A.15. Chapter 16: Working the Web with IIS 7.0 and 7.5

Understand IIS 7 architecture and capabilities

IIS 7 redefined the structure of Microsoft's web server by compartmentalizing functionality and vertically managing behavior in a hierarchy. The new features of IIS 7.5 enhance application pools and include native modules for application protocols such as FTP that were absent from the previous revision. A dependency for many other services, IIS has become an integral part of the OS.

Master It

Which of the following does not require IIS?

• Remote Server Administration Tools

• AD Rights Management Services

• Windows SharePoint Services 3.0

• Windows Management Service

• Federation Service

Solution

Windows Management Service supports IIS remote administration but does not rely on IIS.

Plan for and install IIS 7.5

Relatively lean by default, IIS 7.5 must be carefully and painstakingly planned so as not to install more modular functionality than you need. More than a resource concern, leaving unnecessary role services off the server is also a method of securing your websites. As always with Microsoft, there are multiple ways to install IIS 7.5, from interactive GUI to CLI utility scripting to Windows PowerShell.

Master It

You are planning a Windows Server 2008 R2 web server and need to make sure the requisite features are already installed in the OS. What three role services should you verify are installed?

Solution

• Windows Process Activation Service (WAS)

• Process Model

• Configuration APIs

Manage IIS 7's modularity and delegated administration

IIS 7.5 modules are only one piece of evidence of the product's compartmentalization. Web applications and individual configuration settings per site can be independently managed as well. A hierarchical ladder of global, web, application, and page settings allow granular administration by multiple engineers.

Master It

What is feature delegation?

Solution

Feature delegation is the art of allowing site administrators to configure a specific IIS feature at their own sites rather than accepting the feature behavior dictated by the global settings on the server. Delegation is enabled by unlocking specific sections of the web.config files on one or more sites.

Create and secure websites in IIS 7

Designing and generating new websites in IIS 7.5 can be accomplished via the GUI or CLI, allowing you to automate routine site creation. Permission structure can be copied from one site to another or managed from the upper layers of the settings hierarchy to simplify permission granting. IIS 7.5 eases site generation by packaging your website.

Master It

You need to create a new website that has all the characteristics of the Default Web Site but must also support ASP.NET pages. You do not want to add ASP.NET support to the Default Web Site for fear of adding vulnerability to existing web content. How would you implement this?

Solution

Create a new website, and add the ASP.NET module to the new site. Use a custom TCP/IP port number or host header to differentiate the new site from existing sites. Consider configuring a unique application pool identity for the site to isolate ASP.NET activity during troubleshooting.

Manage IIS 7 with advanced administration techniques

Day-to-day site maintenance and content posting may be the bulk of your IIS 7.5 administration. But additional higher-level management is what assures consistent and uninterrupted service of your web pages. Important configuring tasks including recovering from disasters, monitoring performance, setting access or code security, and defining encryption can be accomplished either locally or remotely.

Master It

Because of limited storage space, you are revising your disaster recovery plan. You are considering delaying backups of the IIS applicationhost.config file to monthly. However, you are concerned that minor global configuration changes made throughout the month may get lost if a failure occurs before the monthly backup. How would you recover a mid-month edit?

Solution

IIS 7 maintains a configuration history of applicationhost.config according to the default schedule found in the iis_schema.xml file. These can be restored with the appcmd.exe restore backup command. By default, the automatically generated historical versions of applicationhost.config are stored in the history subdirectory under %systemdrive%\inetpub.