Speaking of which... : IIS7

Adding Server ROles to an IIS installation on an RODC

JohanS — Tue, 05 May 2009 17:10:15 GMT

In a recent case I was involved with I stumbled upon something quite interesting. The customer had set up a brand new Windows 2008 Server running IIS, and made it into a Read Only Domain Controller (RODC). Having done this they now wanted to add the FTP-server Role to the existing IIS installation and found that they couldn't.

The reason for this is that the RODC is quite picky about what server roles and features it will allow you to install. I recommend looking at the following articles, but they still don't cover everything.

Applications That Are Known to Work with RODCs
http://technet.microsoft.com/en-us/library/cc732790.aspx

Planning for Application Compatibility with RODCs
http://technet.microsoft.com/en-us/library/cc731746.aspx

The main lesson to be learned is that although the application is listed as known to work with RODCs that doesn't necessarily mean it installs well once the server has been promoted to RODC. When it comes to FTP you have two valid options to get this working:

Install the FTP server before promoting the server to RODC
Install the FTP Service 7.5 for IIS7. This is a stand-alone installer and works just fine.

/ Johan

PowerShell - Managing Feature Delegation in IIS7

JohanS — Tue, 16 Dec 2008 16:51:54 GMT

Perhaps you've read my earlier post on advanced feature delegation using PowerShell and the IIS 7.0 PowerShell Provider. This could actually be called Part II.

The previous post was based on a quick question from a premier customer. He is a never-ending source of intriguing questions and I always enjoy his "just one thing"-type of inquiries. They often force you to think a little extra. Anyway, the other day he came with a question, which (as always) seemed simple enough at a first glance. The goal was to set Feature Delegation for SMTP E-mail And Forms Authentication to "Read Only".

Now, most basic configuration topics have been covered in countless posts, and at first I thought that this shouldn't be so hard. There is, however, a major difference. The SMTP E-mail and Forms Authentication settings are set in the root web.config. Not in applicationhost.config.

If we open up and compare web.config before, and after we change the setting, we'll notice that the change made by the IIS Manager is adding the following into the root <configuration>-block:

Okay, so using what we already know from the old post we should put together a call that looks something like this:

Set-WebConfiguration "/System.Net/mailSettings/smtp" -value @{<something... overrideMode="Deny", maybe?>} -PSPath IIS:\

Please note that this is NOT the correct syntax. It is close, but no cigar. What we need to do is:

Correctly set the overrideMode. The above sample is not the way to do it.
Make sure the changes are saved to web.config

So, the final, (and correct,) call to the Set-WebConfiguration cmdlet would look like this:

Set-WebConfiguration //System.Net/mailSettings/smtp -metadata overrideMode -value Deny -PSPath MACHINE/WEBROOT

The Forms Authentication call would look like this:

Set-WebConfiguration //System.Web/authentication -metadata overrideMode -value Deny -PSPath MACHINE/WEBROOT

I've searched quite extensively for samples on this and so far I've found none. So I thought someone should write it down. :)

Happy Holidays! / Johan

PowerShell - Advanced configuration editing in IIS7

JohanS — Thu, 02 Oct 2008 16:28:18 GMT

I've written a lot of PowerShell posts lately and here's another one. :-)

I got a question from one of the account managers if it was possible to alter the FTP Authorization Rules for a specific folder on his IIS.

The appcmd for the operation was

appcmd.exe set config "FTPFolder" -section:system.ftpServer/security/authorization /+"[accessType='Allow',users='*',roles='*',permissions='Read, Write']" /commit:apphost

He wanted to know if there was a PowerShell equivalent. Sure, you could use the appcmd directly from powershell, but if you're going to use the command line for everything, then what's the use of PowerShell?

The section in applicationhost.config that we want to edit is the following:

System Specs

As you might have noticed from the screenshots already he was Running Windows 2008 with FTP 7 installed. He also had the IIS 7.0 PowerShell Provider installed.

Troubleshooting

There are a lot of cool things you can do with the WebSites using the IIS7 PowerShell provider. Below is a sample copied from iis.net. To use it properly, go to an IIS directory such as IIS:\DemoSite\DemoApp:

$winAuth = Get-WebConfiguration -filter /system.webServer/security/authentication/windowsAuthentication
$winAuth.enabled = $false
$winAuth | set-Webconfiguration -filter /system.webServer/security/authentication/windowsAuthentication -PSPath IIS:\ -location "DemoSite/DemoApp"

So judging from the sample above we should simply have to set anonymousAuthentication.enabled = $true or something like that. Unfortunately this isn't the case. If you try to access the section of applicationhost.config that we're attempting to edit (see above) you will see that we don't have any applicable properties for the object. $ftpAuth = Get-WebConfiguration -filter /system.ftpServer/security/authorization will not throw any exceptions, but using TAB to cycle through the properties of $ftpAuth will show us no immediate properties or methods of use.

Solution

The solution in this scenario is to use the Add-WebConfiguration cmdlet. The applicationhost.config can easily be translated to a valid Add-WebConfiguration call:

Add-WebConfiguration "/system.ftpServer/security/authorization" -value @{accessType="Allow";users="?";permissions=3} -PSPath IIS:\ -location FTPFolder

The only thing that sticks out as being out of the ordinary is the permissions=3 setting. Why isn't it "Read, Write"? Actually, passing "Read, Write" as a parameter will not work. It will leave the permissions setting blank. "Read" or "Write" only will work, but not both together. I've tried figuring out if there's a valid way of passing both arguments, but so far I've drawn blanks. I've tried putting them in an array {"Read";"Write"}, passing them as "ReadWrite", "Read;Write", "Read+Write" etc. but the only way I've found so far is to pass the value 3 which is the obvious sum of the two enum values for Read and Write.

Later! / Johan

The first thing you should do after setting up an IIS7-server

JohanS — Thu, 29 May 2008 15:14:58 GMT

As you're probably well aware IIS7 relies heavily on a master configuration file named ApplicationHost.config. Now, instead of using a history file like IIS6 did, IIS7 will check this file every 2 minutes to see if it's changed. If the file has been updated, then a backup copy of the old .config will be stored in the inetpub\history-directory.

Configuration history

This is really cool and a very useful feature. There's only one little caveat in my opinion and that's the fact that by default IIS7 will only save up to 10 backups. All the other backups will be discarded. This means that if you're spending 20 minutes fiddling with the settings in ApplicationHost.config you will quite likely have overwritten all your old backups. Now, if something goes wrong at that point and you decide to spend another 20 minutes trying to fix this problem by further editing the ApplicationHost.config you will surely have overwritten the backups.

In a worst case scenario you might even have gone from Healthy Server to Unstable Server to Server Down and you now find that you aren't even able to restore it to the Unstable state.

My suggestion is to increase the default number of backups to 100, or why not 1000? You can then feel certain that any backups taken aren't overwritten when you try to undo the very same changes. Here's how you do it:

Go to %windir%\system32\inetsrv\config\
Open applicationHost.config in notepad
Locate the system.applicationHost section group
Add the following item to the section group:
<configHistory maxHistories="100" period="00:02:00" />
(Naturally the maxHistories value can be whichever value you prefer)
Save

To restore one of the previous configurations, simply go to inetpub\history\cfgHistory_[nnnnnnnnnn] and copy the config from there, or use appcmd. (See below)

Backup using appcmd

Now that we've done this there is one more thing I'd strongly recommend doing:

Open up a command-line with administrative priviliges
Go to %windir%\system32\inetsrv
Run "appcmd add backup "[Name of your backup]""

What you've done now is to create a manual backup of your current config. It's always good to have a decent (and persistent) restore point to return to.

If you wish to restore this backup you simply use the following syntax: "appcmd restore backup "[Name of your backup]"". You can also delete a backup using the "delete" keyword, or you can list all backups, including the ones generated by the Configuration history, like this: "appcmd list backup"

Okay, so now we have made sure we have some extensive automatic backups in place which might save us a lot of headaches later on.

Later! / Johan

My web application times out when debugging in IIS7

JohanS — Wed, 12 Sep 2007 16:51:00 GMT

Problem:

When using Visual Studio 2005 to debug a web application under IIS7 you will find that after 90-120 seconds the debugger will time out and you will get an appropriate error message in your browser. Visual Studio will return to it's "non debugging"-state and pretend like nothing happened.

Changing the ExecutionTimout property in web.config doesn't change anything, and since you're debugging you'd expect IIS to ignore that setting anyway.

Cause:

With every new software release there are always small changes that will effect performance / behavior in certain situations. I've mentioned this before in my I've upgraded and now my application doesn't work anymore - post. There are always a few scenarios in which a new feature will appear to limit functionality when it is in fact increasing it.

IIS will periodically ping your worker process in order to ensure that it is still responsive. By default it will be pinging the process every 30 seconds, and the process will have 90 seconds to respond. If it doesn't respond in time it is terminated. All in all this means that If your application pool has hung for some reason it will be recycled and everything will return to normal.

This is not a new feature, but it can, however, cause some problems while debugging. When you hit a breakpoint all execution stops, pending requests are not served and the worker process freezes completely. It will not respond to the health monitoring ping and if it doesn't continue execution within this 90-120 window it will be terminated.

Resolution:

There are three settings you can tweak with to resolve this. You'll find them all in the "Process Model"-section of the Advanced Settings for the Application Pool:

Open up the IIS manager
Locate the Application Pool in question
Right-click on it and select "Advanced Settings"
Scroll down to the "Process Model"-section

The settings of interest, and their default values are:

Ping Enabled (True)
Ping Maximum Response Time (90 seconds)
Ping Period (30 seconds)

This means you can either turn off health monitoring altogether by setting "Ping Enabled" to false, or you can tweak with the response time or the interval. Please note that the settings are there for a reason, so once you're getting close to production you really should return them back to their default values. I personally think the settings are excellent. An application pool that has hung will be reset within a maximum of 2 minutes. With a decent out of process State Server setup your clients will probably notice an unusually long response time for one request, but think nothing else of it.

Over and out / Johan