Care, Share and Grow! : Tools

A simple exe to find DEBUG build for managed modules and DEBUG attribute in Web.Config for Web applications in IIS 6/7

Saurabh Singh — Sat, 05 Dec 2009 22:17:00 GMT

CAVEAT: Some stories before I get to the point, so you may want to skip to the end.

We in Microsoft PSS get lot many cases on a daily basis which are related to performance issues with Web applications developed using ASP.Net and hosted on IIS. Based on my experience with debugging these issues many-a-times I have seen that one (or two) very basic step is often missed by our customers. Guess what, they develop the projects/class libraries/modules/assemblies etc (name it whatever you want) and test it thoroughly in the development/testing/staging environments and then go ahead and deploy the same binaries in the Production. What they overlook or tend to forget is that they are deploying the same DEBUG build modules/dlls in the production as against the recommended RELEASE builds/dlls.

Most of us know that for performance reasons it is always recommended to deploy a release build in the production as against a debug build to reap more benefits from compiler optimizations etc. The above observation is generic and applies to any application running managed code.

There is one more thing people often overlook when it comes in specific to IIS ASP.Net Web applications, i.e. DEBUG attribute in the Web.Config file under system.web/compilation tag. This is one setting which has a lot of repercussions on the performance of the Web applications running ASP.Net as a web technology like memory issues, fragmentations, etc.

A very nice detailed tutorial by Rahul (one of our former Technical leads in IIS/ASPNET support group) just reflects what I will never be able to convey any better. Check this link if you want to know more on how this DEBUG attribute may affect your application.

What we often do in support is that we capture memory dumps of the IIS process and analyze it using various tools (most common here being WinDBG). There are some public extensions available to our customers like sos.dll to debug managed memory dumps. However this extension has been deprecated (from .Net 2.0) and it does not have a feature to find out debug modules that were loaded in the IIS process and the value of the debug attribute set in the Web.Config file.

I felt that getting memory dumps from our customers and then finding out the above in their application settings and then recommending them to fix it just adds to the overall delay in finally fixing their core issue. This should be done by default. This is something that does not even need our support in the first place if people are well aware of it.

I wrote this tool just to help reduce their downtime or getting one step closer to their ultimate resolution. I know I write a lot so I will come straight to the point now :).

Point:

Feature 1:

This tool (I rechristened it as DebugFinder.exe) will attach non-invasively to any currently running process on the system and find out if any managed modules that are loaded is a DEBUG or a RELEASE build. This is applicable to any process and not only to Web applications. That way you can find out at run time which managed modules referenced in the current process are deployed as release versus debug builds. This helps keeps track of any debug build assembly that is being referenced from the GAC at runtime apart from the modules loaded from its current working directory if any. Once done it then detaches from the attached process without terminating it.

Feature 2:

We know that it is always recommended to have DEBUG attribute set to false in a Web.Config file in a production server.

This tool scans the machine for the Web applications that are configured in IIS. It looks for the Web.Config files corresponding to all the web applications configured in IIS and checks if they have the DEBUG attribute set to true or false and notifies in the display.

The Debug flag checking in the Web.Config file works for the web applications running either in IIS 6.0 or IIS 7.0/7.5 by this tool.

Pre-conditions:

DebugFinder has to be run locally on the machine where we want to get the debug related details (remotely may be in another version).
It needs .Net framework 2.0 to be installed on the machine for successful running.
Currently it is designed/tested for Win2k3/Vista/Win2k8/Win7 for finding Debug attribute in the Web.Config file.
If we have UAC turned on on Vista/Win2k8/Win7 ensure we run it in the privileged mode.

Here are some screenshots:

Here I have used MdbgCore.dll to attach/detach to a process at run time and show the details for debug modules.

Attached is a zip file, containing a 32bit and a 64bit DebugFinder builds along with MdbgCore.dll. Ensure we keep both the DebugFinder32/64.exe and the MdbgCore.dll in the same folder while running it.

Chill!

Required permissions when calling a Web service using client certificate for authentication in an ASP.NET Web application

Saurabh Singh — Fri, 03 Jul 2009 04:08:04 GMT

A Web service requiring Client certificate authentication is a common scenario.

You may have a client application which needs to send the Client certificate as part of the web request for accessing the web service.

This client application may be a Windows/Console application or another Web application.

Often you will get into issues wherein you are able to send Client certificate as part of the web request from a windows/console app but not from another web app. The primary reason for this could often be around Web app not being able to send the client cert to the target Web service.

This can happen for multiple reasons, in particular account under which Web app is running doesn't have enough permissions to access the Client cert in its local certificate store.

Refer to this excellent kb for this for more details.

In this post I want to highlight ways in which you can grant access to the Web application account to access the Client certificate in its local machine store.

When we have to send client cert as part of the web service call from a web app we need to ensure that the client cert is installed in the Local Computer -> Personal Store on the local box (where Web app is running). By default you will see the client cert installed in the Local User Store for the user who requested and installed the cert on the machine. You need to ensure first that the client cert is installed on the Local Computer Store instead of the Local User Store and then follow any of the methods below to grant access to the private key for the account (under which your web app is running).

Method 1:

The above article kb gives an example of granting access using the Microsoft Windows HTTP Services Certificate Configuration Tool

> WinHttpCertCfg.exe -g -c LOCAL_MACHINE\MY -s " IssuedToName " -a " AccountName "

for e.g.

> WinHttpCertCfg.exe -g -c LOCAL_MACHINE\MY -s " IssuedToName " -a "Network Service"

There are other ways in which you can achieve the same result. This feature is in fact built in on Windows Server 2008 within the Certificate mmc console.

Method 2:

Using the WSE X509 Certificate tool (This tool has features that can be used to check certificate properties).

You need to download Web Services enhancements (WSE) 2.0+ SP3 for Microsoft.Net and in the install wizard ensure you select Tools as shown below:

Once installed go ahead and launch the tool. It has a clean UI. You have the option to check certificates in the Local Computer/Current user for the available stores like Personal/Trusted/Intermediate Root CA etc. If you click on View Private Key File Properties (shown below) you can directly modify the permission for private key associated with the certificate. Basically this is just a file under C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys on Win2k3 server and C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys on Win2k8 server.

You may want to go ahead and give the Service account under which the web app is running Full permission on this file (modify the permissions from the Security tab).

Method 3:

If you are running the web app on Windows Server 2008/Vista there is a far simpler way built in the Certificate mmc.

Right click on the certificate and go to All Tasks -> Manage Private Keys and then give Full permission for the associated account.

Till next time..

Cheers!

Automate client certificate one-to-one mapping in IIS 6.0 using C#

Saurabh Singh — Sat, 11 Apr 2009 03:04:00 GMT

In PSS, we occasionally get requests from our customers wherein they want to automatically add entries for client certificate mapping in IIS or Active Directory (AD). That is either a 1-to-1, Many-to-1 or AD mapping for the client certificate authentication for the web site. I recommend going with AD mapping because that eases the management but it finally depends upon one's need.

I am not sure but I feel there is a security breach plus annoyance when an administrator has to laboriously enter the mappings for all the accounts/certificates (I am being specific to 1-to-1/Many-to-1 here).

The concern I feel when dealing with the administrator doing it for 1-to-1 and Many-to-1 are:

a. If there are hundreds of users you need to do this manually for everyone of those accounts and it's a pain.

b. Yes, the above can be automated using a script but then the second concern that arises is that whoever is running the script has to know the passwords for all these accounts to be mapped. I think this doesn't sound good.

I have written a sample application using which users can enter the mappings themselves in the IIS's Client certificate setting, i.e. entries having the client certificate mapped to a windows account (either a local IIS or AD account) and the corresponding password.

So this is how it works:

User accesses this web page from their workstation which already has the client certificate installed.
They are authenticated over Basic with SSL.
Browser sends across the client certificate as part of the HTTP web request.
This application gathers the user account, password plus the client certificate from the incoming HTTP web request and does the mapping in IIS.

I am adding the code here in case someone may want to extract the section for automated scripting instead of using it as a web app.

This code is also attached to this post as well.

using System;using System.Data;using System.Configuration;using System.Web;using System.Web.Security;using System.Security.Cryptography.X509Certificates;using System.Web.UI;using System.Web.UI.WebControls;using System.Web.UI.WebControls.WebParts;using System.Web.UI.HtmlControls;using System.DirectoryServices; /* This sample application is to automate One-to-One Client certificate mapping in IIS 6.0. * User should be able to access this site from the browser and select the client certificate * in their machine which will be mapped to their account on the IIS server for 1-to-1 mapping.  * You need to deploy this application on the IIS server which is hosting the website(s) which  * needs client certificate mapping, preferably under its own virtual directory. * * Important: * - Have the authentication for this web application configured to use Basic along with SSL. * - Have the "Accept client certificates" or "Require client certificates" selected under  *   <Website> -> Properties -> Directory Security -> Secure communications -> Edit -> Client certificates * - Ensure the website that we want the mapping for is mentioned in the web.config file associated with *   this application under <appSettings> * - In the Web.config file we are impersonating an Administrator account for this application.  *   <identity impersonate="true" userName="Administrator" password="myadminpassword"/> *   This is done because non-admin users cannot modify the IIS metabase. If you do not want users to map *   entries themselves through web page you can change this to <identity impersonate="true" />. *   In such a case only admins can add the mappings for their user accounts. Non-admins won't be able to  *   add the client mapping entries. *   This is valid for both domain or local Windows NT accounts. * - This app is written using .Net 2.0, ASP.Net 2.0 and above in mind. You should be able to make it work *   with ASP.Net 1.1 as well. * - You may prefer to run this application under its own dedicated application pool to ensure stability and security. *  * DISCLAIMER: The code is not tested for production scenarios so use it at your own risk.  *             In case one wants to use batch scripting etc or some kind of console app instead  *             of web app you can extract the code section from this page which should work fine for the job. */ public partial class _Default : System.Web.UI.Page {    protected void Page_Load(object sender, EventArgs e)      {        Response.Write("<B>Client Certificate One-to-One Mapping Application:</B><BR><HR>");        Response.Write("Serial number: " + Request.ClientCertificate.SerialNumber + "</BR><HR>");        Response.Write("Issuer: " + Request.ClientCertificate.Issuer + "</BR><HR>");        Response.Write("Subject Name: " + Request.ClientCertificate.Subject + "</BR><HR>");        if (Request.ClientCertificate.IsPresent)        {            Response.Write("Validity<BR>");            Response.Write("&nbsp;&nbsp;&nbsp;&nbsp;Not before: " + Request.ClientCertificate.ValidFrom + "</BR>");            Response.Write("&nbsp;&nbsp;&nbsp;&nbsp;Not after: " + Request.ClientCertificate.ValidUntil + "</BR><HR>");        }        else            Response.Write("<B>There is no client certificate sent along with the request!</B><HR>");         Response.Write("Authenticated User: " + Request.ServerVariables["AUTH_USER"] + "</BR><HR>");        Response.Write("Authentication Type: " + Request.ServerVariables["AUTH_TYPE"] + "</BR><HR>");    }    protected void Button1_Click(object sender, EventArgs e)    {        string user = Request.ServerVariables["AUTH_USER"];        string password = Request.ServerVariables["AUTH_PASSWORD"];        string clientCertMappingName = "Mapping for " + user;  // <--- Our One-to-One Mapping name for the entry        HttpClientCertificate cert = Request.ClientCertificate;        /*          If you want to map a client certificate located on the disk instead of the one as part of the           HTTP Web request try the code below.                    X509Certificate certificate = X509Certificate2.CreateFromCertFile(@"c:\cert.cer");          X509Certificate certificate = cert.Certificate;          byte[] certHash = certificate.GetRawCertData();        */        byte[] certHash = Request.ClientCertificate.Certificate;        try        {        //Get the name of the Web site for which mapping has to be done from the App settings in the web.config file.        string friendlyWebsiteName = ConfigurationManager.AppSettings["websitename"].ToString();         //Get the Site Identifier based on the friendly name of the Web Site.        string siteId = getsiteid(friendlyWebsiteName);         if (siteId != null)            {            string sitePath = "IIS://localhost/W3SVC/" + siteId + "/IIsCertMapper";            using (DirectoryEntry de = new DirectoryEntry(sitePath))            {                de.Invoke("CreateMapping", new object[] { certHash, user, password, clientCertMappingName, true });            }            Response.Write("Account Mapped: <B>" + Request.ServerVariables["AUTH_USER"] + "</B></BR>");            Response.Write("Mapping Name: <B>" + "Mapping for " + Request.ServerVariables["AUTH_USER"] + "</B></BR>");            Response.Write("Web Site: <B>" + friendlyWebsiteName + "</B></BR>");            }        else            {            Response.Write("<B>Web Site does not have a valid Site ID. Ensure we have the correct site name in the config file for this app.</B>");            }        }                catch (System.Runtime.InteropServices.COMException)        {            Response.Write("A COM exception occurred while setting up the mapping.");        }        catch (SystemException)        {            Response.Write("An error occurred while setting up the mapping.");        }        catch (Exception)        {            Response.Write("An error occurred while setting up the mapping.");        }           }     public string getsiteid(string websitename)    {        DirectoryEntry root = new DirectoryEntry("IIS://localhost/W3SVC");        try        {            string siteid = null;            foreach (DirectoryEntry de in root.Children)            {                if (de.SchemaClassName == "IIsWebServer")                {                    if (websitename.ToUpper() == de.Properties["ServerComment"].Value.ToString().ToUpper())                        siteid = de.Name;                }            }            if (siteid == null) return null;            return siteid;        }        catch        {            return null;        }        finally        {            root.Close();        }    }}

Ciao

Nice weekend!

New features in SETSPN.EXE on Windows Server 2008

Saurabh Singh — Fri, 09 Jan 2009 03:05:00 GMT

The version of Setspn.exe that came with Microsoft Windows Server 2000/2003 Support Tools did not have features to detect duplicate SPNs. The new version of Setspn.exe that comes bundled with Windows Server 2008 utilities has some really cool features. For someone dealing with the dreaded Kerberos authentication failure issues on a daily basis like me it's a sigh of relief.

If you try the following command on the Windows Server 2008 you will see the various new options (or switches) available.

Notice the modifiers/switches:

-F = perform the duplicate checking on forestwide level

-S = add arbitrary SPN after verifying no duplicates exist

-Q = query for existence of SPN

-X = search for duplicate SPNs

Searching for duplicate SPNs using Setspn.exe:

D:\>setspn -X http/www.test.com
Processing entry 0
http/www.test.com is registered on these accounts:
    CN=mstest,CN=Users,DC=<some-DC-primary>,DC=<some-DC-secondary>
    CN=<IIS-servername>,OU=Domain Controllers,DC=<some-DC-primary>,DC=<some-DC-secondary> 

found 1 group of duplicate SPNs.

Searching for the existence of an SPN in the domain:

D:\>setspn -Q http/www.test.com
CN=<IIS-servername>,OU=Domain Controllers,DC=<some-DC-primary>,DC=<some-DC-secondary>
    http/www.test.com
    ldap/2334590-45566-113f....
    HOST/<IIS-servername>
    HOST/<IIS-servername.<some-DC-primary>.<some-DC-secondary>
    .......
    .......
CN=mstest,CN=Users,DC=<some-DC-primary>,DC=<some-DC-secondary>
    http/www.test.com 

Existing SPN found!

Adding an arbitrary SPN after verifying no duplicates exist in the domain:

D:\>setspn -S http/www.test.com <IIS-servername>
CN=mstest,CN=Users,.<some-DC-primary>.<some-DC-secondary>
    http/www.test.com 

Duplicate SPN found, aborting operation!

Adding an arbitrary SPN after verifying no duplicates exist in the forest:

D:\>setspn -F -S http/www.test.com <IIS-servername>
Operation will be performed forestwide, it might take a while.
CN=mstest,CN=Users,DC=<some-DC-primary>,DC=<some-DC-secondary>
    http/www.test.com
CN=mstest1,CN=Users,DC=<some-DC-primary>,DC=<some-DC-secondary>
    http/www.test.com 

Duplicate SPN found, aborting operation!

So what does this mean? It means you no longer have to depend upon boggling commands using LDIFDE or your own custom scripts to find out the duplicate SPNs. This is a good news indeed!

*Prior to this using Windows Server 2000/2003 Support Tools we could use commands using LDIFDE to find duplicate SPNs as below:

Syntax:

ldifde -f <filename> -d "<dc=domain-netbiosname,dc=primary-domain>" -l serviceprincipalname -r "(serviceprincipalname=<serviceprincipalname-to-check-for-duplicates>)" -p subtree

For example, if the domain name is test.abcd.com and the site URL is http//test.abcd.com command should be as shown below:

ldifde –f C:\log.txt -d "dc=test, dc=abcd, dc=com"-l serviceprincipalname –r "(serviceprinicpalname=http/test.abcd.com)" -p subtree

With the newer version of Setspn hopefully the dependency on the above command should reduce drastically.

Till next time,

Cheers!

My IIS 6.0 Mobile Manager - Manage your Web Sites, application Pools through mobile device from anywhere...

Saurabh Singh — Sun, 24 Aug 2008 05:13:51 GMT

In May this year I had written a Web application using which we can manage basic IIS settings through Web browser from anywhere. Here is another application which I feel brings in more convenience to the end user (meant for Web administrators) since one can manage IIS through a Mobile phone.

These are the features available through this Mobile web application.

Application Pool related activities

. Check the current Application Pool(s) State/Identity

· Recycle/Start/Stop Application Pool(s)

· Change Application Pool(s) Identity.

Web Site related activities

· Start/Stop Web Site(s)

· Check features like current Web Site state, and some configuration related settings like Web Site physical path, Server Bindings, Secure Bindings, Authentication method, SSL accessibility, Application Pool etc.

IISRESET

· At times the only way to recover from a problem is to restart IIS services. You can restart all IIS services like IISADMIN, SMTP and World Wide Web Publishing service from any where through this application.

Pre-requisites

· You need to have .Net Framework 2.0 installed on the IIS 6.0 web server.

Steps to deploy the application

1. Download the ZIP file from the URL linked with this post.

2. Extract all the contents to some physical folder on the IIS Web server.

3. Create a new Web Site (or a new Virtual Directory under any of your existing Internet-facing Web sites) and point it to this physical path for the extracted files/folders.

4. ***ENSURE that you create a new application Pool for this Web Site/Virtual Directory, and put the application under this application pool. In such a scenario this application will not interfere with any of your existing web applications running on the server.

5. Open the web.config file associated with this application and modify the <appSettings> to reflect the name of your Application Pool and name of the Web site under which this Mobile Web application is running [Attached ZIP file contains a word document as well with detailed steps for deployment].

6. This application is built using ASP.Net 2.0 Mobile controls, WMI built on top of .Net and supports most of the WAP enabled browsers.

Here are some screen captures associated with this application. I have used an Emulator to show the same.

Application Pool related usage.

Web Site related usage.

IISRESET

When you reset IIS, you won't be able to browse to the Web application for a few seconds to a minute or so, depending upon how long it takes for the IIS services to stop and then start back running.

In this interval if you try to access the site you will see the following error:

Hope this adds to your convenience when taking care of bare minimum action items for the IIS web sites from anywhere across the world.

Until next time, cheers

***This is provided "AS IS".

Links for download:

IIS Mobile manager: http://cid-d6e3b4cd95f9d0f2.skydrive.live.com/self.aspx/Public/Mobile%20IIS%20Mananger%20resources/MobileIISManager.rar

Steps for deployment: http://cid-d6e3b4cd95f9d0f2.skydrive.live.com/self.aspx/Public/Mobile%20IIS%20Mananger%20resources/Steps%20for%20Deployment-Mobile%20IIS%20manager.doc

*It should also be available in some days @ http://www.iis.net/downloads/default.aspx?tabid=34&g=6&i=1720

My IIS 6.0 Web Manager - Manage your Web Sites, Application Pools from any where on the Web.

Saurabh Singh — Wed, 14 May 2008 05:47:00 GMT

A Web administrator has to have access to the IIS server in order to ensure that any diagnostic/preventive measures can be performed at any point of time. One has to ensure all the web sites are running up and fine during the course of a day. Activities like recycling Application pools, starting/stopping Web sites etc. are an essential part of this process. This may be most painful when you are away having a good time and you get a call that the web sites are having performance issues etc, and you are required to ensure they are recycled, restarted etc. etc.

I have written this Web application to ensure one has access to their IIS 6.0 Web server from any part of the world. I have used WMI features built on top of .Net. It has the following features at this point.

Application Pool related activities

· Recycle/Start/Stop Application Pool(s)

· Change Application Pool Identity.

· Check features like Application Pool Recycling options, Current state of an Application Pool and current Application Pool Identity.

· Enumerate an Application Pool to see the Web applications running underneath it.

Web Site related activities

· Start/Stop Web Site(s)

IISRESET

There are tools available like MS Administration site, but it had somewhat limited features in my opinion. I intend to modify the existing features in my application as time permits.

Pre-requisites

· You need to have .Net Framework 2.0 installed on the IIS web server.

· If AJAX-enabled version of this application is deployed, you need to have Microsoft ASP.Net 2.0 AJAX Extensions 1.0 installed on the server for it to work.

Steps to deploy the application

1. Download the ZIP file attached with this post.

2. Extract all the contents to some physical folder on the IIS Web server.

3. Create a new web site (or better in my opinion, a new virtual Directory under any of your existing Internet-facing Web sites) and point it to this physical path for the extracted files/folders.

4. ***ENSURE that you create a new application Pool for this Virtual Directory, and put the application under this application pool. In such a scenario this application will not interfere with any of your existing web applications running on the server.

5. This application is built using ASP.Net 2.0 and has two flavors, AJAX-enabled and non-AJAX based. if you are using AJAX-enabled application you need to ensure Microsoft ASP.Net 2.0 AJAX Extensions 1.0 is installed on the server.

6. Open the web.config file associated with this application and modify the <appSettings> to reflect the name of your Application Pool and name of the Web site under which this application is running [Attached ZIP file contains a word document as well with detailed steps for deployment].

I have covered the essential features required for a web server management and plan to modify it with more granular features with time.

Here are some screen captures related to usage

****Ensure the application pool Identity entered forms a part of Local IIS_WPG group on the server.

Click on IIS Reset shown below to restart all IIS services like IISADMIN, FTP, SMTP and WWW.

When you reset IIS, you won't be able to browse to the Web application for a minute or so, depending upon how long it takes for the IIS services to stop and then start back running.

In this interval if you try to access the site you will see the following error:

For AJAX-enabled version, you will get a pop up as shown below:

For Non-AJAX version you will see the following page:

At any point you can check the status of the selected Application Pool and the selected Web site.

This is provided "AS IS".

Any constructive feedback is appreciated ;-)

Till next time, Cheers!

Links for download:

AJAX enabled version: http://cid-d6e3b4cd95f9d0f2.skydrive.live.com/self.aspx/Public/AJAX%20enabled%20version.rar

Non-AJAX version: http://cid-d6e3b4cd95f9d0f2.skydrive.live.com/self.aspx/Public/Non-AJAX%20version.rar

Steps for Deployment: http://cid-d6e3b4cd95f9d0f2.skydrive.live.com/self.aspx/Public/Steps%20for%20Deployment.doc

*You can also download the AJAX version from here www.iis.net/downloads

My IIS 7.0 Administration UI Extension Page

Saurabh Singh — Wed, 28 Nov 2007 20:24:00 GMT

The UI extension option in IIS 7.0 is an exciting feature for any .Net developer. You can write your own custom UI pages and can add various features to it to manage IIS on Windows Vista and Windows Server 2008. I have written an UI extension and is attached with this post.

I have added the IIsReset feature provided by my good friend Rakki as part of this UI module. He had blogged about it here. Besides IISRESET, I have also added an integrated browser, AppCmd.exe UI and a generic Request monitoring tab.

To add this module in your IIS 7 manager follow the steps below:

Download the ExtensibilityDemo.dll.
Drag and Drop the ExtensibilityDemo.dll into the Global Assembly Cache (C:\Windows\assembly) or use GacUtil -i ExtensibilityDemo.dll to install it to the GAC.
From the Windows Explorer, browse to the file

%WinDir%\System32\InetSrv\config\Administration.config.

4. Search for the <moduleProviders> section and add the following

<add name="ExtensibilityDemo" type="ExtensibilityDemo.DemoModuleProvider, ExtensibilityDemo, Version=1.0.0.0, Culture=neutral, PublicKeyToken=204f1a1ad20ba534" />

You need to crosscheck that PublickKeyToken matches what is present in the GAC.

This should be same as the following in the Assembly folder:

5. Search for the <modules> section and add the following

<location path=".">
<modules>
<add name="ExtensibilityDemo" />

6. Open Inetmgr (Start Menu->Run->Inetmgr) and You will see the module listed in your IIS 7 Manager if everything went fine during the installation.

You can see the Module listed in Connections Pane as well as middle pane in its own category. If you want you can remove from the Connections Pane by right click and "remove".

Here are some screen shots for this extension:

In the central IIS manager pane (window) you should see the following:

I will be adding some new functionalities as time progresses to have more UI interface for various features. I will recommend if you are interested start developing your modules today to customize/extend IIS 7.0 features.

Good luck....