IIS — Internet Information Services Guide

In this tutorial, you'll learn about IIS. We cover key concepts, practical examples, and best practices to help you understand and apply this topic effectively.

Internet Information Services (IIS) is Microsoft's web server for Windows Server and Windows, providing a secure, scalable platform for hosting ASP.NET web applications, static websites, and REST APIs with GUI and command-line management.

What You'll Learn

You'll understand how to install IIS, create websites and application pools, configure SSL/TLS certificates, set up URL rewrite rules, harden security, and troubleshoot common server issues.

Why IIS Matters

IIS powers millions of enterprise websites and internal web applications. It integrates deeply with Windows security (Active Directory, Kerberos), supports classic ASP and ASP.NET Core, and provides a robust management console. DodaTech's enterprise customers host their internal dashboards on IIS.

Real-World Use

A company deploys an ASP.NET Core CRM application for 500 internal users. IIS handles SSL termination, Windows authentication against Active Directory, URL rewriting for clean URLs, and application pool isolation to prevent one site from crashing others.

IIS Learning Path

flowchart LR
  A["Windows Server Basics"] --> B["IIS Installation"]
  B --> C["Websites & App Pools"]
  C --> D["SSL Certificates & HTTPS"]
  D --> E["URL Rewrite & Modules"]
  E --> F["Security Hardening"]
  C:::current
  classDef current fill:#f90,color:#fff,stroke:#333,stroke-width:2px

Installing IIS

Using PowerShell

# Install IIS web server with commonly used features
Install-WindowsFeature -Name Web-Server, Web-WebSockets, Web-Asp-Net45, `
    Web-Mgmt-Console, Web-Url-Rewrite -IncludeManagementTools

# Verify installation
Get-WindowsFeature Web-Server | Select-Object InstallState

Expected output:

InstallState
------------
Installed

Using Server Manager

Open Server Manager → Add Roles and Features → Server Roles → Web Server (IIS). Select these role services:

Creating a Website

Step 1: Create the Site Directory

New-Item -Path "C:\sites\dodatech" -ItemType Directory

Step 2: Create the Website via PowerShell

# Create a new website listening on port 80
New-Website -Name "DodaTech" `
    -Port 80 `
    -PhysicalPath "C:\sites\dodatech" `
    -ApplicationPool "DodaTechPool"

# Create a dedicated application pool
New-WebAppPool -Name "DodaTechPool"
Set-ItemProperty -Path "IIS:\AppPools\DodaTechPool" -Name "managedRuntimeVersion" -Value "v8.0"

# Start the site
Start-Website -Name "DodaTech"

Application Pools: Understanding Isolation

An application pool isolates one or more websites into a separate worker process (w3wp.exe). If one site crashes, others stay running.

Configuring SSL/TLS

# Generate a self-signed certificate (dev only)
New-SelfSignedCertificate -DnsName "dodatech.local" -CertStoreLocation "cert:\LocalMachine\My"

# Get certificate thumbprint
$cert = Get-ChildItem -Path "cert:\LocalMachine\My" | Where-Object { $_.Subject -like "*dodatech*" }

# Bind HTTPS to the site
New-WebBinding -Name "DodaTech" -Protocol "https" -Port 443
$cert | New-Item -Path "IIS:\Sites\DodaTech\Bindings\0" -Name "SSL Certificate"

# Redirect HTTP to HTTPS
Install-WindowsFeature Web-Url-Rewrite
# Use URL Rewrite rules for redirect (see below)

Code Example: URL Rewrite Rules

These rules redirect HTTP to HTTPS and enforce trailing slashes:

Via IIS Manager GUI

Or directly in web.config:

<system.webServer>
  <rewrite>
    <rules>
      <rule name="Redirect to HTTPS" stopProcessing="true">
        <match url="(.*)" />
        <conditions>
          <add input="{HTTPS}" pattern="^OFF$" />
        </conditions>
        <action type="Redirect" url="https://{HTTP_HOST}/{R:1}" redirectType="Permanent" />
      </rule>
      <rule name="Enforce trailing slash" stopProcessing="true">
        <match url="(.*[^/])$" />
        <conditions>
          <add input="{REQUEST_FILENAME}" matchType="IsFile" negate="true" />
          <add input="{REQUEST_FILENAME}" matchType="IsDirectory" negate="true" />
        </conditions>
        <action type="Redirect" url="{R:1}/" />
      </rule>
    </rules>
  </rewrite>
</system.webServer>

Deploying an ASP.NET Core App to IIS

ASP.NET Core apps run as self-contained processes, reverse-proxied by IIS (ANCM — AspNetCore Module).

<system.webServer>
  <handlers>
    <add name="aspNetCore" path="*" verb="*"
         modules="AspNetCoreModuleV2" resourceType="Unspecified" />
  </handlers>
  <aspNetCore processPath="dotnet"
              arguments=".\DodaTech.Web.dll"
              stdoutLogEnabled="false"
              stdoutLogFile=".\logs\stdout"
              hostingModel="inprocess">
    <environmentVariables>
      <environmentVariable name="ASPNETCORE_ENVIRONMENT" value="Production" />
    </environmentVariables>
  </aspNetCore>
</system.webserver>

Security Hardening Checklist

Common Errors

1. HTTP Error 500.19 — Config file error: The web.config has a malformed XML element. Validate with an XML validator or use IIS Manager to edit the configuration.

2. HTTP Error 500.30 — ANCM process failed: The ASP.NET Core app failed to start. Check the stdout log file specified in aspNetCore element or the Windows Event Viewer.

3. HTTP Error 403.14 — Directory listing denied: Directory browsing is disabled and no default document exists. Add index.html, default.aspx, or an index route.

4. Cannot connect to site — port already in use: Another process (or another IIS site) is listening on the same port. Run netstat -ano | findstr :80 to find the conflicting PID.

5. Certificate binding fails — invalid certificate store: The certificate must be in the LocalMachine\My store (not CurrentUser). Or the private key is not exportable.

6. 401 Unauthorized — Windows Authentication fails: The application pool identity doesn't have permission to the website folder. Grant Read access to IIS AppPool\DodaTechPool.

7. Static files return 404 for ASP.NET Core: You need the AspNetCoreModuleV2 installed. Run the .NET Core Hosting Bundle installer from Microsoft.

Practice Questions

1. What is the purpose of an application pool in IIS?
2. How do you redirect HTTP to HTTPS in IIS?
3. What module does ASP.NET Core use to run under IIS?
4. How do you hide the IIS version from HTTP response headers?
5. Why should you use ApplicationPoolIdentity instead of NetworkService?

Answers:

1. Application pools isolate websites into separate worker processes, so one site crashing doesn't affect others.
2. Use the URL Rewrite module with a rule that checks {HTTPS} is ^OFF$ and redirects to https://{HTTP_HOST}/{R:1}.
3. The AspNetCore Module (ANCM) version 2 — it reverse-proxies requests to the Kestrel server or hosts in-process.
4. Use Remove-WebConfigurationProperty for removeServerHeader under security/requestFiltering.
5. ApplicationPoolIdentity runs with minimal permissions (a virtual account specific to that pool), reducing the Blast Radius if the app is compromised.

Challenge

Write a PowerShell script that fully configures an IIS server from scratch: installs IIS and the AspNetCore module, creates a new website with HTTPS binding using a Let's Encrypt certificate (via win-acme or Certify), configures HSTS, and sets up a URL Rewrite rule for SEO-friendly URLs.

Real-World Task

You have a legacy ASP.NET Web Forms application and a new ASP.NET Core API. Configure IIS to host both on port 443 using host headers. The API should be at api.dodatech.local, the web app at app.dodatech.local. Both need SSL and separate app pools.

Featured Snippet

What is IIS (Internet Information Services)?

IIS is Microsoft's web server for Windows that hosts ASP.NET, static websites, and APIs, featuring application pool isolation, integrated Windows authentication, URL rewriting, and deep integration with Active Directory.

FAQ

Try It Yourself

What's Next