script blocks (<SCRIPT> ... </SCRIPT> ) and call them from any other language.
(The following words are used by Search; they are not intended to be displayed on the page.) W3SVC


WWW Service Registry Entries

In addition to service-specific registry entries, the World Wide Web Publishing Service (WWW service) maintains the following entries.

LogSuccessfulRequests
Registry Path: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W3SVC\Parameters
Data Type: REG_DWORD
Default value: 1 (enabled)
Range: 0 - 1
Determines whether to record successful activities in the log file. A value of 1 logs successful activities, and a value of 0 turns it off.
SSIEnableCmdDirective
Registry Path: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W3SVC\Parameters
Data Type: REG_DWORD
Default value: 0 (disabled)
Range: 0 - 1
To execute shell commands, the #exec cmd directive of server-side includes is used. Security-conscious sites may want to disable the #exec cmd directive when untrusted parties are allowed to place files on the server by setting SSIEnableCmdDirective to 0 as an added security precaution. SSIEnableCmdDirective does not exist in the registry by default; to allow the #exec cmd directive to execute shell commands, you must first create SSIEnableCmdDirective and set it to 1.
TryExceptDisable
Registry Path: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W3SVC\Parameters
Data Type: REG_DWORD
Default value: 0 (disabled)
Range: 0 - 1
Disables exception caching when calling the HttpExtensionproc of an Internet Server API (ISAPI) application. Setting TryExceptDisable to 1 results in any exception that is caused by a misbehaving ISAPI application to stop the server, but it allows developers to do just-in-time debugging. Therefore, you should set TryExceptDisable to 1 only to debug ISAPI applications.
UploadReadAhead
Registry Path: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W3SVC\Parameters
Data Type: REG_DWORD
Default value: 48KB
Range: 0 - 0x80000000
When a client posts data to the server, some data is read by the server and some by the application. UploadReadAhead sets the amount of data the server will read before passing control to the application. The application is then responsible for reading the rest of the data. If you increase this size, you should increase the amount of RAM on the server.
UsePoolThreadForCGI
Registry Path: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W3SVC\Parameters
Data Type: REG_DWORD
Default value: 1 (enabled)
Range: 0 - 1
IIS, by default, uses a server pool thread to do Common Gateway Interface (CGI) processing. This means that CGI requests that take an extended period of time can consume a server pool thread.
(The following words are used by Search; they are not intended to be displayed on the page.) W3SVC


FTP Service Registry Entries

In addition to service-specific registry entries, the FTP service maintains the following value entries.

AnnotateDirectories
Registry Path: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MSFTPSVC\Parameters\
Data Type: REG_DWORD
Default value: 0 (disabled)
Range: 0,1
The FTP service supports annotating a directory with custom messages. The annotation text is stored in a file named ~ftpsvc~.ckm in the directory to be annotated. If ~ftpsvc~.ckm exists in the target directory of a Change Directory (CWD - Change Working Directory) FTP operation, the FTP service responds with the contents of this file for the operation. This provides a way for administrators to add custom messages for directories under consideration. By default, the service is configured to not send annotation text. If you choose to add a custom message, you should also create the annotation file. Also, you should make the annotation file a hidden file so that the file does not appear on a directory listing.
EnablePortAttack
Registry Path: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MSFTPSVC\Parameters\
Data Type: REG_DWORD
Default value: 0 (disabled)
Range: 0,1
This entry is disabled by default to prevent a security problem in the FTP protocol specification. Because EnablePortAttack is disabled by default, you should enable this flag if you want users to connect by using other ports as specified in the FTP RFC. The FTP service specification allows passive connections to be established based on the port address given by the client. This can allow malicious users to execute destructive commands in the FTP service. The problem occurs when the FTP service makes a connection to a client using a port other than FTP Data port (20) and that port number is less than IP_PORT_RESERVED (1024). EnablePortAttack controls whether or not such an attack should be allowed. By default, the service does not make any connections to port numbers lower than IP_PORT_RESERVED (other than 20).
LowercaseFiles
Registry Path: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MSFTPSVC\Parameters\
Data Type: REG_DWORD
Default value: 0 (disabled)
Range: 0,1
The FTP service uses uppercase for file names. In order for comparisons with case-sensitive file systems to work, you need to ensure that the exact file names are compared. Administrators can add LowercaseFiles to the registry to ensure that the FTP service also uses lowercase for such comparisons.
MaxPassiveAcceptEvents
Registry Path: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MSFTPSVC\Parameters\
Data Type: REG_DWORD
Default value:60
Range: 1 through 300. Any number is rounded up to the nearest multiple of 60 and capped off at 300.
This registry value is intended for advanced users. When FTP clients initiate passive file transfer operations, the FTP server uses asynchronous network notification to wait for the actual client connection to a passive data socket. By default, the FTP server allows 60 passive file transfer operations to be queued simultaneously. Once the queue reaches 60, subsequent client requests receive error 451: Too many Passive Users. Client connections remain in this transient state for a short time, between issuing a file transfer command (e.g. RETR, STOR) and connecting the data channel to the passive socket. For this reason, this error can only occur in one of the following scenarios:
  1. A DoS attack has issued concurrent file transfer commands without actually connecting to the data socket.
  2. An extremely large number of concurrent users are transferring files in passive mode (which is possible on slow networks).

Consistent failure with the above error may indicate a DoS attack. However, sporadic failures at peak usage times may indicate valid usage of this registry value.


Events Reference

IIS generates events in Event Viewer so that you can verify the performance of IIS. Event Viewer tracks (in order of importance) error events, warning events, and informational events. The logs in Event Viewer provide an audited record of all Microsoft® Windows® services and of processes, such as logon and connection times.

This section includes the following information:

  • About Events: Provides conceptual topics related to Windows Events.
  • ASP Errors: Speciies errors generated by the World Wide Web Publishing Service (WWW service) when processing ASP applications that are configured incorrectly.
  • ASP Events: Specifies events generated from Active Server Pages.
  • FTP Service Events: Specifies events generated by the FTP service.
  • ODBC Logging Events: Specifies events caused by Web pages that contain ODBC driver errors.
  • Server-Side Includes Events: Specifies events generated by the part of the WWW service that processes server-side include directives in Web pages.
  • Core WWW Service Events: Specifies events generated from Web services.
  • WWW Performance Counter Events: Specifies events generated by the part of the WWW service that monitors and records performance counter data.
  • WWW Service Events: Specifies events generated by the part of the WWW service that handles internal administration of the IIS server.
Related Topics
  • For information on error messages displayed in the browser of a client, see Custom Error Messages.
  • For information on logging client requests, see Logging Site Activity.


About Events

Logging begins automatically when Windows is started. There are three types of logs: system, security, and application. For each type of log, you can filter the events to be viewed, designate the number of entries to view, specify how long to save entries, and specify whether to automatically overwrite existing events when the log becomes full.

You can open Event Viewer in any one of the following ways:

  • From the Start menu, click Run. In the Open box, type eventvwr. Click OK.

    • - or -

  • Type start eventvwr at the command prompt, and press ENTER.

    • - or -

  • From the Start menu, point to Administrative Tools, and then click Event Viewer.

    • - or -

  • From the Start menu, point to Administrative Tools, and then click Computer Management. Event Viewer is listed under the System Tools node. The benefit of this display is that IIS Manager is in the same window under the Services and Applications node.

ASP Errors and the Windows Events Log

In the Event Viewer, you can open the property pages for each type of log and configure the filter options that generally apply to all events.

IIS increases the degree of control by providing the following two metabase keys that enable you to specify what is sent to the Windows Events log when ASP errors occur.

AspLogErrorRequests

The AspLogErrorRequests property controls whether the Web server writes unsuccessful client requests to the Windows Event Log file. If AspLogErrorRequests is set to true, a standard set of ASP error requests are logged.

If AspLogErrorRequests is set to true and AspErrorsToNTLog is set to false, then the ASP errors are sent to the IIS log. If these errors are serious or logging to IIS log previously failed, then each error is also sent to the Windows Event Log.

If AspLogErrorRequests is set to false, then these errors are only sent to the IIS log, and not to the Windows Event Log.

If AspLogErrorRequests is set to true and AspErrorsToNTLog is set to true, then all ASP related errors go to the Windows Event Log and the IIS log.

To completely prevent ASP errors from being logged in the IIS log file, you must disable logging altogether. To accomplish this see the DontLog and LogType properties.

This key can be set in IIS Manager, or it can be set programmatically using ADSI, WMI, or ABO. See Code Examples to Configure Metabase Properties for instructions on how to programmatically change metabase properties.

To set the AspLogErrorRequests key in IIS Manager

  1. In IIS Manager, right-click a virtual directory.
  2. Set the Application Protection to High (Isolated), and click Configuration.
  3. Click the Process Options tab.
  4. Select the Write unsuccessful client requests to event log check box. When checked, this metabase key is set to TRUE.

AspErrorsToNTLog

If the AspErrorsToNTLog key is set to TRUE, all possible ASP errors are sent to the application event log. If this key is set to FALSE, only a subset of all ASP errors is sent. The subset includes the error numbers 100, 101, 102, 103, 104, 105, 106, 107, 115, 190, 191, 192, 193, 194, 240, 241, and 242. This key cannot be set in IIS Manager, and must be set programmatically.

Related Topics
  • For instructions on how to programmatically change metabase properties, see Code Examples to Configure Metabase Properties.
  • For descriptions of ASP Event errors, see ASP Events.
  • For more information about the metabase and programmatic administration of IIS, see Programmatic Administration Guide.


ASP Errors

This topic lists the errors that are generated by the World Wide Web Publishing Service (WWW service) when processing ASP applications that are configured incorrectly or ASP pages that contain errors. These errors are logged to the Windows Event application log only if the AspLogErrorRequests metabase property is set to true. If the AspErrorsToNTLog metabase property is also set to true, then all of the errors get logged to the Windows Event application log; otherwise, only a subset are logged. The subset includes the error numbers 100, 101, 102, 103, 104, 105, 106, 107, 115, 190, 191, 192, 193, 194, 240, 241, and 242.

note Note When messages appear in the event log or Web browser, the symbols that appear below (such as |, %s, %X, %1, %2, %2!.20s!, and so on) are replaced with details about the error at the time that the error actually occurs.

Event ID | Description
0100 | Out of memory. Unable to allocate required memory.
0101 | Unexpected error. The function returned |.
0102 | Expecting string input. The function expects a string as input.
0103 | Expecting numeric input. The function expects a number as input.
0104 | Operation not Allowed.
0105 | Index out of range. An array index is out of range.
0106 | Type Mismatch. An unhandled data type was encountered.
0107 | Data size too large. Size of data being sent in the request is over the allowed limit.
0108 | Create object failed. An error occurred while creating object '%s'.
0109 | Member not found.
0110 | Unknown name.
0111 | Unknown interface.
0112 | Missing parameter.
0113 | Script timed out. The maximum amount of time for a script to execute was exceeded. You can change this limit by specifying a new value for the property Server.ScriptTimeout or by changing the value in the IIS administration tools.
0114 | Object not free threaded. The application object accepts only free threaded objects; object '%s' is not free threaded.
0115 | Unexpected error. A trappable error (%X) occurred in an external object. The script cannot continue running.
0116 | Missing close of script delimiter. The Script block lacks the close of script tag (%>).
0117 | Missing close of script tag. The Script block lacks the close of script tag (</SCRIPT>) or close of tag symbol (>).
0118 | Missing close of object tag. The Object block lacks the close of object tag (</OBJECT>) or close of tag symbol (>).
0119 | Missing Classid or Progid attribute. The object instance '|' requires a valid Classid or Progid in the object tag.
0120 | Invalid Runat attribute. The Runat attribute of the Script tag or Object tag can only have the value 'Server'.
0121 | Invalid Scope in object tag. The object instance '|' cannot have Application or Session scope. To create the object instance with Session or Application scope, place the Object tag in the Global.asa file.
0122 | Invalid Scope in object tag. The object instance '|' must have Application or Session scope. This applies to all objects created in a Global.asa file.
0123 | Missing Id attribute. The required Id attribute of the Object tag is missing.
0124 | Missing Language attribute. The required Language attribute of the Script tag is missing.
0125 | Missing close of attribute. The value of the '|' attribute has no closing delimiter.
0126 | Include file not found. The include file '|' was not found.
0127 | Missing close of HTML comment. The HTML comment or server-side include lacks the close tag (-->).
0128 | Missing File or Virtual attribute. The Include file name must be specified using either the File or Virtual attribute.
0129 | Unknown scripting language. The scripting language '|' is not found on the server.
0130 | Invalid File attribute. File attribute '|' cannot start with forward slash or back slash.
0131 | Disallowed Parent Path. The Include file '|' cannot contain '..' to indicate the parent directory.
0132 | Compilation Error. The Active Server Page '|' could not be processed.
0133 | Invalid ClassID attribute. The object tag has an invalid ClassID of '|'.
0134 | Invalid ProgID attribute. The object has an invalid ProgID of '|'.
0135 | Cyclic Include. The file '|' is included by itself (perhaps indirectly). Please check include files for other Include statements.
0136 | Invalid object instance name. The object instance '|' is attempting to use a reserved name. This name is used by Active Server Pages intrinsic objects.
0137 | Invalid Global Script. Script blocks must be one of the allowed Global.asa procedures. Script directives within <% ... %> are not allowed within the Global.asa file. The allowed procedure names are Application_OnStart, Application_OnEnd, Session_OnStart, or Session_OnEnd.
0138 | Nested Script Block. A script block cannot be placed inside another script block.
0139 | Nested Object. An object tag cannot be placed inside another object tag.
0140 | Page Command Out Of Order. The @ command must be the first command within the Active Server Page.
0141 | Page Command Repeated. The @ command can only be used once within the Active Server Page.
0142 | Thread token error. A thread token failed to open.
0143 | Invalid Application Name. A valid application name was not found.
0144 | Initialization Error. The page level objects list failed during initialization.
0145 | New Application Failed. The new Application could not be added.
0146 | New Session Failed. The new Session could not be added
0147 | 500 Server Error.
0148 | Server Too Busy.
0149 | Application Restarting. The request cannot be processed while the application is being restarted.
0150 | Application Directory Error. The Application directory could not be opened.
0151 | Change Notification Error. The change notification event could not be created.
0152 | Security Error. An error occurred while processing a user's security credentials.
0153 | Thread Error. A new thread request failed.
0154 | Write HTTP Header Error. The HTTP headers could not be written to the client browser.
0155 | Write Page Content Error. The page content could not be written to the client browser.
0156 | Header Error. The HTTP headers are already written to the client browser. Any HTTP header modifications must be made before writing page content.
0157 | Buffering On. Buffering cannot be turned off once it is already turned on.
0158 | Missing URL. A URL is required.
0159 | Buffering Off. Buffering must be on.
0160 | Logging Failure. Failure to write entry to log.
0161 | Data Type Error. The conversion of a Variant to a String variable failed.
0162 | Cannot Modify Cookie. The cookie 'ASPSessionID' cannot be modified. It is a reserved cookie name.
0163 | Invalid Comma Use. Commas cannot be used within a log entry. Please select another delimiter.
0164 | Invalid TimeOut Value. An invalid TimeOut value was specified.
0165 | SessionID Error. A SessionID string cannot be created.
0166 | Uninitialized Object. An attempt was made to access an uninitialized object.
0167 | Session Initialization Error. An error occurred while initializing the Session object.
0168 | Disallowed object use. An intrinsic object cannot be stored within the Session object.
0169 | Missing object information. An object with missing information cannot be stored in the Session object. The threading model information for an object is required.
0170 | Delete Session Error. The Session did not delete properly.
0171 | Missing Path. The Path parameter must be specified for the MapPath method.
0172 | Invalid Path. The Path parameter for the MapPath method must be a virtual path. A physical path was used.
0173 | Invalid Path Character. An invalid character was specified in the Path parameter for the MapPath method.
0174 | Invalid Path Character(s). An invalid '/' or '\\' was found in the Path parameter for the MapPath method.
0175 | Disallowed Path Characters. The '..' characters are not allowed in the Path parameter for the MapPath method.
0176 | Path Not Found. The Path parameter for the MapPath method did not correspond to a known path.
0177 | Server.CreateObject Failed. %s
0178 | Server.CreateObject Access Error. The call to Server.CreateObject failed while checking permissions. Access is denied to this object.
0179 | Application Initialization Error. An error occurred while initializing the Application object.
0180 | Disallowed object use. An intrinsic object cannot be stored within the Application object.
0181 | Invalid threading model. An object using the apartment threading model cannot be stored within the Application object.
0182 | Missing object information. An object with missing information cannot be stored in the Application object. The threading model information for the object is required.
0183 | Empty Cookie Key. A cookie with an empty key cannot be stored.
0184 | Missing Cookie Name. A name must be specified for a cookie.
0185 | Missing Default Property. A default property was not found for the object.
0186 | Error parsing certificate
0187 | Object addition conflict. Could not add object to application. Application was locked down by another request for adding an object.
0188 | Disallowed object use. Cannot add objects created using object tags to the session intrinsic.
0189 | Disallowed object use. Cannot add objects created using object tags to the application intrinsic.
0190 | Unexpected error. A trappable error occurred while releasing an external object.
0191 | Unexpected error. A trappable error occurred in the OnStartPage method of an external object.
0192 | Unexpected error. A trappable error occurred in the OnEndPage method of an external object.
0193 | OnStartPage Failed. An error occurred in the OnStartPage method of an external object.
0194 | OnEndPage Failed. An error occurred in the OnEndPage method of an external object.
0195 | Invalid Server Method Call. This method of the Server object cannot be called during Session_OnEnd and Application_OnEnd.
0196 | Cannot launch out of process component. Only InProc server components should be used. If you want to use LocalServer components, you must set the AspAllowOutOfProcComponents metabase setting. Please consult the help file for important considerations.
0197 | Disallowed object use. Cannot add object with apartment model behavior to the application intrinsic object.
0198 | Server shutting down. Cannot process request
0199 | Disallowed object use. Cannot add JScript objects to the session.
0200 | Out of Range 'Expires' attribute. The date and time given for 'Expires' precedes Jan 1, 1980 or excedes Jan 19, 2038, 3:14:07 GMT.
0201 | Invalid Default Script Language. The default script language specified for this application is invalid.
0202 | Missing Code Page. The code page attribute is missing.
0203 | Invalid Code Page. The specified code page attribute is invalid.
0204 | Invalid CodePage Value. An invalid CodePage value was specified.
0205 | Change Notification. Failed to create event for change notification.
0206 | Cannot call BinaryRead. Cannot call BinaryRead after using Request.Form collection.
0207 | Cannot use Request.Form. Cannot use Request.Form collection after calling BinaryRead.
0208 | Cannot use generic Request collection. Cannot use the generic Request collection after calling BinaryRead.
0209 | Illegal value for TRANSACTION property. The TRANSACTION property can only be REQUIRED, REQUIRES_NEW, SUPPORTED or NOT_SUPPORTED.
0210 | Method not implemented. This method has not yet been implemented.
0211 | Object out of scope. A built-in ASP object has been referenced, which is no longer valid.
0212 | Cannot Clear Buffer. Response.Clear is not allowed after a Response.Flush while Client Debugging is Enabled.
0214 | Invalid Path parameter. The Path parameter excedes the maximum length allowed.
0215 | Illegal value for ENABLESESSIONSTATE property. The ENABLESESSIONSTATE property can only be TRUE or FALSE.
0216 | MSDTC Service not running. Transactional web pages cannot be run if the MSDTC service is not running.
0217 | Invalid Scope in object tag. Object scope must be Page, Session or Application.
0218 | Missing LCID. The LCID attribute is missing.
0219 | Invalid LCID. The specified LCID is not available.
0220 | Requests for GLOBAL.ASA Not Allowed. Requests with the URL pointing to GLOBAL.ASA are not allowed.
0221 | Invalid @ Command directive. The specified '|' option is unknown or invalid.
0222 | Invalid TypeLib Specification. METADATA tag contains an invalid Type Library specification.
0223 | TypeLib Not Found. METADATA tag contains a Type Library specification that does not match any Registry entry.
0224 | Cannot load TypeLib. Cannot load Type Library specified in the METADATA tag.
0225 | Cannot wrap TypeLibs. Cannot create a Type Library Wrapper object from the Type Libraries specified in METADATA tags.
0226 | Cannot modify StaticObjects. StaticObjects collection cannot be modified at run time.
0227 | Server.Execute Failed. The call to Server.Execute failed
0228 | Server.Execute Error. The call to Server.Execute failed while loading the page.
0229 | Server.Transfer Failed. The call to Server.Transfer failed
0230 | Server.Transfer Error. The call to Server.Transfer failed while loading the page.
0231 | Server.Execute Error. Invalid URL form or fully-qualified absolute URL was used. Use relative URLs.
0232 | Invalid Cookie Specification. METADATA tag contains an invalid cookie specification.
0233 | Cannot load cookie script source. Cannot load cookie script source file specified in the METADATA tag.
0234 | Invalid include directive. Server side include directives may not be present in script blocks. Please use the SRC= attribute of the <SCRIPT> tag.
0235 | Server.Transfer Error. Invalid URL form or fully-qualified absolute URL was used. Use relative URLs.
0236 | Invalid Cookie Specification. METADATA tag contains an invalid or missing SRC parameter.
0237 | Invalid Cookie Specification. METADATA tag contains an invalid or missing NAME parameter.
0238 | Missing attribute value. No value was specified for the '|' attribute.
0239 | Cannot process file. UNICODE ASP files are not supported.
0240 | Script Engine Exception. A ScriptEngine threw exception '%X' in '%s' from '%s'.
0241 | CreateObject Exception. The CreateObject of '%s' caused exception %X.
0242 | Query OnStartPage Interface Exception. Querying Object '%s''s OnStartPage or OnEndPage methods caused exception %X.
0243 | Invalid METADATA tag in Global.asa. Only METADATA TYPE="TypeLib" may be used in Global.asa.
0244 | Cannot Enable Session State. Session state cannot be enabled when it has been disabled in the application.
0245 | Mixed usage of Code Page values. The @CODEPAGE value specified differs from that of the including file's CODEPAGE or the file's saved format.
0246 | Too many concurrent users. Please try again later..
0247 | Bad Argument to BinaryRead. The argument to BinaryRead must be non-negative.
0248 | Script isn't transacted. This ASP file must be transacted in order to use the ObjectContext object.
0249 | Cannot use IStream on Request. Cannot use IStream on Request object after using Request.Form collection or Request.BinaryRead.
0250 | Invalid Default Code Page. The default code page specified for this application is invalid.
0251 | Response Buffer Limit Exceeded. Execution of the ASP page caused the Response Buffer to exceed its configured limit.


ASP Events

This topic lists the events that are generated by the World Wide Web Publishing Service (WWW service) when processing ASP applications that are configured incorrectly or ASP pages that contain errors. These events are logged to the Windows Event application log regardless of the value of the AspLogErrorRequests metabase property.

note Note When messages appear in the event log or Web browser, the symbols that appear below (such as |, %s, %X, %1, %2, %2!.20s!, and so on) are replaced with details about the error at the time that the error actually occurs.

Event ID | Description
0x10 | Warning: %1, %2.
0x11 | Warning: %1, %2, %3.
0x12 | Warning: %1, %2, %3, %4.
0x13 | Failed to create an ASP Session due to Access Denied when activating COM+ Partition %1.
0x14 | Failed to create ASP Application %1 due to invalid or missing COM+ Partition ID.
0x15 | Failed to retrieve the Anonymous User Token for ASP Application %1. Global.ASA OnEnd routines will not be executed.
0x16 | Failed to impersonate the Anonymous User for ASP Application %1. Global.ASA OnEnd routines will not be executed.
0x17 | No Default Script Language specified for Application %s. Using default: %s.
0x1f3 | Invalid ProgID.
0x5 | Error: %1.
0x6 | Error: %1, %2.
0x7 | Error: %1, %2, %3.
0x8 | Error: %1, %2, %3, %4.
0x9 | Warning: %1.


FTP Service Events

This topic lists the events that are generated by the FTP service.

note Note When messages appear in the event log or Web browser, the symbols that appear in the documentation below (such as |, %s, %X, %1, %2, %2!.20s!, and so on) are replaced with details about the error at the time that the error actually occurs.

Event ID | Description
1 | FTP Server could not initialize its security. The data is the error.
3 | FTP Server could not initialize the socket library. The data is the error.
4 | FTP Server was unable to initialize due to a shortage of available memory. The data is the error.
5 | FTP Server could not locate the FTP/TCP service. The data is the error.
6 | FTP Server could not create the main connection socket. The data is the error.
7 | FTP Server could not create the main connection thread. The data is the error.
8 | FTP Server could not create a client worker thread for user at host %1. The connection to this user is terminated. The data is the error.
9 | A call to a system service failed unexpectedly. The data is the error.
10 | User %1 at host %2 has timed-out after %3 seconds of inactivity.
11 | Anonymous logon request received from %1 at host %2.
12 | User logon request received from %1 at host %2.
13 | User %1 failed to log on, could not access the home directory %2.
14 | User %1 denied access to the current directory %2 due to a security change.
15 | Failed to read metabase property PassivePortRange under the FTP Service node %1.
16 | The FTP Service configuration property PassivePortRange has invalid value: %1.


ODBC Logging Events

This topic lists the events that are caused by Web pages that contain ODBC driver errors.

note Note When messages appear in the event log or Web browser, the symbols that appear below (such as |, %s, %X, %1, %2, %2!.20s!, and so on) are replaced with details about the error at the time that the error actually occurs.

Event ID | Description
2602 | The form you just filled in requires the %1 entry to be filled in. Please fill in that entry in the form and resubmit the form.
2603 | The query file could not be opened. The file may not exist or you may have insufficient permission to open the file.
2605 | The template file contains an else tag without a matching if tag.
2606 | The template file contains an endif tag without a matching if tag.
2607 | The template file contains an expression with parameters that are of different type. For example, an if tag comparing a string with a number would cause this error.
2608 | The template file contains an expression using the CONTAINS operator where one or both parameters are not strings. CONTAINS is only valid with string values.
2609 | The template file contains an expression that uses a quoted string but the close quote is missing.
2610 | The template file contains an expression with an unrecognized operator. Valid operators are GT, LT, EQ and CONTAINS.
2611 | The query file contains an unrecognized field %1.
2612 | The query file must contain a valid, non-empty Datasource: field and SQLStatement: field.
2613 | The library odbc32.dll could not be loaded to perform the query. Make sure ODBC has been properly installed on the server.
2615 | Error performing query. %1
2616 | The maximum number of SQLStatement fields in the IDC file has been exceeded.


Server-Side Include Events

Server-Side Includes Events

This topic lists the events that are generated by the part of the World Wide Web Publishing Service (WWW service) that processes server-side include directives in Web pages.

note Note When messages appear in the event log or Web browser, the symbols that appear below (such as |, %s, %X, %1, %2, %2!.20s!, and so on) are replaced with details about the error at the time that the error actually occurs.

Event ID | Description
2501 | Error processing SSI file.
2502 | Invalid SSI tag.
2503 | Cannot perform flastmod(): Win32 Error Code = %2!.20s!
2504 | Cannot perform fsize(): Win32 Error Code = %2!.20s!
2505 | Variable '%1!.40s!' cannot be found.
2506 | Variable '%1!.40s!' cannot be evaluated.
2507 | SSI feature not supported
2508 | Error handling SSI File : Win32 Error Code = %2!.20s!
2509 | Failed to process SSI file.
2510 | Failed to execute CMD : Win32 Error Code = %2!.20s!
2511 | Failed to execute CGI : Win32 Error Code = %2!.20s!
2512 | Failed to execute ISAPI extension : Win32 Error Code = %2!.20s!
2513 | Cannot #EXEC file due to lack of EXECUTE permission.
2514 | Cannot process file due to access denied.
2515 | A server side include file has included itself or the maximum depth of server side includes has been exceeded.
2516 | The CMD option is not enabled for #EXEC calls.
2517 | #EXEC calls have been disabled for this virtual path.
2518 | There is a recursive #INCLUDE chain.
2519 | Failed to execute script: Http Status Code = %2!.20s!


Core WWW Service Events

This topic lists the events that are generated by the core processes of the World Wide Web Publishing Service (WWW service) such as authentication and authorization, application problems, memory monitoring, and so on.

note Note When messages appear in the event log or Web browser, the symbols that appear below (such as |, %s, %X, %1, %2, %2!.20s!, and so on) are replaced with details about the error at the time that the error actually occurs.

Event ID | Description
2201 | HTTP Server could not initialize its security. The data is the error.
2203 | HTTP Server could not initialize the socket library. The data is the error.
2204 | HTTP Server was unable to initialize due to a shortage of available memory. The data is the error.
2206 | HTTP Server could not create the main connection socket. The data is the error.
2208 | HTTP Server could not create a client connection object for user at host %1. The connection to this user is terminated. The data is the error.
2214 | The HTTP Filter DLL %1 failed to load. The data is the error.
2216 | The script started from the URL '%1' with parameters '%2' has not responded within the configured timeout period. The HTTP server is terminating the script.
2218 | The HTTP server encountered an error processing the server side include file '%1'.The error was '%2'.
2219 | The HTTP server encountered an unhandled exception while processing the ISAPI Application '%1'.
2220 | The HTTP server was unable to load the ISAPI Application '%1'. The data is the error.
2221 | A server side include file has included itself or the maximum depth of server side includes has been exceeded.
2222 | An attempt was made to load filter '%1' on a server instance but it requires the SF_NOTIFY_READ_RAW_DATA filter notification so it must be loaded as a global filter.
2223 | For compatibility with previous versions of IIS, the filter '%1' was loaded as a global filter from the registry. To control the filter with the Internet Service Manager, remove the filter from the registry and add it as a global filter with Internet Service Manager. Filters in the registry are stored at "HKLM\System\CurrentControlSet\Services\W3Svc\Parameters\Filter DLLs".
2226 | The server was unable to read the file %1 due to a lack of access permissions.
2227 | The server was unable to acquire a license for a SSL connection.
2228 | The server stop serving requests for application '%1' because the number of Out of Process component crashes exceed a limit.
2229 | The server failed to shut down application '%1'. The error was '%2'.
2230 | The server was unable to read the file %1. The file does not exist.
2231 | The server was unable to read the file %1. The Windows 32 error returned from the attempt is %2.
2232 | The server was unable to read the file %1. The file exceeds the maximum allowable size of %2.
2233 | The server was unable to allocate a buffer to read the file %1.
2236 | The server failed to load application '%1'. The error was '%2'.
2237 | Out of process application '%1' terminated unexpectedly.
2238 | Job object query failed. The data is the error.
2239 | Job object set limit failed. The data is the error.
2240 | Schedule a work item for CPU Accounting or Limits failed. The data is the error.
2241 | Site '%1' hit its CPU Limit. No action was taken.
2242 | Site '%1' hit its CPU Limit. The priority of all process on that site has been lowered to idle class.
2243 | Site '%1' hit its CPU Limit. All processes on that site have been terminated.
2244 | Site '%1' hit its CPU Limit. The site has been paused.
2245 | The server certificate for instance '%1' has expired or is not yet valid.
2246 | The server certificate for instance '%1' has been revoked.
2247 | The server certificate for instance '%1' does not chain up to a trusted root certificate.
2248 | One of the certificates in the certificate chain of the server certificate for instance '%1' has an invalid signature.
2249 | CPU Limits/Accounting failed to queue work item. The data is the error.
2250 | The server certificate for instance '%1' had invalid metabase data associated with it and could not be retrieved; the error encountered was '%2'.
2251 | A CryptoAPI error was encountered trying to retrieve the server certificate for instance '%1'; the error encountered was '%2'.
2252 | The server certificate for instance '%1' could not be retrieved because it could not be found in a certificate store; the error encountered was '%2'
2253 | The server certificate for instance '%1' could not be retrieved due to an internal error; the error encountered was '%2'.
2254 | The server Certificate Trust List for instance '%1' had invalid metabase data associated with it and could not be retrieved; the error encountered was '%2'.
2255 | A CryptoAPI error was encountered trying to retrieve the server Certificate Trust List for instance '%1'; the error encountered was '%2'.
2256 | The server Certificate Trust List for instance '%1' could not be retrieved because it could not be found in a certificate store; the error encountered was '%2'.
2257 | The server certificate for instance '%1' could not be retrieved due to an internal error; the error number is '%2'.
2258 | The server failed to close client connections to the following URLs during shutdown: '%1'.
2259 | The COM Application '%1' at '%2' failed to activate out of process.
2261 | An attempt was made to load filter '%1' but it requires the SF_NOTIFY_READ_RAW_DATA filter notification and this notification is not supported in Worker Process Isolation Mode.
2262 | ISAPI '%1' reported itself as unhealthy for the following reason: '%2'.
2263 | ISAPI '%1' reported itself as unhealthy. No reason was given by the ISAPI.
2264 | The directory specified for caching compressed content %1 is invalid. Static compression is being disabled.
2265 | The registry key for IIS subauthenticator is not configured correctly on local machine, the anonymous password sync feature is disabled.
2266 | The account that the current worker process is running under does not have SeTcbPrivilege privilege, the anonymous password sync feature and the Digest authentication feature are disabled.
2267 | Raw ISAPI Filter could not be loaded due to configuration problem. HTTPFilter Service has to be hosted in Inetinfo.exe for Raw ISAPI filters to work correctly. The most likely reason is that IIS5IsolationModeEnabled setting was changed and HTTPFilter service was not restarted. Restart HTTPFilter for configuration changes to be taken into effect.
2268 | Could not load all ISAPI filters for site/service. Therefore startup aborted.
2269 | The worker process failed to initialize the HTTP.sys communication or the w3svc communication layer and therefore could not be started. The data field contains the error number.
2270 | IIS Client certificate mapping configuration for site %1 failed to be loaded. The data field contains the error number.
2271 | Could not initialize the logging module for site %1. The site will therefore be non-functional.
2272 | The registry key for IIS subauthenticator is not configured correctly on domain controller, the Digest feature is disabled.


WWW Performance Counter Events

This topic lists the events that are generated by the part of the World Wide Web Publishing Service (WWW service) that monitors and records performance counter data.

note Note When messages appear in the event log or Web browser, the symbols that appear below (such as |, %s, %X, %1, %2, %2!.20s!, and so on) are replaced with details about the error at the time that the error actually occurs.

Event ID | Description
2000 | Unable to query the W3SVC (HTTP) service performance data. The error code returned by the service is data DWORD 0.
2001 | It has taken too long to refresh the W3SVC counters, the stale counters are being used instead.
2002 | Setting up Web Service counters failed, please make sure your Web Service counters are registered correctly.
2003 | It has taken too long to refresh the W3SVC counters, the stale counters are being used instead. This is the second message within the past %1 (hours, minutes, seconds). No more stale counter messages will be logged for this client session until the time limit expires. %nFor additional information specific to this message please visit the Microsoft Online Support site located at: http://go.microsoft.com/fwlink?linkid=538.


WWW Service Events

This topic lists the events that are generated by the part of the World Wide Web Publishing Service (WWW service) that handles internal administration of the IIS server.

note Note When messages appear in the event log or Web browser, the symbols that appear below (such as |, %s, %X, %1, %2, %2!.20s!, and so on) are replaced with details about the error at the time that the error actually occurs.

Event ID | Description
1001 | The World Wide Web Publishing Service's Inetinfo.exe process monitor encountered an error and has shut down. This condition prevents the World Wide Web Publishing Service from detecting an unexpected termination of the Inetinfo.exe process and, therefore, may not detect changes to the metabase as expected. It is recommended that you restart the World Wide Web Publishing Service.
1002 | Application pool '%1' is being automatically disabled due to a series of failures in the process(es) serving that application pool.
1003 | Cannot register the URL prefix '%1' for site '%2'. The URL may be invalid. The site has been deactivated. The data field contains the error number.
1004 | Cannot register the URL prefix '%1' for site '%2'. The site has been deactivated. The data field contains the error number.
1005 | The World Wide Web Publishing Service is exiting due to an error. The data field contains the error number.
1006 | Not Used.
1007 | Cannot register the URL prefix '%1' for site '%2'. The necessary network binding may already be in use. The site has been deactivated. The data field contains the error number.
1008 | Not Used.
1009 | A process serving application pool '%1' terminated unexpectedly. The process id was '%2'. The process exit code was '0x%3'.
1010 | A process serving application pool '%1' failed to respond to a ping. The process id was '%2'.
1011 | A process serving application pool '%1' suffered a fatal communication error with the World Wide Web Publishing Service. The process id was '%2'. The data field contains the error number.
1012 | A process serving application pool '%1' exceeded time limits during start up. The process id was '%2'.
1013 | A process serving application pool '%1' exceeded time limits during shut down. The process id was '%2'.
1014 | The World Wide Web Publishing Service encountered an internal error in its process management of worker process '%2' serving application pool '%1'. The data field contains the error number.
1015 | A process serving application pool '%1' was orphaned but the specified orphan action %2 could not be executed. The data field contains the error number.
1016 | Unable to configure logging for site '%1'. The data field contains the error number.
1017 | The World Wide Web Publishing Service has terminated due to a Worker process failure.
1018 | The World Wide Web Publishing Service was not able to initialize performance counters. The service will run without the performance counters. Please restart the World Wide Web Publishing Service to reinitialize the performance counters. The data field contains the error number.
1019 | The World Wide Web Publishing Service encountered difficulty initializing performance counters. Performance counters will function, however, not all counter data may be accurate. The data field contains the error number.
1020 | The World Wide Web Publishing Service encountered difficulty configuring the HTTP.sys control channel property '%1'. The data field contains the error number.
1021 | The identity of application pool, '%1' is invalid. If it remains invalid when the first request for the application pool is processed, the application pool will be disabled. The data field contains the error number.
1022 | The World Wide Web Publishing Service failed to create a worker process for the application pool '%1'. The data field contains the error number.
1023 | Not Used.
1024 | Virtual site '%1' is configured to truncate its log every '%2' bytes. Since this value must be at least 1048576 bytes ( 1 megabyte ), 1048576 bytes will be used.
1025 | Application pool '%1' exceeded its job limit settings.
1026 | An error occurred securing the handle of application pool '%1'. Therefore, the application pool was not secured as expected. Change the identification information to cause the World Wide Web Publishing Service to secure the handle of the application pool again. The data field contains the error number.
1027 | The World Wide Web Publishing Service's request of HTTP.sys to enable the application pool '%1' failed. The data field contains the error number.
1028 | The World Wide Web Publishing Service failed to add the worker process '%1' to the job object representing application pool '%2'. The data field contains the error number.
1029 | A failure occurred while configuring an application's bindings for site '%1'. The site has been deactivated. The data field contains the error number.
1030 | Inetinfo.exe terminated unexpectedly and the system was not configured to restart IIS Admin. The World Wide Web Publishing Service has shut down.
1031 | Not Used.
1032 | A failure occurred while configuring the logging properties for the site '%1'. Probable cause: A mapped network path is being used for the site's log file directory path, which is not supported by IIS. Please use a UNC path instead.
1033 | A failure occurred while configuring the logging properties for the site '%1'. Probable cause: The site's log file directory contains an invalid machine or share name.
1034 | A failure occurred while configuring the logging properties for the site '%1'. The server does not have access permissions to the site's log file directory.
1035 | A failure occurred while configuring the logging properties for the site '%1'. The site's log file directory is not fully qualified. Probable cause: It is missing the drive letter or other crucial information.
1036 | A failure occurred while initializing the configuration manager for the World Wide Web Publishing Service. The data field contains the error number.
1037 | A failure occurred while opening the HTTP control channel for the World Wide Web Publishing Service. The data field contains the error number.
1038 | Not Used.
1039 | A process serving application pool '%1' reported a failure. The process id was '%2'. The data field contains the error number.
1040 | Not Used.
1041 | The '%1' '%2' failed range validation for property '%3'. The configured value '%4' is outside of the range '%5' to '%6'. The value will default to '%7'.
1042 | The AppPoolCommand property set on the application pool '%1' is not a valid value. It is '%2'. It must be either MD_APPPOOL_COMMAND_START = 1 or MD_APPPOOL_COMMAND_STOP = 2.
1043 | The virtual site '%1' has been invalidated and will be ignored because valid site bindings could not be constructed, or no site bindings exist.
1044 | The virtual site '%1' has been invalidated and will be ignored because the site's AppPoolId is null.
1045 | Not Used.
1046 | The server command property for virtual site '%1' is not a valid value. It is set to '%2'. It must be one of the following: MD_SERVER_COMMAND_START = 1 or MD_SERVER_COMMAND_STOP = 2 or MD_SERVER_COMMAND_PAUSE = 3 or MD_SERVER_COMMAND_CONTINUE = 4.
1047 | The application '%2' belonging to site '%1' has an AppPoolId set, but the property is empty. Therefore, the application will be ignored.
1048 | The application '%2' belonging to site '%1' has an invalid AppPoolId '%3' set. Therefore, the application will be ignored.
1049 | The application pool '%1' has an IdleTimeout '%2' greater than the PeriodicRestartTime '%3'. The defaults ( IdleTimeout = '%4' & PeriodicRestartTime '%5' ) will be used.
1050 | The application pool id '%1' exceeds length limits. It is '%2' characters and can not be more than '%3' characters. The application pool will therefore be ignored.
1051 | An application pool id was defined as a zero length string. An application pool id must not be a zero length string. The application pool will therefore be ignored.
1052 | The application '%2' belongs to an invalid site '%1'. Therefore, the application will be ignored.
1053 | The World Wide Web Publishing Service received a change notification, but was unable to process it correctly. The data field contains the error number.
1054 | The World Wide Web Publishing Service failed to run the auto stop action %2 for application pool '%1'. The data field contains the error number.
1055 | The site '%1' was disabled because the application pool defined for the site '%2' is not a valid application pool.
1056 | The site '%1' was disabled because the application pool '%2' defined for the site's root application is not a valid application pool.
1057 | The identity of application pool '%1' is invalid, so the World Wide Web Publishing Service can not create a worker process to serve the application pool. Therefore, the application pool has been disabled.
1058 | The World Wide Web Publishing Service encountered a failure while setting the affinity mask of application pool '%1'. Probable cause: The mask does not contain any processors available on this machine. The data field contains the error number.
1059 | A failure was encountered while launching the process serving application pool '%1'. The application pool has been disabled.
1060 | The job object associated with application pool '%1' encountered an error during configuration. CPU monitoring may not function as expected. The data field contains the error number.
1061 | The job object attached to application pool '%1' failed to start its timer. The application pool's CPU usage is being monitored and will eventually reach the limit and report a failure. The data field contains the error number.
1062 | The World Wide Web Publishing Service encountered a failure configuring the logging properties on the HTTP Control Channel. Logging Enabled is '%1'. Log File Directory is '%2'. Log Period is '%3'. Log Truncate Size is '%4'. The data field contains the error number.
1063 | The World Wide Web Publishing Service encountered a failure requesting metabase change notifications. The data field contains the error number.
1064 | The World Wide Web Publishing Service encountered a failure requesting metabase change notifications during recovery from Inetinfo.exe terminating unexpectedly. While the World Wide Web Publishing Service will continue to run, it is highly probable that it is no longer using current metabase data. Please restart the World Wide Web Publishing Service to correct this condition. The data field contains the error number.
1065 | Centralized logging is configured to truncate its log every '%1' bytes. Since this value must be at least 1048576 bytes ( 1 megabyte ), 1048576 bytes will be used.
1066 | The World Wide Web Publishing Service encountered an error attempting to configure centralized logging. It is not configured as expected. The data field contains the error number.
1067 | The World Wide Web Publishing Service property '%1' failed range validation. The configured value, '%2' is outside of the range '%3' to '%4'. The default value, '%5', will be used.
1068 | The World Wide Web Publishing Service failed to record the proper state '%2' and win32error '%3' of site '%1'in the metabase. To correct, start/stop the site or restart the World Wide Web Publishing Service. The data field contains the error number.
1069 | The World Wide Web Publishing Service failed to record the proper state '%2' and win32error '%3' of application pool '%1' in the metabase. To correct, start/stop the application pool or restart the World Wide Web Publishing Service. The data field contains the error number.
1070 | The World Wide Web Publishing Service failed to issue recycle requests to all worker processes of application pool '%1'. The data field contains the error number.
1071 | The World Wide Web Publishing Service failed to enable bandwidth throttling on site '%1' because QoS Packet Scheduler is not installed.
1072 | The World Wide Web Publishing Service failed to enable bandwidth throttling on site '%1'. The data field contains the error number.
1073 | The World Wide Web Publishing Service failed to enable global bandwidth throttling because QoS Packet Scheduler is not installed.
1074 | A worker process with process id of '%1' serving application pool '%2' has requested a recycle because the worker process reached its allowed processing time limit.
1075 | A worker process with process id of '%1' serving application pool '%2' has requested a recycle because it reached its allowed request limit.
1076 | A worker process with process id of '%1' serving application pool '%2' has requested a recycle because it reached its scheduled recycle time.
1077 | A worker process with process id of '%1' serving application pool '%2' has requested a recycle because it reached its virtual memory limit.
1078 | An ISAPI reported an unhealthy condition to its worker process. Therefore, the worker process with process id of '%1' serving application pool '%2' has requested a recycle.
1079 | An administrator has requested a recycle of all worker processes in application pool '%1'.
1080 | The worker processes serving application pool '%1' are being recycled due to 1 or more configuration changes in the application pool properties which necessitate a restart of the processes.
1081 | The worker processes serving application pool '%1' are being recycled due to detected problems with the metabase that may make current cached metadata invalid.
1082 | A worker process with pid '%2' that serves application pool '%1' has been determined to be unhealthy (see previous event log message), but because a debugger is attached to it, the World Wide Web Publishing Service will ignore the error.
1083 | HTTP.sys provided inconsistent site performance counter data to the World Wide Web Publishing Service. Therefore, the World Wide Web Publishing Service will ignore the data provided.
1084 | The World Wide Web Publishing Service's request of HTTP.sys to disable the application pool '%1' failed. The data field contains the error number.
1085 | The World Wide Web Publishing Service failed to apply a new configuration for application pool '%1'. The data field contains the error number.
1086 | The World Wide Web Publishing Service failed to properly configure the load balancer capabilities on application pool '%1'. The data field contains the error number.
1087 | The World Wide Web Publishing Service failed to properly configure the application pool queue length on app pool '%1'. The data field contains the error number.
1088 | The World Wide Web Publishing Service failed to properly configure the job object for application pool '%1'. The data field contains the error number.
1089 | The World Wide Web Publishing Service failed to issue a demand start to HTTP.sys for application pool '%1'. The data field contains the error number.
1090 | The World Wide Web Publishing Service failed to update the AutoStart property for application pool '%1'. The data field contains the error number.
1091 | The World Wide Web Publishing Service failed to run the auto stop action for application pool '%1'. The data field contains the error number.
1092 | The World Wide Web Publishing Service failed to issue a request for the worker process '%2' of application pool '%1' to supply its performance counters. The data field contains the error number.
1093 | The World Wide Web Publishing Service failed to overlap recycle for application pool '%1' worker process '%2'. The data field contains the error number.
1094 | The World Wide Web Publishing Service failed to disassociate the application '%1' from the virtual site '%2'. The data field contains the error number.
1095 | The World Wide Web Publishing Service failed to delete the config group for the application '%1' in site '%2'. The data field contains the error number.
1096 | The World Wide Web Publishing Service failed to remove the urls for the virtual site '%1'. The data field contains the error number.
1097 | The World Wide Web Publishing Service failed to set the application pool for the application '%1' in site '%2'. The data field contains the error number.
1098 | The World Wide Web Publishing Service failed to set the max connections for the virtual site '%1'. The data field contains the error number.
1099 | The World Wide Web Publishing Service failed to set the connection timeout for the virtual site '%1'. The data field contains the error number.
1100 | The World Wide Web Publishing Service failed to create the application '%2' in site '%1'. The data field contains the error number.
1101 | The World Wide Web Publishing Service failed to create app pool '%1'. The data field contains the error number.
1102 | The World Wide Web Publishing Service failed to create site '%1'. The data field contains the error number.
1103 | The World Wide Web Publishing Service failed to delete the application '%2' in site '%1'. The data field contains the error number.
1104 | The World Wide Web Publishing Service failed to delete app pool '%1'. The data field contains the error number.
1105 | The World Wide Web Publishing Service failed to delete site '%1'. The data field contains the error number.
1106 | The World Wide Web Publishing Service failed to modify the application '%2' in site '%1'. The data field contains the error number.
1107 | The World Wide Web Publishing Service failed to modify app pool '%1'. The data field contains the error number.
1108 | The World Wide Web Publishing Service failed to modify site '%1'. The data field contains the error number.
1109 | The World Wide Web Publishing Service failed to set the control channel's filter config. The data field contains the error number.
1110 | The World Wide Web Publishing Service failed to write the AutoStart Property for site '%1'. The data field contains the error number.
1111 | The World Wide Web Publishing Service failed to delete all IIS owned SSL configuration data. The data field contains the error number.
1112 | The World Wide Web Publishing Service failed to query SSL configuration data for site '%1'. The data field contains the error number.
1113 | One of the IP/Port combinations for site '%1' has already be configured to be used by another site. The other site's SSL configuration will be used.
1114 | One of the IP/Port combinations for site '%1' has already been configured to be used by another program. The other program's SSL configuration will be used.
1115 | The World Wide Web Publishing Service failed to set SSL configuration data for site '%1'. The data field contains the error number.
1116 | The World Wide Web Publishing Service failed to delete SSL configuration data for site '%1'. The data field contains the error number.
1117 | A worker process with process id of '%1' serving application pool '%2' has requested a recycle because it reached its private bytes memory limit.
1118 | During recovery from an unexpected termination of the Inetinfo.exe process, the World Wide Web Publishing Service failed to identify the appropriate records requiring deletion from its metadata cache. The data field contains the error number.
1119 | During recovery from an unexpected termination of the Inetinfo.exe process, the World Wide Web Publishing Service failed to queue action items necessary to handle the recovery. It is recommended that you restart the World Wide Web Publishing Service. The data field contains the error number.
1120 | The World Wide Web Publishing Service failed to obtain cache counters from HTTP.sys. The reported performance counters do not include performance counters from HTTP.sys for this gathering. The data field contains the error number.
1121 | The World Wide Web Publishing Service failed to obtain site performance counters from HTTP.sys. The reported performance counters do not include counters from HTTP.sys for this gathering. The data field contains the error number.
1122 | The World Wide Web Publishing Service failed to publish the performance counters it gathered. The data field contains the error number.
1123 | The World Wide Web Publishing Service failed to cancel the performance counter gathering timer. The data field contains the error number.
1124 | The World Wide Web Publishing Service failed to cancel the performance counter timer. The data field contains the error number.
1125 | The World Wide Web Publishing Service failed to start the performance counter gathering timer. The data field contains the error number.
1126 | The World Wide Web Publishing Service failed to copy a change notification for processing. Therefore, the service may not be in sync with the current data in the metabase. The data field contains the error number.
1127 | A worker process '%2' serving application pool '%1' is no longer trusted by the World Wide Web Publishing Service, based on ill-formed data the worker process sent to the service.
1128 | The World Wide Web Publishing Service was not able to initialize asp performance counters. The service will therefore run without asp performance counters. Restart the World Wide Web Publishing Service to start asp performance counter gathering. The data field contains the error number.
1129 | Cannot register the URL prefix '%1' for site '%2'. Either the network endpoint for the site's IP address could not be created, or the IP listen list for HTTP.sys did not contain any usable IP addresses. The site has been deactivated. The data field contains the error number.
1130 | Cannot register the URL prefix '%1' for site '%2'. The IP address for the site is not in the HTTP.sys IP listen list. The site has been deactivated. The data field contains the error number.
1131 | Cannot register the URL prefix '%1' for site '%2'. Too many listening ports have been configured in HTTP.sys. The site has been deactivated. The data field contains the error number.


Performance Counters Reference

Performance counters measure quantities of information or data, according to the number, size, duration, and rate of data being requested or received. You should not expect to get a list of details from a counter, such as a list of error messages. Instead, use performance counters to get quantities, such as the number of error message since startup or the rate at which error messages are being generated.

You can access counter data through the System Monitor (formerly known as Performance Monitor) or through the Simple Network Management Protocol (SNMP) service.

The names and descriptions of the following counters are included in this reference:

System Monitor Counters
  • WWW Service Counters
  • ASP System Monitor Counters
  • WWW Service Cache Counters
  • IIS Global Counters
  • FTP Service Counters
SNMP Counters
  • SNMP FTP Service Counters
  • SNMP HTTP Service Counters

You must be a member of the Administrators group on the IIS server or a member of the Performance Logging group to retrieve valid data from the following counters. If you are not a member of one of these groups, or if the service you are monitoring is not running, the performance counters return a zero value.

WWW Service Counters

These counters help you determine how well the World Wide Web Publishing Service (WWW service) processes requests. These counters can be configured to monitor performance for all sites on a server (using the _Total instance) or for individual Web sites. Note that a few counters included with IIS 5.x are now obsolete and are marked as such. Obsolete counters return a zero value.

Counter | Description
Total Bytes Sent | Number of data bytes that have been sent by the WWW service (since service startup). This counter is new in IIS 6.0.
Bytes Sent/Sec | Rate that data bytes are sent by the WWW service, per second. This counter was called Bytes Sent in IIS 5.x.
Total Bytes Received | Total bytes of data received by the WWW service since service startup. This counter is new in IIS 6.0.
Bytes Received/Sec | Rate at which data bytes are received by the WWW service, per second. This counter was called Bytes Recieved in IIS 5.x.
Total Bytes Transferred | Total bytes of data that were sent and received by the WWW service since service startup. This counter is new in IIS 6.0.
Bytes Total/Sec | Sum of bytes sent/sec and bytes received/sec. This counter was called Bytes Total in IIS 5.x.
Total Files Sent | Number of user-mode files that were sent by the WWW service since service startup (not including cache hits). Note that this counter does not increment when files are being served from the kernel-mode cache. For more information, see Kernel: URI Cache Hits under WWW Service Cache Counters.
Files Sent/Sec | Rate that files are sent, per second.
Total Files Received | Number of files received by the WWW service since service startup.
Files Received/Sec | Rate at which files are received by the WWW service, per second.
Total Files Transferred | Sum of files sent and received by the WWW service since service startup. Note that this counter does not increment when files are being served from the kernel-mode cache. For more information, see Kernel: URI Cache Hits under WWW Service Cache Counters.
Files/Sec | Rate at which files are sent and received by the WWW service, per second.
Current Anonymous Users | Number of users who currently have an anonymous request using the WWW service. Note that IIS 6.0 counts each request as a new user. This is a change from IIS 5.x, which counted each connection as a new user. Current Users (Anonymous or NonAnonymous) are now the number of requests currently being worked on by the server.
Current NonAnonymous Users | Number of users who currently have a nonanonymous request using the WWW service. Note that IIS 6.0 counts each request as a unique user. This is a change from IIS 5.x, which counted each connection as a new user. Current Users (Anonymous or NonAnonymous) are now the number of requests currently being worked on by the server.
Total Anonymous Users | Number of users who established an anonymous request since the WWW service started. Note that IIS 6.0 counts each request as a unique user. This counter does not increment when files are being served from the kernel cache. For more information, see Kernel: URI Cache Hits under WWW Service Cache Counters.
Anonymous Users/Sec | Rate at which users are making anonymous requests to the WWW service. Note that IIS 6.0 counts each request as a new user.
Total NonAnonymous Users | Number of users who had nonanonymous requests to the WWW service since service startup. Note that IIS 6.0 counts each request as a unique user. This counter does not increment when files are being served from the kernel cache. For more information, see Kernel: URI Cache Hits under WWW Service Cache Counters.
NonAnonymous Users/Sec | Rate at which users are making nonanonymous requests to the WWW service, per second. Note that IIS 6.0 counts each request as a new user.
Maximum NonAnonymous Users | Maximum number of users who made concurrent nonanonymous requests to the WWW service since service startup. Note that IIS 6.0 counts each request as a new user.
Current Connections | Current number of active connections to the WWW service. The behavior of this counter is unchanged from IIS 5.x.
Maximum Connections | Maximum number of simultaneous connections to the WWW service since service startup.
Total Connection Attempts | Number of attempted connections to the WWW service since service startup.
Connection Attempts/Sec | Rate of attempted connections to the WWW service since service startup, per second.
Total Logon Attempts | Number of logons attempted on the WWW service since service startup.
Logon Attempts/Sec | Rate at which logons to the WWW service are being attempted, per second.
Total Options Requests | Number of HTTP requests that were using the OPTIONS method since WWW service startup.
Options Requests/Sec | Rate at which HTTP requests using the OPTIONS method are made.
Total Get Requests | Number of HTTP requests that were using the GET method since WWW service startup.
Get Requests/Sec | Rate at which HTTP requests using the GET method are made to the WWW service, per second.
Total Post Requests | Number of HTTP requests that were using the POST method since WWW service startup.
Post Requests/Sec | Rate at which requests using the POST method are made to the WWW service, per second.
Total Head Requests | Number of HTTP requests that were made using the HEAD method since WWW service startup.
Head Requests/Sec | Rate at which HTTP requests using the HEAD method are made to the WWW service, per second.
Total Put Requests | Number of HTTP requests that were using the PUT method since WWW service startup.
Put Requests/Sec | Rate at which HTTP requests using the PUT method are made to the WWW service, per second.
Total Delete Requests | Number of HTTP requests that were using the DELETE method since WWW service startup.
Delete Requests/Sec | Rate at which HTTP requests using the DELETE method are made to the WWW service, per second.
Total Trace Requests | Number of HTTP requests that were using the TRACE method since WWW service startup.
Trace Requests/Sec | Rate at which HTTP requests using the TRACE method are made to the WWW service, per second.
Total Move Requests | Number of HTTP requests that were using the MOVE method since WWW service startup.
Move Requests/Sec | Rate at which HTTP requests using the MOVE method are made to the WWW service, per second.
Total Copy Requests | Number of HTTP requests that were using the COPY method since WWW service startup.
Copy Requests/Sec | Rate at which HTTP requests using the COPY method are made to the WWW service, per second.
Total Mkcol Requests | Number of HTTP requests that were using the MKCOL method since WWW service startup.
Mkcol Requests/Sec | Rate at which HTTP requests using the MKCOL method are made to the WWW service, per second.
Total Propfind Requests | Number of HTTP requests that were using the PROPFIND method since WWW service startup.
Propfind Requests/Sec | Rate at which HTTP requests using the PROPFIND method are made to the WWW service, per second.
Total Proppatch Requests | Number of HTTP requests that were using the PROPPATCH method since WWW service startup.
Proppatch Requests/Sec | Rate at which HTTP requests using the PROPPATCH method are made to the WWW service, per second.
Total Search Requests | Number of HTTP requests that were using the SEARCH method since WWW service startup.
Search Requests/Sec | Rate at which HTTP requests using the SEARCH method are made to the WWW service, per second.
Total Lock Requests | Number of HTTP requests that were using the LOCK method since WWW service startup.
Lock Requests/Sec | Rate at which HTTP requests using the LOCK method are made to the WWW service, per second.
Total Unlock Requests | Number of HTTP requests that were using the UNLOCK method since WWW service startup.
Unlock Requests/Sec | Rate at which HTTP requests using the UNLOCK method are made to the WWW service, per second.
Total Other Requests Methods | Number of HTTP requests that do not use the OPTIONS, GET, HEAD, POST, PUT, DELETE, TRACE, MOVE, COPY, MKCOL, PROPFIND, PROPPATCH, SEARCH, LOCK, or UNLOCK methods since WWW service startup. May include LINK or other methods supported by gateway applications.
Other Requests Methods/Sec | Rate at which HTTP requests are made to the WWW service that do not use the methods listed for Total Other Requests, per second.
Total Method Requests | Number of HTTP requests since WWW service startup.
Total Method Requests/Sec | Rate at which all HTTP requests are received, per second.
Total Not Found Errors | Number of requests that could not be satisfied by the server because the requested document could not be found (since service startup). Generally reported as HTTP error 404.
Not Found Errors/Sec | Rate of errors due to requests that couldn't be satisfiedby the server because the requested document couldn't be found, per second.
Total Locked Errors | Number of requests that could not be satisfied by the server because the requested document was locked (since service startup). Generally reported as HTTP error 423.
Locked Errors/Sec | Rate at which requests couldn't be satisfied because the document requested was locked, per second.
Current CGI Requests | Current number of CGI requests that are being processed simultaneously by the WWW service.
Total CGI Requests | Number of all CGI requests that have been made since WWW service startup.
CGI Requests/Sec | Rate at which CGI requests are being processed simultaneously by the WWW service, per second.
Maximum CGI Requests | Maximum number of CGI requests simultaneously processed by the WWW service since service startup.
Current ISAPI Extension Requests | Current number of ISAPI extension requests that are being processed simultaneously by the WWW service.
Total ISAPI Extension Requests | Number of all ISAPI extension requests that have been made since WWW service startup.
ISAPI Extension Requests/Sec | Rate of ISAPI extension requests that are processed simultaneously by the WWW service, per second.
Maximum ISAPI Extension Requests | Maximum number of ISAPI extension requests that have been processed simultaneously by the WWW service.
Current CAL count for authenticated users | This counter is no longer valid. The value will always be zero.
Maximum CAL count for authenticated users | This counter is no longer valid. The value will always be zero.
Total count of failed CAL requests for authenticated users | This counter is no longer valid. The value will always be zero.
Current CAL count for SSL connections | This counter is no longer valid. The value will always be zero.
Maximum CAL count for SSL connections | This counter is no longer valid. The value will always be zero.
Total count of failed CAL requests for SSL connections | This counter is no longer valid. The value will always be zero.
Total Allowed Async I/O Requests | This counter is no longer valid. The value will always be zero.
Total Blocked Async I/O Requests | This counter is no longer valid. The value will always be zero.
Total Rejected Async I/O Requests | This counter is no longer valid. The value will always be zero.
Current Blocked Async I/O Requests | This counter is no longer valid. The value will always be zero.
Measured Async I/O Bandwidth Usage | This counter is no longer valid. The value will always be zero.
Total blocked bandwidth bytes | Total bytes blocked due to bandwidth throttling settings (since service startup). This counter is new in IIS 6.0.
Current blocked bandwidth bytes | Current bytes temporarily blocked due to bandwidth throttling settings (since service startup). This counter is new in IIS 6.0.
Service Uptime | Uptime for WWW service or Web site.
MaxCalSsl | This counter is no longer valid. The value will always be zero.

Return to top

ASP System Monitor Counters

If you are running Active Server Pages (ASP) on your server, these counters can help you determine how well the pages are performing. The counters are designed to monitor server performance and cannot be configured for individual sites.

Counter | Description
ASP Debugging Requests | Number of requests for debugging documents since WWW service startup.
Errors During Script Runtime | Number of requests failed due to runtime errors.
Errors From ASP Preprocessor | Number of requests failed due to preprocessor errors.
Errors From Script Compilers | Number of requests failed due to script compilation errors.
Errors/Sec | Number of errors per second.
Request Bytes In Total | Total size, in bytes, of all requests.
Request Bytes Out Total | Total size, in bytes, of responses sent to clients. This does not include standard HTTP response headers.
Request Execution Time | Number of milliseconds that it took to execute the most recent request.
Request Wait Time | Number of milliseconds the most recent request was waiting in the queue.
Requests Disconnected | Number of requests that were disconnected due to communication failure.
Requests Executing | Number of requests currently executing.
Requests Failed Total | Number of requests failed due to errors, authorization failure, and rejections.
Requests Not Authorized | Number of requests failed due to insufficient access rights.
Requests Not Found | Number of requests for files that were not found.
Requests Queued | Number of requests waiting for service from the queue.
Requests Rejected | Number of requests not executed because there were insufficient resources to process them.
Requests Succeeded | Number of requests that executed successfully.
Requests Timed Out | Number of requests that timed out.
Requests Total | Number of requests since the service was started.
Requests/Sec | Number of requests executed per second.
Script Engines Cached | Number of script engines in cache.
Session Duration | Number of milliseconds that the most recent session persisted.
Sessions Current | The current number of sessions being serviced.
Sessions Timed Out | Number of sessions timed out.
Sessions Total | Number of sessions since the service was started.
Templates Cached | Number of templates currently cached.
Template Cache Hit Rate | Percent of requests found in template cache.
Template Notifications | Number of templates invalidated in the cache due to change notification.
Transactions Aborted | Number of transactions aborted.
Transactions Committed | Number of transactions committed.
Transactions Pending | Number of transactions in progress.
Transactions Total | Number of transactions since the service was started.
Transactions/Sec | Transactions started per second.
In Memory Templates Cached | Number of compiled templates cached in memory.
In Memory Template Cache Hit Rate | Percent of requests found in cache in memory.
Script Engine Cache Hit Rate | Percent of requests found in script engine cache.
Engine Flush Notifications | Number of engines invalidated in the cache due to change notification.

Return to top

WWW Service Cache Counters

The WWW service and FTP service do not share a common cache. The caches are split into two separate performance objects: one for FTP service (IIS global counters) and one for the WWW service (WWW service cache counters).

WWW service cache counters are designed to monitor server performance and cannot be configured to monitor individual sites.

Counter | Description
Active Flushed Entries | Active Flushed Entries are file handlers cached in user mode that will be closed when all current transfers complete. This counter is new in IIS 6.0.
Current File Cache Memory Usage | Current number of bytes used for the user-mode file cache. This counter is new in IIS 6.0.
Current Files Cached | Current number of files whose content is in the user-mode cache. This counter is new in IIS 6.0.
Total Files Cached | Number of files whose content was ever added to the user-mode cache since WWW service startup. This counter is new in IIS 6.0.
File Cache Hits | Number of successful lookups in the user-mode file cache since WWW service startup. This counter is new in IIS 6.0.
File Cache Hits % | Ratio of user-mode file cache hits to total cache requests since WWW service startup. This counter is new in IIS 6.0.
File Cache Misses | Number of unsuccessful look ups in the user-mode file cache since WWW service startup. This counter is new in IIS 6.0.
File Cache Flushes | Number of files removed from the user-mode cache since WWW service startup. This counter is new in IIS 6.0.
Maximum File Cache Memory Usage | Maximum number of bytes used for user-mode file cache since service startup. This counter is new in IIS 6.0.
Total Flushed Files | Number of file handles that have been removed from the user-mode cache since WWW service startup. This counter is new in IIS 6.0.
Current URIs Cached | Number of URI information blocks that are currently in the user-mode cache. This counter is new in IIS 6.0.
Total URIs Cached | Number of URI information blocks that have been added to the user-mode cache since WWW service startup. This counter is new in IIS 6.0.
URI Cache Hits | Number of successful look ups in the user-mode URI cache since WWW service startup. This counter is new in IIS 6.0.
URI Cache Misses | Number of unsuccessful lookups in the user-mode URI cache since WWW service startup. This counter is new in IIS 6.0.
URI Cache Hit % | Ratio of URI Cache Hits to total cache requests since WWW service startup. This counter is new in IIS 6.0.
URI Cache Flushes | Total URI cache flushes since WWW service startup. This counter is new in IIS 6.0.
Total Flushed URIs | Number of URI information blocks that have been removed from the user-mode cache since WWW service startup. This counter is new in IIS 6.0.
Current Metadata Cached | Current number of metadata information blocks in the user-mode cache. This counter is new in IIS 6.0.
Total Metadata Cached | Number of metadata information blocks that have been added to the user-mode cache since service startup. This counter is new in IIS 6.0.
Metadata Cache Hits | Number of successful lookups in the user-mode metadata cache since WWW service startup. This counter is new in IIS 6.0.
Metadata Cache Misses | Number of unsuccessful look ups in the user-mode metadata cache since WWW service startup. This counter is new in IIS 6.0.
Metadata Cache Hits % | Ratio of successful lookups to total metadata cache requests. This counter is new in IIS 6.0.
Metadata Cache Flushes | Number of user-mode metadata cache flushes since WWW service startup. This counter is new in IIS 6.0.
Total Flushed Metadata | Number of metadata information blocks that have been removed from the user-mode cache since WWW service startup. This counter is new in IIS 6.0.
Kernel: Current URIs Cached | URI information blocks currently cached by the kernel. Kernel counters reflect all HTTP.sys activity, not just IIS activity. This counter is new in IIS 6.0.
Kernel: Total URIs Cached | Number of URI information blocks added to the kernel URI cache since WWW service startup. Kernel counters reflect all HTTP.sys activity, not just IIS activity. This counter is new in IIS 6.0.
Kernel: URI Cache Hits | Number of successful look ups in the kernel URI cache since WWW service startup. Kernel counters reflect all HTTP.sys activity, not just IIS activity. This counter is new in IIS 6.0.
Kernel: URI Cache Hits% | The ratio of kernel URI cache hits to total cache requests since WWW service startup. Kernel counters reflect all HTTP.sys activity, not just IIS activity. This counter is new in IIS 6.0.
Kernel: URI Cache Hits/Sec | Number of kernel URI cache hits, per second. Kernel counters reflect all HTTP.sys activity, not just IIS activity. This counter is new in IIS 6.0.
Kernel URI Cache Misses | Number of unsuccessful lookups in the kernel URI cache since WWW service startup. Kernel counters reflect all HTTP.sys activity, not just IIS activity. This counter is new in IIS 6.0.
Kernel: URI Cache Flushes | Number of kernel URI cache flushes since WWW service startup. Kernel counters reflect all HTTP.sys activity, not just IIS activity. This counter is new in IIS 6.0.
Kernel: Total Flushed URIs | Number of URI information blocks that have been removed from the kernel cache since WWW service startup. Kernel counters reflect all HTTP.sys activity, not just IIS activity. This counter is new in IIS 6.0.

Return to top

IIS Global Counters

These counters monitor FTP, SMTP, and NNTP services as a whole and cannot be configured to monitor individual sites. This is a change from IIS 5.x, in which global counters monitored WWW and FTP services. Additionally, some IIS 5.x counters are now obsolete and return a zero value.

note Note If the service you wish to monitor (FTP, SMTP, or NNTP) is not installed or is not running, the counters return a zero value.

Counter | Description
Measured Async I/O Bandwidth Usage | This counter is no longer valid. The value will always be zero.
Total Blocked Async I/O Requests | This counter is no longer valid. The value will always be zero.
Total Rejected Async I/O Requests | This counter is no longer valid. The value will always be zero.
Current Blocked Async I/O Requests | This counter is no longer valid. The value will always be zero.
Measured Async I/O Bandwidth Usage | This counter is no longer valid. The value will always be zero.
Current Files Cached | Current number of files whose content is in the cache.
Total Files Cached | Number of files whose content was ever added to the cache.
File Cache Hits | Number of successful lookups in the file cache.
File Cache Misses | Number of unsuccessful lookups in the file cache.
File Cache Hits % | Ratio of File Cache Hits to total cache requests.
File Cache Flushes | Number of file cache flushes since server startup.
Current File Cache Memory Usage | Current number of bytes used for file cache.
Maximum File Cache Memory Usage | Maximum number of bytes used for file cache.
Active Flushed Entries | Number of cached file handles that will be closed when all current transfers complete.
Total Flushed Files | Number of file handles that have been removed from the cache since service start up.
Current URIs Cached | URI information blocks currently in the cache.
Total URIs Cached | Number of URI information blocks ever added to the cache.
URI Cache Hits | Number of successful lookups in the URI cache.
Uri Cache Misses | Number of unsuccessful lookups in the URI cache.
URI Cache Hit % | The ratio of URI Cache Hits to total cache requests.
URI Cache Flushes | URI Cache Flushes since server startup.
Total Flushed URIs | Number of URI information blocks that have been removed from the cache since service start up.
Current Blobs Cached | BLOB information blocks currently in the cache.
Total Blobs Cached | Number of BLOB information blocks ever added to the cache.
Blob Cache Hits | Number of successful lookups in the BLOB cache.
Blob Cache Misses | Number of unsuccessful lookups in the BLOB cache.
Blob Cache HitRatio | The ratio of BLOB Cache Hits to total cache requests.
Blob Cache Flushes | BLOB Cache Flushes since server startup.
Total Flushed Blobs | Number of BLOB information blocks that have been removed from the cache since service start up.

Return to top

FTP Service Counters

These counters are designed to monitor FTP service performance. They can be configured to monitor a server or individual FTP sites.

Counter | Description
Bytes Sent/Sec | Rate that data bytes are sent by the FTP service.
Bytes Received/Sec | Rate that data bytes are received by the FTP service.
Bytes Total/Sec | Sum of Bytes Sent/sec and Bytes Received/sec. This is the total rate of bytes transferred by the FTP service.
Total Files Sent | Total number of files sent by the FTP service since service startup.
Total Files Received | Total number of files received by the FTP service since service startup.
Total Files Transferred | Sum of Files Sent and Files Received. This is the total number of files transferred by the FTP service since service startup.
Current Anonymous Users | Number of users who currently have an anonymous connection using the FTP service.
Current NonAnonymous Users | Number of users who currently have a nonanonymous connection using the FTP service.
Total Anonymous Users | Number of users who established an anonymous connection with the FTP service (since service startup).
Total NonAnonymous Users | Number of users who had nonanonymous connections to the FTP service since FTP service startup.
Maximum Anonymous Users | Maximum number of users who established concurrent anonymous connections using the FTP service (since service startup).
Maximum NonAnonymous Users | Maximum number of users who established concurrent nonanonymous connections using the FTP service (since service startup).
Current Connections | Current number of connections established with the FTP service.
Maximum Connections | Maximum number of simultaneous connections established with the FTP service.
Total Connection Attempts (all instances) | Number of connections that have been attempted using the FTP service (since service startup). This counter is for all instances listed.
Total Logon Attempts | Number of logons that have been attempted using the FTP service (since service startup).
FTP Service Uptime | FTP Service and FTP site uptime, in seconds.

Return to top

SNMP Counters

If you prefer to use Simple Network Management Protocol (SNMP) services to monitor your Web servers, IIS exposes a set of counters via SNMP. These counters are defined in 3 .mib files in the %windir%\system32 folder. These files are named inetsrv.mib, http.mib and ftp.mib. Inetsrv.mib is a container object for the other two and does not contain any counters.

For information on installing and using the SNMP service see SNMP in Windows Help.

SNMP FTP Service Counters

These SNMP counters are designed to monitor FTP service performance.

Counter | Description
totalBytesSentHighWord | This is the high 32-bits of the total number of bytes sent by the FTP server.
totalBytesSentLowWord | This is the low 32-bits of the total number of bytes sent by the FTP server.
totalBytesReceivedHighWord | This is the high 32-bits of the total number of bytes received by the FTP server.
totalBytesReceivedLowWord | This is the low 32-bits of the total number of bytes received by the FTP server.
totalFilesSent | This is the total number of files sent by this FTP server.
totalFilesReceived | This is the total number of files received by this FTP server.
currentAnonymousUsers | This is the number of anonymous users currently connected to the FTP server.
currentNonAnonymousUsers | This is the number of nonanonymous users currently connected to the FTP server.
totalAnonymousUsers | This is the total number of anonymous users that have ever connected to the FTP server.
totalNonAnonymousUsers | This is the total number of nonanonymous users that have ever connected to the FTP server.
maxAnonymousUsers | This is the maximum number of anonymous users simultaneously connected to the FTP server.
maxNonAnonymousUsers | This is the maximum number of nonanonymous users simultaneously connected to the FTP server.
currentConnections | This is the current number of connections to the FTP server.
maxConnections | This is the maximum number of simultaneous connections to the FTP server.
connectionAttempts | This is the number of connection attempts that have been made to the FTP server.
logonAttempts | This is the number of logon attempts that have been made to the FTP server.

Return to top

SNMP HTTP Service Counters

These counters are designed to monitor World Wide Web Publishing (WWW) service performance.
Counter | Description
totalBytesSentHighWord | This is the high 32-bits of the total number of bytes sent by the WWW service (since service startup).
totalBytesSentLowWord | This is the low 32-bits of the total number of bytes sent by the WWW service (since service startup).
totalBytesReceivedHighWord | This is the high 32-bits of the total number of bytes received by the WWW service (since service startup).
totalBytesReceivedLowWord | This is the low 32-bits of the total number of bytes received by the WWW service (since service startup).
totalFilesSent | This is the total number of files sent by this WWW service (since service startup).
totalFilesReceived | This is the total number of files received by the WWW service (since service startup).
currentAnonymousUsers | This is the number of users who currently have an anonymous connection using the WWW service.
currentNonAnonymousUsers | This is the number of users who currently have a nonanonymous connection using the WWW service.
totalAnonymousUsers | This is the total number of users who established an anonymous connection with the WWW service (since service startup).
totalNonAnonymousUsers | This is the total number of users who established a nonanonymous connection with the WWW service (since service startup).
maxAnonymousUsers | This is the maximum number of users who established concurrent anonymous connections using the WWW service (since service startup).
maxNonAnonymousUsers | This is the maximum number of concurrent nonanonymous connections to the WWW service (since service startup).
currentConnections | This is the current number of connections established with the WWW service.
maxConnections | This is the maximum number of concurrent connections established with the WWW service (since service startup).
connectionAttempts | This is the number of connections that have been attempted using the WWW service (since service startup).
logonAttempts | This is the number of logons attempts to the WWW service (since service startup).
totalOptions | This is the number of HTTP requests using the OPTIONS method (since service startup).
totalGets | This is the number of HTTP requests using the GET method (since service startup). Get requests are the most common HTTP request.
totalPosts | This is the number of HTTP requests using the POST method (since service startup).
totalHeads | This is the number of HTTP requests using the HEAD method (since service startup). Head requests generally indicate a client is querying the state of a document they already have to see if it needs to be refreshed.
totalPuts | This is the number of HTTP requests using the PUT method (since service startup).
totalDeletes | This is the number of HTTP requests using the DELETE method (since service startup). Delete requests are generally used for file removals.
totalTraces | This is the number of HTTP requests using the TRACE method (since service startup). Trace requests allow the client to see what is being received at the end of the request chain and use the information for diagnostic purposes.
totalMove | This is the number of HTTP requests using the MOVE method (since service startup). Move requests are used for moving files and directories.
totalCopy | This is the number of HTTP requests using the COPY method (since service startup). Copy requests are used for copying files and directories.
totalMkcol | This is the number of HTTP requests using the MKCOL method (since service startup). Mkcol requests are used to create directories on the server.
totalPropfind | This is the number of HTTP requests using the PROPFIND method (since service startup). Propfind requests retrieve property values on files and directories.
totalProppatch | This is the number of HTTP requests using the PROPPATCH method (since service startup). Proppatch requests set property values on files and directories.
totalSearch | This is the number of HTTP requests using the SEARCH method (since service startup). Search requests are used to query the server to find resources that match a set of conditions provided by the client.
totalLock | This is the number of HTTP requests using the LOCK method (since service startup). Lock requests are used to lock a file for one user so that only that user can modify the file.
totalUnlock | This is the number of HTTP requests using the UNLOCK method (since service startup). Unlock requests are used to remove locks from files.
totalOthers | This is the number of HTTP requests that are not OPTIONS, GET, HEAD, POST, PUT, DELETE, TRACE, MOVE, COPY, MKCOL, PROPFIND, PROPPATCH, SEARCH, LOCK or UNLOCK methods (since service startup).
currentCGIRequests | This is the current number of CGI requests being simultaneously processed by the WWW service.
currentBGIRequests | This is the current number of ISAPI requests being simultaneously processed by the WWW service.
totalCGIRequests | This is the total number of CGI requests (since service startup).
totalBGIRequests | This is the total ISAPI requests received (since service startup).
maxCGIRequests | This is the maximum number of CGI requests simultaneously processed by the WWW service (since service startup).
maxBGIRequests | This is the maximum number of ISAPI requests simultaneously processed by the WWW service (since service startup).
currentBlockedRequests | This is the current number of requests that have been temporarily blocked by the WWW service due to bandwidth throttling settings.
totalBlockedRequests | This is the total number of requests that have been temporarily blocked by the WWW service due to bandwidth throttling settings.
totalAllowedRequests | This is the total number of requests that the WWW service has allowed when the bandwidth throttling settings on the server have been enabled (since service startup).
totalRejectedRequests | This is the total number of requests rejected due to bandwidth throttling settings (since service startup).
totalNotFoundErrors | This is the number of requests that couldn't be satisfied by the server because the requested document could not be found (since service startup). These are generally reported as an HTTP 404 error code to the client.
totalLockedErrors | This is the number of requests that couldn't be satisfied by the server because the requested was locked (since service startup). These are generally reported as an HTTP 423 error code to the client.
measuredBandwidth | This is the I/O bandwidth used by the WWW service, averaged over a minute.
currentCALsforAuthenticatedUsers | This counter is no longer valid. Value will always be zero.
maxCALsforAuthenticatedUsers | This counter is no longer valid. Value will always be zero.
totalCALFailedAuthenticatedUser | This counter is no longer valid. Value will always be zero.
currentCALsforSecureConnections | This counter is no longer valid. Value will always be zero.
maxCALsforSecureConnections | This counter is no longer valid. Value will always be zero.
totalCALFailedSecureConnection | This counter is no longer valid. Value will always be zero.

Return to top


Timeouts Reference

Internet Information Services (IIS) has several time-out values that are set by default when you install a member of the Microsoft® Windows® Server 2003 family. Time-out values allow the server to specify how long server resources are allocated to specific tasks or clients.

Time-out settings are configurable from IIS Manager as well. For more information about setting the various time-out values, see Setting Connection Timeouts.

The following table lists the time-out values in IIS and where you can set them.

Property Name | Metabase Identifier | Available in IIS Manager
AspScriptTimeout | MD_ASP_SCRIPTTIMEOUT | Yes
AspSessionTimeout | MD_ASP_SESSIONTIMEOUT | Yes
ConnectionTimeout | MD_CONNECTION_TIMEOUT | Yes
CGITimeout | MD_SCRIPT_TIMEOUT | Yes
ServerListenTimeout | MD_SERVER_LISTEN_TIMEOUT | No
PoolIdcTimeout | MD_POOL_IDC_TIMEOUT | No
AspQueueTimeout | MD_ASP_QUEUETIMEOUT | No
HeaderWaitTimeout | MD_HEADER_WAIT_TIMEOUT | No
MinFileBytesPerSec | MD_MIN_FILE_BYTES_PER_SEC | No


Logging Properties Reference

This topic includes the following:

  • W3C Extended Logging Definitions: General properties available to the W3C Extended log file format.
  • IIS Log Definitions: General properties available to the IIS log file format.
  • NCSA Common Log File Format: General properties available to the NCSA Common log file format.

note Note For all log formats except ODBC logging, Time Taken is logged, in milliseconds, according to the following technical breakdown: The client-request timestamp is initialized when HTTP.sys (the kernel mode driver) receives the very first byte (before HTTP.sys even begins parsing the request). The client-request timestamp is stopped when the send completion happens (for the very last send) in IIS. Time Taken does not reflect time across the network. Also note, the very first request to the site shows a slightly longer time taken than other similar/same requests because HTTP.sys opens the log file with the very first request.

W3C Extended Logging Definitions

Prefix | Meaning
s- | Server actions.
c- | Client actions.
cs- | Client-to-server actions.
sc- | Server-to-client actions.

Field | Appears As | Description
Date | date | The date that the activity occurred.
Time | time | The time that the activity occurred.
Client IP Address | c-ip | The IP address of the client that accessed your server.
User Name | cs-username | The name of the authenticated user who accessed your server. This does not include anonymous users, who are represented by a hyphen (-).
Service Name | s-sitename | The Internet service and instance number that was accessed by a client.
Server Name | s-computername | The name of the server on which the log entry was generated.
Server IP Address | s-ip | The IP address of the server on which the log entry was generated.
Server Port | s-port | The port number the client is connected to.
Method | cs-method | The action the client was trying to perform (for example, a GET method).
URI Stem | cs-uri-stem | The resource accessed; for example, Default.htm.
URI Query | cs-uri-query | The query, if any, the client was trying to perform.
Protocol Status | sc-status | The status of the action, in HTTP or FTP terms.
Win32® Status | sc-win32-status | The status of the action, in terms used by Microsoft Windows®.
Bytes Sent | sc-bytes | The number of bytes sent by the server.
Bytes Received | cs-bytes | The number of bytes received by the server.
Time Taken | time-taken | The duration of time, in milliseconds, that the action consumed.
Protocol Version | cs-version | The protocol (HTTP, FTP) version used by the client. For HTTP this will be either HTTP 1.0 or HTTP 1.1.
Host | cs-host | Displays the content of the host header.
User Agent | cs(User-Agent) | The browser used on the client.
Cookie | cs(Cookie) | The content of the cookie sent or received, if any.
Referrer | cs(Referer) | The previous site visited by the user. This site provided a link to the current site.

IIS Log Definitions

Field | Description
Client's IP address | The IP address of the client machine that made the request.
User name | The name of the authenticated user who accessed your server. This does not include anonymous users, who are represented by a hyphen (-).
Date | The date that the activity occurred
Time | The time that the activity occurred.
Service and Instance | A Web site instance is displayed as W3SVC#; an FTP site instance is displayed as MSFTPSVC#, where # is the instance of the site.
Computer name | The server's network basic input/output system (NetBIOS) name.
IP address of server | The IP address of the server that the request was serviced through.
Time taken | The duration of time, in milliseconds, that the action consumed.
Bytes sent | The number of bytes sent from the client to the server.
Bytes received | The number of bytes received by the client from the server.
Service status code | The HTTP or FTP status code.
Windows status code | The status of the action, in terms used by Windows.
Request type | The type of request received by the server (for example, GET and PASS).
Target of the operation | The URL that was the target of the operation.
Parameters | The parameters that are passed to a script.

NCSA Common Log File Format

Field | Description
Remote host address | The IP address of the client machine that made the request.
Remote Log Name | This value is always a hyphen (-).
Username | In the format of domain\user name for authenticated users, or a hyphen (-) for anonymous users.
Date | The date that the activity occurred.
Time and GMT offset | The time the activity occurred, followed by the Greenwich mean time offset.
Request, and version | The request type that was used, the URL that was targeted, the parameters that were passed to a script (if any), and the HTTP version that the client used.
Server Status code | The HTTP status code.
Bytes sent | The number of bytes the server sent to the client.
Related Topics
  • For more information on the logging process, including a discussion of log fields as they appear in IIS log files, see About Logging Site Activity.
  • For more specific information about the W3C Extended log format, see the World Wide Web Consortium Web site.


Redirect Reference

Redirecting a client's request is one way to ensure that users get the correct page, if your site is under construction or has changed identity. You can redirect client requests to a directory on the same Web server or a different URL.

Redirect Variables

You can use redirect variables to pass portions of the original URL with the destination URL. To use these variables, open a directory's properties in IIS Manager, select the Home Directory, Virtual Directory, or Directory tab, click the A redirection to a URL option, and enter a URL in the Redirect to text box, using any of the variables below.

Variable | Description | Example
$S | Passes the matched suffix of the requested URL. The matched suffix is the portion of the original URL that remains after the redirected URL is substituted. | If /Scripts is redirected to /Newscripts, and the original request is for /Scripts/Program.exe, /Program.exe is the suffix. The server automatically substitutes this suffix; you use the $S variable only in combination with other variables.
$P | Passes the parameters in the original URL. | For example, if the original URL is /Scripts/Myscript.asp?number=1, the string "number=1" is mapped to the destination URL.
$Q | Passes both the question mark (?) and the parameters from the original URL. | For example, if the original URL is /Scripts/Myscript.asp?number=1, the string "?number=1" is mapped to the destination URL.
$V | Passes the requested URL, without the server name. | For example, if the original URL is //Myserver/Scripts/Myscript.asp, the string "/Scripts/Myscript.asp" is mapped to the destination URL.
$0 through $9 | Passes the portion of the requested URL that matches the indicated wildcard character. | For example, if a wildcard character is used for the lowest-level directory name, such as */Default.htm, the part of the URL that names the directory containing Default.htm is passed.
! | Do not redirect. | Use this variable to prevent redirecting a subdirectory or an individual file in a virtual directory that has been redirected.

Redirect Wildcards

You can use redirect wildcards to match any number of characters in the original URL. Open a directory's property sheet in IIS Manager, select the Home Directory, Virtual Directory, or Directory tab, click the A redirection to a URL option, and insert the wildcard character (*) in the Redirect to text box. Begin the destination URL with an asterisk (*) and a semicolon (;), and separate pairs of wildcard characters and destination URLs with a semicolon.

For example, to redirect all requests for /Scripts/Filename.stm to a single file called Default.stm, and to redirect all requests for /Scripts/Filename.htm to a single file called Default.htm, type the following in the Redirect To text box for the /scripts virtual directory:

*;Filename.stm;/Default.stm;Filename.htm;/Default.htm

When you use wildcard characters, be sure to select The exact URL entered above check box. For a redirected path, type in a URL.

Related Topics

  • For conceptual and information about redirects, see the Reroute Requests with Redirects section in About Web Site Administration.
  • For procedural information about redirects, see Redirecting Requests to Files, Directories, or Programs.
  • For reference topics related to ASP, see ASP References at MSDN Online or in the IIS Software Developer Kit (SDK).


Glossary

A B C D E F G H I J K L M N O P Q R S T U V W X Y Z

Select the first letter of the word from the list above to jump to appropriate section of the glossary.

To Top A

ABO
See definition for: IIS Admin Base Object (ABO)

abstract class
In Windows Management Instrumentation (WMI), a class from which you cannot create an instance because it does not have a full implementation. An abstract class serves as a base class from which other classes can inherit properties and methods.

See also: concrete class

access control
The mechanism for limiting access to resources based on the identities of users and their membership in various predefined groups. Access control is used typically to control user access to network resources such as servers, directories, and files.

access control list (ACL)
A list that indicates which users or groups have permission to access or modify a particular file. The Windows discretionary access control list (DACL) and system access control list (SACL) are examples of access control lists.

ACL
See definition for: access control list (ACL)

Active Directory Service Interfaces (ADSI)
A COM-based directory service model that allows ADSI-compliant client applications to access a wide variety of distinct directory protocols, including Windows Directory Services and Lightweight Directory Access Protocol (LDAP), while using a single, standard set of interfaces. ADSI shields the client application from the implementation and operational details of the underlying data store or protocol.

Active Group, The
A standards organization, under the auspices of The Open Group, that is an open, customer-driven steering committee responsible for the ongoing development and management of ActiveX technologies and licensing.

active script
A script that can be implemented in various languages, persistent formats, and so on that can interact with other ActiveX Controls.

See also: ActiveX Controls

active scripting
A Microsoft technology that uses Component Object Model (COM) to run scripts in Microsoft Internet Explorer without regard to language and other elements of implementation.

See also: Active Server Pages; Automation; Component Object Model (COM) component; script; scripting engine

Active Server Pages (ASP)
A server-side scripting environment that can be used to create dynamic Web pages or to build Web applications. ASP pages are files that contain HTML tags, text, and script commands. ASP pages can call Component Object Model (COM) components to perform tasks, such as connecting to a database or performing a business calculation. With ASP, you can add interactive content to Web pages or build entire Web applications that use HTML pages as the interface to your customers.

ActiveX
An umbrella term for Microsoft technologies that enable developers to create interactive content for the World Wide Web. ActiveX is a set of language-independent interoperability technologies that enable software components that are written in different languages to work together in networked environments. The core technology elements of ActiveX are the Component Object Model (COM) and distributed COM. These technologies are licensed to The Open Group standards organization, and they are being implemented on multiple platforms.

See also: Component Object Model (COM); Common Gateway Interface; distributed COM (DCOM); Java

ActiveX Controls
Reusable software components that incorporate ActiveX technology. These components can be used to add specialized functionality, such as animation or pop-up menus, to Web pages, desktop applications, and software development tools. ActiveX Controls can be written in a variety of programming languages, including C, C++, Visual Basic, and Java.

ActiveX Data Objects (ADO)
A high-level data access programming interface to an underlying data access technology (such as OLE DB) that is implemented by using the Component Object Model (COM).

activity
A collection of COM objects that has a single distributed logical thread of execution. Every COM object belongs to one activity.

Address Resolution Protocol (ARP)
A TCP/IP protocol for determining the hardware address (or physical address) of a node on a local area network (LAN) that is connected to the Internet, when only the IP address (or logical address) is known. An ARP request is sent to the network, and the node that has the IP address responds with its hardware address. Although ARP technically refers only to finding the hardware address, and Reverse ARP (RARP) refers to the reverse procedure, the acronym ARP is commonly used to describe both. ARP is limited to physical network systems that support broadcast packets. It is defined in RFC 826.

See also: Reverse Address Resolution Protocol (RARP); Transmission Control Protocol/Internet Protocol (TCP/IP)

administrative credentials
Logon information that is used to identify a member of an administrative group. Groups that use administrative credentials include Administrators, Domain Admins, and DNS Admins. Most system-wide or domain-wide tasks require administrative credentials.

See also: Administrators group

Administrators group
On a local computer, a group whose members have the highest level of administrative access to the local computer. Examples of administrative tasks that can be performed by members of this group include installing programs; accessing all files on the computer; auditing access control; and creating, modifying, and deleting local user accounts.

ADO
See definition for: ActiveX Data Objects (ADO)

ADSI
See definition for: Active Directory Service Interfaces (ADSI)

ADSI Provider
An application that makes itself available to Active Directory Service Interfaces (ADSI) client applications by providing an ADSI implementation.

agent
In client/server applications, a process that mediates between the client and the server. In Simple Network Management Protocol (SNMP), agent information consists of comments about the user, the physical location of the computer, and the types of service to report based on the computer's configuration.

See also: catalog agent

aggregation
A composition technique for implementing component objects in which a new object can be built by using one or more existing objects that support some or all of the new object's required interfaces.

alias
A name that maps part of a Uniform Resource Locator (URL) to a physical directory on the server. In general, an easily remembered name that is used in place of an IP address, directory path, or other identifier; also called a friendly name.

See also: host name; virtual directory; virtual server

American National Standards Institute (ANSI)
A voluntary, nonprofit organization of U.S. business and industry groups that was formed in 1918 for the development of trade and communication standards. ANSI provides area charters for groups that establish standards in specific fields, such as the Institute of Electrical and Electronics Engineers (IEEE). ANSI is the United States representative of the International Standards Organization, and it has developed recommendations for the use of programming languages, including FORTRAN, C, and COBOL. Standards that are approved by ANSI are often called ANSI standards. For example, ANSI C is the version of the C language that is approved by ANSI).

See also: ASCII; ASCII character set; ASCII file

American Standard Code for Information Interchange (ASCII)
A coding scheme using 7 or 8 bits that assigns numeric values up to 256 characters, including letters, numerals, punctuation marks, control characters, and other symbols. ASCII was developed in 1968 to standardize data transmission among disparate hardware and software systems. It is built into most minicomputers and into all personal computers.

annotation file
For the File Transfer Protocol (FTP) service, a summary of the information in a given directory. This summary appears automatically to browsers.

anonymous access
The most common access control method for Web sites. Anonymous access allows anyone to visit the public areas of Web sites, while preventing unauthorized users from gaining access to a Web server's critical administrative features and private information.

Anonymous File Transfer Protocol (Anonymous FTP)
A protocol that makes it possible for a user to retrieve documents, files, programs, and other archived data from anywhere on the Internet without having to establish a logon name and password.

anonymous-only logon
A logon process that allows remote access by the IUSR_computername account. Remote users can connect to the computer without a user name or password, and they have only the permissions that are assigned to that account. Anonymous-only logon is typically used for Internet sites.

ANSI
See definition for: American National Standards Institute (ANSI)

Apartment model multithreading
A form of multithreading that is supported by Component Object Model (COM). "Apartment" is a way of describing a thread with a message queue that supports COM objects. Apartment model multithreading enables multiple application threads—one for each apartment—to be managed by COM.

Apartment thread
A thread that is used to execute calls to objects of components that are configured as "Apartment threaded." Each object "lives in an apartment" (thread) for the life of the object. All calls to that object execute on the Apartment thread.

API
See definition for: application programming interface (API)

applet, Java
See definition for: Java applet

application
A computer program, such as a word processor or electronic spreadsheet, or a group of Active Server Pages (ASP) scripts and components that perform such tasks.

application isolation
The separation of applications by process boundaries that prevent the applications from affecting one another. Application isolation is configured differently for each of the two Internet Information Services (IIS) isolation modes.

See also: IIS 5.0 isolation mode; worker process isolation mode

application pool
A grouping of one or more URLs served by a worker process.

application programming interface (API)
A set of routines that an application uses to request and carry out lower-level services that are performed by a computer's operating system. Also, a set of calling conventions in programming that define how a service is invoked through the application.

application root
The root directory for an application. All directories and files contained within the application root are considered part of the application. Also called an application starting-point directory.

application scope
A way of making data available to all users of an application from all pages of a Web application. A variable or an object instance is given application scope by being stored in the Active Server Pages (ASP) application object. Application scope is useful for global data, such as a global counter.

argument
A constant, variable, or expression that is passed to a procedure.

ARP
See definition for: Address Resolution Protocol (ARP)

array
A list of data values—all of the same type—any element of which can be referenced by an expression that consists of the array name followed by an indexing expression. Arrays are part of the fundamentals of data structures, which, in turn, are a major fundamental of computer programming.

ascii
In a File Transfer Protocol (FTP) client program, the command that instructs the FTP server to send or receive files as ASCII text.

See also: American Standard Code for Information Interchange (ASCII)

ASCII
See definition for: American Standard Code for Information Interchange (ASCII)

ASCII character set
A standard 7-bit code for representing ASCII characters by using binary values; code values range from 0 to 127. Most PC-based systems use an 8-bit extended ASCII code, with an extra 128 characters used to represent special symbols, non-English language characters, and graphic symbols.

See also: American Standard Code for Information Interchange (ASCII)

ASCII file
A file that contains characters, spaces, punctuation, carriage returns, and sometimes tabs and an end-of-file marker, but that contains no other formatting information. Also called a text file, a text-only file, or an ASCII text file.

See also: American Standard Code for Information Interchange (ASCII)

ASP
See definition for: Active Server Pages (ASP)

ASP buffering
Functionality of Active Server Pages (ASP) that temporarily stores all output that is generated by a script until script execution is complete and then sends the output to a client.

associating
See definition for: file name extension mapping

association
In file name extension mapping, the linking of a file extension, such as .asp, to an application, such as asp.dll. In Windows Management Instrumentation (WMI), an association class represents a relationship between two specific WMI classes. The properties of an association class include pointers, or references, to the two classes or instances.

asynchronous transfer mode (ATM)
A network technology capable of transmitting data, voice, video, and frame relay traffic in real time. Data, including frame relay data, is broken into packets containing 53 bytes each, which are switched between any two nodes in the system at rates ranging from 1.5 megabits per second to 622 megabits per second. ATM is defined in the broadband Integrated Services Digital Network (ISDN) protocol at the levels corresponding to level 1 and level 2 of the International Organization for Standardization Open Systems Interconnection (ISO/OSI) model. ATM is currently used in local area networks (LANs) involving workstations and personal computers.

See also: Integrated Services Digital Network (ISDN); International Organization for Standardization Open Systems Interconnection (ISO/OSI) model

asynchronous transmission
In modem communication, a form of data transmission in which data is sent intermittently, one character at a time, rather than in a steady stream, with characters separated by fixed time intervals. Each transmitted character consists of a number of data bits (the character itself) preceded by a "begin character" signal called the start bit and ending in an optional parity bit followed by 1, 1.5, or 2 "end character" signals, called stop bits.

ATM
See definition for: Asynchronous Transfer Mode (ATM)

atomicity
A feature of a transaction that is considered or guaranteed to be indivisible. Either the transaction is uninterrupted, or, if it fails, a mechanism is provided that ensures the return of the system to the state it was in before initiation of the transaction.

attributes
In a database record, the name or structure of a field. The size of a field or the type of information it contains are also attributes of a database record. In markup languages, such as Standard Generalized Markup Language (SGML) and Hypertext Markup Language (HTML), a name-value pair within a tagged element that modifies certain features of that element.

auditing
The process an operating system uses to detect and record security-related events, such as an attempt to create, access, or delete objects such as files and directories. The records of such events are stored in a file known as a security log, whose contents are available only to those with the proper clearance.

See also: security log

authentication
The process by which the system validates a user's logon information. A user's name and password are compared against an authorized list, and if the system detects a match, access is granted to the extent that is specified in the permission list for the user.

authentication certificate
See definition for: certificate, digital

authorization
In relation to computers, especially to remote computers on a network that is open to more than one person, the right that is granted to an individual to use the system and the data that is stored on it. Authorization is typically set up by a system administrator, Web master, or site owner, and it is checked and cleared by the computer. This requires that the user provide some type of identification, such as a code number or a password, that the computer can verify against its internal records.

automatic directory listing
Providing a directory listing by default when a Uniform Resource Locator (URL) without a file name is received. Also called directory browsing.

Automation
A Component Object Model (COM)-based technology that enables dynamic binding to COM objects at run time. Formerly called OLE Automation and ActiveX Automation.

Automation object
An object that is exposed to other applications or programming tools through Automation interfaces.

To Top B

bandwidth
The capacity of the transmission medium, stated in bits per second (bps) or as a frequency (Hz). Generally, a higher bandwidth number indicates faster data-transfer capability. In communications, the difference between the highest and lowest frequencies in a given range. In computer networks, greater bandwidth indicates faster data-transfer capability, and it is expressed in bits per second (bps).

bandwidth throttling
Setting the maximum portion of total network capacity that a service is allowed to use. An administrator can deliberately limit a server's Internet workload by not allowing it to receive requests at full capacity, thus saving resources for other programs, such as e-mail.

Basic authentication
An authentication protocol that is supported by most browsers, including Internet Explorer. It is a method of authentication that encodes user name and password data transmissions. Basic authentication is sometimes called plaintext authentication, because the Base-64 encoding can be decoded by anyone with a freely available decoding utility. Note that encoding is not the same as encryption.

See also: Integrated Windows authentication; encryption

baud
A measure of data transmission speed. Commonly used to refer to the data transmission speed of a modem.

BIND
See definition for: Domain Name System

binding
The process in which Microsoft Visual Basic code uses Automation to access objects in another application.

See also: Automation; static binding; dynamic binding

bitmask
A value that is used with bit-wise operators (And, Eqv, Imp, Not, Or, Xor) to test the state of individual bits in a particular bit-field.

See also: bitmask identifier

bitmask identifier
For the metabase, a name assigned to a bitmask to help identify its purpose. For example, In IIS 6.0, bitmask 512 is assigned the identifier MD_ACCESS_SCRIPT.

See also: bitmask

bits per second (bps)
The number of bits transmitted every second, used as a measure of the speed at which a device, such as a modem, can transfer data.

Boolean
Of, pertaining to, or characteristic of logical (true or false) values. Many languages directly support a Boolean data type, with predefined values for true and false; others use integer data types to implement Boolean values, usually (although not always) with "0" equaling false and "not 0" equaling true. Queries with Boolean operators (AND, OR, NOT, and NEAR) are referred to as Boolean queries.

Boolean expression
An expression that yields a Boolean value.

Both-threaded
Characteristic of a component that supports Free-threading and Apartment-threading models.

See also: Apartment thread

broken link
A reference to a resource that cannot be located because the Uniform Resource Locator (URL) is not valid, the resource the link points to does not exist, or the server that contains the resource is busy or is having other technical difficulties.

browser
A client interface that enables a user to view Hypertext Markup Language (HTML) documents on the World Wide Web, another network, or the user's computer; follow hyperlinks among them; and transfer files. One example of a browser is Microsoft Internet Explorer. Also called a Web browser.

bulk data encryption
The encryption of all data that is sent over a network.

See also: encryption

business rules
The laws, regulations, policies, and procedures that are encoded into a computer system. Also known as business logic.

bytecode
The executable form of Java code that executes within the Java virtual machine (VM). Also called interpreted code, pseudo code, and p-code.

To Top C

CA
See definition for: certification authority (CA)

cache
A special memory subsystem in which frequently used data values are duplicated for quick access. A memory cache stores the contents of frequently accessed RAM locations and the addresses where these data items are stored. When the processor references an address in memory, the cache checks to see whether it holds that address. If it does, the data is returned to the processor; if it does not, a regular memory access occurs. A cache is useful when RAM accesses are slow compared with the microprocessor speed, because cached memory is faster than main RAM memory.

call
To transfer program execution to some section of code (usually a subroutine) while saving the necessary information to allow execution to resume at the calling point when the called section has completed execution. When a subroutine call occurs, one or more values (known as arguments or parameters) are often passed to the subroutine, which can then use and sometimes modify these values.

callback function
A function provided by Internet Information Services (IIS) that allows an Internet Server API (ISAPI) extension or filter to access IIS services.

caller
A client that invokes a method of an object. An object's caller is not necessarily the object's creator. For example, client A could create object X and pass this reference to client B, and then client B could use that reference to call a method of object X. In this case, client A is the creator, and client B is the caller.

catalog agent
An automatic software program that periodically opens all files in a designated set of directories and indexes their contents. Also called a link crawler.

certificate, client
A digital certificate that functions in a manner that is similar to a driver's license or passport. Client certificates can contain detailed identification information about the user and organization that issued the certificate.

See also: certificate, digital

certificate, digital
An encrypted file, containing user or server identification information, that is used to verify identity. Also called an authentication certificate. When it is issued to users, a digital certificate is called a client certificate. When it is issued to a server administrator, it is called a server certificate.

See also: key pair; certificate, client; encryption

certificate revocation list
A document that is maintained and published by a certification authority (CA) that lists certificates that have been revoked by the CA.

See also: certification authority (CA)

certification authority (CA)
An entity that issues, manages, and revokes certificates.

CGI
See definition for: Common Gateway Interface (CGI)

CIM
See definition for: Common Information Model (CIM)

class
In Microsoft® Visual Basic®, Scripting Edition (VBScript), the formal definition of an object. The class acts as the template from which an instance of an object is created at run time. The class defines the properties of the object and the methods used to control the object's behavior.

See also: Microsoft Visual Basic, Scripting Edition

class factory
An object that implements the IClassFactory interface, which allows IClassFactory to create objects of a specific class.

class ID (CLSID)
A universally unique identifier (UUID) that identifies a COM component. Each COM component has its CLSID in the Windows registry, so that it can be loaded by other applications.

class restrictions
A general term that is sometimes used for access control by IP address filtering and host name filtering.

client
On a local area network (LAN) or on the Internet, a computer that accesses shared network resources that are provided by another computer, called a server. Also, an application or process that requests a service from some process or component. A client facilitates a connection to server computers, and it manages and presents information retrieved from those sources. In a client/server environment, the workstation is usually the client computer. When referring to COM objects, a program that accesses or uses a service that is provided by another component.

client tier
In the three-tier Web application model, the application or process that requests services from the middle tier, which typically includes a Web server and business processes.

See also: middle tier; data source tier

client/server architecture
A model of computing in which client applications running on a desktop or personal computer access information on remote servers or host computers. The client portion of the application is typically optimized for user interaction, whereas the server portion provides centralized, multiuser functionality.

CLSID
See definition for: class ID (CLSID)

clustering
Connecting two or more computers together for the purpose of sharing resources and request load. Each member computer of a cluster is called a node. The nodes in a cluster may either have their own storage devices or share a common device. Typically, clustering involves support for load balancing, fault tolerance, and failover.

See also: load balancing; node; fault tolerance; failover

Common Information Model (CIM)
An industry standard technique to represent systems, applications, networks, devices, and other managed components in an enterprise environment. Used by Windows Management Instrumentation (WMI) to access management information in an enterprise environment.

See also: Web-Based Enterprise Management (WBEM)

codepage
Used by the system to encode and interpret string characters. Codepage formats are not the same for each language. Some languages, such as Japanese and Hindi, have multibyte characters, while others, such as English and German, need only one byte to represent each character. Each codepage is represented by a unique integer. In Internet Information Services (IIS), the default codepage is the same as CP_ACP. IIS supports Web files that are saved in UTF-8 format or ANSI format.

See also: CP_ACP; UTF-8

collocation
The installation and maintenance of a computer at an Internet service provider (ISP) that belongs to another company or group. A company might collocate one of its servers at an ISP to save costs or to make large-scale upgrades easier.

COM
See definition for: Component Object Model (COM)

commit
The phase in a transaction when all interactions are finalized and the persistent state of the underlying database is changed.

Common Gateway Interface (CGI)
An interface used by executable files that handle specific requests.

See also: Common Gateway Interface bin directory; Common Gateway Interface script

Common Gateway Interface (CGI) bin directory
The directory on a server where CGI script programs are stored. Commonly called CGI-bin or CGI-scripts.

Common Gateway Interface (CGI) script
A program that allows a server to communicatce with users on the Internet. For example, when a user enters information in a form on a Web page, a CGI script interprets the information and communicates it to a database program on the server.

Common Object Request Broker Architecture (CORBA)
A specification developed by the Object Management Group in 1992 in which pieces of programs (objects) communicate with other objects in other programs, even if the two programs are written in different programming languages and are running on different platforms. A program makes its request for objects through an object request broker (ORB), and therefore it does not need to know the structure of the program that the object comes from. CORBA is designed to work in object-oriented environments.

communications protocol
A set of rules or standards that is designed to enable computers to connect with one another and to exchange information with as few errors as possible. Some communications protocols contain other protocols, such as hardware protocols and file transfer protocols. Examples include Hypertext Transfer Protocol (HTTP), Transmission Control Protocol/Internet Protocol (TCP/IP), and Systems Network Architecture (SNA).

compile time
The time during which a program is translated from source language into machine language.

Component Object Model (COM)
The object-oriented programming model that defines how objects interact within a single application or between applications. In COM, client software accesses an object through a pointer to an interface—a related set of functions called methods—on the object.

Component Object Model (COM) component
A binary file that contains code for one or more class factories, COM classes, registry-entry mechanisms, loading code, and so on.

See also: Component Object Model (COM); distributed Component Object Model (DCOM)

concrete class
In Windows Management Instrumentation (WMI), a class from which you can create an instance because it has a full implementation.

See also: abstract class

concurrency
The appearance of simultaneous execution of processes or transactions by interleaving the execution of multiple pieces of work.

connected user
A user who is currently accessing one of the services of a Web server.

connection pooling
A performance optimization that is based on using collections of preallocated resources, such as objects or database connections. Connection pooling results in more efficient resource allocation.

content type
The type of file (such as text, graphic, or sound), which is usually indicated by the file name extension (such as .txt, .gif, or .wav, respectively).

control
In a graphical user interface (GUI), an object on the screen that can be manipulated by a user to perform an action. Perhaps the most common controls are buttons, which a user clicks to select an option, and scroll bars, which a user employs to move through a document or to position text in a window.

cookie
A small text file that is stored in the user's browser by the Web server. Under the HTTP protocol, a server or a script can use cookies to maintain information on the client computer. Cookies contain information about the user, such as an identification number, a password, how a user shops on a Web site, or how many times the user visits that site. A Web site can access cookie information whenever the user connects to the server.

CORBA
See definition for: Common Object Request Broker Architecture (CORBA)

counters
See definition for: Counters Component (a simple Component Object Model (COM) object that is included with Internet Information Services (IIS)); Performance Counters (which are used to measure system performance)

Counters Component
An installable component of Internet Information Services (IIS) that you can use to create, store, increment, or retrieve any number of individual custom counters. The Counters Component is not the same as the Performance Counters that are installed with Windows to monitor system performance.

CP_ACP
The system ANSI codepage. There is also a system OEM codepage: CP_OEMCP.

See also: codepage

crawler
See definition for: spider

CryptoAPI
See definition for: Microsoft Cryptographic API (CryptoAPI)

cryptographic service provider (CSP)
An independent module that performs cryptographic operations, known as encryption. When you create a certificate for your server, you can select a Microsoft CSP or another CSP, if you have one installed. Microsoft CryptoAPI provides a set of functions that allow applications to encrypt or digitally sign data in a flexible manner by using certificates.

See also: Microsoft Cryptographic API (CryptoAPI); encryption

cryptography
A field of science that involves the transmission of information in an encoded form so that only an intended recipient can decode the information and reveal its meaning. Encoded information is commonly said to be encrypted.

CSP
See definition for: cryptographic service provider (CSP); encryption

cursor
An on-screen indicator, such as a blinking underline or rectangle, that marks the place at which a keystroke appears when it is typed. In applications and operating systems that use a mouse, the arrow or other on-screen icon that moves with movements of the mouse. Also, a piece of software that returns rows of data to the application. A cursor on a result set indicates the current position in the result set.

custom property
A metabase property that is not predefined in the metabase schema (MBSchema.xml) and is created programmatically to meet a specific need.

See also: schema

cycle
In logging, to close an existing log file and start a new one.

To Top D

daemon
A networking program that performs a housekeeping or maintenance utility function without being called by the user. A daemon sits in the background and is activated only when needed, for example, to correct an error from which another program cannot recover.

Data Encryption Standard (DES)
A specification for the encryption of computer data that was developed by IBM and adopted by the U.S. government as a standard in 1976. DES uses a 56-bit key to protect against password discovery and playback.

datagram
A self-contained, independent entity of data that carries sufficient information to be routed from the source to the destination computer without relying on earlier exchanges between the source and destination computer and the transporting network.

See also: frame; packet

data provider
Software that implements Object Linking and Embedding Database (OLE DB) methods and interfaces.

data source
The name that applications use to request a connection to an Open Database Connectivity (ODBC) data source. It specifies the computer name and, optionally, the database that the data source name (DSN) maps to. A system data source is a data source that is available to anyone using the computer. Data sources that are used with a Web server must be system data sources.

Data Source Name (DSN)
The logical name used by Open Database Connectivity (ODBC) to refer to the drive and other information that is required to access data. The name is used by Internet Information Services (IIS) for a connection to an ODBC data source, such as a Microsoft® SQL Server™ database.

data source tier
A logical layer that represents a computer running a Database Management System (DBMS), such as a SQL Server database.

See also: client tier; middle tier

DCOM
See definition for: distributed COM (DCOM)

deadlock
In operating systems or databases, a situation in which two or more processes are prevented from continuing while each waits for resources to be freed by the continuation of the other.

debugger
A software tool that is used to detect the source of program or script errors, by performing step-by-step execution of application code and viewing the content of code variables.

default document
The file that is sent by a Web server when it receives a request for a Uniform Resource Locator (URL) that does not specify a file name. This document can be generated automatically by the server, or it can be a custom file that is placed in that directory by the administrator. Sometimes called a default home page.

default gateway
In TCP/IP, the intermediate network device on the local network that has knowledge of the network IDs of the other networks in the Internet, so that it can forward packets to other gateways until they are delivered to the gateway that is connected to the specified destination.

DES
See definition for: Data Encryption Standard (DES)

design time
The time during which a user builds an application in the development environment by adding controls, setting control or form properties, and so on. In contrast, run time is the time during which a user interacts with the application.

Design-time ActiveX Controls
Visual authoring components that help a developer construct dynamic Web applications by automatically generating standard HTML and scripting code. They are analogous to wizards. Design-time ActiveX Controls exist at design time, not at run time.

developer isolation
A feature of some software that provides a way for an application developer to create and test scripts without a connecting to a Web server.

DHCP
See definition for: Dynamic Host Configuration Protocol (DHCP)

DHTML
See definition for: Dynamic HTML (DHTML)

dial-up
Of, pertaining to, or being a connection that uses the public switched telephone network rather than a dedicated circuit or some other type of private network. Also called a slow link.

Dial-up Networking
A component of the Windows operating system that makes it possible for users to connect to remote networks such as the Internet or private networks.

Digest authentication
An authentication method that sends user name and password information over the network as a hash value.

See also: authentication; hash value; hash value comparison

digital signature
The part of a digital certificate that contains an encryption key that uniquely identifies the holder of the certificate.

See also: certificate, client; key pair

directive
An instruction to the Active Server Pages (ASP) script engine that specifies properties, such as script language, for the selection of a script.

directory browsing
A feature that automatically provides a default Web page of available directories and files to browsers that submit a Uniform Resource Locator (URL) that does not specify a particular file.

directory replication
The copying of a master set of directories from a server (called an export server) to specified servers or workstations (called import computers) in the same domain or in other domains. Replication simplifies the task of maintaining identical sets of directories and files on multiple computers, because only a single master copy of the data must be maintained. Files are replicated when they are added to an exported directory and every time a change is saved to the file.

directory service
Middleware that locates the correct and full network address from a partial name or address that is typed into a dialog box.

See also: middleware

disconnected recordset
A recordset in a client cache that no longer has a live connection to the server. If something must be done with the original data source, such as updating data, the connection will need to be reestablished.

discovery mechanism
A way of finding other servers on a network.

distributed COM (DCOM)
A wire protocol that enables software components to communicate directly over a network.

Distributed Internet Application Architecture (DNA)
Microsoft architecture for Web applications.

distributed processing
A form of information processing in which work is performed by separate computers that are linked through a communications network. Distributed processing is usually categorized as either plain distributed processing or true distributed processing. Plain distributed processing shares the workload among computers that can communicate with one another. True distributed processing has separate computers perform different tasks in such a way that their combined work can contribute to a larger goal. The latter type of processing requires a highly structured environment that allows hardware and software to communicate, share resources, and exchange information freely.

DLL
See definition for: dynamic-link library (DLL)

DNS
See definition for: Domain Name System (DNS)

domain
In Windows, a collection of computers that share a common domain database and security policy. Each domain has a unique name.

See also: domain, Internet

domain controller
For a Windows domain, the server that authenticates domain logons and that maintains the security policy and the master database for a domain.

domain, Internet
The highest subdivision of a domain name in a network address, which identifies the type of entity owning the address (for example, .com for commercial users or .edu for educational institutions) or the geographical location of the address (for example, .fr for France or .sg for Singapore). The domain is the last part of the address (for example, www.microsoft.com).

domain name
An address of a network connection that identifies the owner of that address in a hierarchical format. For example, www.whitehouse.gov identifies the Web server at the White House, which is a government agency.

See also: Domain Name System (DNS)

Domain Name System (DNS)
The system by which hosts on the Internet have domain name addresses (such as microsoft.com) and IP addresses (such as 172.21.13.45). The domain name address is used by human users, and it is automatically translated into the numerical IP address, which is used by the packet-routing software. DNS is also the acronym for Domain Name Service, the Internet utility that implements the Domain Name System. DNS servers, also called name servers, maintain databases that contain the addresses, and they are accessed transparently by the user.

Domain Name System (DNS) reverse lookup
A method of finding the IP address that corresponds to a domain name.

Domain Name System (DNS) spoofing
The assumption of the DNS name of another system by either corrupting a name service cache or compromising a domain name server for a valid domain.

download
In communications, the process of transferring a copy of a file from a remote computer to the requesting computer by means of a modem or network.

DSN
See definition for: Data Source Name (DSN)

DWORD
The Win32 API designation for a 32-bit integer.

dynamic binding
Binding (converting symbolic addresses in the program to storage-related addresses) that occurs during program execution. The term often refers to object-oriented applications that determine, during run time, which software routines to call for particular data objects. Also called late binding.

Dynamic Host Configuration Protocol (DHCP)
A TCP/IP protocol that enables a network that is connected to the Internet to assign a temporary IP address to a host automatically when the host connects to the network.

dynamic HTML (DHTML)
A set of innovative features in Internet Explorer 4 and later that can be used to create HTML documents that dynamically change their content and interact with the user. By using DHTML, authors can provide special effects on a Web page without relying on server-side programs.

dynamic-link library (DLL)
A feature of Windows operating systems that supports executable routines—usually serving a specific function or set of functions—that are stored separately as files with the file extension name .dll and that are loaded only when called by the program that needs them. This saves memory during program execution, and it makes the reuse of code possible.

dynamic page
A Hypertext Markup Language (HTML) document that contains animated GIFs, Java applets, ActiveX Controls, or dynamic HTML (DHTML). Also, a Web page that is created automatically, based on information that is provided by the user, or that is generated "on the fly" with Active Server Pages (ASP).

To Top E

early binding
See definition for: static binding

e-commerce
Electronic commerce. The process of buying and selling over the Web.

encapsulate
To treat a collection of structured information as a whole, without affecting or taking notice of its internal structure. In communications, a message or packet that is constructed according to a protocol, such as a TCP/IP packet, may be taken with its formatting data as an undifferentiated stream of bits that is then broken up and packaged according to a lower-level protocol (for example, as asynchronous transfer mode (ATM) packets) to be sent over a particular network. At the destination, the lower-level packets are assembled, recreating the message as it was formatted for the encapsulated protocol.

encryption
A way of making data indecipherable to protect it from unauthorized viewing or use, especially during network transmission or when it is stored on a transportable magnetic medium while it is being sent from computer to computer. Encryption can be either symmetric or asymmetric. Symmetric encryption involves the use of the same key to both encrypt and decode the data. Asymmetric encryption uses one key to encrypt and another key to decode.

See also: key pair; cryptographic service provider (CSP)

Ethernet
A 10-Mb/s standard for local area networks (LANs), initially developed by Xerox and later refined by Digital, Intel, and Xerox (DIX). All hosts are connected to a coaxial cable where they contend for network access using a CSMA/CD paradigm.

event
Any action, often generated by a user or an ActiveX control, to which a program might respond. Typical events include pressing a keyboard key, choosing a button by using a mouse click, and other mouse actions. Programmers write code to respond to these actions.

event method
A procedure that is invoked only by a particular event, such as On_Click.

exception
In programming, a problem or change in conditions that causes the microprocessor to stop what it is doing and handle the situation in a separate routine. An exception is similar to an interrupt; both refer the microprocessor to a separate set of instructions.

executable program
A program, or a collection of programs, forms, data, menus, and other files, that can be run.

expires header
An expiration date or time for a file that is sent by a server. The expiration information is used by proxy servers and browser caches.

extended partition
A partition that is created from free space on a hard disk. An extended partition can be subpartitioned into zero or more logical drives. Only one of the four partitions that is allowed per physical disk can be an extended partition, and no primary partition must be present to create an extended partition.

See also: logical drive

Extensible Markup Language (XML)
A data format for structured document interchange on the Web. This format is called Extensible Markup Language because it is not a fixed format like Hypertext Markup Language (HTML). XML is designed to enable the use of Standard Generalized Markup Language (SGML) on the World Wide Web. XML is not a single markup language; it is a metalanguage that enables an author to design a markup language. A single markup language defines a way to describe information in a certain class of documents (for example, HTML). With XML, authors can define their own customized markup language for many classes of documents.

Extensible Stylesheet Language (XSL)
A style sheet mechanism that can be used to specify how to transform XML documents into displayable structures. Although XSL defines a grammar of advanced formatting characteristics, it also can be used to generate displayable Hypertext Markup Language (HTML) or other well-formed markup languages.

extension control block
A data structure that is created and used by Internet Information Services (IIS) to communicate with an Internet Server API (ISAPI) extension.

extranet
An extension of an organization's intranet that uses World Wide Web technology to facilitate communication with the organization's suppliers and customers. An extranet allows customers and suppliers to gain limited access to the organization's intranet to enhance the speed of communications and the efficiency of business relationships.

To Top F

failback
The process of fully restoring a failed server node.

failover
The process of another computer automatically taking over the request load when one individual computer fails. This transition is invisible to the user.

FAQ
See definition for: Frequently Asked Questions (FAQ)

fat server
In a client/server architecture, a server that performs most of the processing, with the client performing little or no processing.

fault tolerance
The ability of a computer or an operating system to respond to a catastrophic event or fault, such as a power outage or a hardware failure, in a way that ensures that no data is lost or corrupted. This can be accomplished with a battery-backed power supply, backup hardware, provisions in the operating system, or any combination of these options. In a fault-tolerant network, the system has the ability either to continue the system's operation without loss of data or to shut the system down and restart it, recovering all processing that was in progress when the fault occurred.

See also: replication; failover

file allocation table (FAT) file system
The system that is used by MS-DOS® to organize and manage files. FAT is a data structure that MS-DOS creates on a disk when the disk is formatted. When MS-DOS stores a file on a formatted disk, the operating system places information about the stored file in FAT so that MS-DOS can retrieve the file later when the file is requested. FAT is the only file system MS-DOS can use.

See also: NTFS file system

file name extension mapping
The process of associating all files with a certain file name extension to a program. For example, through a default setting in Windows Explorer, all .txt files are associated with Notepad.

file space
The file directory tree of a server.

File Transfer Protocol (FTP)
A protocol for copying files to and from remote computer systems on a network, such as the Internet, that uses TCP/IP. This protocol also allows users to use FTP commands to perform such actions as listing files and directories on the remote system.

filter
In Internet Information Services (IIS), a feature of Internet Server API (ISAPI) that allows preprocessing of requests and postprocessing of responses, which enables site-specific handling of Hypertext Transfer Protocol (HTTP) requests and responses.

filtering, host name
Allowing or denying access based on the host name from which the browser is attempting access.

filtering, IP address
Allowing or denying access based on the IP address from which the browser is attempting access.

finger
An Internet utility that enables a user to obtain information about other users who might be at other sites (if those sites permit access by finger). When it is given an e-mail address, finger returns the user's full name, an indication of whether or not the user is currently logged on, and any information that other users have chosen to supply as a profile. When it is given a first or last name, finger returns the logon names of users whose names match. It can also show the last time the user logged on, idle time, terminal line, and terminal location (where applicable), and project files that are left by the user.

firewall
A security system that is intended to protect an organization's network against external threats, such as intruders, that come from another network, such as the Internet. A firewall prevents computers in the organization's network from communicating directly with computers that are outside the network, and vice versa. Instead, all communication is routed through a proxy server that is outside the organization's network, and the proxy server determines whether it is safe to let a particular message or file pass through.

See also: proxy server

footer
In Web publishing, a short addition to every Web page that is sent by the server.

See also: server-side include

form
In Web publishing, a Web page or a portion of a Web page that is filled out by the user and sent back to the server for processing.

Fortezza
The U.S. government security standard that meets the requirements of the Defense Messaging System security architecture with a cryptographic mechanism that provides message confidentiality, integrity, authentication, and access control to messages, components, and systems. These features can be implemented with both server and browser software and with Personal Computer Memory Card International Association (PCMCIA) hardware. A Fortezza card is a type of PCMCIA card, similar to the cards that are used in notebook computers and in other small devices. This card can store a private key that is used by the server to authenticate users.

See also: Crypto Service Provider (CSP)

frame
In asynchronous serial communications, a unit of transmission that is sometimes measured in elapsed time. It begins with the start bit that precedes a character and ends with the last stop bit that follows the character. In synchronous communications, a package of information that is transmitted as a single unit. Every frame follows the same basic organization and contains control information, such as synchronizing characters, station address, and an error-checking value, as well as a variable amount of data.

See also: datagram; encapsulate; packet

Frequently Asked Questions (FAQ)
A document containing questions and answers that address basic questions on a Web site. FAQs introduce visitors to the topic or subject of Web sites, and they offer general guidelines about how to best use the sites.

friendly name
A name that substitutes for an IP address, for example, www.microsoft.com instead of 172.16.255.255. Also called a host name.

FrontPage Server Extensions
A group of files that is installed on a Hypertext Transfer Protocol (HTTP) service to give that service the ability to provide special Microsoft FrontPage functionality. With FrontPage Server Extensions, administrators can view and manage a Web site in a graphical user interface. Also, authors can create, edit, and post Web pages to Internet Information Services (IIS) remotely.

FTP
See definition for: File Transfer Protocol (FTP)

To Top G

gateway
A device that connects networks using different communications protocols so that information can be passed from one network to the other. A gateway both transfers information and converts it to a form that is compatible with the protocols that are used by the receiving network.

GIF
See definition for: Graphics Interchange Format (GIF)

Global.asa
A file that stores information about an Internet Information Services (IIS) application, such as initialization in structures, and objects that have been given application scope.

globally unique identifier (GUID)
In Component Object Model (COM), a 16-byte code that identifies an interface to an object across all computers and networks. Such an identifier is unique, because it contains a time stamp and a code that is based on the network address that is hard wired on the host computer's local area network (LAN) interface card. These identifiers are generated by a utility program.

Gopher
An early Internet protocol and software program that was designed to search for, retrieve, and display text documents from remote computers or sites.

graphical user interface (GUI)
A type of environment that represents programs, files, and options by means of icons, menus, and dialog boxes on the screen. The user can select and activate these options by pointing and clicking with a mouse or, often, with a keyboard.

Graphics Interchange Format (GIF)
A computer graphics file format that was developed in the mid-1980s by CompuServe for use in photo-quality graphic image display on computer screens. This format is now commonly used on the Internet.

GUI
See definition for: graphical user interface (GUI)

GUID
See definition for: globally unique identifier (GUID)

To Top H

handshake
A series of signals acknowledging that communication or the transfer of information can take place between computers or other devices. A hardware handshake is an exchange of signals over specific wires (other than the data wires), in which each device indicates its readiness to send or receive data. A software handshake consists of signals that are transmitted over the same wires that are used to transfer data, as in modem-to-modem communications over telephone lines.

hash value
A small amount of binary data, typically around 160 bits, that is derived from a message by using a hashing algorithm. The hashing procedure is one-way. There is no feasible way of deriving the original message, or any of its properties, from the hash value, even given the hashing algorithm. The same message always produces the same hash value when the message is passed through the same hashing algorithm. Messages that differ by even one character can produce very different hash values.

hash value comparison
When a client or server receives a hash value as part of an authentication scheme, the use of a commonly known key value, such as a password, to create a hash value and compare the generated hash value with the hash value that is received. If the two hash values are identical, authentication is accepted.

See also: replication

heap, Windows
An area of working memory, provided by Windows, that applications can use to store data.

hit
A successful retrieval of data from a cache rather than from the slower hard disk or RAM; a successful retrieval of a record that matches a query in a database; or the retrieval of a document, such as a home page, from a Web site.

See also: usage data

home directory
The root directory for a Web site, where the content files are stored. Also called a document root or Web root. In Internet Information Services (IIS), the home directory and all its subdirectories are available to users by default. Also, the root directory for an IIS service. Typically, the home directory for a site contains the home page.

See also: home page

home page
The initial page of information for a collection of pages, a Web site, or a section of a Web site.

See also: default document

host
The main computer in a system of computers or terminals that are connected by communications links.

host name
The name of a specific server on a specific network within the Internet. For example, www.microsoft.com indicates the server called "www" in the network at Microsoft Corporation.

HTML
See definition for: Hypertext Markup Language (HTML)

HTTP
See definition for: Hypertext Transfer Protocol (HTTP)

HTTPD
HTTP Daemon; a Web server.

HTTP header
An informational listing at the top of a Hypertext Transfer Protocol (HTTP) request or response.

hyperlink
A connection between an element in a hypertext document, such as a word, phrase, symbol, or image, and a different element in the document, another hypertext document, a file, or a script. The user activates the link by clicking the linked element, which is usually underlined or in a color that is different from the rest of the document. Hyperlinks are indicated in a hypertext document by the use of tags in markup languages such as Standard Generalized Markup Language (SGML) and Hypertext Markup Language (HTML). These tags are generally not visible to the user. Also called hot links and hypertext links.

hypertext
Text that is linked together in a complex, nonsequential web of associations in which the user can browse through related topics. The term hypertext was invented in 1965 to describe documents presented by a computer that express the nonlinear structure of ideas, as opposed to the linear format of books, film, and speech.

Hypertext Markup Language (HTML)
A simple markup language that is used to create hypertext documents that are portable from one platform to another. HTML files are simple American Standard Code for Information Interchange (ASCII) text files with codes embedded (indicated by markup tags) to indicate formatting and hypertext links. HTML is the formatting language that is used for documents on the World Wide Web.

See also: Dynamic HTML (DHTML); Extensible Markup Language (XML); Standard Generalized Markup Language (SGML)

Hypertext Transfer Protocol (HTTP)
The client/server protocol that is used to access information on the World Wide Web.

To Top I

IADs interface
One the core Active Directory Service Interfaces (ADSI), which defines the properties and methods of any ADSI object. In Internet Information Services (IIS), the IADs::Get and IADs::Put methods are used with the IADsContainer interface to add new objects and properties to the IIS ADSI Schema.

See also: Active Directory Service Interfaces (ADSI); IADsContainer interface

IADsContainer interface
One the core Active Directory Services Interfaces (ADSI), which enables an ADSI container object to create, delete, and manage contained ADSI objects. In Internet Information Services (IIS), the IADsContainer::Create method is used with the IADs interface to add new objects and properties to the IIS ADSI Schema.

See also: Active Directory Service Interfaces (ADSI); IADs interface

ICMP
See definition for: Internet Control Message Protocol (ICMP)

identities, multiple
Multiple Web sites that are hosted on one computer. Also called virtual servers.

IETF
See definition for: Internet Engineering Task Force (IETF)

IIS 5.0 isolation mode
Internet Information Services (IIS) 6.0 isolation mode that simulates the IIS 5.0 Web process model.

IIS Admin Base Object (ABO)
A distributed COM (DCOM) object that implements the IMSAdminBase interface, using methods that enable a Web application to manipulate Internet Information Services (IIS) configuration keys and data in the memory-resident metabase.

IIS Admin Objects
A set of methods, provided by Internet Information Services (IIS), that allow applications to access and modify configuration settings in the metabase.

image map
An image that contains more than one hyperlink on a Web page. Clicking different parts of the image links the user to other resources on another part of the Web page, a different Web page, or a file. Often, an image map, which can be a photograph, a drawing, or a composite of several different drawings or photographs, is used as a map to the resources that can be found on a particular Web site. Image maps are created with Common Gateway Interface (CGI) scripts. Image maps can be server-side or client-side. Server-side image maps map each Uniform Resource Locator (URL) on the server. Client-side image maps, on the other hand, do not require mediating server-side scripts, because the Uniform Resource Locator (URL) mapping is contained in a Hypertext Markup Language (HTML) file.

See also: Common Gateway Interface (CGI) script; hyperlink

index file
See definition for: default document

inheritance
In general, the ability of a newly created object to automatically have, or inherit, the properties of an existing object. For example, a newly created child directory can inherit the access control settings of its parent directory.

in-memory metabase
An image of the Internet Information Services (IIS) metabase that has been loaded from disk into the computer's RAM memory and is used while IIS is running.

See also: metabase

in-process
Internet Server API (ISAPI) extensions that are hosted in the worker process address space.

See also: Internet Server API (ISAPI)

in-schema property
A metabase property predefined in the metabase schema (MBSchema.xml) file.

See also: metabase schema; schema

instance
An object of a particular component class. Each instance has its own private data elements or member variables. Component instance is synonymous with object.

instantiate
To create an instance of an object.

Integrated Services Digital Network (ISDN)
A type of phone line that is used to enhance wide area network (WAN) speeds. ISDN combines voice and digital network services in a single medium, making it possible to offer telephone customers digital data service and voice connection through a single "wire." An ISDN line can transmit at speeds of 64 kilobits per second or 128 kilobits per second. An ISDN line must be installed by the phone company at both the server site and the remote site.

Integrated Windows authentication
A method of authentication in which a server verifies user account information by means of a cryptographic exchange; actual passwords are never transmitted.

interface
A group of logically related operations or methods that provides access to a component object.

internal Web
An intranet. Also called internal network, private network, local area network (LAN), or wide area network (WAN).

See also: intranet; local area network (LAN); wide area network (WAN)

International Organization for Standardization (ISO)
A voluntary, nontreaty organization, founded in 1946, that is responsible for creating international standards in many areas, including computers and communications. Its members are the national standards organizations of the 89 member countries/regions, including the American National Standards Institute (ANSI) for the United States.

See also: American National Standards Institute (ANSI)

International Organization for Standardization Open Systems Interconnection model (ISO/OSI model)
A layered architecture (plan) that standardizes levels of service and types of interaction for computers that exchange information through a communications network. The ISO/OSI model separates computer-to-computer communications into seven layers, or levels, each building on the standards contained in the levels below. The lowest of the seven layers deals solely with hardware links; the highest layer deals with software interactions at the application-program level.

Internet
An abbreviation for internetwork. A set of dissimilar computer networks that are joined together by means of gateways. The gateways handle data transfer and the conversion of messages from the sending network to the protocols that are used by the receiving networks. These networks and gateways use the TCP/IP suite of protocols. The Internet was originally part of the Defense Advanced Research Projects Agency (DARPA), which is operated by the U.S. Department of Defense (DOD).

Internet Control Message Protocol (ICMP)
An extension to Internet Protocol (IP). ICMP allows for the generation of error messages, test packets, and informational messages related to IP.

See also: PING

Internet Engineering Task Force (IETF)
An open community of network designers, operators, vendors, and researchers concerned with the evolution of Internet architecture and the smooth operation of the Internet. Technical work is performed by working groups organized by topic areas (such as routing, transport, and security) and through mailing lists. Internet standards are developed in IETF Requests for Comments (RFCs), which are a series of notes that discuss many aspects of computing and computer communication, focusing on networking protocols, programs, and concepts.

Internet Protocol (IP)
The part of TCP/IP that routes messages from one Internet location to another. IP is responsible for addressing and sending Transmission Control Protocol (TCP) packets over the network. IP provides a best-effort, connectionless delivery system that does not guarantee that packets arrive at their destination or that they are received in the sequence in which they were sent.

See also: packet

Internet Protocol address (IP address)
A unique address that identifies a host on a network. An IP address identifies a computer as a 32-bit address that is unique across a TCP/IP network. An IP address is usually represented in dotted-decimal notation, which depicts each octet (eight bits, or one byte) of an IP address as its decimal value and separates each octet with a period, for example, 172.16.255.255.

Internet Server API (ISAPI)
An application programming interface (API) that resides on a server computer for the purpose of initiating software services that are tuned for the Windows operating system. ISAPI is an API for developing extensions to Internet Information Services (IIS) and other Hypertext Transfer Protocol (HTTP) services that support the ISAPI interface.

See also: application programming interface (API); Common Gateway Interface (CGI)

Internet service
One of any of a number of technologies for making information accessible to users over the Internet. Each Internet service is defined by a protocol, such as Hypertext Transfer Protocol (HTTP), and each is enabled using client/server applications, such as Web browsers and Web servers. Internet protocols are defined in the Request for Comments (RFC) documents that are published by the Internet Engineering Task Force (IETF).

Examples of Internet services include Telnet, File Transfer Protocol (FTP), Gopher, Wide Area Information Server (WAIS), Archie, Veronica, Simple Mail Transfer Protocol (SMTP), Network News Transfer Protocol (NNTP), and Internet Relay Chat (IRC).

See also: Hypertext Transfer Protocol (HTTP); protocol

Internet service provider (ISP)
A public provider of remote connections to the Internet. A company or educational institution that enables remote users to access the Internet by providing dial-up connections or by installing leased lines.

interoperability
The ability of software and hardware on multiple computers from multiple vendors to communicate meaningfully.

intranet
A network that is designed for information processing in an organization. Its uses include such services as document distribution, software distribution, access to databases, and training. This type of network is called an intranet because it usually employs applications that are associated with the Internet, such as Web pages, Web browsers, File Transfer Protocol (FTP) sites, e-mail, newsgroups, and mailing lists. But in an intranet, these applications are accessible only to users who are within the organization.

IP
See definition for: Internet Protocol (IP)

ISAPI
See definition for: Internet Server API (ISAPI)

ISAPI extension
A DLL that handles a specific request, for example ASP.dll and ASPNET_ISAPI.dll. Extensions are loaded when first needed and kept in memory until the host process shuts down. Also known as ISAPIs.

ISAPI filter
A DLL registered with Internet Information Services (IIS) that modifies the behaviour of the server, for example URLScan.dll. Filters are loaded when the worker process starts and unloaded when the worker process shuts down. Also known as filters.

ISDN
See definition for: Integrated Services Digital Network (ISDN)

ISO
See definition for: International Organization for Standardization (ISO)

ISO/OSI model
See definition for: International Organization for Standardization Open Systems Interconnection model (ISO/OSI model)

ISP
See definition for: Internet service provider (ISP)

To Top J

Java
An object-oriented programming language developed by Sun Microsystems, Inc. Currently, the most widespread use of Java is in programming small applications, or Java applets, for the World Wide Web.

Java applet
A small piece of code that can be transported over the Internet and executed on a client computer. Java Applet is frequently used to refer to such programs in the form of embedded inline objects in HTML documents on the World Wide Web.

JavaBeans
An object model being developed by SunSoft that is targeted to interoperate with a variety of other object models, including Common Object Request Broker Architecture (CORBA) and Component Object Model (COM).

See also: Common Object Request Broker Architecture (CORBA); Component Object Model (COM)

Java Database Connectivity (JDBC)
Data access interfaces that are based on Open Database Connectivity (ODBC) for use with the Java language.

JavaScript
A scripting language developed by Netscape Communications that is syntactically similar to Java. JavaScript, however, is not a true object-oriented language, and it is limited in performance compared with Java because it is not compiled. A JavaScript-client Web browser is necessary to run JavaScript code. Now an open standard known as the ECMA 262 language specification.

See also: JScript

Java virtual machine
Software on a computer that runs Java applets.

JDBC
See definition for: Java Database Connectivity (JDBC)

JIT
See definition for: just-in-time (JIT) activation

Joint Photographic Experts Group (JPEG)
An ISO/ITO standard for storing images in compressed form using a discrete cosine transform. JPEG trades off compression against loss; it can achieve a compression ratio of 100:1 with significant loss and up to 20:1 with little noticeable loss.

JPEG
See definition for: Joint Photographic Experts Group (JPEG)

JScript
The Microsoft open implementation of JavaScript. JScript complies with the ECMA 262 language specification.

just-in-time (JIT) activation
The ability of a Component Object Model (COM) object to be activated only as needed for executing requests from its client. Objects can be deactivated even while clients hold references to them, allowing otherwise idle server resources to be used more productively.

To Top K

Keep-Alive connection
A Hypertext Transfer Protocol (HTTP) connection that is not closed after an exchange is completed.

Kerberos V5 authentication protocol
An authentication mechanism used to verify user or host identity.

See also: cryptography; encryption

key
A node in the Windows registry or IIS metabase. A key can contain subkeys and entries; for example, Environment is a key of HKEY_CURRENT_USER.

key pair
The combination of private and public encryption keys that provides verification of the source of data that is sent across a network.

See also: certificate, client; digital signature; session key

keyword
In search-engine technology, a significant word that is used for content indexing; see also noise word. In programming, a word that is reserved for a command or other program instruction.

keyword index
A file of significant words that appear in documents. It used for keyword searches.

To Top L

LAN
See definition for: local area network (LAN)

late binding
See definition for: dynamic binding

LCID
See definition for: Locale Identifier (LCID)

LDAP
See definition for: Lightweight Directory Access Protocol (LDAP)

Lightweight Directory Access Protocol (LDAP)
A network protocol that is designed to work on TCP/IP stacks to extract information from a hierarchical directory. This gives users a single tool to search through data to find a particular piece of information, such as a user name, e-mail address, security certificate, or other contact information.

link
See definition for: hyperlink

load balancing
A server cluster sharing information requests equally over all its active nodes. This can be done either statically, by tying clients directly to different back-end servers, or dynamically, by tying each client to a different back-end server that is controlled by software or a hardware device.

local area network (LAN)
A group of computers and other devices that is intended to serve an area of only a few square kilometers or less and that is connected by a communications link that enables any device to interact with any other device on the network. Because the network is known to cover only a small area, optimizations can be made in the network signal protocols that permit data rates of up to 100 Megabits per second.

See also: Ethernet; token ring; wide area network (WAN)

local group
A group that can be granted permissions and rights only for its own workstation. However, it can contain user accounts from its own computer, and (if the workstation participates in a domain), it can contain user accounts and global groups both from its own domain and from trusted domains.

Locale Identifier (LCID)
A unique integer that represents a locale for the formatting style of dates, times, currencies and other values, which is different for each geographical location. In Internet Information Services (IIS), the default LCID is the same as the system locale.

See also: LOCALE_SYSTEM_DEFAULT

LOCALE_SYSTEM_DEFAULT
The default system locale. There is also a default user locale.

See also: Locale Identifier (LCID)

LocalHost
A placeholder for the name of the computer on which a program is running. LocalHost uses the reserved loopback IP address (127.0.0.1 in IPv4 and ::1 in IPv6).

log file
The file in which logging records are stored. This file can be either a text file or a database file.

logging
Storing information about events that occur on a firewall or network.

logical drive
A subpartition of an extended partition on a hard disk.

See also: extended partition

To Top M

main thread
A single thread that is used to run all objects of components that are marked as "Single-threaded."

See also: Apartment thread

Mail or Messaging Application Programming Interface (MAPI)
An open and comprehensive messaging interface that is used by developers to create messaging and workgroup applications, such as e-mail, scheduling, calendars, and document management. In a distributed client/server environment, MAPI provides enterprise messaging services within Windows Open Services Architecture (WOSA).

Management Information Base (MIB)
Information about aspects of a network that can be managed by using the Simple Network Management Protocol (SNMP). This information is formatted in MIB files that are provided for each service that can be monitored. Most third-party monitors (clients) use SNMP and MIB files to monitor Web, File Transfer Protocol (FTP), and other Windows services. Using SNMP, developers or system administrators can write their own custom monitoring applications.

MAPI
See definition for: Mail or Messaging Application Programming Interface (MAPI)

marshaling
The process of packaging and sending interface method parameters across thread or process boundaries.

master properties
In Internet Information Services (IIS), properties that are set at the computer level that become default settings for all Web or File Transfer Protocol (FTP) sites on that computer.

See also: inheritance

MD5
An industry-standard one-way, 128-bit hashing scheme, developed by RSA Data Security, Inc., and used by various Point-to-Point Protocol (PPP) vendors for encrypted authentication. A hashing scheme is a method for transforming data (for example, a password) in such a way that the result is unique and cannot be changed back to its original form.

See also: encryption; hash value

MDAC
See definition for: Microsoft Data Access Components (MDAC)

message passing
A method for processes that are running in parallel to interact with one another.

Message Queuing
A server technology that developers can use to build large-scale distributed systems with reliable communications between applications, which can continue to operate even when networked systems are unavailable.

meta-authoring environment
The process of both authoring Web pages and setting up a Web site.

metabase
A hierarchical store of configuration information and schema that is used to configure Internet Information Services (IIS). The metabase performs some of the same functions as the system registry, but it uses less disk space. In physical terms, the metabase is a combination of the MetaBase.xml and MBSchema.xml files and the in-memory metabase.

metabase configuration file
A file that stores Internet Information Services (IIS) configuration settings to disk. This file is named MetaBase.xml by default. When IIS is started or restarted, the configuration settings are read from MetaBase.xml into the IIS cache in memory, which is called the in-memory metabase.

metabase schema
The master configuration file (MBSchema.xml) supplied with Internet Information Services (IIS) that contains all of the predefined properties from which metabase entries are derived.

See also: metabase; schema

metadata
Data that is used to describe other data. For example, Indexing Service must maintain data that describes the data in the content index.

method
A procedure (function) that acts on an object.

MIB
See definition for: Management Information Base (MIB)

Microsoft Cryptographic API (CryptoAPI)
An application programming interface (API) that provides services for authentication, encoding, and encryption in Win32-based applications.

See also: cryptographic service provider (CSP); encryption

Microsoft Data Access Components (MDAC)
Consists of ActiveX Data Objects (ADO), the Remote Data Service (RDS), Microsoft OLE DB Provider for ODBC, Open Database Connectivity (ODBC), ODBC drivers for Microsoft SQL Server, Microsoft Access and other desktop databases, as well as Oracle databases.

Microsoft® Visual Basic®
A high-level, visual-programming version of Basic. Visual Basic was designed for building Windows-based applications.

Microsoft® Visual Basic® for Applications
The development environment and language in Visual Basic that can be hosted by applications.

Microsoft® Visual Basic®, Scripting Edition (VBScript)
A subset of Microsoft Visual Basic, VBScript is implemented as a fast, portable, lightweight interpreter for use in World Wide Web browsers and other applications that use ActiveX Controls and Java applets.

middle tier
The logical layer between a user interface or Web client and the database. This is typically where the Web server resides and where business objects are instantiated. Also known as application server tier.

See also: client tier; data source tier

middleware
Network-aware system software, which is layered between an application, the operating system, and the network transport layers, whose purpose is to facilitate some aspect of cooperative processing. Examples of middleware include directory services, message-passing mechanisms, distributed transaction processing (TP) monitors, object request brokers, remote procedure call (RPC) services, and database gateways.

mirror set
A fully redundant (shadow) copy of data. Mirror sets provide an identical twin for a selected disk; all data that is written to the primary disk is also written to the mirror, or shadow, disk. The user then has instant access to another disk with a redundant copy of the information that is on the primary disk, if it fails. Mirror sets provide fault tolerance.

See also: fault tolerance

modem
Modulator/demodulator. A communications device that enables a computer to transmit information over a standard telephone line.

MSMQ
See definition for: Message Queuing

multihomed host
A host that has a connection to more than one physical network. The host may send and receive data over any of the links, but it does not route traffic for other nodes.

See also: host; router

Multipurpose Internet Mail Extensions mapping (MIME mapping)
A method of configuring browsers to view files that are in multiple formats. An extension of the Internet mail protocol that enables the sending of 8-bit-based e-mail messages, which are used to support extended character sets, voice mail, facsimile images, and so on.

multithreading
Running several processes in rapid sequence within a single program, regardless of which logical method of multitasking is being used by the operating system. Because the user's sense of time is much slower than the processing speed of a computer, multitasking appears to be simultaneous, even though only one task at a time can use a computer processing cycle.

multitier architecture
A technique for building applications that are generally split into user, business, and data services tiers. These applications are built from component services that are based on an object model such as Component Object Model (COM). Also known as three-tier architecture.

See also: three-tier architecture

To Top N

name resolution
The method for mapping friendly names to IP addresses.

See also: friendly name

namespace
A naming convention that defines a set of unique names for resources in a network. For DNS, a hierarchical naming structure that identifies each network resource and its place in the hierarchy of the namespace. For WINS, a flat naming structure that identifies each network resource using a single, unique name.

See also: Domain Name System (DNS); Windows Internet Name Service (WINS)

namespace, Windows Management Instrumentation
A logical unit for grouping classes and class instances in a Windows Management Instrumentation (WMI) provider and for controlling their scope and visibility. The namespace for the Internet Information Services (IIS) WMI provider is called MicrosoftIISv2.

See also: namespace; WMI provider

natural language query
A query in a database system that is composed in a subset of a natural language, such as English or Japanese. The query must conform to some restrictive syntax rules so that it can be parsed.

Network File System (NFS)
A service for distributed computing systems that provides a distributed file system, eliminating the need for keeping multiple copies of files on separate computers.

network latency
The time it takes for information to be transferred between computers in a network.

Network News Transfer Protocol (NNTP)
A protocol that is used to distribute network news messages to NNTP servers and to NNTP clients (news readers) on the Internet. NNTP provides for the distribution, inquiry, retrieval, and posting of news articles by using a reliable, stream-based transmission of news on the Internet. NNTP is designed in such a way that news articles are stored on a server in a central database, so that users can select specific items to read. Indexing, cross-referencing, and expiration of old messages are also provided. NNTP is defined in RFC 977.

network sniffer
A hardware and software diagnostic tool that can also be used to decipher passwords, which may result in unauthorized access to network accounts. Plaintext passwords are susceptible to network sniffers.

NNTP
See definition for: Network News Transfer Protocol (NNTP)

node
A computer that is attached to a network; also, a junction of some kind. On a local area network (LAN), a node is a device that is connected to the network and that is capable of communicating with other network devices. Also called a host.

noise word
An insignificant word, such as the, and, or be, that is ignored during indexing. Also called an ignored word.

NTFS file system
A file system that is designed for use specifically with the Windows operating system. It supports long file names, full security access control, file system recovery, extremely large storage media, and various features for the Windows POSIX subsystem. It also supports object-oriented applications by treating all files as objects with user-defined and system-defined attributes.

See also: file allocation table (FAT) file system

To Top O

object
In object-oriented programming, a variable comprising both routines and data that is treated as a discrete entity. An object is based on a specific model, in which a client that uses an object's services gains access to the object's data through an interface that consists of a set of methods or related functions. The client can then call these methods to perform operations.

object-cache scavenger
The code that periodically scans the cache for objects to be discarded. It deletes files that have not been used recently and therefore are unlikely to be used again in the near future.

object identifier (OID)
An extensible, unique identification number for attributes and classes. Performance counter names have their own object identifiers, which are listed in Management Information Base (MIB) files, to provide performance monitoring applications with access to the counters.

See also: Management Information Base (MIB), Simple Network Management Protocol (SNMP)

Object Linking and Embedding (OLE)
A set of integration standards fortransferringg and sharing information among client applications. Also, a protocol that enables the creation of compound documents with embedded links to applications, so that a user does not have to switch among applications to make revisions. OLE is based on the Component Object Model (COM), and it enables the development of reusable objects that operate across multiple applications. This technology has been broadly used in business, where spreadsheets, word processors, financial packages, and other applications can share and link disparate information across client/server architectures.

Object Linking and Embedding Database (OLE DB)
Data-access interfaces that provide consistent access to Structured Query Language (SQL) data sources and non-SQL data sources across an organization and the Internet.

See also: Structured Query Language (SQL)

Object Management Group (OMG)
A vendor alliance that was formed to define and promote Common Object Request Broker Architecture (CORBA) object specifications.

object orientation
A concept that is used to describe a suite of technologies that enable software products to be highly modular and reusable. Object orientation is an approach to accurately modeling the real world in computer applications. Applications, data, networks, and computing systems are treated as objects that can be mixed and matched flexibly, rather than as components of a system with built-in relationships. As a result, an application does not need to be tied to a specific system, and data does not need to be tied to a specific application. The four central object-oriented concepts are encapsulation, message passing, inheritance, and late binding.

Object Request Broker (ORB)
In client/server applications, an interface to which the client makes a request for an object. The ORB directs the request to the server that contains the object, and then the ORB returns the resulting values to the client.

octet
Eight contiguous bits, or a byte. The term octet is used because some computer systems use a byte with more than eight bits.

ODBC
See definition for: Open Database Connectivity (ODBC)

OID
See definition for: object identifier (OID)

OLE
See definition for: Object Linking and Embedding (OLE)

OLE DB
See definition for: Object Linking and Embedding Database (OLE DB)

OMG
See definition for: Object Management Group (OMG)

Open Database Connectivity (ODBC)
An application programming interface (API) that enables applications to access data from a variety of existing data sources. A standard specification for cross-platform database access.

Open Group, The
The parent company of a number of standards organizations, including The Active Group. The Open Group now manages the core ActiveX technology, X/Open, and the Open Software Foundation (OSF).

ORB
See definition for: Object Request Broker (ORB)

out-of-process
For IIS 5.0 isolation mode, ISAPI extensions that are hosted in a surrogate process called DLLHOST.exe, which is managed by COM+.

See also: IIS 5.0 isolation mode; ISAPI extension; out-of-process, pooled

out-of-process component
A Component Object Model (COM) component that runs in a separate process space from its client.

See also: process isolation

out-of-process, pooled
For IIS 5.0 isolation mode, a special Web Application Manager (WAM) package that hosts all out-of-process ISAPI extensions that are set to medium isolation within the same DLLHOST.exe process.

See also: IIS 5.0 isolation mode; ISAPI extension; out-of-process; Web Application Manager (WAM)

To Top P

packet
A piece of information that is sent over a network. A packet is a transmission unit of fixed maximum size that consists of binary information representing both data and a header that contains an ID number, source and destination addresses, and error-control data.

page
See definition for: Web page

parameter
A value that is passed in a function call.

parity
The quality of sameness or equivalence. In the context of computers, usually referring to an error-checking procedure in which the number of ones must always be the same—either even or odd—for each group of bits that is transmitted without error. If parity is checked on a per-character basis, the checking method is called vertical redundancy checking (VRC). If parity is checked on a block-by-block basis, the checking method is called longitudinal redundancy checking (LRC). In typical modem-to-modem communications, parity is one of the parameters that must be agreed on by sending parties and receiving parties before transmission can take place.

See also: fault tolerance; stripe set; stripe set with parity

partition
A portion of a physical disk that functions as if it were a physically separate unit.

password authentication
See definition for: authentication

path, physical
A universal naming convention (UNC) directory path.

See also: path, relative

path, relative
A universal naming convention (UNC) directory path with placeholders, or wildcards, at some levels. Also, the physical path that corresponds to a Uniform Resource Locator (URL).

See also: Uniform Resource Locator (URL)

path, URL
The full Uniform Resource Locator (URL) that is submitted to the server. A URL path may or may not include a specific file name.

See also: Uniform Resource Locator (URL)

PDH
See definition for: Performance Data Helper (PDH)

Perfmon
See definition for: Performance Monitor

performance counters
References that measure the performance of applications, services, or drivers. Counters can be monitored using protocol interfaces, such as Performance Data Helper (PDH) or Simple Network Management Protocol (SNMP), or by using the Performance Monitor MMC snap-in (Perfmon).

Performance Data Helper (PDH)
A network monitoring protocol in Windows. Performance monitoring is the process of capturing and analyzing the performance data that applications, services, and drivers provide. The data can be used to determine the cause of system bottlenecks and to fine-tune system and application performance. PDH is an interface for accessing this data. The Windows Performance Monitor (Perfmon) uses PDH.

See also: Simple Network Management Protocol (SNMP)

Performance Monitor
A Microsoft Management Console (MMC) snap-in that shows real-time data and logs from Performance Counters. The data can be used to determine the cause of system bottlenecks and to fine-tune system and application performance. Counters can be added and removed from the display or configured to log in a certain way.

See also: Performance Counters; Performance Data Helper

Perl (Practical Extraction and Report Language)
An interpreted language that is based on C and several UNIX utilities. Perl has powerful string-handling features for extracting information from text files. Perl can assemble a string and send it to the shell as a command; therefore, it is often used for system administration tasks. A program in Perl is known as a script. Perl was devised by Larry Wall at the NASA Jet Propulsion Laboratory.

See also: script

PGP
See definition for: Pretty Good Privacy (PGP)

physical transaction
The actual updating of the data resources that are used to record a logical transaction.

ping
A command that is used to verify connections to one or more remote hosts. The ping utility uses Internet Control Message Protocol (ICMP) echo request and echo reply packets to determine whether a particular Internet Protocol (IP) system on a network is functional. The ping utility is useful for diagnosing IP network or router failures.

See also: Internet Control Message Protocol (ICMP); router

Point-to-Point Protocol (PPP)
A set of industry-standard framing and authentication protocols that are included with Windows to ensure interoperability with other remote access software. PPP negotiates configuration parameters for multiple layers of the Open Systems Interconnection (OSI) model. The Internet standard for serial communications, PPP defines how data packets are exchanged with other Internet-based systems using a modem connection.

Point-to-Point Tunneling Protocol (PPTP)
A specification for virtual private networks (VPNs) in which some nodes of a local area network (LAN) are connected through the Internet. PPTP is an open industry standard that supports widely used networking protocols: Internet Protocol (IP), Internetwork Packet Exchange (IPX), and Microsoft NetBIOS Extended User Interface (NetBEUI). Organizations can use PPTP to outsource their remote dial-up needs to an Internet service provider or to other carriers to reduce cost and complexity.

policies
Conditions that are set by the system administrator, for example, how quickly account passwords expire and how many unsuccessful logon attempts are allowed before a user is locked out. Policies manage accounts to help prevent exhaustive or random password attacks.

port number
A number that identifies a certain Internet application. For example, the default port number for the WWW service is 80.

PPP
See definition for: Point-to-Point Protocol (PPP)

PPTP
See definition for: Point-to-Point Tunneling Protocol (PPTP)

Pretty Good Privacy (PGP)
A security application that uses public-key encryption.

See also: public-key encryption

process
In Windows, an object that consists of an executable program, a set of virtual memory addresses, and a thread. In UNIX, a synonym for thread.

See also: thread

process accounting
A feature of Internet Information Services (IIS) that administrators can use to monitor and log resource consumption of Common Gateway Interface (CGI) scripts and out-of-process applications.

process isolation
Running an application or component out of process.

See also: out-of-process component

program file
A file that starts an application or program. A program file has an .exe, .pif, .com, .cmd, or .bat file name extension.

programmatic security
Procedural logic that is provided by a component to determine if a client is authorized to perform a requested operation.

properties, document
Information about a document and its physical location on a hard disk.

properties, link
Information about a Hypertext Markup Language (HTML) document and the full Uniform Resource Locator (URL) that is associated with it.

property inheritance
See definition for: inheritance

protocol
The method by which computers communicate on the Internet. The most common protocol for the World Wide Web is Hypertext Transfer Protocol (HTTP). Other Internet protocols include File Transfer Protocol (FTP), Gopher, and Telnet. The protocol is part of the full Uniform Resource Locator (URL) for a resource.

provider
See definition for: WMI provider

proxy
A software program that connects a user to a remote destination through an intermediary gateway.

proxy server
A firewall component that manages Internet traffic to and from a local area network (LAN) and that can provide other features, such as document caching and access control. A proxy server can improve performance by caching and directly supplying frequently requested data, such as popular Web pages. It can also filter and discard requests that the owner does not consider appropriate, such as requests for unauthorized access to proprietary files.

See also: firewall

public-key encryption
An asymmetric scheme that uses a pair of keys for encryption: the public key encrypts data, and a corresponding secret key decrypts the data. For digital signatures, the process is reversed: the sender uses the secret key to create a unique electronic number that can be read by anyone who possesses the corresponding public key, which verifies that the message is truly from the sender.

See also: RSA; session key

To Top Q

query form
An online form that a user fills out to search for information by keyword or concept. Also called a search interface.

query restriction
An expression that limits what to look for in a search. A query restriction narrows the focus of a search. Also called a search expression or search string.

To Top R

RAID
See definition for: Redundant Array of Independent Disks (RAID)

RAM
See definition for: random access memory (RAM)

random access memory (RAM)
Semiconductor-based memory that can be read and written by the central processing unit (CPU) or other hardware devices. The storage locations can be accessed in any order. Note that various types of read-only memory (ROM) are capable of random access, but they cannot be written to. The term RAM is generally understood to refer to volatile memory that can be written to as well as read. Information that is stored in RAM is lost when a user turns off the computer.

RARP
See definition for: Reverse Address Resolution Protocol (RARP)

realm
A term that is sometimes used for domain, in this case to refer to user domains that are established for security reasons, not Internet domains. For password-protected files, the name of the protected resource or area on the server. If the user tries to access the protected resource while browsing, the name of the realm usually appears in the dialog box that asks for a user name and password.

redirection
The process of writing to or reading from a file or device that is different from the one that would normally be the target or the source. Redirection an be used to automatically send a user from an outdated Uniform Resource Locator (URL) to a new URL.

Redundant Array of Independent Disks (RAID)
A data storage method in which data, along with information used for error correction, such as parity bits, is distributed among two or more hard disk drives to improve performance and reliability. The hard disk array is governed by array management software and a disk controller, which handles the error correction. RAID is generally used on network servers. Several defined levels of RAID offer differing trade-offs among access speed, reliability, and cost. Windows includes three of the RAID levels: Level 0, Level 1, and Level 5.

registry
A central, hierarchical database in Windows that is used to store information necessary to configure the system for one or more users, applications, and hardware devices. The registry contains information that is constantly referenced during operation, such as profiles for each user, the applications that are installed on the computer and the types of documents that each application can create, property sheet settings for folders and application icons, the hardware that exists on the system, and the ports are being used.

Remote Data Services
A Web-based technology that brings database connectivity and corporate data publishing capabilities to Internet and intranet applications.

remote procedure call (RPC)
In programming, a call by one program to a second program on a remote system. The second program usually performs a task and returns the results of that task to the first program.

replication
The copying from one server node to another of either content or the configuration metabase, or both. This copying can be done either manually or automatically by using replication software. Replication is a necessary function of clustering that ensures fault tolerance.

See also: fault tolerance; clustering

Request for Comments (RFC)
The document series, begun in 1969, that describes the Internet suite of protocols and related experiments. Not all (in fact, very few) RFCs describe Internet standards, but all Internet standards are written up as RFCs. The RFC series of documents is unusual in that the proposed protocols are forwarded by the Internet research and development community, acting on its own behalf, as opposed to the formally reviewed and standardized protocols that are promoted by organizations such as the American National Standards Institute (ANSI).

See also: American National Standards Institute (ANSI)

resource dispenser
A service that provides the synchronization and management of nondurable resources within a process through simple and efficient sharing by Component Object Model (COM) objects. For example, the Open Database Connectivity (ODBC) resource dispenser manages pools of database connections.

See also: Open Database Connectivity (ODBC)

resource manager
A system service that manages durable data. Server applications use resource managers to maintain the durable state of an application, such as the record of inventory on hand, pending orders, and accounts receivable. Resource managers work in cooperation with the transaction manager to provide the application with a guarantee of atomicity and isolation (using the two-phase commit protocol). Microsoft SQL Server is an example of a resource manager.

Reverse Address Resolution Protocol (RARP)
A TCP/IP protocol for determining the Internet Protocol (IP) address (or logical address) of a node on a local area network (LAN) that is connected to the Internet, when only the hardware address (or physical address) is known. Although the acronym RARP refers only to finding the IP address, and the term Address Resolution Protocol (ARP) technically refers to the opposite procedure, the acronym ARP is commonly used to describe both procedures.

RFC
See definition for: Request for Comments (RFC)

robot
An automated program such as a search engine, indexing program, or cataloging software, that requests Web pages much faster than human beings can. Other commonly used terms for robot include crawler and spider.

router
An intermediary device on a communications network that expedites message delivery. On a single network linking many computers through a mesh of possible connections, a router receives transmitted messages and forwards them to their correct destinations over the most efficient available route. On an interconnected set of local area networks (LANs) using the same communications protocols, a router serves the somewhat different function of acting as a link between LANs, enabling messages to be sent from one LAN to another.

RPC
See definition for: remote procedure call (RPC)

RSA
A public-key encryption standard for Internet security. This acronym derives from the last names of the inventors of the technology: Rivest, Shamir, and Adleman.

run time
The time during which a program actually runs.

See also: design time

To Top S

SAG
See definition for: SQL Access Group (SAG)

scalability
The capability of using the same software environment on many classes of computers and hardware configurations. Although often associated with an evolution to large systems, larger organizations often have need for the same software service to be provided with good performance to both small and large groups of users.

schema
A representation of the structure of something. Classes in Visual Basic and C++ can be said to be schemas of objects, and objects are instances of classes. In internet Information Services (IIS), the metabase schema represents the structure of the metabase configuration file.

scope
In programming, the extent to which an identifier, such as a constant, data type, variable, or routine, can be referenced within a program. Scope can be global or local. Scope can also be affected by the redefinition of identifiers, for example, by giving the same name to both a global variable and a local variable.

script
A kind of program that consists of a set of instructions for an application or utility program. A script can be embedded in a Web page.

See also: ActiveX; Common Gateway Interface (CGI)

scripting engine
A program that interprets and executes a script.

See also: script

search expression
See definition for: query restriction

search interface
See definition for: query form

search string
See definition for: query restriction

Secure Sockets Layer (SSL)
A protocol that supplies secure data communication through data encryption and decryption. SSL uses RSA public-key encryption for specific TCP/IP ports. It is intended for handling commerce payments. An alternative method is Secure-HTTP (S-HTTP), which is used to encrypt specific Web documents, rather than the entire session. SSL is a general-purpose encryption standard. SSL can also be used for Web applications that require a secure link, such as e-commerce applications, or for controlling access to Web-based subscription services.

security log
A log, which is generated by a firewall or other security device, that lists events that could affect security, such as access attempts or commands, and that lists information about the users who are involved in these events.

Selectable Cryptographic Service Provider
See definition for: Cryptographic Service Provider (CSP)

semaphore
A locking mechanism that is used inside resource managers or resource dispensers. Semaphores have no symbolic names, only shared and exclusive mode access; no deadlock detection; and no automatic release or commit.

server
Any of the following: a computer on a network that sends files to, or runs applications for, other computers on the network; the software that runs on the server computer and performs the work of serving files or running applications; or, in object-oriented programming, a piece of code that exchanges information with another piece of code upon request.

server certificate
A unique digital identification that forms the basis of a Web server's Secure Sockets Layer (SSL) security features. Server certificates are obtained from a mutually trusted, third-party organization, and they provide a way for users to authenticate the identity of a Web site.

server cluster
A group of server computers that are networked together, both physically and with software, to provide cluster features such as fault tolerance or load balancing.

See also: fault tolerance; load balancing

server node
An individual computer in a server cluster.

server process
A process that hosts Component Object Model (COM) components. A COM component can be loaded into a surrogate server process, either on the client computer (local) or on another computer (remote). It can also be loaded into a client application process (in-process).

server scriptlet
A Component Object Model (COM) object that is created with Microsoft Server Scriptlet technology.

server-side include (SSI)
A mechanism for including dynamic text in World Wide Web documents. Server-side includes are special command codes that are recognized and interpreted by the server; their output is placed in the document body before the document is sent to the browser. Server-side includes can be used, for example, to include the Date and Time stamp in the text of the file.

session key
A digital key that is created by a client, encrypted, and then sent to a server. This key is used to encrypt data that is sent by the client.

See also: certificate, client; digital signature; key pair

SGML
See definition for: Standard Generalized Markup Language (SGML)

shared property
In Component Services, a variable that is available to all objects in the same server process through Shared Property Manager. The value of the property can be any type that can be represented by a variant.

Simple Mail Transfer Protocol (SMTP)
A TCP/IP protocol for sending messages from one computer to another on a network. This protocol is used on the Internet to route e-mail.

Simple Network Management Protocol (SNMP)
The network management protocol of TCP/IP. In SNMP, agents or clients monitor the activity of various devices on the network and report to the network console workstation. The agents or clients can be hardware as well as software. Control information about each device or service is maintained in a structure known as a management information block. One way to access this information is with Performance Counters.

See also: Management Information Base (MIB)

single-threaded control
A processing model in which all objects are executed on a single thread.

site name
See definition for: host name

slow link
A modem connection, usually from 14,400 bits per second to 56,000 bits per second.

SMTP
See definition for: Simple Mail Transfer Protocol (SMTP)

SNA
See definition for: Systems Network Architecture (SNA)

snap-in
Snap-ins are programs that are hosted within Microsoft Management Console (MMC) that administrators use to manage network services. Snap-ins provide the actual management behavior necessary to administer network services such as Internet Information Services (IIS).

sniffer
See definition for: network sniffer

SNMP
See definition for: Simple Network Management Protocol (SNMP)

socket
An identifier for a particular service on a particular node on a network. The socket consists of a node address and a port number, which identifies the service. For example, port 80 on an Internet node indicates a Web server.

spider
A fast, automated program, such as a search engine, indexing program, or cataloging software, that requests Web pages much faster than human beings can. Other commonly used terms for spider are crawler and robot.

spoofing
Impersonating another person or computer, usually by providing a false e-mail name, Uniform Resource Locator (URL), or IP address.

SQL
See definition for: Structured Query Language (SQL)

SQL Access Group (SAG)
A consortium of vendors that was established in November 1989 to accelerate the Remote Data Access standard and to deliver protocols for interconnectivity among multiple Structured Query Language (SQL)-based software products.

SSI
See definition for: server-side include (SSI)

SSL
See definition for: Secure Sockets Layer (SSL)

Standard Generalized Markup Language (SGML)
An ISO standard (ISO 8879:1986) that supplies a formal notation for the definition of generalized markup languages. It is an international standard for the definition of device-independent, system-independent methods of representing text in an electronic form. SGML is a metalanguage; that is, it is a means of formally describing a language, in this case, a markup language.

See also: Hypertext Markup Language (HTML); International Organization for Standardization (ISO); Extensible Markup Language (XML)

stateful object
An object that holds private state accumulated from the execution of one or more client calls.

stateless object
An object that does not hold private state accumulated from the execution of one or more client calls.

static binding
Binding (converting symbolic addresses in a program to storage-related addresses) that occurs during program compilation or linkage.

static page
A Hypertext Markup Language (HTML) page that is prepared in advance of a request for it and that is sent to the client upon request. This page takes no special action when it is requested.

See also: dynamic page

stripe set
The saving of data across identical partitions on different drives. A stripe set does not provide fault tolerance; however, stripe sets with parity do provide fault tolerance.

See also: fault tolerance; partition; stripe sets with parity

stripe set with parity
A method of data protection in which data is striped in large blocks across all the disks in an array. Data redundancy is provided by the parity information. This method of data protection provides fault tolerance.

See also: fault tolerance; stripe set

Structured Query Language (SQL)
The international standard language for defining and accessing relational databases.

stub
A routine that contains no executable code and that generally consists of comments that describe what will eventually be in its place. A stub is used as a placeholder for a routine to be written later.

subnet mask
A TCP/IP configuration parameter that extracts network and host configuration from an IP address.

System Data Source Name (DSN)
A name that can be used by any process on the computer. Internet Information Services (IIS) uses system DSNs to access Open Database Connectivity (ODBC) data sources.

System Monitor
See definition for: Performance Monitor

Systems Network Architecture (SNA)
A widely used communications framework that was developed by IBM to define network functions and to establish standards for enabling its different models of computers to exchange and process data. SNA contains separate layers. As changes occur in one layer, no other layer has to be changed.

To Top T

T1
A U.S. telephone standard for a transmission facility at digital signal level 1 (DS1) with 1.544 megabits per second in North America and 2.048 megabits per second in Europe. The bit rate is with the equivalent bandwidth of approximately twenty-four 56-kilobits-per-second lines. A T1 circuit is capable of serving a minimum of 48 modems at 28.8 kilobits per second or 96 modems at 14.4 kilobits per second. T1 circuits are also used for voice telephone connections. A single T1 line carries 24 telephone connections with 24 telephone numbers. When it is used for voice transmission, a T1 connection must be split into 24 separate circuits.

T3
A U.S. telephone standard for a transmission facility at digital signal level 3 (DS3). T3 is equivalent in bandwidth to 28 T1's, and the bit rate is 44.736 megabits per second. T3 is sometimes called a 45-meg circuit.

TCP/IP
See definition for: Transmission Control Protocol/Internet Protocol (TCP/IP)

Telnet
A protocol that enables an Internet user to log on to and enter commands on a remote computer that is linked to the Internet, as if the user were using a text-based terminal directly attached to that computer. Telnet is part of the TCP/IP suite of protocols.

10BaseT
A variant of Ethernet which allows stations to be attached by a twisted-pair cable.

Remote Administration (HTML) tool
A tool that is included in Internet Information Services IIS that you can use to remotely administer Internet Information Services (IIS) across the Internet or your intranet through your Web browser.

thin server
A client/server architecture in which most of an application is run on the client computer, which is called a fat client, with occasional data operations on a remote server. Such a configuration yields good client performance but complicates administrative tasks, such as software upgrades.

See also: fat server

thread
The basic entity to which the operating system allocates central processing unit (CPU) time. A thread can execute any part of the application's code, including a part that is currently being executed by another thread. All threads of a process share the virtual address space, global variables, and operating-system resources of the process.

three-tier architecture
Divides a networked application into three logical areas: the user interface layer, the business logic layer, and the database layer. Layers may have one or more components. For example, there can be one or more user interfaces in the top tier, each user interface may communicate with more than one application in the middle tier at the same time, and the applications in the middle tier may use more than one database at a time. Components in a tier may run on a computer that is separate from the other tiers, communicating with the other components over a network.

throttling
Controlling the maximum amount of bandwidth that is dedicated to Internet traffic on a server. This feature is useful if there are other services (such as e-mail) sharing the server over a busy link.

thumbnail
A small version of a graphic with a hyperlink to a larger version of the same graphic.

time-out
A setting that automatically cancels an unanswered client request after a certain period of time.

token ring
A type of network that consists of nodes that are wired into a ring. Each node constantly passes a control message (token) on to the next node; the node that has the token can send a message. Often, token ring is used to refer to the Institute of Electrical and Electronics Engineers (IEEE) 802.5 token ring standard, which is the most common type of token ring.

See also: local area network (LAN)

TP
See definition for: transaction processing (TP)

transaction context object
An object used to allow a client to dynamically include one or more objects in one transaction.

transaction manager
A system service that is responsible for coordinating the outcome of transactions in order to achieve atomicity. The transaction manager ensures that resource managers reach a consistent decision on whether the transaction should commit or fail.

transaction processing (TP)
The real-time handling of computerized business transactions as they are received by the system. Also called online transaction processing (OLTP).

Transmission Control Protocol/Internet Protocol (TCP/IP)
A communications standard for all computers on the Internet. On the sending end, TCP breaks the data that is to be sent into data segments. IP assembles segments into packets that contain data segments, as well as sender and destination addresses. IP then sends the packets to the router for delivery. On the receiving end, IP receives the packets and breaks them down into data segments. TCP assembles the data segments into the original data set.

See also: packet

Transport Layer Security (TLS) encryption
A generic security protocol similar to Secure Sockets Layer (SSL), used with Simple Mail Transfer Protocol (SMTP). Se also Secure Sockets Layer

tree, directory
A conceptual model that is used to describe the directory structure of a file directory or a Web site.

two-phase commit
A protocol that ensures that transactions that apply to more than one server are completed on all servers or on none at all. Two-phase commit is coordinated by the transaction manager and supported by resource managers.

two-tier architecture
See definition for: client/server architecture

type library
A binary file that describes a component's methods, properties, and data structure.

To Top U

UNC
See definition for: Universal Naming Convention (UNC)

Uniform Resource Locator (URL)
A naming convention that uniquely identifies the location of a computer, directory, or file on the Internet. A URL also specifies the appropriate Internet protocol, such as Hypertext Transfer Protocol (HTTP) or File Transfer Protocol (FTP). An example of a URL is http://www.microsoft.com.

universal naming convention (UNC)
The naming convention that is used for physical directories.

upload
In communications, the process of transferring a copy of a file from a local computer to a remote computer by means of a modem or network. With a modem-based communications link, the process generally involves instructing the remote computer to prepare to receive the file on its disk and then wait for the transmission to begin.

URL
See definition for: Uniform Resource Locator (URL)

URL directory
See definition for: virtual directory

URL mapping
The process of associating a Uniform Resource Locator (URL) with a physical directory.

See also: virtual directory

usage data
Information that an administrator can use to learn how other people access and use a site. By analyzing this data, an administrator can identify a site's most popular (or unpopular) areas and clarify the most common navigational paths through the site.

Usenet
The most popular news group hierarchy on the Internet.

user type
A DWORD that specifies how data is used. A user type is assigned to an identifier in the metabase.

UTF-8
A method of character encoding that allows for both single and multibyte characters in one string. UTF-8 files take up more space than files that are stored in an American National Standards Institute (ANSI) format. Internet Information Services (IIS) supports Web files that are saved in UTF-8 format or in ANSI format.

See also: codepage

To Top V

virtual directory
A directory name, used in an address, that corresponds to a physical directory on the server. Sometimes called URL mapping.

virtual document
A document that is created automatically in response to information that is provided by the user. A virtual document is created only in answer to a browser request, and it is not permanently stored in a physical directory. An ASP page is an example of a virtual document. Also called a dynamic document.

virtual machine
Software that mimics the performance of a hardware device, for example, a program that allows applications that are written for an Intel processor to be run on a Motorola processor.

Virtual Reality Modeling Language (VRML)
A language for coding three-dimensional HTML applications.

virtual server
A virtual computer that resides on a Hypertext Transfer Protocol (HTTP) server but appears to the user as a separate HTTP server. Several virtual servers can reside on one computer, each capable of running its own programs and each with individualized access to input and peripheral devices. Each virtual server has its own domain name and IP address, and each appears to the user as an individual Web site or File Transfer Protocol (FTP) site. Some Internet service providers (ISPs) use virtual servers for those clients who want to use their own domain names. Also called a Web site.

volatile objects
Typically, files that a Web site administrator updates frequently.

volume set
A combination of partitions on a physical disk that appear as one logical drive.

See also: logical drive

VRML
See definition for: Virtual Reality Modeling Language (VRML)

To Top W

W3C
See definition for: World Wide Web Consortium (W3C)

W3SVC
See definition for: World Wide Web Publishing Service (WWW service)

WAN
See definition for: wide area network (WAN)

WAM
See definition for: Web Application Manager (WAM)

WBEM
See definition for: Web-Based Enterprise Management (WBEM)

Web application
A software program that uses Hypertext Transfer Protocol (HTTP) for its core communication protocol and that delivers Web-based information to the user in the Hypertext Markup Language (HTML) language. Also called a Web-based application.

Web Application Manager (WAM)
For IIS 5.0 isolation mode, a COM+ application package that works with DLLHOST.exe to host out-of-process ISAPI extensions. Provides communication between DLLHOST.exe and INETINFO.exe.

See also: IIS 5.0 isolation mode; ISAPI extension; out-of-process, pooled

Web-Based Enterprise Management (WBEM)
An industry initiative to develop a standard technology for accessing management information about systems in an enterprise environment. The Microsoft implementation of Web-based Enterprise Management is Windows Management Instrumentation (WIM).

WebDAV
See definition for: Web Distributed Authoring and Versioning (WebDAV)

Web Distributed Authoring and Versioning (WebDAV)
An extension to the Hypertext Transfer Protocol (HTTP) 1.1 standard that facilitates access to files and directories through an HTTP connection. Remote authors can add, search, delete, or change directories and documents and their properties.

Web farm
A collection or group of Web servers, typically running behind a load-balancing scheme.

See also: Web garden

Web garden
An application pool served by more than one worker process.

See also: Web farm

Web page
A World Wide Web document. A Web page typically consists of a Hypertext Markup Language (HTML) file, with associated files for graphics and scripts, in a particular directory on a particular computer. It is identified by a Uniform Resource Locator (URL).

Web server
In general, a computer that is equipped with server software that uses Internet protocols such as Hypertext Transfer Protocol (HTTP) and File Transfer Protocol (FTP) to respond to Web client requests on a TCP/IP network.

Web service extensions
ISAPIs and CGIs that extend Internet Information Services (IIS) functionality beyond serving static pages.

wide area network (WAN)
A communications network that connects geographically separated areas.

Windows Internet Name Service (WINS) server
A server that uses the WINS protocol to map IP addresses to user-friendly names.

See also: Domain Name System (DNS)

Windows Management Instrumentation (WMI)
The Microsoft implementation of Web-Based Enterprise Management (WBEM), which is an industry-wide standard technology for accessing management information about systems in an enterprise environment. WMI uses the Common Information Model (CIM) industry standard to represent managed components in a system. A system developer can develop a WMI interface that allows programmatic access to a system, so that users can write command-line administration scripts and tools.

See also: Web-Based Enterprise Management (WBEM); Common Information Model (CIM)

Windows Open Services Architecture (WOSA)
Standards for creating cross-platform applications that utilize Windows services.

Windows Script Host (WSH)
A language-independent scripting host for ActiveX scripting engines on 32-bit Windows platforms.

WMI
See definition for: Windows Management Instrumentation (WMI)

WMI provider
In Windows Management Instrumentation (WMI), a set of interfaces that provide programmatic access to management information in a system. Internet Information Services (IIS) implements a WMI provider in the namespace called MicrosoftIISv2 to provide programmatic access to metabase properties and system settings.

WMI Query Language (WQL)
A subset of the American National Standards Institute (ANSI) standard Structured Query Language (SQL), with Windows Management Instrumentation (WMI)-specific extensions. Because WQL is a read-only query language, a developer cannot use it to instruct the Windows Management service to update, insert, or delete data in the WMI repository or in a provider. Instead, a developer can only use WQL to retrieve information.

worker process
The implementation of the core Web server in Internet Information Services (IIS). Worker processes run in W3wp.exe.

worker process isolation mode
The new Web process model for Internet Information Services (IIS) 6.0

worker thread
A thread that is created by a component, Internet Server API (ISAPI) extension, or filter to perform asynchronous processing. Using worker threads frees up Internet Information Services (IIS) I/O threads to process additional requests.

working directory
The directory in which Web server software is installed.

working set
The RAM that is allocated to a process in the Windows operating system.

World Wide Web (WWW)
A set of services that run on top of the Internet and provide a cost-effective way of publishing information, supporting collaboration and workflow, and delivering business applications to connected users all over the world. The Web is a collection of Internet host systems that make these services available on the Internet, using the Hypertext Transfer Protocol (HTTP). Web-based information is usually delivered in the form of hypertext and hypermedia, using Hypertext Markup Language (HTML). The most graphical service on the Internet, the Web also has the most sophisticated linking abilities.

World Wide Web Consortium (W3C)
An international industry consortium that is jointly hosted by the Massachusetts Institute of Technology Laboratory for Computer Science (MIT/LCS) in North America, by the Institut National de Recherche en Informatique et en Automatique (INRIA) in Europe, and by the Keio University Shonan Fujisawa Campus in Asia. W3C was founded in 1994 to develop common standards for the World Wide Web. Initially, the W3C was established in collaboration with CERN, where the Web originated, with support from the Defense Advanced Research Projects Agency (DARPA) and the European Commission.

World Wide Web Publishing Service (WWW service)
The service that manages the Internet Information Services (IIS) core components that process HTTP requests and configure and manage Web applications. Formerly known as W3SVC.

WOSA
See definition for: Windows Open Services Architecture (WOSA)

WSH
See definition for: Windows Script Host (WSH)

WWW
See definition for: World Wide Web (WWW)

WWW Service Administration and Monitoring component
A component of the World Wide Web Publishing Service (WWW service) in Internet Information Services (IIS) that is responsible for configuration, by means of the metabase, and for worker process management.

To Top X

XML
See definition for: Extensible Markup Language (XML)

XSL
See definition for: Extensible Stylesheet Language (XSL)


Troubleshooting

Many of the design changes in Internet Information Services (IIS) 6.0 directly address the need to secure the World Wide Web Publishing Service (WWW service) as a whole, and Web and FTP sites in particular. You might experience errors if you have not enabled certain features or services that are locked, or disabled, by default. This topic describes some of the symptoms of these errors and the processes to remedy them (or a link to a topic that describes how to remedy the error). For a comprehensive list of changes in IIS 6.0, including a list of security changes and a brief explanation of the new process model, see What's Changed.

Dynamic or Static Content Errors

  • Applications are denied access to resources
  • Requests for dynamic content return 404 error
  • Requests for static files return 404 error
  • Worker process recycling drops application session state
  • Server-side include directives (#include) return 404 error (for .stm files) or 0131 error (for .asp files)
  • ASP generates Permission Denied errors in event log for global.asa
  • CGI processes will not start
  • ASP.NET pages are returned as static files
  • Collaboration Data Objects for Windows NT Server fail

Connection Errors

  • Client requests receive 503 error
  • Anonymous accounts (IUSR_computername) attempting sub-authentication logon receive 401 error
  • Clients cannot connect to server
  • UNC connections are denied access
  • Access denied to console applications in System32 directory
  • Client requests error-out or time-out

Miscellaneous Errors

  • File requests to UNIX or Linux server return wrong file or error
  • Cannot locate /Scripts or /Msadc directory
  • ISAPI filter does not show up as "loaded" in UI

Dynamic or Static Content Errors

Applications Are Denied Access to Resources

After a clean install, IIS 6.0 runs in worker process isolation mode. Applications running in this mode use the Network Service identity, by default. Network Service is an account with few user rights and therefore provides better security by restricting access to resources on the Web server. If you migrate applications to IIS 6.0 while the server is in worker process isolation mode, and if your applications previously ran in-process (in Inetinfo.exe) as LocalSystem, the applications may fail to access resources because of the restrictions set forth by the Network Service identity. The LocalSystem account has access to almost all resources on the operating system, and therefore creates serious security implications. You should avoid using the LocalSystem account when possible. If it is absolutely necessary to use the LocalSystem account on an application, run that application in a new application pool in its own virtual directory so you can reduce the attack surface by isolating the application. As an alternative, and if your application needs permission to use the Trusted Computing Base (TCB), run the application as a configurable identity and assign the TCB permission to the configurable identity. This alternative, however, still presents a security risk because the TCB permission is very powerful.

For more information, see Configuring Worker Process Identities and IIS and Built-in Accounts.

Requests for Dynamic Content Return 404 Error

In order to take a more proactive stance against malicious users and attackers, IIS is installed in a highly secure and locked mode. By default, IIS serves only static content—meaning features like ASP, ASP.NET, server-side includes, WebDAV publishing, FrontPage® Server Extensions, and Common Gateway Interfaces—do not work unless enabled. If you do not enable this functionality after installing IIS, by default on this denial, IIS returns a generic 404 custom error page to prevent disclosure of configuration information. IIS also writes the 404 error with the substatus code of 2 (404.2) in the W3C Extended log files, by default.

important Important You must be a member of the Administrators group on the local computer to perform the following procedure (or procedures), or you must have been delegated the appropriate authority. As a security best practice, log on to your computer using an account that is not in the Administrators group, and then use the Run as command to run IIS Manager as an administrator. From the command prompt, type runas /user:administrative_accountname "mmc %systemroot%\system32\inetsrv\iis.msc".

To enable or disable a Web service extension

  1. In IIS Manager, expand the local computer, and then click Web Service Extensions.
  2. In the details pane, click the Web service extension that you want to enable or disable.
  3. To enable a disabled Web service extension, click Allow.
  4. To disable an enabled Web service extension, click Prohibit.
  5. Click OK.

To enable or disable Web service extensions programmatically, see WebSvcExtRestrictionList.

Requests for Static Files Return 404 Error

For requests to static content, this version of IIS serves requests for files with known file name extensions only, a feature called Known Extensions. If a request is made for a resource whose file name extension is not mapped to a known extension in the MimeMap property, IIS denies the request and logs a 404 error with the substatus code of 3 (404.3) in the W3C Extended log files (by default). To prevent disclosure of configuration information, IIS is configured to return the generic 404 custom error page by default on this denial. You can add or edit the Multipurpose Internet Mail Exchange (MIME) map using IIS Manager. To turn off the Known Extensions feature and allow IIS to serve files with any extension, add the *,application/octet-stream value to the list of MIME maps. If you update the global MIME map, you must wait until the worker process has recycled or restart the World Wide Web Publishing Service (WWW service) before changes take effect. If you update an individual Web site MIME map, the change is reflected instantly.

For more informatin on adding or editing the MIME map, see Working with MIME Types.

Worker Process Recycling Drops Application Session State

By default, worker processes recycle after 120 minutes. If your ASP applications are not designed to store session state while a worker process is recycled, then session state in that ASP application can be lost. To remedy this problem, you can either store session state in a database or disable worker process recycling.

To disable worker process recycling

  1. In IIS Manager, expand the local computer, expand Application Pools, right-click the application pool, and then click Properties.
  2. On the Recycling tab, clear the Recycle worker processes (in minutes) check box.
  3. Click OK.

Server-Side Include Directives (#include) Return 404 Error (for .stm Files) or 0131 Error (for .asp Files)

If your ASP page uses the #include server-side include directive and the ".." notation to refer to a parent directory, the directive will return an error unless you have reconfigured the AspEnableParentPaths metabase property. This property is set to false by default. If set to true, this property constitutes a potential security risk because an include path may access critical or confidential files outside the application root directory.

To enable parent paths through IIS Manager

  1. In IIS Manager, expand the local computer, right-click the starting-point directory of the application you want to configure, and then click Properties.
  2. Click the Directory tab, and then click Configuration.
  3. Click the Options tab.
  4. In the Application configuration section, select the Enable parent paths check box.
  5. Click OK.

ASP Generates Permission Denied Errors in Event Log for Global.asa

Earlier versions of ASP executed events in the security context (or user identity) of the host process because there is no user context during these events. This caused problems, such as access denied errors when writing to a file in the Session_OnEnd event. ASP, by default, now runs the global.asa events, Application_OnEnd and Session_OnEnd, anonymously (the default value is true).

To change this setting programmatically, see AspRunOnEndAnonymously.

CGI Processes Will Not Start

If your CGI processes do not run, ensure that the CGI Web service extension has been enabled. See Requests for Dynamic Content Return 404 Error in this topic. Also, CGIs will not start unless the account on which the CGI processes run are assigned certain user rights. You can add the account as a member of the IIS_WPG group and assign the account the following two user rights:

  • Adjust memory quotas for a process.
  • Replace a process level token.

To assign user rights to an account on the local computer

  1. From the Start menu, point to Administrative Tools, and then click Local Security Policy.
  2. Expand Security Settings, double-click Local Policies, and then double-click User Rights Assignment.
  3. In the details pane, double-click the policy you want to change.
  4. Click Add User or Group.
  5. In the Enter the object names to select box, type the user or group name.
  6. Click OK.

ASP.NET Pages are Returned as Static Files

If you installed IIS 6.0 without installing ASP.NET, ASP.NET files can be returned as static files. This error can also occur if you reinstalled IIS 6.0 without reregistering ASP.NET. To learn how to remedy this error, see ASP.NET IIS Registration Tool and use the i option.

Collaboration Data Objects for Windows NT Server Fail

Collaboration Data Objects for Microsoft® Windows NT® Server (CDONTS) has been removed from the Microsoft Windows® Server 2003 family. If your Web applications use CDONTS, you can convert them to Microsoft Collaboration Data Objects (CDO). Most methods in CDONTS have matching methods in CDO, but might be named differently.

For reference material for CDO in the Platform Software Developer Kit (PSDK), see Overview of CDO at MSDN Online.

Connection Errors

Client Requests Receive 503 Error

Check the error event log to determine if the 503 error was detected in HTTP.sys or in the World Wide Web Publishing Service (WWW service). If the error was detected in HTTP.sys, there may be too many queued requests so that HTTP.sys has exceeded its application pool queue length limit. To remedy this problem, increase the application pool queue length limit.

To change an application pool queue length limit

  1. In IIS Manager, expand the local computer, expand the Application Pools folder, right-click the application, and then click Properties.
  2. Click the Performance tab.
  3. In the Request queue limit section, select the Limit the kernel request queue to check box, and type the maximum number of queued requests.
  4. Click OK.

If the 503 error was detected in the WWW service, then the problem may be that IIS has initiated rapid-fail protection because too many worker processes assigned to an application pool have become unhealthy in a given period of time. To remedy this problem, increase the number of failures or the time period before rapid-fail protection initiates. You should test your application for memory leaks or other problems that may be the source of the unhealthy worker processes.

To configure rapid-fail protection

  1. In IIS Manager, expand the local computer, expand Application Pools, right-click the application pool, and then click Properties.
  2. Click the Health tab.
  3. In the Failures box, type the number of worker process failures to be detected before disabling the worker process.
  4. In the Time period box, type the number of minutes during which failure totals are accumulated.
  5. Click OK.

Anonymous Accounts (IUSR_computername) Attempting Sub-Authentication Logon Receive 401 Error

The sub-authentication component, Iissuba.dll, is not enabled by default in IIS 6.0. In earlier versions, Iissuba.dll allowed IIS to manage passwords on anonymous accounts, which created a potential security risk. In IIS 6.0, you can use sub-authentication to manage passwords for anonymous accounts by meeting the following requirements:

  • For applications which you assign anonymous access, the worker process runs as LocalSystem.
  • The sub-authentication component, Iissuba.dll, is registered.
  • The AnonymousPasswordSynch metabase property is enabled (set to true).

The actions taken to meet the above requirements differ between clean installs of IIS 6.0 and upgrades to IIS 6.0 from installations of IIS with sub-authentication configured.

For information on the procedures to configure sub-authentication, see Anonymous Authentication.

Clients Cannot Connect to Server

The Windows Server 2003 family provides a software-based firewall to prevent unauthorized connections to your server from remote computers. The Internet Connection Firewall (ICF) is disabled by default. However, if you have enabled the firewall in its default configuration after installing a member of the Windows Server 2003 family and before installing IIS, clients will not be able to connect to your server. The following procedure configures ICF to allow clients to initiate Web and other IIS-related connections to your server.

To configure Internet Connection Firewall for IIS

  1. From the Start menu, click Control Panel.
  2. Double-click Network Connections.
  3. Right-click Local Area Connection, and click Properties.
  4. Click the Advanced tab.
  5. If you do not want to use the ICF, make sure the Protect my computer and network by limiting or preventing access to this computer from the Internet check box isn't available, and click OK.
  6. If you do want to use the ICF, make sure the Protect my computer and network by limiting or preventing access to this computer from the Internet check box is enabled, and click Settings.
  7. On the Services tab, enable a service to which you want to allow access to clients.
  8. In the Service Settings dialog box that appears after enabling a service, do one of the following:
    • If you are enabling a service on the same computer you are working, the correct computer name is already filled in. Click OK.
    • If you are enabling a service on a different computer on your network, type the name or IP address of the computer hosting the service you are enabling, and click OK.
  9. Repeat steps 7 and 8 until all the services you want accessible to clients are enabled.

UNC Connections Are Denied Access

The Universal Naming Convention (UNC) authentication method, also called UNC Passthrough authentication, determines the credentials to be used for gaining access to a UNC share on a remote computer. Beginning with IIS 6.0, the UNC authentication looks at the request user and the credentials stored in the UNCUserName and UNCPassword properties of the metabase to determine the credentials to pass through to the computer with the UNC share, in the following way:

  1. If UNCUserName is specified (not empty) and UNCPassword is valid, the metabase user credentials are sent as the user identity for access to the remote share. If UNCUserName is specified (not empty) and UNCPassword is not valid, a 500 Internal Server Error: Invalid Username or Password message is sent to the client.
  2. If UNCUserName is empty, then the credentials of the request user (either an authenticated set of credentials for authenticated requests or IUSR_computername credentials for anonymous requests) are sent as the user identity for access to the remote share.

note Note The UNCAuthenticationPassthrough metabase key is no longer used for UNC authentication.

Access Denied to Console Applications in System32 Directory

Requests that use console applications in the Windows System32 directory, such as Cmd.exe, are denied access unless the remote user making the request is an authenticated member of the Administrators group. The denial is the result of special access control lists (ACLs) on all console application programs in the Windows System32 directory to restrict access to only administrators, LocalSystem, interactive users, and services. The ACL restriction does not affect local logon users that should have access, nor does the restriction affect your own custom CGI executable programs.

Client Requests Error-out or Time-out

In IIS 6.0, settings are set to aggressive and secure defaults to minimize attacks due to time-outs and limits that were previously too generous. IIS enforces the following time-outs at the connection level:

  • Limits on Response Buffering: The default value for the ASPBufferingLimit metabase property is 4 MB. If ASP scripts buffer more than this, they error-out. There was no limit to buffering prior to IIS 6.0.
  • Limits on posts: The AspMaxRequestEntityAllowed metabase property enforces a maximum ASP post size of 204,800 bytes, with each individual field limited to 100 KB. There was no limit to posts prior to IIS 6.0.
  • The ServerListenTimeout metabase property no longer exists: ServerListenTimeout has been replaced by the following metabase properties:
    • ConnectionTimeout: This property specifies the amount of time, in seconds, the server waits before disconnecting an inactive connection.
    • MinFileBytesPerSec: When IIS responds to a client request, the MinFileBytesPerSec property determines the length of time the client has to receive the entire response. If the client machine takes too long to receive the entire response, the kernel-mode driver, HTTP.sys, terminates the connection according to the time-out value.
    • HeaderWaitTimeout: When a client connects to the Web server, the client computer is given a time limit to send in all headers for the request (demarked by a final double \r\n). If the complete header set for the request is not received within the time period indicated by HeaderWaitTimeout, HTTP.sys resets the connection. You can configure the value of HeaderWaitTimeout.
  • Header size limitation: By default, HTTP.sys only accepts requests where the request header is less than 16 KB. This means that if HTTP.sys does not receive the terminating <CRLF><CRLF> sequence within 16 KB, HTTP.sys considers the request malicious and terminates the connection. You can change the header size limitation by adjusting the value in the MaxRequestBytes registry key.

Miscellaneous Errors

File Requests to UNIX or Linux Server Return Wrong File or Error

If IIS must access files on a UNIX or Linux system, file name case sensitivity can be an issue unless Network File System (NFS) support is enabled in IIS.

UNIX and Linux both support mixed-case file names, and IIS fully supports requesting static files in a case-sensitive manner. An issue arises, however, when IIS makes a subsequent request for a file from its static file cache. Because all file names are converted to uppercase letters in the IIS cache, any request after the first request from the IIS static file cache might fail or return the wrong file.

To remedy this problem, disable the IIS static file cache so that all file requests are issued fresh, thereby retaining correct file name case. The static file cache can be disabled for individual virtual directories on Web sites, or globally for all sites.

note Note Changing this setting has no effect on how ASP files and templates are cached.

To disable the static file cache for a particular Web site virtual directory

  • Edit the metabase and set the MD_VR_NO_CACHE property to 1.

To disable the static file cache for all sites

  • Edit the registry and add the binary value DisableStaticFileCache=1 to the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\InetInfo\Parameters key.

Cannot Locate /Scripts or /Msadc Directory

By default, the /scripts and /msadc directories in IIS 5.0 allowed scripts and executables to run. These directories were removed from IIS 6.0 because, if a malicious user gained access to one of these directories, the user could run a script or executable and potentially gain control of the Web server. If your server configuration requires a directory of this nature, you will need to create the directory and establish the appropriate NTFS permissions.

ISAPI Filter Does Not Show Up as "Loaded" in UI

In an effort to optimize resources in IIS 6.0, an ISAPI filter is not loaded until a request is made to a Web site that requires the ISAPI filter. Until this request is made, IIS Manager does not display the status of the ISAPI filter. Also, if the ISAPI filter requires the SF_NOTIFY_READ_RAW_DATA filter notification, the filter will not load while IIS is running in worker process isolation mode. Review the Application Event Log for events from W3SVC-WP to verify that the filter did not load. To remedy this problem, run IIS in IIS 5.0 isolation mode or contact the vendor of the ISAPI filter for compatibility updates.

important Important If the ISAPI filter is restricted by an access control list (ACL) in such a way that the IIS worker process identity cannot load it, requests receive a 503 error. To remedy this, set the ACLs on the ISAPI filter DLL to allow access for the IIS_WPG group.

To configure IIS for IIS 5.0 isolation mode

  1. In IIS Manager, expand the local computer, right-click Web Sites, and then click Properties.
  2. Click the Service tab, select the Run WWW service in IIS 5.0 isolation mode check box, and then click OK.
  3. To start the WWW service, click Yes.


Legal Information

Microsoft Documentation

Information in this document, including URL and other Internet Web site references, is subject to change without notice. Unless otherwise noted, the example companies, organizations, products, domain names, e-mail addresses, logos, people, places and events depicted herein are fictitious, and no association with any real company, organization, product, domain name, e-mail address, logo, person, place or event is intended or should be inferred. Complying with all applicable copyright laws is the responsibility of the user. Without limiting the rights under copyright, no part of this document may be reproduced, stored in or introduced into a retrieval system, or transmitted in any form or by any means (electronic, mechanical, photocopying, recording, or otherwise), or for any purpose, without the express written permission of Microsoft Corporation.

Microsoft may have patents, patent applications, trademarks, copyrights, or other intellectual property rights covering subject matter in this document. Except as expressly provided in any written license agreement from Microsoft, the furnishing of this document does not give you any license to these patents, trademarks, copyrights, or other intellectual property.

© 1997–2003 Microsoft Corporation. All rights reserved.

Active Directory, ActiveX, BizTalk, FrontPage, JScript, Microsoft, MSDN, MS-DOS®, MSN, Outlook, SharePoint, Visual Basic, Visual C++, Visual C#, Visual InterDev, Win32, Windows, and Windows NT, are either registered trademarks or trademarks of Microsoft Corporation in the United States and/or other countries.

The names of actual companies and products mentioned herein may be the trademarks of their respective owners.


Understanding the MD5 Hash

An MD5 hash is used for sending encrypted user credentials across a network within an HTTP header. An MD5 hash, also known as the MD5 message-digest, is created by an HTTP 1.1 compliant browser such as Internet Explorer 5 and above, using the MD5 message-digest algorithm as defined in the RFC 1321 specification located at the World Wide Web Consortium Web site.

note Note The MD5 hash is a security improvement over base64 encoded clear text passwords, because a base64 encoded passwords that are intercepted, using a network sniffer, are a trivial matter to decode and use by an unauthorized person. A user name and password that is encrypted using the MD5 message-digest algorithm cannot be feasibly decrypted from the hash.

An MD5 hash contains a users name, password, and the name of the realm. The realm is the domain that will authenticate or reject the users credential. The users credential is the password that is encrypted within the MD5 hash.

For information about setting the realm name on an IIS server, see Digest Authentication or Advanced Digest Authentication.

MD5 Hash Properties

An MD5 hash consists of a small amount of binary data, typically no more than 160 bits, and is sent by across the network within an HTTP header. All hash values share the following properties:

  • Hash length The length of the hash value is determined by the type of algorithm used, and its length does not vary with the size of the message. The most common hash value lengths are either 128 or 160 bits.
  • Non-discoverability Every pair of nonidentical messages will translate into a completely different hash value, even if the two messages differ only by a single bit. Using today's technology, it is not feasible to discover a pair of messages that translate to the same hash value.
  • Repeatability Each time a particular message is hashed using the same algorithm, the exact same hash value will be produced.
  • Irreversibility All hashing algorithms are one-way. Given a hash value, it is infeasable to discover the password. In fact, none of the properties of the original message can be determined given the hash value alone.

For more information about the MD5 hash (message-digest) algorithm, search for RFC 1321 at the World Wide Web Consortium Web site.