Microsoft IIS Configuration Guide

This is an original planning guide. It is not a vendor manual, an official standard, or legal advice. Example addresses use documentation ranges. Review every command before you paste it.

Where Microsoft IIS sits

IIS is the Windows web server. A site has bindings, a physical path, and an application pool identity. You change it with IIS Manager on a session you can see, or with PowerShell you have previewed. The Windows roles guide decides whether this host should run IIS at all. This page is the site.

The lab binding is 127.0.0.1 and a port you choose, with a single test page. A binding on every address is the later public window. The management service and remote administration stay off the public interface. If you need Web Management Service, it listens on the management prefix only.

web.config is the per-site file. URL Rewrite and the Application Request Routing proxy are features you install on purpose. They are not present on every IIS. A generator that emits rewrite rules you cannot install is a draft to trim. The converter toward Nginx is the migration guide, after this site already works.

The application pool identity is a named account when the site must read a restricted path, and the permissions guide still applies on NTFS. The pool does not run as a domain admin to make a file readable.

A loopback site you can fetch

Step 1 for Microsoft IIS is the role. Confirm IIS is an intended role on this server. A domain controller does not gain IIS as a side effect. Check: The roles guide and this host agree. If the check fails, do not reload again and do not point a name at this host. Restore the previous file. The generators for Microsoft IIS draft a site in the browser and do not open a firewall. Delete every listen-on-every-address line for the lab. Replace prompt-for-this. A config from a neighbouring web server is not this syntax.

Step 2 for Microsoft IIS is the site. Create a site bound to 127.0.0.1 with a test page and a dedicated pool. The default site bound widely is not the lab. Check: A local fetch returns the test page. If the check fails, do not reload again and do not point a name at this host. Restore the previous file. The generators for Microsoft IIS draft a site in the browser and do not open a firewall. Delete every listen-on-every-address line for the lab. Replace prompt-for-this. A config from a neighbouring web server is not this syntax.

Step 3 for Microsoft IIS is the identity. Set the pool identity to the account that should read the folder, and grant that account the folder. Broad admin rights hide a missing grant. Check: The pool identity is not a domain admin, and the page still loads. If the check fails, do not reload again and do not point a name at this host. Restore the previous file. The generators for Microsoft IIS draft a site in the browser and do not open a firewall. Delete every listen-on-every-address line for the lab. Replace prompt-for-this. A config from a neighbouring web server is not this syntax.

Step 4 for Microsoft IIS is management. Leave remote management off, or bind it to the management prefix only. A public management port is a second site you did not mean. Check: A test from outside the prefix fails. If the check fails, do not reload again and do not point a name at this host. Restore the previous file. The generators for Microsoft IIS draft a site in the browser and do not open a firewall. Delete every listen-on-every-address line for the lab. Replace prompt-for-this. A config from a neighbouring web server is not this syntax.

Step 5 for Microsoft IIS is rewrite and proxy. Install URL Rewrite or ARR only if the ticket names a rule, and test that rule on loopback. A missing module looks like a broken web.config. Check: The module list matches the config. If the check fails, do not reload again and do not point a name at this host. Restore the previous file. The generators for Microsoft IIS draft a site in the browser and do not open a firewall. Delete every listen-on-every-address line for the lab. Replace prompt-for-this. A config from a neighbouring web server is not this syntax.

# IIS lab. Review before you paste.
# Binding: 127.0.0.1 and a lab port.
# One test page. One application pool.
# Do not enable remote management on a public address.
# Do not run the pool as a domain admin.
# prompt-for-this is not a password to keep.

Certificates come after the name is yours

A certificate lives in the Windows certificate store, bound to the site, for a name you control. The lab does not need that binding. HTTP on loopback is enough to prove the site and the pool.

A binding that uses a certificate you cannot renew is a binding you do not add. Write the expiry next to the hostname when you do add one.

Changing bindings is a reload of that site. Confirm the previous binding is written down so you can put it back.

What not to paste

IIS is not Apache and not Nginx. .htaccess and server blocks do not apply.

A domain-admin application pool is not a fix for NTFS permissions.

Remote IIS management on a public address is not part of bringing a site up.

The hour you stop

Write the hostname, the role, and the clock time before you change Microsoft IIS. If this host is also serving users, it is not the lab and this first hour belongs on a spare. The provisioning guide is how the spare gets built. A change without a spare is a change you can still postpone.

Keep the console or the out-of-band path open for the whole hour. Reloading a network service, a firewall, or a secure-shell daemon from the only session is how a lab becomes a drive across town. The hardware guide names that path for a physical machine. A virtual machine uses the hypervisor console. A cloud instance uses the serial console the platform gives you. Test it before the reload, not after.

The address 192.0.2.10/24 and the gateway 192.0.2.1 are documentation. They belong in the lab note and nowhere else. On a real network, use the prefix the network desk already assigned. On a cloud instance, use the address the platform assigned and do not hard-code the documentation range into user-data. If a generator filled the documentation address into a production draft, delete it.

prompt-for-this is a reminder that a secret is missing. It is not a password you set, not a token you commit, and not a string you leave in a configuration file because the service started. The real secret lives in the password store. The ticket says who can read it. A file that still contains the reminder is a file you have not finished.

One service is enough for the first hour on Microsoft IIS. The purpose from the fundamentals page says which service. Every other package stays uninstalled until its own guide has a ticket. A host that enables a web server, a database, and a queue in the first hour has three changes and no proof. Finish the login, the address, and the update. Then stop.

Read the package transaction before you accept it. A count of packages is not a review. If the list contains a repository you did not add, stop. If it contains a kernel, the patch guide's reboot decision applies and the console stays open. If it contains software this role does not need, remove that line from the plan rather than installing it and disabling it later.

The previous image, the previous configuration file, or the previous package version is the rollback. Write the path down while the host still works. A rollback you invent after a failed reload is a guess. The migration guide assumes the old copy is still there. Do not delete it in the same hour to free a disk.

When the checks pass, copy the notes into the ticket and leave the host alone. The next host waits until a second person can repeat the login and the address from the notes. A fleet built from memory drifts. A fleet built from the file the provisioning guide stored stays boring, which is the point of Microsoft IIS in production.

If a step on Microsoft IIS fails twice, stop for the day. The failure is the result. Adding a forum command beside a half-applied config produces a host nobody can rebuild. Rebuild from the image instead. The time you lose is smaller than the time you will spend explaining the hybrid.

Hand the finished lab to the guide that matches the role: web, mail, storage, backup, or hardening. Microsoft IIS being installed is not the same as the role being ready. The role guide has its own proof. Do not skip it because the package manager exited without an error.

A second person reads the hostname, the address, and the rollback path aloud before you build the next host. If they cannot find those three in the ticket, the notes are not done. Silence is not agreement. The check is the sentence they repeat back.

Store the working notes next to the image version. A month from now Microsoft IIS will still boot from that pair, and the chat where you remembered a flag will be gone. The file is the memory. The host is replaceable. That is the whole point of writing this hour down.

Microsoft IIS checks before a public listener

Confirm this before you call the change done: Microsoft IIS is the process that is listening, confirmed on the host. The lab site binds to 127.0.0.1, not to every address. The config test passed before the reload. A fetch of the test page from the host itself succeeded. The admin or dashboard port is not reachable from a public address. The document root is readable by the worker and not writable by it. No certificate was requested for a name you do not control. The generator draft was edited until it matched this file. The previous config is saved. prompt-for-this was not left in a password field. Logs from the test do not contain a secret. A second person read the listen address. The binding is loopback in the lab. The application pool is not a domain admin. Remote management is not public. And web.config was reviewed and contains no secret. If one of those fails, stop.

Tools for this guide

These tools run in the browser on this site. They do not log into your machines.

Guides in this cluster

These supporting pages belong to this pillar.