1. IIS 7 Administration IIS Manager Delegated Administration
11/29/2018 8:12 PM
IIS 7 Administration
IIS Manager
Delegated Administration
Configuration System
© 2007 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries.
The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

2. IIS Administration Part 1
IIS Manager Details
Delegated Administration
Configuration System

3. Overview Navigation-based, task-oriented, rich experience
Easier to manage 1 or 1000’s of sites
Manage .NET and IIS7 configuration
Extensible
Install controls for new IIS 7 features
Add functionality to UI
Customize Appearance
Delegated Administration
Specific settings are delegated to web.config
Non-administrators can change relevant settings.
Use configuration system for granular control
Key point: The UI is more of a platform than UI. It is highly extensible and has many features.
You are likely to use the IIS manager for managing features, products, and services that you add in. 1

4. Navigation-based, task-oriented, rich experience
Updated UI with a modern look and feel
Icons instead of tabs
Better use of screen real estate
Manage ASP.net settings as well as IIS 7
Context sensitive Actions
Provides Features view and Content view
Controls Delegated / Remote Administration
View currently executing requests
Skip this slide for the Roadshow. This has already been covered in the overview.

5. Easier to Manage 1 or 1000 Sites
IIS 6 UI and high site densities
Difficult to manage
Not easy to find specific site in long list of sites
Can have long startup and shutdown
Add / Remove sites can be slow
IIS 7 Server Manager
Many times faster to create and load sites
Sort and filter by name
Very fast, even with 1000s of sites.
Running high site densities on IIS is a topic of keen interest to hosters. In the past, high site density on IIS has come with the trade off in performance in the IIS UI. A lot of work has gone into the IIS 7 UI to make it a much better tool for managing a number of sites. Simple additions like the ability to filter the listed sites based on the name have been added as well as extensive work on UI performance.

6. demo Managing 2000+ Sites #1 of 6 11/29/2018 8:12 PM
Open an administrative command prompt.
Type “powershell” and enter.
Type cd \. And enter (go to root)
Type set-executionpolicy unrestricted and enter. Please tell the audience is not something to in the real world.
Type iissite<tab>. This shows “. .\iissitetest.ps1” and press enter. (that’s dot space dot slash)
Type “type iissite<tab>” and show that this code has three functions.
Setup-iis:creates a backup of the configuration and creates X number of directories
Load-iis: creates X sites and pools, maps the sites to the pools and assigns them to the directores
Reset-iis: undo Load-iis
Type “Setup-iis 2000” and enter.
Type “load-iis 2000” and enter. (comment on speed of creating sites)
Open IIS Manager
Show app pools
Edit a pool
Go to sites
Filter sites
Edit site
Show treeview lists “show all X Sites”.
Type “reset-iis 2000” to return to original state
#1 of 6
© 2007 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries.
The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

7. Manage .NET and IIS7 Configuration
Configure ASP.net and IIS7 settings
Add .NET users
.NET configuration for use by developers
Writes to proper .NET config store
Machine.config
Global Web.config
Site Web.config
App Web.config
Benefits of .NET integration in IIS Manger
IIS7 integration with ASP.net is made more seamless by the ability to manage .NET configuration settings in the IIS Manger.
For developers, this is a benefit as they can use UI to develop IIS 7 integrated ASP.net web apps
For IT Pros, there are some features here that may be useful such as managing Connection Strings or adding .NET users to an application. This will be covered more in the security talk.
Note that the STMP configuration is not the SMTP service from IIS 6.
Quick demo:
In Authentication, show each method and how some of them write to different sections depending on the kind of authentication.

8. Extensibility IIS Manager is an extensible platform
Built with Windows Forms
Add new features to IIS Manager:
Configure custom applications
New Administration Features
View Log File information
New IIS Manager capabilities
Add Most Recently Used list
Key point here for administrators is that the UI can be made to do much more than the out of the box experience.
It’s an extensible platform. As a result, the UI will be used for more than just managing IIS.
If you have an internet connection, show the Download site from IIS.net and the add- ons for the IIS Manager
Microsoft teams extending the UI
BITS.
FTP
Client Certificate AD authentication

9. IIS Manager Extensiblity
11/29/2018 8:12 PM
demo
IIS Manager Extensiblity
In the C:\IISAddons\IIS7Addins folder locate and install:
logparser.msi
Iisreports.msi (Carlos IIS Reports extensions)
Demo new feature
Key point: extensibility means you can add new administrative features
Install MRUModuleSetup.msi
Key point: IIS Manager features can also be added.
#2 of 6
© 2007 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries.
The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

10. Customize Appearance: Controlling Global Features
IIS Manager uses a modular design
Settings stored in Administration.config
Windows\system32\inetsrv\config
Administraton.config specifies UI modules
Modules are features with icons in the UI
Remove (or add) features globally
Remove (or add) entry for <module providers> in .config
Cannot manage global display in the in UI
The IIS Manager can be customized in to show only the features you want to show.
The UI configuration is stored in administration.config with the other IIS 7 configuration files.
If you open this file you will see that it has some key similarities to the applicationhost.config file. The modules that are defined are the features (associated with icons), in the UI. By editing the global modules list you can remove, replace, or add feature in the UI. These global settings cannot be edited in the UI.
For example, you may not want to have the ASP.net configuration settings appear in the UI.
There are two ways this particular customization can be achieved.
<module providers> sections effects everyone, that is global.
The <modules> sections effects only the site and app admins.
Note: Administration.config works like web.config. You can put an administration.config in the website and it will be read?

11. Controlling Appearance of Global Features
11/29/2018 8:12 PM
demo
Controlling Appearance of Global Features
1 Configure app pool to no framework
Another feature of the allows you to remove the ASP.net modules icons for a website if the application pool does not require .net
-doubleclick on Default App Pool, click on set Framwork to No Managed Code. Refresh. : no .net icons.
But what if you have .net apps but do not want the icons?
2 Remove asp.net modules using adminstration.config
Copy administration.config to a backup
Open adminstration.config and briefly walkthrough the organization.
Explain the <ModuleProviders> section directs IIS Manager to load the code that runs the “icon”.
Explain the <modules> section defines what is to be displayed .
#3 of 6
© 2007 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries.
The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

12. Delegated Administration
IIS Manager will lock or unlock features
Locked features cannot be delegated
.NET features are delegated by default
Non-Admins can control delegated features
Administrator delegates to Site owner
Web.config located in web root
Site owners delegate to application managers
Web.config located in app folder under web root
Xcopy deploy configuration with content
UI writes configuration to lowest level

13. Delegation and Section Locking
Example:
ASP is not Delegated
Read Only in UI
The “section” for asp is locked in applicationhost.config.
Syntax is
overrideModeDefault=
Allow
Deny
Again, delegation is the ability to permit non-machine administrators, that is, site and app owners, to modify settings of the server that affect only their site or application. By default, there are some sections in IIS, like defaultdocuments, that are unlocked and are permitted to be modified by these site/app owners. Any section that relates to basic funcitonality and does not constitute a performance or security threat if trifled with.
There are two ways to unlock sections that are locked by default. The first way is to modify the overridemodedefault attribute in the configsections section. This is an internal section that is special in nature. It has properties that affect the configuration sections and also registers them in the system. Unlocking them here makes the settings in those sections available to be overriden by any sites and any application.
A better approach to unlock sections is to scope those to certain sites or settings via location tags. The overrideMode attribute in a location tag element permits this to happen.

14. Delegated by Default Managed code features are delegated
Handlers and Modules can be loaded by ASP.net only for the site or app
Cannot load global modules from the site
Cannot be delegated
Site, pool, or vdir definitions
Examples of features not delegated by default:
Logging, authentication, ISAPI filters, error pages

15. Locking Error Messages
Web.config updates can occur from
UNC path
Publishing object
FTP
Replication
Tip: Be careful about overwriting web.config !
If web.config contains a locked section – an error is reported.
Note: Remember that IIS will not deliver a web.config file

16. Delegated Administration
11/29/2018 8:12 PM
demo
Delegated Administration
Browse to 
Change directory browsing list
See the web.config
IE F5  200!
Turn off Delegation of directory browsing
IE F5  locking violation
Remove web.config
IE F5 
Enable directory browsing
Site works. Where is the new entry?
See new entry in applicationhost.config with the Location Tag
Discuss how wonderful location tags are.
Cleanup:
Remove the location tag
undo the delegation change
#4 of 6
© 2007 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries.
The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

17. 11/29/2018 8:12 PM
Using Location Tags
Specify and apply configuration settings to certain paths under the current configuration file.
<location path="MyWebSite" allowOverride="Allow">
<system.webServer>
<defaultDocument enabled="true">
<files>
<add value="index.htm" />
<add value="iisstart.htm" />
<add value="default.aspx" />
</files>
</defaultDocument>
</system.webServer>
</location>
When you allow delegation at the server level, the features (section) that is unlocked can be changed in every website. If you configure delegation at the site level, a Location tag is used in Applicationhost.config to allow delegation of the feature only for the specific path. This can be used to control delegation, or locking, to a very fine degree.
© 2006 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries.
The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

18. Granular Locking Delegation unlocks entire feature
Finer control can be obtained in .config file
Lock directives, items, elements and attributes to create useful configurations
Examples:
Delegate Authentication but require Anonymous authentication
Delegate Default Document but require Contoso.aspx
Lock is added in parent config file and applies to all access in child
When you unlock a section for delegation, all settings in the section are unlocked. In some cases, this involves a collection of possible settings such as authentication or the default page.
Rather than have an all or nothing approach to locking, IIS 7 leverages the .NET configuration syntax for locking. This allows you refine delegation settings to a high degree.
If the web.config contains a reference to lock, an error results reporting the error.

19. Configuration Concepts Section
11/29/2018 8:12 PM
Configuration Concepts Section
Container for feature settings
<system.webServer>
<defaultDocument enabled="true">
<files>
<add value="Default.htm" />
<add value="Default.asp" />
<add value="index.htm" />
<add value="index.html" />
<add value="iisstart.htm" />
<add value="default.aspx" />
</files>
</defaultDocument>
</system.webServer>
The second concept is a section. A section usually maps to specific feature that can be identified by name, tn this case, default document. Other sections include custom errors, modules, handlers, etc that logically group settings for a specific feature set. When you enable delegation, you unlock a section for configuration in web.config files.
© 2006 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries.
The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

20. Configuration Concepts Element
11/29/2018 8:12 PM
Configuration Concepts Element
Contains one or more settings. May include additional elements.
<system.webServer>
<defaultDocument enabled="true">
<files>
<add value="Default.htm" />
<add value="Default.asp" />
<add value="index.htm" />
<add value="index.html" />
<add value="iisstart.htm" />
<add value="default.aspx" />
</files>
</defaultDocument>
</system.webServer>
The next concept is the element. An element is an XML element per se, and can contain other elements and properties.
© 2006 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries.
The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

21. Configuration Concepts Attribute
11/29/2018 8:12 PM
Configuration Concepts Attribute
A property.
<system.webServer>
<defaultDocument enabled="true">
<files>
<add value="Default.htm" />
<add value="Default.asp" />
<add value="index.htm" />
<add value="index.html" />
<add value="iisstart.htm" />
<add value="default.aspx" />
</files>
</defaultDocument>
</system.webServer>
An attribute is the most basic leaf configuration setting. It is represented by an xml attribute of a name value pair. It can be defined as a specific type and given a default value if needed.
© 2006 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries.
The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

22. Granular Locking Concepts lockElements, lockAllElementsExcept
Can be used for directive control.
<location path="MyWebSite" allowOverride="Allow">
<system.webServer>
<defaultDocument enabled="true">
<files lockElements="add">
<add value="index.htm" />
<add value="iisstart.htm" />
<add value="default.aspx" />
</files>
</defaultDocument>
</system.webServer>
</location>

23. Granular Locking Concepts lockElements, lockAllElementsExcept
Defines a comma-separated list of elements that are locked.
<location path="MyWebSite" allowOverride="Allow">
<system.webServer>
<defaultDocument enabled="true"
lockElements="files">
<files>
<add value="index.htm" />
<add value="iisstart.htm" />
<add value="default.aspx" />
</files>
</defaultDocument>
</system.webServer>
</location>

24. Granular Locking Concepts lockAttributes, lockAllAttributesExcept
Defines a comma-separated list of attributes that are locked.
<location path="MyWebSite" allowOverride="Allow">
<system.webServer>
<defaultDocument enabled="true"
lockAttributes="enabled">
<files>
<add value="index.htm" />
<add value="iisstart.htm" />
<add value="default.aspx" />
</files>
</defaultDocument>
</system.webServer>
</location>

25. Concepts lockItem
Specifies a single attribute that is restricted from being edited.
<location path="MyWebSite" allowOverride="Allow">
<system.webServer>
<defaultDocument enabled="true">
<files>
<add value="index.htm" lockItem="true" />
<add value="iisstart.htm" />
<add value="default.aspx" />
</files>
</defaultDocument>
</system.webServer>
</location>

26. demo Granular Locking #5 of 6 11/29/2018 8:12 PM
Imagine that you have a company that wants to insure that it’s home page is in the list of default documents, but will allow you to replace the page with one you’ve desinged.
Granular locking lets you enforce such a configuration.
0. APPCMD ADD BACKUP PREGRANULAR
Browse to the default webs site. Insure that the normal home page is shown.
Show that delegation is enabled for the default page as it is set to Read/Write in feature delegation.
Company policy allows for delegation of the default document, but if one is not specified, the company home page must be shown. You can add the companies home page to the default document list, but since the features is delegated, the web administrator can remove it.
To enforce this policy, open Application host.config and add the following section at the bottom
// explain that lockAttributes prevents this feature from being turned off in a web.config file.
// explain that lockItem forces the page to always be in the list of files.
<location path="Default Web Site">
<system.webServer>
<defaultDocument enabled="true" lockAttributes="enabled">
<files>
<clear />
<add value="company.txt" lockItem="true" />
</files>
</defaultDocument>
</system.webServer>
</location>
5. Save the applicationhost.config file
6. Browse to the default website. The company page should show as usual.
7. Our web site administrator wants to add their own page.
In the web.config, add:
<configuration>
<defaultDocument>
<add value="iisstart.htm"/>
</configuration>
8. Browse to the site to see the new custom page.
9. The site administrator decideds to remove the company page as a default setting.
Add a clear directive
<add value="iisstart.htm" />
10. Browse site – see error.
11. Clean up. APPCMD RESTORE BACKUP PREGRANULAR
#5 of 6
© 2007 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries.
The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

27. Reading the IIS 7 Schema Lookup locking semantics in schema
Shows all possible settings for any item
Default values are defined in the schema
Located in system32\inetsrv\config\schema
Extend with XML snippets

28. demo Tour de IIS 7 Schema #6 of 6 11/29/2018 8:12 PM
© 2007 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries.
The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

30. 11/29/2018 8:12 PM
© 2007 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries.
The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.
© 2007 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries.
The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.