Customizing IIS 7.0 Roles and Modules

This article describes the specific Microsoft® Windows Server™ 2008 roles, role services, features and the associated Internet Information Services (IIS) version 7.0 modules that are required to run www.microsoft.com Web servers. It then demonstrates how the Microsoft.com Engineering Operations (MSCOM Ops) team installs the role services it requires by using the ServerManagerCmd.exe command line tool. It also demonstrates how to view and modify related applicationHost.config settings by using the appcmd.exe command line tool.

One of exciting new features in IIS 7.0 is the modular architecture that enables server administrators to customize exactly which features are installed on their Web servers. By installing only the features you need to run your site, you reduce the server footprint, thereby optimizing performance and increasing security. There are over 40 modules, each containing a specific set of features that you can independently install.

One of strengths of the new modular architecture is that you can extend the base IIS 7.0 functionality by creating custom modules to meet the requirements of your site. For example, when the MSCOM Ops team moved to a hardware load balancing solution, we lost the ability to track unique client IP (c-ip) information in our IIS logs. To work around this problem, we created a custom module that passes the client IPs from our hardware load balancer into each of our Web server IIS logs.

Installing Windows Server 2008 Role Services

Windows Server 2008 refers to the primary function of a server as a server role and the associated functional components that you install as role services. File server and Web server are examples of server roles. The role services that the MSCOM Ops Team installs on a Web server include static content and ASP.NET.

MSCOM Ops installs the Web Server (Web-Server) component on the www.microsoft.com site. Additionally, we install many of the other role services that are described in Tables 1 through 7.

Table 1 describes commonly used HTTP features, such as enabling static content (HTML, .jpeg files, and so on) or default documents.

Table 1. Common HTTP Features (Web-Common-Http Component)

Role Service

MSCOM installed

Component

applicationHost.config section

Module

Description

Static Content

Yes

Web-Static-Content

<system.webServer>
  <staticContent>

StaticFileModule
(static.dll)

Static content (such as .html, .css and .jpeg files) can be served by the Web server if this feature is enabled.

Default Document

Yes

Web-Default-Doc

<system.webServer>
  <defaultDocument>

DefaultDocumentModule
(defdoc.dll)

Allows users to be seamlessly directed to the default document defined for the Web site when they visit www.site.com, but do not provide a default document (such as default.aspx).

Directory Browsing

Yes

Web-Dir-Browsing

<system.webServer>
  <directoryBrowse>

DirectoryListingModule
(dirlist.dll)

Lists the contents of a directory.

HTTP Errors

Yes

Web-Http-Errors

<system.webServer>
  <httpErrors>

CustomErrorModule
(custerr.dll)

Allows error messages sent to a visitor’s browser to be customized and for the server administrator to view the new detailed errors on the local Web server.

HTTP Redirection

Yes

Web-Http-Redirect

<system.webServer>
  <httpRedirect>

HttpRedirectionModule
(redirect.dll)

Allows hosted customers to redirect requests for one URL to another URL.

 

Table 2 describes application development features, which allow applications (such as ASP.NET) to run on the server.

Table 2. Application Development Features (Web-App-Development Component)

Role Service

MSCOM installed

Component

applicationHost.config section

Module

Description

ASP.NET

Yes

Web-Asp-Net

Not applicable

Not applicable

ASP.NET ISAPI and modules for managed code applications (.aspx pages).

.NET Extensibility

Yes

Web-Net-Ext

Not applicable

Not applicable

Infrastructure required for ASP.NET. Allows developers to change and extend Web server functionality in the new request pipeline.

ASP

Yes

Web-ASP

<system.webServer>
  <asp>

IsapiModule
(isapi.dll)

Required if customers use classic ASP applications.

CGI

No

Web-CGI

<system.webServer>
  <cgi>

CgiModule
(cgi.dll)

Required for CGI applications (such as PHP) so that they can use the new FastCGI component.

ISAPI Extensions

Yes

Web-ISAPI-Ext

Not applicable

Not applicable

Required for ASP.NET and other ISAPI extensions.

ISAPI Filters

Yes

Web-ISAPI-Filter

<system.webServer>
  <isapiFilters>

IsapiFilterModule
(filter.dll)

Required for the ASP.NET 1.1 ISAPI filter.

Server Side Includes

No

Web-Includes

<system.webServer>
  <serverSideInclude>

ServerSideInclude
Module
(iis_ssi.dll)

Processes server-side includes code.

 

Table 3 describes health and diagnostics features, which provide the infrastructure for monitoring and troubleshooting the health of the Web server and sites.

Table 3. Health and Diagnostics Features (Web-Health Component)

Role Service

MSCOM installed

Component

applicationHost.config section

Module

Description

HTTP Logging

Yes

Web-Http-Logging

<system.webServer>
  <httpLogging>

HttpLoggingModule
(loghttp.dll)

Allows logging of Web site activity or traffic.

Logging tools

Yes

Web-Log-Libraries

Not applicable

Not applicable

IIS Logging tools

Request Monitor

Yes

Web-Request-Monitor

<system.webServer>
  <RequestMonitorModule>

RequestMonitorModule
(iisreqs.dll)

Allows requests to be monitored as they occur. This feature can be used to determine why a worker process is unresponsive or slow.

Tracing

Yes

Web-Http-Tracing

<system.webServer>
  <tracing>
    <traceFailedRequests>

<system.webServer>
  <tracing>
    <traceProvider
      Definitions>

FailedRequestsTracing
Module
(iisfreb.dll)

Infrastructure for diagnosing problems by using Event Tracing in Windows and Failed Request Tracing.

Custom Logging

No

Web-Custom-Logging

<system.webServer>
  <CustomLoggingModule>

CustomLoggingModule
(logcust.dll)

Loads custom logging modules.

 

Table 4 describes security features, which provide the infrastructure for securing requests and filtering incoming requests based on security rules.

Table 4. Security Features (Web-Security Component)

Role Service

MSCOM installed

Component

applicationHost.config section

Module

Description

Basic Authentication

No

Web-Basic-Auth

<system.webServer>
  <security>
    <basicAuthentication>

BasicAuthentication
Module
(authbas.dll)

Requires a user ID and password, and provides a low level of security. User credentials are sent in clear text across the network.

Windows Authentication

No

Web-Windows-Auth

<system.webServer>
  <security>
    <windows
      Authentication>

WindowsAuthentication
Module)
(authsspi.dll)

Sends user authentication information over the network as a Kerberos ticket, and provides a high level of security.

Digest Authentication

No

Web-Digest-Auth

<system.webServer>
  <security>
    <digestAuthentication>

DigestAuthentication
Module
(authmd5.dll)

Requires a user ID and password, provides a medium level of security, and may be used when you want to grant access to secure information from public networks.

Client Certificate Mapping Authentication

No

Web-Client-Auth

<system.web>
  <Serversecurity>
    <authentication>
      <clientCertificate
        Mapping
        Authentication>

CertificateMapping
AuthenticationModule
(authcert.dll)

Performs Certificate Mapping authentication using Active Directory.

IIS Client Certificate Mapping Authentication

No

Web-Cert-Auth

<system.web>
  <Serversecurity>
    <authentication>
      <iisClientCertificate
        Mapping
        Authentication>

IISCertificateMapping
AuthenticationModule
(authmap.dll)

Performs Certificate Mapping authentication using IIS certificate configuration.

URL Authorization

No

Web-Url-Auth

<system.webServer>
  <security>
    <authorization>

UrlAuthorizationModule
(urlauthz.dll)

Allows users to create rules that restrict access to content.

Request Filtering

Yes

Web-Filtering

<system.webServer>
  <security>
    <RequestFiltering>

RequestFilteringModule
(modrqflt.dll)

URLscan replacement in applicationHost.config. Screens incoming requests based on rules sets.

IP and Domain Restrictions

No

Web-IP-Security

<system.webServer>
  <ipSecurity>

IpRestrictionModule
(iprestr.dll)

Allows IIS to restrict access by IP and or Domain.

 

Table 5 describes performance features, which help improve Web server performance.

Table 5. Performance Features (Web-Performance Component)

Role Service

MSCOM installed

Component

applicationHost.config section

Module

Description

Static Content Compression

Yes

Web-Stat-Compression

<system.webServer>
  <httpCompression>

StaticCompression
Module
(compstat.dll)

Allows static content to be compressed and unlike dynamic responses, compressed static responses can be cached without degrading CPU resources.

Dynamic Content Compression

Yes

Web-Dyn-Compression

<system.webServer>
  <httpCompression>

DynamicCompression
Module
(compdyn.dll)

Allows dynamic compression, using bandwidth more efficiently, but may add a CPU load.

 

Table 6 describes management tool features, which provide IIS management-level capabilities.

Table 6. Management Tool Features (Web-Mgmt-Tools Component)

Role Service

MSCOM installed

Component

applicationHost.config section

Module

Description

IIS Management Console

Yes

Web-Mgmt-Console

Not applicable

Not applicable

Required for locally managing IIS 7.0. Provides a user interface for server management.

IIS Management Scripts and Tools

Yes

Web-Scripting-Tools

Not applicable

Not applicable

Required for scripting tasks. Allows programmatic management of the server using scripts.

Management Service

Yes

Web-Mgmt-Service

Not applicable

Not applicable

Required for remote management of IIS 7.0, and to allow delegated users to administer their sites using a remote management tool.

IIS 6.0 Management Compatibility

Yes

Web-Mgmt-Compat

Not applicable

Not applicable

Do not install unless compatibility with features, services, scripts and management tools for IIS 6.0 is required.

IIS 6 Metabase Compatibility

Yes

Web-Metabase

<system.applicationHost>
  <CustomMetadata>

Not applicable

Required for Microsoft SharePoint Services 3.0, ASP.NET 1.1, SMTP service and other features that require backwards capability with the metabase. Provides compatibility for scripts based on IIS 6.0 interfaces for ADSI (Active Directory Service Interface) and ABO (Admin Base Object).

IIS 6.0 WMI Compatibility

Yes

Web-WMI

Not applicable

Not applicable

Compatibility with WMI scripting

IIS 6.0 Scripting Tools

Yes

Web-Lgcy-Scripting

Not applicable

Not applicable

Compatibility layer required to run existing applications and scripts that use ABO or ADSI

IIS 6.0 Management Console

Yes

Web-Lgcy-Mgmt-Console

Not applicable

Not applicable

Compatibility layer required for IIS 6.0 Management Console

 

Table 7 describes FTP publishing service features, which provide FTP functionality.

Table 7. FTP Publishing Service Features (Web-Ftp-Publishing Component)

Role Service

MSCOM installed

Component

applicationHost.config section

Module

Description

FTP Server

No

Web-Ftp-Server

<system.ftpServer>

Not applicable

Only needed if users upload using FTP.
Note: This table refers to the built-in, legacy FTP server. It is highly recommended that you download and install the new FTP7.

FTP Management Console

No

Web-Ftp-Mgmt-Console

Not applicable

Not applicable

Only needed if users upload using FTP.

 

Roles versus Features

Roles are the primary functions of the server (Web server, File Server, and so on). Role services are the functional components that you customize to support the functionality of your server (Static Web server, ASP.NET support, and so on).

Features are different from roles in that they are support or enhance the functionality of the server (NLB, .NET Framework, SMTP, and so on).

Installing IIS 7.0 Components

As previously mentioned, you can customize how your server functions by installing only the components required for your Web server to run correctly. Each of these components is associated with a task-specific workload. Table 8 illustrates two examples of workloads associated with IIS 7.0, the components that comprise the workload, and roles, role services, and features that are enabled by installing the associated components.

Table 8. IIS 7.0 Examples of IIS 7.0 workloads, components, and related role services

Workload

Component

Role Services

Web server role

Web-Server

Static Content, Default Document, Directory Browsing, HTTP Errors, HTTP Logging, Logging Tools, Request Monitor, Request Filtering, Static Content Compression, IIS Management Console

ASP.NET role

Web-Server
Web-ASP-Net
Web-Net-Ext
Web-Filtering
Web-ISAPI-Filter
Web-ISAPI-Ext

Static Content, Default Document, Directory Browsing, HTTP Errors, HTTP Logging, Logging Tools, Request Monitor, Request Filtering, Static Content Compression, IIS Management Console, ASP.NET, NET Extensibility, ISAPI Filters, ISAPI Extensions

 

We only install the components (roles, role services and features) that are required to run the Microsoft.com Web sites. There are several ways to install and configure IIS 7.0 on your server. You can use IIS Manager, or command line tools such as ServerManagerCmd.exe, which is included with Windows Server 2008.

We use the new ServerManagerCmd.exe command line tool to install specific IIS 7.0 components on our servers. ServerManagerCmd.exe also has a query option that you can use to list which components are currently installed.

This section contains examples that demonstrate how to use ServerManagerCmd.exe switches that are required to install specific role services. These examples demonstrate how to:

1.     Install Web server role services.

2.     Install ASP.NET role services.

3.     Install www.microsoft.com-required role services.

4.     Validate the role features that are installed on your server.

ServerManagerCmd.exe is installed in the C:\Windows\System32 folder by default, but is not added to the system Path environment variable. It is assumed that you have used the command prompt to navigate to this folder, or that you have added a reference to this folder to the Path environment variable, prior to using the following examples.

If your server only serves static content as described for the Web workload in Table 8, you can use the ServerManagerCmd.exe Install command in the following example to install the associated role services.

To install Web server role services by using ServerManagerCmd.exe

At the command prompt, type

ServerManagerCmd –install Web-Server

and press Enter.

Similarly, if your site requires support of ASP.NET content as described for the ASP.NET workload in Table 8, you can use the ServerManagerCmd.exe Install command in the following example to install the associated role services.

To install ASP.NET role services by using ServerManagerCmd.exe

At the command prompt, type

ServerManagerCmd –install Web-Server;Web-ASP-Net;Web-Net-Ext;Web-Filtering;Web-ISAPI-Filter;Web-ISAPI-Ext

and press Enter.

The MSCOM Ops team uses ServerManagerCmd.exe to install all of the role services we require by using a single command. The following example demonstrates the ServerManagerCmd.exe command line syntax we use to configure our servers.

To install www.microsoft.com-required role services by using ServerManagerCmd.exe

At the command prompt, type

ServerManagerCmd -install Web-Server Web-Common-Http Web-Http-Redirect Web-Asp-Net Web-Net-Ext Web-ASP Web-ISAPI-Ext Web-ISAPI-Filter Web-Http-Logging Web-Log-Libraries Web-Request-Monitor Web-Http-Tracing Web-Filtering Web-Stat-Compression Web-Dyn-Compression Web-Mgmt-Console Web-Scripting-Tools Web-Mgmt-Service Web-Mgmt-Compat WAS

and press Enter.

After you run the install command, you can validate which components are installed on your server, as illustrated in the following example.

To validate the role features that are installed on your server

At the command prompt, type

ServerManagerCmd –query

and press Enter.

ServerManagerCmd.exe returns the following output:

[X] Web Server (IIS)  [Web-Server]

    [X] Web Server  [Web-WebServer]

        [X] Common HTTP Features  [Web-Common-Http]

            [X] Static Content  [Web-Static-Content]

            [X] Default Document  [Web-Default-Doc]

            [X] Directory Browsing  [Web-Dir-Browsing]

            [X] HTTP Errors  [Web-Http-Errors]

            [X] HTTP Redirection  [Web-Http-Redirect]

        [X] Application Development  [Web-App-Dev]

            [X] ASP.NET  [Web-Asp-Net]

            [X] .NET Extensibility  [Web-Net-Ext]

            [X] ASP  [Web-ASP]

            [ ] CGI  [Web-CGI]

            [X] ISAPI Extensions  [Web-ISAPI-Ext]

            [X] ISAPI Filters  [Web-ISAPI-Filter]

            [ ] Server Side Includes  [Web-Includes]

        [X] Health and Diagnostics  [Web-Health]

            [X] HTTP Logging  [Web-Http-Logging]

            [X] Logging Tools  [Web-Log-Libraries]

            [X] Request Monitor  [Web-Request-Monitor]

            [X] Tracing  [Web-Http-Tracing]

            [ ] Custom Logging  [Web-Custom-Logging]

            [ ] ODBC Logging  [Web-ODBC-Logging]

        [X] Security  [Web-Security]

            [ ] Basic Authentication  [Web-Basic-Auth]

            [ ] Windows Authentication  [Web-Windows-Auth]

            [ ] Digest Authentication  [Web-Digest-Auth]

            [ ] Client Certificate Mapping Authentication  [Web-Client-Auth]

            [ ] IIS Client Certificate Mapping Authentication  [Web-Cert-Auth]

            [ ] URL Authorization  [Web-Url-Auth]

            [X] Request Filtering  [Web-Filtering]

            [ ] IP and Domain Restrictions  [Web-IP-Security]

        [X] Performance  [Web-Performance]

            [X] Static Content Compression  [Web-Stat-Compression]

            [X] Dynamic Content Compression  [Web-Dyn-Compression]

    [X] Management Tools  [Web-Mgmt-Tools]

        [X] IIS Management Console  [Web-Mgmt-Console]

        [X] IIS Management Scripts and Tools  [Web-Scripting-Tools]

        [X] Management Service  [Web-Mgmt-Service]

        [X] IIS 6 Management Compatibility  [Web-Mgmt-Compat]

            [X] IIS 6 Metabase Compatibility  [Web-Metabase]

            [X] IIS 6 WMI Compatibility  [Web-WMI]

            [X] IIS 6 Scripting Tools  [Web-Lgcy-Scripting]

            [X] IIS 6 Management Console  [Web-Lgcy-Mgmt-Console]

    [ ] FTP Publishing Service  [Web-Ftp-Publishing]

        [ ] FTP Server  [Web-Ftp-Server]

        [ ] FTP Management Console  [Web-Ftp-Mgmt-Console]

 

For more information about how to use the ServerManagerCmd.exe command line tool, see “Server Manager Technical Overview Appendix”.

Configuring IIS 7.0 Modules

After you have installed the roles, roles services, and features required for your site to run correctly, you must configure the associated modules. Modules are individual components that the server uses to process requests. For example, IIS 7.0 uses the Static Content Compression (StaticCompressionModule) and Dynamic Content Compression (DynamicCompressionModule) modules to compress content to clients, and http cache module (HttpCacheModule ) to manage cache activity.

You can create and configure IIS Modules by:

·         Manually editing applicationHost.config.

·         Using the appcmd.exe command line tool.

·         Using IIS Manager.

This section contains examples that demonstrate how to create and configure modules by using appcmd.exe. These examples demonstrate how to:

1.     List all installed modules and their associated processes.

2.     List the configuration of a specific module.

3.     Display a list of Set command actions.

4.     Add a new default document to a site.

5.     Remove a default document from a site.

The appcmd.exe command line tool is installed in the %windir%\system32\inetsrv folder by default. It is assumed that you have used the command prompt to navigate to this folder, or that you have added a reference to this folder to the Path environment variable, prior to using the following examples.

The following example returns a list of installed global modules and their associated processes that are installed on the server.

To list installed modules by using appcmd.exe

At the command prompt, type

appcmd list config "www.microsoft.com" -section:globalmodules

and press Enter.

The global modules and their associated processes appear in applicationHost.config as follows:

<system.webServer>

    <globalModules>

      <add name="FileCacheModule" image="%windir%\System32\inetsrv\cachfile.dll" />

      <add name="TokenCacheModule" image="%windir%\System32\inetsrv\cachtokn.dll" />

      <add name="HttpCacheModule" image="%windir%\System32\inetsrv\cachhttp.dll" />

      <add name="DynamicCompressionModule" image="%windir%\System32\inetsrv\compdyn.dll" />

      <add name="StaticCompressionModule" image="%windir%\System32\inetsrv\compstat.dll" />

      <add name="DefaultDocumentModule" image="%windir%\System32\inetsrv\defdoc.dll" />

      <add name="ProtocolSupportModule" image="%windir%\System32\inetsrv\protsup.dll" />

      <add name="HttpRedirectionModule" image="%windir%\System32\inetsrv\redirect.dll" />

      <add name="ServerSideIncludeModule" image="%windir%\System32\inetsrv\iis_ssi.dll" />

      <add name="StaticFileModule" image="%windir%\System32\inetsrv\static.dll" />

      <add name="AnonymousAuthenticationModule" image="%windir%\System32\inetsrv\authanon.dll" />

      <add name="CertificateMappingAuthenticationModule" image="%windir%\System32\inetsrv\authcert.dll" />

      <add name="IISCertificateMappingAuthenticationModule" image="%windir%\System32\inetsrv\authmap.dll" />

      <add name="RequestFilteringModule" image="%windir%\System32\inetsrv\modrqflt.dll" />

      <add name="CustomLoggingModule" image="%windir%\System32\inetsrv\logcust.dll" />

      <add name="CustomErrorModule" image="%windir%\System32\inetsrv\custerr.dll" />

      <add name="HttpLoggingModule" image="%windir%\System32\inetsrv\loghttp.dll" />

      <add name="TracingModule" image="%windir%\System32\inetsrv\iisetw.dll" />

      <add name="FailedRequestsTracingModule" image="%windir%\System32\inetsrv\iisfreb.dll" />

      <add name="RequestMonitorModule" image="%windir%\System32\inetsrv\iisreqs.dll" />

      <add name="IsapiModule" image="%windir%\System32\inetsrv\isapi.dll" />

      <add name="IsapiFilterModule" image="%windir%\System32\inetsrv\filter.dll" />

      <add name="ManagedEngine" image="%windir%\Microsoft.NET\Framework\v2.0.50727\webengine.dll" preCondition="integratedMode,runtimeVersionv2.0,bitness32" />

      <add name="ConfigurationValidationModule" image="%windir%\System32\inetsrv\validcfg.dll" />

      <add name="ManagedEngine64" image="%windir%\Microsoft.NET\Framework64\v2.0.50727\webengine.dll" preCondition="integratedMode,runtimeVersionv2.0,bitness64" />

      <add name="HTTPHeaderLogger" image="%windir%\System32\HTTPHeaderLogger\IIS7NativeModule.dll" preCondition="bitness64" />

      <add name="DirectoryListingModule" image="%windir%\System32\inetsrv\dirlist.dll" />

    </globalModules>

  </system.webServer>

You can also list the configuration for a module that is located in applicationHost.config. The following example demonstrates how to list the configuration of the <DefaultDocument> section:

To list the configuration of a specific module by using appcmd.exe

At the command prompt, type

appcmd list config "www.microsoft.com" -section:defaultDocument

and press Enter.

The results of the query appear in applicationHost.config as follows:

  <system.webServer>

    <defaultDocument enabled="true">

      <files>

        <add value="default.aspx" />

        <add value="default.htm" />

        <add value="default.asp" />

        <add value="index.html" />

      </files>

    </defaultDocument>

  </system.webServer>

If you want to modify the configuration of the <DefaultDocument> section, you can use the appcmd.exe Set command. The following example demonstrates how to display a complete list of the actions you can perform by using the Set command with /? switch.

To display a list of Set command actions by using appcmd.exe

At the command prompt, type

appcmd set config "www.microsoft.com" -section:defaultDocument /?-files.[value='string'].value

and press Enter.

The following example demonstrates how we modify the configuration of the <DefaultDocument> section by using appcmd.exe Set command to add a new default document to our site.

To add a new default document by using appcmd.exe

At the command prompt, type

appcmd set config "www.microsoft.com" -section:defaultDocument  /+files.[value='newDefault.aspx']

and press Enter.

The new default document setting appears with other default document settings in applicationHost.config as follows:

  <system.webServer>

    <defaultDocument enabled="true">

      <files>

        <add value="newDefault.aspx" />

        <add value="default.aspx" />

        <add value="default.htm" />

        <add value="default.asp" />

        <add value="index.html" />

      </files>

    </defaultDocument>

  </system.webServer>

You can also remove a default document from the list by using the previous example, and by changing the -files.[value=’string’] switch.

To remove a default document by using appcmd.exe

At the command prompt, type

appcmd set config "www.microsoft.com" -section:defaultDocument  /-files.[value='newDefault.aspx']

and press Enter.

This change is reflected in applicationHost.config as follows:

  <system.webServer>

    <defaultDocument enabled="true">

      <files>

        <add value="default.aspx" />

        <add value="default.htm" />

        <add value="default.asp" />

        <add value="index.html" />

      </files>

    </defaultDocument>

  </system.webServer>

For more information about how to use the appcmd.exe command line tool, see “Getting Started with AppCmd.exe”.

Summary

In this article, we described the specific Windows Server 2008 roles, role services, features and the associated IIS 7.0 modules that are required to run www.microsoft.com Web servers. We then demonstrated how the Microsoft.com Engineering Operations team installs the role services it requires by using the ServerManagerCmd.exe command line tool. We also demonstrated how to view and modify related applicationHost.config settings by using the appcmd.exe command line tool.