1. DEP320 Deploying IIS 6.0 Tips and Tricks Vikas Malhotra Program Manager Internet Information Services

2. Agenda Preparing for IIS 6 Deployments Hints and Tips Case Studies Tools

3. IIS 6.0 Enhancements Security Reliability Scalability SystemManagement Fault tolerant architecture Health monitoring Intelligent queuing XML-based configuration Command line administration Remote administration Scale-up/scale-out Kernel-mode caching Integrated application platform Secure by default Secure by design Secure in deployment

4. Preparing For IIS 6 Deployments

5. Planning for deployment Prepare IIS Deployment Guide http://www.microsoft.com/windowsserver2003/techn ologies/webapp/ IIS Resource Kit Inventory apps (ASP, ASP.NET, ISAPI, CGI) Determine dependencies Flag apps requiring special attention Plan install process Clean install WP isolation mode Upgrade IIS 5 isolation mode Benchmark Before and after

6. Upgrade Recommendations After upgrading, document everything you did to get things working E.g., enabling ISAPIs Setting ACLs Put box in production and monitor for 500 errors Compare with known good box that’s not been upgraded Helps identify anything to tweak on other boxes

7. IIS Tools Shipping in IIS 6 ResKit Delegated administration Log parser Search for data and patterns in IIS log files Export data to SQL database MBExplorer RegEdit and MetaEdit-like tool for easy metabase access Host helper service Registers sites automatically with WINS and DNS WCAT Runs simulated workloads on client-server configurations IIS 4/5 to IIS 6 migration Apache to IIS migration Out of band releases URLscan

8. IIS 6 Resource Kit Tools demo demo

9. Hints And Tips

10. ‘First-time’ user tips Web service extensions ISAPIs are disabled by default IIS UI shows Web Service Extensions first time Mime maps 404 returned if file doesn’t have mime map entry Can override behavior globally or at vdir level Add “*,text/xml” mime map Careful! Overrides secure setting

11. ASP and ASP.NET tips ASP.NET v1.1 May need to point existing Windows Server 2003 Framework applications to v1.0 bits ASP.NET v1.0 only supports IIS 5 compatibility mode ASP Parent paths disabled by default E.g., paths using..\ Can override by setting AspEnableParentPaths

12. Security tips Installing IIS on FAT Some OEMs build machines first on FAT volumes, then convert to NTFS Inherently insecure – no way to apply necessary ACLs if IIS is already installed IIS displays warning message but user can continue FPSE blocks installation on FAT IE hardening may break some functionality Functionality removed from local intranet zone (e.g., local UNC paths)

13. Remote administration tips Supported scenarios IIS 6 to IIS 6 IIS 6 to IIS 5.1, IIS 5 and IIS 4 Unsupported scenarios IIS 4, IIS 5, IIS 5.1 to IIS 6 Can’t use Windows XP Pro to administer Windows Server 2003 Plans Shipping IIS UI snap-in upgrade to XP SP2

14. FPSE tips Fixed in Windows Server 2003 UNC webs FPSE 2002 supports webs on remote file shares Previous versions blocked configuring web on UNC path Multiple front-end servers untested Performance with IIS 6 App pool support Extensions run in separate app pool but apps can be in their own app pool

15. FPSE tips Improving multi-site security Problem: FPSE permitted browsing other webs via NETWORK/INTERACTIVE ACE on virtual server root Content viewable by FTP or FSO Fix: Use group accounts to separate access Enabled by regkey: HKEY_LOCAL_MACHINE\Software\Microsoft\Shared Tools\Web Server Extensions\All Ports\anonusergroupprefix Associate group account with specific virtual server: HKEY_LOCAL_MACHINE\Software\Microsoft\Shared Tools\Web Server Extensions\Ports\Port \anonusergroup

16. FPSE tips What to watch out for Two versions of FPSE 2002 Download lacks functionality needed by IIS 6 Latest version installable by Configure Your Server Dropped support for lightweight extensions Upgrade from Windows 2000 Multiple vservers aren’t upgraded automatically FPSE 2000 not supported Removed WAIS search engine Index Server is recommended replacement Only local content searching supported Improved indexing functionality in SP1

17. App Pool Tips Configure app pools for each unique application or web site Large apps with many pages Different parts of app have different impacts on perf and resource use Optimize by splitting app into multiple vdirs Assign each vdir to its own app pool AppPoolQueueLength Sets size of HTTP request queue 4000 is default Need more with more req/sec & slower bandwidth Requests remain in NPP until final ACK received from client

18. Things to avoid ISAPI filters using SF_NOTIFY_READ_RAW_DATA Can’t run in worker process isolation mode Use HSE_REQ_EXEC_URL instead to: Rewrite URL Modify request entity body Call another ISAPI Extension Problematic ISAPIs in IIS 6 Global filters Singleton ISAPIs don’t scale well across multiple worker processes ISAPIs that don’t play well with others IISReset & reboots Tools that kill/start IIS processes directly Extensive metabase schema modifications ADSI scripts Supported for compatibility Start using WMI

19. Things to work around CDONTS doesn’t ship on Windows Server 2003 Replace references to use CDOSYS Superset of CDONTS Troubleshooting & tracing Try orphaning bad worker process & set orphan action to launch AD+ or debugger Use app pools to isolate bad apps

20. Case Studies

21. In production with IIS 6.0 since RC1 100k current connections during the day Over 470 million hits per day for www Highest availability among peers in industry No security failures Case Study: Microsoft.com Source: KeyNote Top Domains Daily30 Day History90 Day History2002 Year-To-Date RankSite Avail. %RankSite Avail. %RankSite Avail. %RankSite Avail. % #1MSFT99.93#1MSFT99.87#1MSFT99.85#1MSFT99.79 2Sun99.802Sun99.852Sun99.752MSN99.59 2Yahoo99.803Oracle99.753Oracle99.763Yahoo99.53 3Oracle99.734Yahoo99.674Yahoo99.484Sun99.25 4MSN99.605AOL99.445AOL99.455AOL99.05 5AOL99.146MSN99.306MSN99.356Oracle94.75

22. Case Study: Qwest Strategic decision to switch to XML Web services platform Detailed case study available on http://ww.microsoft.comhttp://ww.microsoft.com Significant performance improvements for ASP.NET At same CPU usage, approx 450 req/sec on IIS 5, 750 req/sec on IIS 6.0 Application pools used for process isolation 25 LOB apps per server Reduced problems with debugging and rogue apps Switching some apps from J2EE to ASP.NET 75% reduction in project cycle time

23. Case Study: Schlund (1 & 1) Summer 2002 – Launched IIS 6 shared hosting October 2002 – Launched service in UK Benefits of IIS 6 Scalability/site density – 3000 IIS 6.0 sites per box App pools – isolation from failures Stability/reliability – iisreset not needed Quote: “Microsoft FTP is rock solid!”

24. Next Steps Plan your IIS 6 deployment or upgrade ‘Must-have’ upgrade for NT4/IIS 4 systems Read whitepapers for unique scenarios Upgrades and Migrations Application Isolation and Consolidation NAS/UNC-based content and multi-server farms Find help from others in the IIS community

25. Ask The Experts Get Your Questions Answered I will be in the ATE after this session and throughout the week Other Program Managers are here and will be also working in the ATE to help you out

26. Community Resources IIS Community Portal http://www.microsoft.com/windowsserver2003/community/centers/iis/ IIS Portal http://www.microsoft.com/iis IIS Newsgroups Microsoft.public.inetserver.iis Microsoft.public.inetserver.iis.ftp Microsoft.public.inetserver.iis.security Newsgroups Converse online with Microsoft Newsgroups, including Worldwide http://www.microsoft.com/communities/newsgroups/default.mspx Community Resources http://www.microsoft.com/communities/default.mspx Most Valuable Professional (MVP) http://www.mvp.support.microsoft.com/ User Groups Meet and learn with your peers http://www.microsoft.com/communities/usergroups/default.mspx

27. evaluations evaluations

28. © 2003 Microsoft Corporation. All rights reserved. This presentation is for informational purposes only. MICROSOFT MAKES NO WARRANTIES, EXPRESS OR IMPLIED, IN THIS SUMMARY. Questions? Product Feedback? vmalhot@microsoft.com

29. © 2003 Microsoft Corporation. All rights reserved. This presentation is for informational purposes only. MICROSOFT MAKES NO WARRANTIES, EXPRESS OR IMPLIED, IN THIS SUMMARY.