Copyright: Monday, December 30, 2002 13:51:21


Internet Information Services 6.0

This file provides context-sensitive Help for Internet Information Services (IIS) 6.0.

To view this Help, run IIS Manager and click Help from any property page within IIS.

Related Topics

To view IIS 6.0 Help (the IISMMC.chm file), which includes detailed conceptual and procedural information, see Internet Information Services.


Connect to Computer

Use this dialog box to connect to a remote computer by typing the IP address, server name (if you are on the same subnet), or fully-qualified domain name.

To log on as another user for the target computer, type the appropriate user name and password.

Computer Name

Type the name of the computer to which you want to connect.

Browse

Browse the network to locate the name of the computer to which you want to connect.

Connect As

Click to connect to another computer using a specific name.

Related Topics

To learn more about remotely administering IIS, see How to Administer the Server Remotely in IIS Help.


Configuration Backup/Restore

After connecting to the computer that you want to back up or restore, use this dialog box to save configuration settings for all Web sites, FTP sites, virtual directories, directories, and files that you administer on your computer. (You must first connect to the computer that you want to back up or restore.) Most configuration settings are stored in the metabase, but some are stored in the registry. This utility backs up only the configuration settings of the metabase.

Previous Backups

The Backups list box lists all configuration backups, their version numbers, and the date and time the backups were created. You must supply the name when a backup file is created.

Restoring the Metabase Configuration Settings

To return to a previous configuration state of the metabase, click a backup version, and then click Restore. IIS stops all services, overwrites all current configuration settings from the backup file, and then restarts all IIS services. Completion time is dependent on the size of the metabase.

Backups

This is a list of all backups available for the currently selected computer, including version number (#) and the creation date and time.

Create backup

Click to create a backup of the current metabase configuration settings after you supply a name for the backup version.

Restore

Click to replace the configuration settings in the current metabase with the settings of the currently selected version.

Delete

Click to delete the currently selected backup file and remove the name from this list.

Related Topics

To learn more about the role and structure of the metabase, see IIS Metabase in IIS Help.

To learn more about the role of the registry, see About the Registry in IIS Help.


Restarting IIS

Restarting or stopping Internet Information Services (IIS), or rebooting your Web server, is a severe action. When you restart the Internet services, all sessions connected to your Web server (including Internet, FTP, SMTP, and NNTP) are dropped. Any data held in Web applications is lost. All Internet sites are unavailable until Internet services are restarted. For this reason, you should avoid restarting, stopping, or rebooting your server if at all possible. IIS 6.0 includes application pool recycling and several other features that provide alternatives to restarting IIS. For a list of features designed to improve IIS reliability and remedy the need to restart IIS, see Restarting IIS in IIS Help.

Note Internet services include Web, FTP, SMTP, NNTP, and IIS Administrative services.

What do you want IIS to do?

This is a list of IIS restart options, as well as explanations and consequences of each option.

Restart Internet Services

Click to stop and then restarts all Internet services. Web and FTP sites are unavailable until services have restarted.

Stop Internet Services

Click to stop all Internet services. Certain changes to IIS require stopping the Internet services in order to register those changes, for example when installing a new COM component or ISAPI filter.

Start Internet Services

Click to start all Internet services. You can use the Services node in the Computer Management snap-in to change which services start up automatically. If Internet services do not respond after issuing this command, restart your computer.

Related Topics

To learn more about restarting IIS, see Restarting IIS in IIS Help.


Internet Information Services

The following features, when enabled, impact all Internet services. Internet Information Services (IIS) prompts the Internet services to restart before the changes can take effect.

Enable Direct Metabase Edit

This feature is also known as edit-while-running. Select this option to change metabase property values while IIS is running. Changes take effect immediately. You can implement changes to the metabase using common text-editing tools like Notepad. You must be an administrator of the computer running IIS to enable and use this feature.

Note To use edit-while-running, the metabase history feature must be enabled. The metabase history feature is enabled by default.

UTF-8 Logging

IIS 6.0 supports writing log files for Web sites in UTF-8, instead of just ASCII (or local code page). IIS 6.0 does not support UTF-8 logging for FTP sites. When enabled, all Web sites on your IIS server begin logging in UTF-8. If UTF-8 is not selected, IIS logs in the Local Character Set.

MIME Types (Global Level)

Multipurpose Internet Mail Extensions (MIME) are mappings that set the various file types that IIS serves to clients. IIS serves only files with extensions registered in the MIME type list.

MIME types can be defined globally for IIS, and additional MIME types can be defined at the Web site, Web site directory, and Web site virtual directory level.

Caution  IIS 6.0 returns an error (404.3) if a request refers to a file with a file extension that is not in the MIME mapping or script mapped. If you want to allow IIS to serve all files regardless of their extension, you must either add the particular extension or a wildcard (.*) to the MIME mapping.

MIME Types

Click to configure MIME mappings. These mappings set the various file types that the World Wide Web Publishing Service (WWW service) returns to browsers.

Related Topics

To learn more about MIME types, see Working with MIME Types in IIS Help.

To learn more about editing MIME types directly in the IIS metabase, see the MimeMap property in IIS Help.

To learn more about defining MIME types at the Web site, directory, or virtual directory level, see Web Site Properties - HTTP Headers Tab.

To learn more about the metabase history feature, see About the Metabase History Feature in IIS Help.


Web Site Properties - Custom Errors Tab

Use this tab to customize HTTP error messages that are sent to clients when Web server errors occur. Administrators can use generic default HTTP 1.1 errors, detailed custom error files that IIS provides, or create their own custom error files.

These values can be set globally for all sites or separately within each site. IIS uses an inheritance model for these settings. If you set or change a setting that conflicts with a setting at another node in the hierarchy, you are prompted to specify the nodes to which this new setting applies.

Edit

Click to change the properties of the currently selected custom error message.

Set to Default

Click to configure the currently selected custom error message to use the default HTTP 1.1 error.

Note To change the settings for multiple errors, press the CTRL or SHIFT key and click the HTTP errors.

Related Topics

To learn more about custom error messages, see Custom Error Messages in IIS Help.


Edit Custom Error Properties

Use this dialog box to edit custom error messages. Click a custom error message, and then click Edit.

For security and other system concerns, some errors cannot be customized to point to a URL. For example, the error 401;2 “Unauthorized - Logon failed due to server configuration” does not allow a custom error message on a URL because if a server configuration exists, it might not be possible to reach the URL containing the custom error file.

Message type

Click the type of message that you want to be returned to the client browser — Default, File, or URL — from the Message type list box.

Default

Click to return the default HTTP 1.1 error to the client browser. File allows you to map the custom error to a file by using a fully qualified file name. URL allows you to map the custom error to a URL. If the output type is a URL, this URL must exist on the local server. Click OK to save your selections.

File/URL

Browse to or type the location of the file mapped to the custom error.

Browse

Click to locate the directory and file.

Related Topics

To learn more about custom error messages, see Custom Error Messages in IIS Help.


Web Site Properties - HTTP Headers Tab

Use the HTTP Headers tab to set values returned to the browser in the header of the HTML page. You can also set content ratings for content, and define MIME types.

These values can be set globally for all sites or separately within each site. Internet Information Services (IIS) uses an inheritance model for these settings. If you set or change a setting that conflicts with a setting at another node in the hierarchy, you are prompted to specify the nodes to which this new setting applies.

Enable content expiration

Select the Enable content expiration check box to include expiration information for time-sensitive material, such as special offers or event announcements. The browser compares the current date to the expiration date to determine whether to display a cached page, or to request an updated page from the server.

Expire immediately

Click this option and content expires immediately after it is served. This setting forces the browser to always retrieve the content fresh from the server on subsequent requests.

Expire after

Set a specific period of time after which the browser is forced to retrieve the content again from the server on the subsequent requests.

Expire on

Select to set a specific date and time after which the browser is forced to retrieve the content again from the server on the subsequent requests.

Custom HTTP headers

You can use this property to send a custom HTTP header from the Web server to the client browser. Custom headers can be used to send instructions from the Web server to the client browser that are not yet supported in the current HTTP specification, such as newer HTTP headers that IIS may not inherently support at the time of the product's release. For example, you can use a custom HTTP header to allow the client browser to cache the page but prevent proxy servers from caching the page.

Add

Click to add a new custom HTTP header.

Edit

Click to edit the properties of the currently selected custom HTTP header.

Remove

Click to remove the currently selected custom HTTP header.

Content rating

Use content ratings to embed descriptive labels in the HTTP headers of your Web pages. Browsers, such as Microsoft® Internet Explorer, version 3.0 or later, can detect content ratings to help users identify potentially objectionable Web content.

Edit Ratings

Click to set content rating values.

MIME types (site, directory, and virtual directory levels)

Multipurpose Internet Mail Extensions (MIME) mappings set the various file types that IIS serves to clients. IIS serves only files with extensions registered in the MIME types list.

MIME types can be defined globally for IIS, and additional MIME types can be defined at the Web site, Web site directory, and Web site virtual directory level.

IIS uses an inheritance model for MIME type settings. MIME types defined at the global level are inherited by all Web sites, Web site directories, and Web site virtual directories. MIME types defined at the Web site, Web site directory, or Web site virtual directory are used only at that particular node. If you set or change a MIME type that conflicts with a setting at another node in the hierarchy, you are prompted with an Inheritance Override dialog box where you can specify the nodes to which the new setting applies.

The registered file types that are installed on this computer are listed in the Registered MIME types (file extensions) list box.

Caution  IIS 6.0 returns an error (404.3) if a request refers to a file with a file extension that is not in the MIME map or script mapped. If you want to allow IIS to serve all files regardless of their extension, you have to either add the particular extension or a wildcard (.*) to the MIME map.

MIME Types

Click to configure MIME mappings. These mappings set the various file types that the Web service returns to browsers

Note When you click a MIME type, the MIME mappings are listed in the MIME Types box.

Related Topics

To learn more about content ratings, see Using Content Ratings in IIS Help.

To learn more about MIME types, see Working with MIME Types in IIS Help.

To learn more about editing MIME types directly in the IIS metabase, see the MimeMap property.


Add/Edit Custom HTTP Header

Custom headers appear in the HTTP Headers tab of a property sheet in the form Name: Value. Type the name and value of your custom HTTP header in the Custom header name and Custom header value boxes.

Related Topics

To learn how to create multiple Web sites using host header names, see Hosting Multiple Sites Using Host Header Names in IIS Help.


Content Ratings - Ratings Tab

Use this tab to configure your Web server's content rating features for a particular Web site, directory, or file.

Your Web server's Platform for Internet Content Selection (PICS) system uses a rating system developed by the Internet Content Rating Association (ICRA), which rates content according to levels of violence, nudity, sex, and offensive language.  For more information about ICRA, see http://www.icra.org.

Enable ratings for this content

Select to set the rating levels on this Web site for each of the listed categories.

Category

Adjust the Rating slider bar for each category to the appropriate level for this content.

E-mail address of person rating this content

Type an e-mail address in the text box to identify the person rating this content.

Expire on

Select an expiration date to control the duration of the rating. After this date, no rating is associated with the content.

Related Topics

To learn more about content ratings, see Using Content Ratings in IIS Help.


Web Site Properties - Documents Tab

Use this tab to define your site's default Web page and to append a footer to the site's documents.

Enable default content page

When enabled, the default document is served to the browser whenever the browser request does not specify a document name. Default documents can be a directory's home page or an index page containing a site document directory listing. Multiple documents can be listed in a top-down search order. The files shown are located in the site’s Home directory. The order can be modified by using the Move Up and Move Down buttons.

Select the Enable default content page check box to enable the Web server to identify a default document whenever a browser request does not specify a document name.

Add

Click to add additional default documents. Default documents are served in the order in which the names appear in the list. The server returns the first document it finds.

Remove

Click to remove a default document from the list without deleting the file.

Enable document footer

Select the Enable document footer check box to configure your Web server to automatically append a footer to every document your Web server returns. The footer file should not be a complete HTML document. It should only include only HTML tags that are necessary to format the appearance and function of your footer content.

Browse

Click to locate and specify the full path and file name for your footer file.

Related Topics

To learn more about a default document, see Setting Up a Default Document in IIS Help.

To learn more about adding a footer to your Web pages, see Adding a Footer to Web Pages in IIS Help.


Web Site Properties - BITS Server Extension Tab

The Background Intelligent Transfer Service (BITS) is a background file transfer mechanism and queue manager, also known as a drizzle service. BITS throttles file requests to minimize bandwidth consumption and enhance the end-user experience. Enable BITS with IIS to maintain Web server quality of service.

Allow clients to transfer data to this virtual directory

Use to enable uploads from the BITS client into this virtual directory. If not enabled, BITS clients that attempt an upload will be denied access. BITS disables all Script and Execute permissions on a BITS-Upload enabled virtual directory.

Use default settings

Select to use use the default configuration for this virtual directory. If this directory is embedded in another virtual directory and the outer virtual directory defines a custom configuration, then that configuration will be used instead of the defaults.

Customize settings

Select to use the configuration information from this property page. No default or inherited settings will be used.

Maximum file size

Select to set the maximum amount of data that can be uploaded in a single BITS job. If not enabled, an unlimited amount of data is permitted.

Delete incomplete jobs after

Select to delete incomplete uploads if no progress is made for the specified time period. The timeout is checked each time the MSTASK cleanup work item is run. Click Schedule Cleanup to configure the frequency for which the timeout should be checked for this virtual directory.

Enable server farm support

Select to force a client to reconnect using the specified name instead of the name used by the client. This allows clients which are uploading to server farms to continue uploading to the same server that the upload was started with. Uploading to Web farms is not recommended without enabling and configuring this feature.

Reconnect to IP address

Select to specify the public IP to use for reconnecting to this server.

Use original IP address after

After receiving an error, clients will continue attempting to reconnect to the server using the Reconnect to IP address name until this timeout is exceeded. After the timeout is exceeded, clients fall back to the original name.

Allow notifications

Use to enable notifications for this virtual directory. The Notification type and Notification URL settings are required if this setting is enabled.

Notification type

Use to configure the type of notification to perform after the job is uploaded.

•	Send the file name:  The server sends the path to the uploaded file to the URL indicated by the Notification URL setting. The server may return a file to the client.

•	Send the data:  The server sends the entire uploaded file to the URL indicated by the Notification URL as the entity of the Power-on Self Test (POST). The response entity is sent to the client.

Notification URL

If the Notification type is Send the data or Send the file name, this URL indicates where the uploaded file will be posted. The URL may be absolute or self-relative. If the URL is self-relative, then the original request URL is used as the base.

Schedule Cleanup

This setting configures the frequency for which BITS Extensions should scan this virtual directory for incomplete files. If an incomplete upload is found, the file is checked against the timeout value. If progress has not been made on this file for longer than the timeout period, the upload is automatically cancelled. This setting is not affected by inheritance and applies only to this virtual directory.

Run Cleanup Now

Select to start a check for files which have had no progress since the timeout period. To remove all incomplete files for this virtual directory, set the timeout value to 0 before running the cleanup.


Web Site Properties - Directory Security Tab

Use this tab to set IIS security features to confirm the user identity of users before granting access to restricted content.

Authentication and access control

This setting allows you to configure your Web server to confirm the user identity of users before assigning access to restricted content. Before your Web server can authenticate users, however, you must first create valid Windows user accounts and then configure the NTFS directory and file permissions for those accounts.

Edit

Click to configure your Web server's authentication and anonymous access features.

IP address and domain name restrictions

This setting allows you to assign or deny specific users, computers, groups of computers, or domains from accessing this Web site, directory, or file based on IP address or domain name.

Edit

Click to add settings that set restrictions on or deny access to this Web site, directory, or file by specific users, computers, groups of computers, or domains.

Secure communications

Windows provides means to secure communication between the client and the Web server using server certificates and certificate mapping.  You can implement secure communications by enabling Windows directory service mapping, which allows you to use the Directory Service client-certificate mapping rather than one-to-one or many-to-one mapping. To enable this service, the server must be a member of the Windows® Server 2003 domain.

Enable the Windows directory service mapper

Select to use Directory Service client-certificate mapping rather than one-to-one or many-to-one mapping. To enable this service, the server must be a member of the Windows Server 2003 domain. This option is available only when editing properties for all Web sites.

When editing properties for a specific Web site, the following options are available:

Server Certificate

Click to start the Web Server Certificate Wizard and obtain a server certificate.

View Certificate

Click to view the server certificate (if there is one installed) for this Web site.

Edit

Click to enable communication settings such as certificate acceptance, certificate mapping, and the certificate trust list.

Related Topics

To learn more about user authentication in IIS, see Web Site Authentication in IIS Help.

To learn more about access control, see Access Control in IIS Help.

To learn more about certificates in IIS, see Certificates in IIS Help.

To learn more about mapping client certificates to user accounts, see Client Certificate Mapping in IIS Help.


Authentication Methods

Use this dialog box to configure your Web server to verify user identities. You can authenticate individuals or select groups of users to prevent unauthorized persons from establishing a Web (HTTP) connection to restricted content. Anonymous access allows users to establish an anonymous connection. The user logs on to IIS with an anonymous or guest account. There are currently four Authenticated access methods:

•	Windows Integrated authentication uses a cryptographic exchange with the user's Web browser to confirm the identity of the user.

•	Digest authentication works only with Active Directory® accounts, sending a hash value over the network, rather than a plaintext password. Digest authentication works across proxy servers and other firewalls and is available on Web Distributed Authoring and Versioning (WebDAV) directories.

•	Basic authentication transmits passwords across the network in cleartext, an unencrypted form.

•	.NET Passport authentication is a Web authentication service.

Enable anonymous access

Select this check box to establish an anonymous connection for users. IIS logs on the user with an anonymous or guest account. By default, the server creates and uses the account IUSR_computername.

User name

This is the user name for the account used for anonymous access only within Windows.

Password

The anonymous user account password is used only within Windows. Anonymous users do not log on by using a user name and password.

Browse

Click to search and select the object type, such as user, and the location, such as your computer or any accessible computer connected on the network.

Authenticated access

Options selected in this section require that users provide a valid Microsoft Windows user name and password before they access any information on your server.

Integrated Windows authentication

Select to ensure that the user name and password are sent across the network in the form of a hash. This provides a secure form of authentication.

Note If this authentication method is enabled, IIS uses Windows Integrated authentication only when Anonymous access is disabled and Anonymous access is denied because Windows file system permissions have been set, requiring users to provide a Windows user name and password before establishing a connection with restricted content.

Digest authentication for Windows domain servers

Select to work with Active Directory® and send a hash value over the network, rather than a cleartext password. This method works across proxy servers and other firewalls. Using Digest authentication requires that a Realm be defined.

Basic authentication (password is sent in cleartext)

Select to send the password across the network in cleartext. Basic authentication is part of the HTTP specification and is supported by most browsers; however, user name and password are not encrypted and could present security risks.

.NET Passport Authentication

Select to enable .NET Passport authentication services on your Web site. NET Passport allows users of your site to create a single sign-in name and password for easy, secure access to all .NET Passport-enabled Web sites and services. .NET Passport-enabled sites rely on the .NET Passport central server to authenticate users rather than hosting and maintaining their own proprietary authentication systems. However, the .NET Passport central server does not authorize or deny a specific users' access to individual .NET Passport-enabled sites. It is the responsibility of the Web site to control user permissions. Using .NET Passport authentication requires that a Default domain be defined.

Default domain

This identifies the Windows domain used for user authentication control.

Select

To authenticate the user or group, click to view a list of all domains to which you are connected.

Realm

This identifies the domain or other operating system authentication controller used to authenticate the user or group.

Select

Click to view a list of all domains and realms to which you are connected.

Related Topics

To learn more about user authentication, see Web Site Authentication in IIS Help.

To learn more about .NET Passport authentication, see .NET Passport Authentication in IIS Help.


Basic Authentication Warning

This warning appears when you choose to use the Basic authentication method. With basic authentication, the user's Web browser transmits Windows account user names and passwords across the network in plaintext. Malicious users can then intercept this information. You can use Basic authentication and still protect account information using Secure Sockets Layer (SSL) encryption. To enable SSL, you must first install a server certificate.

Yes

Click to implement the authentication option selected and continue with the security configuration.

No

Click to cancel the selection of the authentication option and return to the previous dialog box.

Related Topics

To learn more about user authentication, see Web Site Authentication in IIS Help.

To learn more about encryption, see Encryption in IIS Help.

To learn more about Secure Sockets Layer, see Secure Sockets Layer in IIS Help.


Digest Authentication Warning

The authenticated access method, Digest authentication, applies only to domain accounts on servers running Microsoft® Windows® Server 2003 and requires the accounts to store passwords using reversible encryption. Internet Information Services (IIS) sends a hash value rather than the password over the network, working across proxy servers and other firewalls.

Requirements for Digest Authentication

Before enabling Digest authentication on your server running IIS, ensure that all of the following minimum requirements are met. Only domain administrators can verify that the domain controller requirements are met. Check with your domain administrator if you are unsure about whether your domain controller meets the following requirements:

•	All clients that access a resource that is secured with Digest authentication are using Microsoft Internet Explorer 5.0 or later.

•	The user and the server running IIS must be members of, or be trusted by, the same domain.

•	Users must have a valid Windows user account stored in Active Directory® on the domain controller.

•	The domain must have a Windows 2000 or later domain controller.

•	The IIS server must be running a member of the Windows Server 2003 family or later.

Yes

Click to set the authentication method in IIS to Digest authentication.

No

Click to stop the operation and return to the previous dialog box to make another selection.

Related Topics

To learn more about user authentication, see Web Site Authentication in IIS Help.

To learn more about Digest authentication, see Digest Authentication in IIS Help.


IP Address and Domain Name Restrictions

Use this dialog box to provide users access to (or to prevent access to) a Web site, directory, or file.

Note Computers accessing your server across proxy servers display the same IP address as the proxy server.

IP address access restrictions

Granted access

Click to grant access to all computers.

To add computers, groups of computers, or domains that you want to deny access to, click Add, and type the required information in the Deny Access dialog box. The computers that are denied access appear in the Except the following list box.

Denied access

Click to deny access to all computers.

To add computers, groups of computers, or domains that you want to grant access to, click Add, and type the required information in the Grant Access dialog box. The computers that are granted access appear in the Except the following list box.

Add

Click to define a computer or group of computers to which you want to grant or deny access.

Remove

Click to remove the currently selected item from the exception list.

Edit

Click to modify the specific properties of the currently selected item in the exception list.

Related Topics

To learn more about security, see Security in IIS Help.


Grant Access or Deny Access

Use these two dialog boxes to list the computers, groups of computers, or domains that you want to grant or deny access to this resource.

Single computer

Click to define access rights for a single computer.

If you select a single computer you will need to know the IP address of the computer.

IP address

Type the Internet Protocol (IP) address of the computer.

DNS Lookup

Click to look up a specific computer's IP address using the domain name (for example, www.MyServer.com). In the DNS Lookup dialog box, type the DNS name for the computer in the Type the DNS name box, and click OK.

You can configure IIS to perform a DNS lookup every time access is requested for the site, virtual directory, or file. However, using the DNS lookup each time a request is made can affect server performance.

Note If you get a "Host not found" error, either the domain name you typed in is incorrect, or the computer you referred to is not available on the network.

Groups of computers

Click to define access rights for a group of computers based on network ID and subnet mask.

When you grant or deny access to groups of computers, you are required to identify them by network ID and subnet mask. A subnet mask, or address mask, is a numerical address of a subnet that includes the network. The mask simply overlays all but the significant part of the network address. Ask your network administrator for information about TCP/IP networking, IP addressing, and the use of subnet masks.

Network ID

This identifies the numerical address of the network that the group of computers are members of.

Subnet mask

This identifies the address mask that, to make the subnet address unique, replaces all but the non-significant numbers of the network ID in order to make the subnet address unique.

Related Topics

To learn more about security, see Security in IIS Help.

To learn about FTP authentication, see FTP Site Authentication in IIS Help.


Web Site Properties - Directory Tab

Use this tab to configure your directory. You can configure the physical location by setting user access permissions, choosing whether to log requests for these resources, and choosing whether to index a site using the Indexing Service. To specify when the request is received, applications must be identified, located, and given the appropriate execute permissions and protection.

The content for this resource should come from

A directory located on this computer

Click to permit users to access a specified directory on this computer to view or update Web content. You can control access to the contents by implementing any Windows security method.

A redirection to a URL

Click to redirect the client application, such as a browser, to another Web site or virtual directory. When selected, redirect options are substituted for path options.

Setting up local or network paths allows the request to be directed to the correct physical location. You can further configure the physical location by setting user access properties, whether or not to log requests for these resources, and whether or not to index this site using the Index Service. To execute when the request is received, applications must be identified, located, and given the appropriate execute permissions and protection.

Note Enable the Index Service through Add/Remove Programs in the Control Panel.

Local path

Type or browse to the path to the directory that stores your default Web site files. By default, these files are stored in the %systemdrive%\inetpub\wwwroot directory for the default Web site.

Script source access

Select to allow users to access source code if either Read or Write permissions are set. Source code includes scripts in ASP applications.

Read

Select to allow users to read or download files or directories and their associated properties.

Write

Select to allow users to upload files and their associated properties to the enabled directory on your server or to change content in a Write-enabled file. Write access is allowed only with a browser that supports the PUT feature of the HTTP 1.1 protocol standard.

Directory browsing

Select to allow users to see a hypertext listing of the files and subdirectories in this virtual directory. Because virtual directories do not appear in directory listings, users must know a virtual directory's alias. If Directory browsing is disabled and the user does not specify a file name, the Web server displays an "Access Forbidden" error message in the user's Web browser.

Log visits

Select to configure IIS to record visits to this directory in a log file. Visits are recorded only if logging is enabled for this Web site.

Index this resource

Select to allow the Microsoft Indexing Service to include this directory in a full-text index of your Web site.

Note Before setting this option, you must enable the Indexing Service through the Add or Remove Programs item in Control Panel.

Application settings:

Application name

Type the name of the root directory that contains the files and subdirectories of an application.

Starting point

This displays the metabase node where this application is configured.

Execute permissions

This option determines the program execution level allowed for this site's resources.

•	Set permissions to None to restrict access to static files, such as HTML or image files.

•	Set permissions to Scripts to allow only scripts to run, not executables.

•	Set permissions to Scripts and Executables to remove all restrictions so that all file types can be accessed or executed.

Application Pool

Select the application pool associated with this home directory.

Browse

Click to locate directory path.

Remove

Click to remove the application from the Web site while leaving the virtual directory intact.

Configuration

Click to configure application mappings, options, and debugging features.

Unload

Click to unload an isolated application from memory, or to unload a pooled application not referenced by any other application.

Related Topics

To learn more about logging site activity, see Logging Site Activity in IIS Help.

To learn more about configuring applications, see Configuring Applications and Configuring Servers for Applications in IIS Help.


Application Configuration - Mappings Tab

Use this tab to map file name extensions to the program or interpreter that processes those files. Mapped applications include Active Server Pages (ASP) applications, Internet Database Connector (IDC) applications, and files that use server-side include (SSI) directives. For example, when the Web server receives a request for a page with an .asp extension, it uses the application mapping to determine that the executable file asp.dll should be called to process the page. You can also use this tab to install wildcard script map ISAPI applications that are executed for every request, regardless of the file extension.

Cache ISAPI extensions

Internet Server API DLLs (ISAPI) can be loaded and cached so that further requests can be processed without calling the application again. Most ISAPI applications (including ASP) benefit from caching. You should clear this check box only for special circumstances, such as debugging ISAPI applications. If the same ISAPI application has been loaded and cached by more than one Web site on a server, then clearing this option for the server does not unload the application from memory. You must clear this option for all Web sites that use the ISAPI application. Clearing this option does not unload running applications. Only subsequent requests are not cached.

Application extensions

You can develop Web applications using a number of programming and scripting languages. Internet Information Services (IIS) uses the file name extension of a requested resource on your Web site to determine which ISAPI or CGI program to run to process a request. For example, a request for a file ending with an .asp extension causes the Web server to call the ASP program (Asp.dll) to process the request. The association of a file name extension with an ISAPI or CGI program is called application mapping. IIS is preconfigured to support common application mappings. You can add or remove mappings for all applications on a Web site or for individual applications.

The Application extensions table lists the file name extension associated with an executable file and the path to the executable file. If the word "ALL" appears in the Verbs column, all verbs are sent to the application. Click the Add, Edit, and or Remove buttons to modify application mappings.

Important  On the Application Mappings tab for IIS 4.0, there was a list of verbs in the Exclusions column. This has changed to the Verbs column, which lists the HTTP verbs run by the application.

Select to configure the Web server to load and cache ISAPI so that subsequent requests can be processed without calling the application again. Most ISAPI applications (including ASP) benefit from caching.

Add

Click to add an application mapping by identifying the file name extension, executable path, and HTTP verbs.

Edit

Click to modify an application mapping by changing the file name extension, executable path, and HTTP verbs.

Remove

Click to remove an application mapping from IIS.

Wildcard application maps

This table lists ISAPI applications that are executed before a Web file is processed, regardless of the file name extension. These ISAPI applications are called wildcard script maps. Using wildcard script maps is similar to using ISAPI filters, except that wildcard script maps can be installed on virtual directories as well as Web sites, they have access to the body of a request, they are not event-driven, and the ISAPI extension API has more functionality than the ISAPI filter API. A virtual directory only inherits wildcard script maps from its parent virtual directory or Web site if it doesn’t contain its own wildcard script maps.

Insert

Click to add a wildcard script map that is executed for every request to a Web file in this Web site or virtual directory.

Edit

Click to modify the currently selected wildcard script map in the Wildcard application maps table.

Remove

Click to remove the currently selected wildcard script map in the Wildcard application maps table.

Move up

Click to move the currently selected wildcard script map higher in the execution order in the Wildcard application maps table.

Move down

Click to move the currently selected wildcard script map lower in the execution order in the Wildcard application maps table.

Related Topics

To learn more about configuring applications, see Configuring Applications and Configuring Servers for Applications in IIS Help.

To learn more about wildcard application mappings, see Installing Wildcard Application Mappings in IIS Help.


Add/Edit Application Extension Mapping (for Application Extensions)

Use this dialog box to add to or modify the mapping between a file name extension and the program or interpreter that processes those files. The Executable is the name of the .exe or .dll that you want to run. The executable file must be located on your Web server's local hard disk. The Extension is the file name extension associated with your application (or an asterisk). If you do not want all HTTP verbs to be passed to your applications through these mappings, then you can set restrictions appropriately. For example, by default, the file Asp.dll processes requests using the HTTP verbs GET, HEAD, and POST. (TRACE requests are handled by IIS.) To enable all verbs, select the All Verbs radio button. Separate verb or method names with a comma (,).

Executable

Type the name of the executable file (.exe or .dll). The executable file must be located on your Web server's local hard disk.

Browse

Click to locate your Web server's local hard disk for the executable file (.exe or .dll).

Extension

Type the file name extension associated with your application (or type the asterisk as a wildcard character).

Verbs

This allows options to restrict the number of HTTP verbs that can be associated with each application extension.

You can select one of two options:

•	All verbs.

•	Limit to.  This option restricts the application to one or multiple verbs as defined by a specific number.

Script engine

Select when you want the application to run in a directory without execute permissions. This setting is intended primarily for script-based applications, such as ASP and IDC, that are mapped to an interpreter. To run a script-mapped application, you must select either Script only or Scripts and Executables from the Execute permissions list box on the Directory tab for the directory in which the application is located.

•	To allow only script-mapped applications to run, click Script only access.

•	To allow both script-mapped applications and executable files (.exe and .dll) to run, click Scripts and Executables access.

Verify that file exists

Select to instruct the Web server to verify the existence of the requested script file and to ensure that the requesting user has access permission for that script file. If the script does not exist or the user does not have permission, the appropriate warning message is returned to the browser and the script engine is not invoked. This option can be useful for scripts mapped to non-CGI executables, such as the Perl interpreter, that do not send a CGI response if the script is not accessible. Because the script must be opened twice, once by the server and once by the script engine, enabling this option can impact performance.

Related Topics

To learn more about configuring applications, see Configuring Applications and Configuring Servers for Applications in IIS Help.


Add/Edit Application Extension Mapping (for Wildcard Application Maps)

Use this dialog box to add or modify wildcard script map ISAPI applications that are executed for every request, regardless of the file name extension. Using wildcard script maps is similar to using ISAPI filters, except that wildcard script maps can be installed on virtual directories as well as Web sites, they have access to the body of a request, they are not event-driven, and the ISAPI extension API has more functionality than the ISAPI filter API. A virtual directory inherits only wildcard script maps from its parent virtual directory or Web site if it doesn’t contain its own wildcard script maps.

Executable

Type the name of the executable file (.exe or .dll). The executable file must be located on your Web server's local hard disk.

Browse

Click to locate your Web server's local hard disk for the ISAPI application.

Verify that file exists

Select Verify that file exists to instruct the Web server to verify the existence of the requested script file and to ensure that the requesting user has access permission for that script file. If the script does not exist or the user does not have permission, the appropriate warning message is returned to the browser and the script engine is not invoked. This option can be useful for scripts mapped to non-CGI executables, such as the Perl interpreter, that do not send a CGI response if the script is not accessible. Because the script must be opened twice, once by the server and once by the script engine, enabling this option can impact performance.

Related Topics

To learn more about configuring applications, see Configuring Applications and Configuring Servers for Applications in IIS Help.

To learn more about wildcard application mappings, see Installing Wildcard Application Mappings in IIS Help.


Application Configuration - Options Tab

Use this tab to control how Active Server Pages (ASP) run within the currently selected application. Applications that run in Internet Information Services (IIS) can be configured for efficiency by enabling session state and timeout, buffering, parent paths, language, and ASP script timeout.

Note You can set application configuration properties at the Web site, virtual directory, or directory level.

Enable session state

Select to enable session state.

When session state is enabled, Active Server Pages (ASP) creates a session for each user who accesses an ASP application so that so that you can identify the user across pages in the application. When session state is disabled, ASP does not track users and does not allow an ASP script to store information in the Session object or to use the Session_OnStart or Session_OnEnd events. A session automatically ends if the user has not requested or refreshed a page in an application by the end of the timeout period.

Session timeout

Set the timeout period for all inactive sessions on this system.

Session timeout controls the duration of the user's session, or more accurately, it controls the lifetime of the session object. A script can explicitly end a session by using the Session.Abandon method. Even when session state is enabled for an application, you can disable session state for an individual ASP page by using the <%@ ENABLESESSIONSTATE = False %> directive.

Enable buffering

Select to enable IIS to allow all output that is generated by an ASP page is to be collected before it is sent to the browser. When the page is displayed by the browser, all content is complete. Buffering output enables you to set HTTP headers from anywhere in an ASP script.

When the check box is cleared, output is returned to the browser as the page is processed, giving the page a "painted" image. You can override this option in a script by using the Response.Buffer method in your ASP scripts.

Enable parent paths

Select to allow ASP pages to use relative paths to the parent directory of the current directory (paths using the .. syntax).

If you enable this option, do not give the parent directories execute access because a script could execute an unauthorized program in a parent directory.

Default ASP language

Specify the primary script language for Active Server Pages, the language used to process commands within ASP delimiters (<% and %>).

ASP comes with two Microsoft® ActiveX® script engines: Microsoft Visual Basic® Scripting Edition (VBScript) and Microsoft Jscript® (JScript). The initial value of Default ASP language is VBScript. You can specify the name of any language for which an ActiveX script engine is installed on your server; be sure to use the exact keyword required for your engine as documented by your script engine provider. You can override the default language on an ASP page by using the <%@ LANGUAGE %> directive.

ASP script timeout

Specify the length of time ASP allows a script to run. You can set the timeout period to a value between 1 and 2147483647.

If the script does not finish running by the end of the timeout period, ASP stops the script and writes an event to the Windows event log. You can override this option in an ASP page by using the Server.ScriptTimeout method.

Enable Side by Side assemblies

Side-by-side (SxS) assemblies allow ASP applications to specify which version of a system DLL or classic COM component to use, such as MDAC, MFS, MSVCRT, MSXML, etc. For example, if your ASP application relies on MSXML, version 2.0, you can ensure that your application still uses MSXML, version 2.0 even after service packs are applied to the server. Any new version of MSXML is still installed on the computer, but version 2.0 remains and is used by your application. Configuring SxS assemblies requires that you know the path to the DLL, and that the COM+ manifest file exists in every virtual directory that needs to use the DLL.

Note  Shared DLLs must support SxS assemblies.

Manifest file name

Type the COM+ manifest file name. The COM+ manifest is an XML file that has information about where a DLL is installed. IIS does not verify that the manifest exists.

To view an excerpt from a manifest file, see
What’s New In ASP in IIS Help.

Related Topics

To learn more about Active Server Pages, see Web Application Guide in IIS Help.

To learn more about configuring applications, see Configuring Applications and Configuring Servers for Applications in IIS Help.


Application Configuration - Debugging Tab

Use this tab to set debugging options for Active Server Pages (ASP) that run in the currently selected application.

You can set two types of debugging flags that enable server-side and client-side script debugging. You can use the Microsoft® Script Debugger to troubleshoot ASP scripts while those scripts are being processed. Enabling ASP server-side debugging forces ASP to run in single-threaded mode. For performance reasons, ASP server-side or client-side debugging is not recommended in a production environment.

You can control when and what error messages are sent to the browser when an error is encountered in your ASP scripts. You can configure Internet Information Services (IIS) to send detailed error messages that contain specific debugging information (including the file name, error message, and line number) to the browser so that you can easily analyze the output. You can also configure IIS to send a default error message to the browser when any error prevents the Web server from processing the ASP page. A specific error message is written to the error log. Additionally, you can change the default error message by typing a message in the text box.

Enable ASP server-side script debugging

Select to enable the Web server to invoke the Microsoft Script Debugger while processing ASP pages.

Enable ASP client-side script debugging

Select to enable the client to invoke the Microsoft Script Debugger while processing ASP pages.

Send detailed ASP error messages to client

Click to enable IIS to send specific debugging information (including the file name, error message, and line number) to the browser.

Send the following text error message to client

Click to enable IIS to send a default error message to the browser when any error prevents the Web server from processing the ASP page. You can use the default error message or change it by typing a new message in the box.

Related Topics

To learn more about Active Server Pages, see Web Application Guide in IIS Help.

To learn more about configuring applications, see Configuring Applications and Configuring Servers for Applications in IIS Help.


Application Configuration - Cache Options Tab

Use this tab to set your application caching options. You can configure Internet Information Services (IIS) to not cache any Active Server Pages (ASP) files on the client. This forces the client browser to query the server for a new (or updated) page at each request. Although this process saves disk space on the client computer, performance is reduced. Caching ASP script files enhances performance because cached ASP scripts are not compiled each time they are called.

Do not cache ASP files

Click to ensure that no ASP files are cached by the browser.  As a result, every repeated request from the browser results in a fresh request of the ASP file from the server.

Cache all ASP files in memory

Click to ensure that all ASP files that have been requested by the browser from the server are cached on this computer. If you choose this option, you should identify a directory in the Disk cache directory box and set a limit for script engines cached in the Number of script engines cached box.

Cache limited ASP files in memory

Click to cache a limited number of compiled ASP files (templates) in memory. Type (or click the up and down arrows to set) the number of files you want to cache in the box. After you click this option, choose one of the following options to either cache all remaining ASP files or to cache a limited number of the remaining files on disk.

Cache remaining ASP files on disk

Click to cache all remaining compiled ASP files (those files not cached in memory) to disk.

Cache limited ASP files on disk

Click to cache a limited number of compiled ASP files (those files not cached in memory) to disk.

Disk cache directory

Type or browse to the target directory to house the ASP files.

Browse

Click to locate a directory on this computer to store cached ASP files.

Number of script engines cached

Type a number or click the up and down arrows to control the number of script engines cached. Script engines, such as Microsoft® Visual Basic® Scripting Edition (VBScript), require memory and accessibility. By limiting the number of script engines cached on your computer, you can better manage performance and memory.

Related Topics

To learn more about Active Server Pages, see Web Application Guide in IIS Help.

To learn more about caching ASP pages, including the metabase properties to use to perform these operations programmatically, see Configuring ASP Applications in IIS Help.

To learn more about configuring applications, see Configuring Applications and Configuring Servers for Applications in IIS Help.


Application Configuration - Process Options Tab

Use this tab to change settings for the applications running in a single process. You can use this tab to change settings for two types of processes: the Web server process and the isolated application processes. Options set for the Web site affect all applications running in the Web server process. Options set for an isolated application affect only that application.

Write unsuccessful client requests to event log

Select to configure IIS so that the Web server writes unsuccessful client requests to the Windows Event Log.

Enable debug exception catching

Select to configure IIS so that ASP sends a general error message when it cannot create an instance of an object provided by a COM component (a call to Server.CreateObject). When this option is not selected, ASP passes on the specific error message from the component. Do not select this option when you are debugging a component. When you have finished debugging, select the option again.

CGI script timeout

Set or change the timeout value, which is the amount of time a CGI script is given to execute and return a value before the operation is stopped. You can set application configuration properties at the Web site, virtual directory, or directory level.

Related Topics

To learn more about Active Server Pages, see Web Application Guide in IIS Help.

To learn more about configuring applications, see Configuring Applications and Configuring Servers for Applications in IIS Help.


Web Sites Properties - Service Tab

Use this tab to enable Internet Information Services (IIS) 5.0 isolation mode and HTTP compression.

Isolation mode

In IIS 6.0, the default process mode is worker process isolation. For backward compatibility, IIS 5.0 isolation mode is also available.

Run WWW service in IIS 5.0 isolation mode

Select to use IIS 5.0 isolation mode for applications that violate worker process isolation mode restrictions, such as the following:

•	Multi-instance ISAPIs:  ISAPI applications that are written to be loaded by multiple processes and run concurrently.

•	Out-of-worker process:  Applications that are written to farm out requests to other worker processes. This is not supported in worker process isolation mode.

•	Session state persisted in-process:  Applications that persist session state in process. Session state may be lost upon worker process recycling. This is not an issue for ASP.NET applications, which always persist state off-process.

HTTP compression

You can select the process to compress files before they are sent to compression-enabled clients. When a file is requested, the compressed copy is created and stored in a cache directory. This compressed file is sent when subsequent requests are received. Files are compressed only when they are requested.

Select to configure IIS to run your IIS applications in the same isolated process mode as IIS 5.0.

Compress application files

Select to configure IIS to compress application files before they are sent to a compression-enabled client to be cached. To compress application files, you must also select the Compress static files option.

Compress static files

Select to configure IIS to compress only static files before they are sent to a compression-enabled client to be cached.

Temporary directory

Type or browse to the path of the directory in which you want to cache the compressed files. The directory must be on an NTFS file system partition on the local hard disk and should not be shared or marked for compression.

Browse

Click to locate the directory path.

Unlimited

Click to configure IIS to not restrict the size of the cache directory where the compressed files are located.

Limited to

Click to configure IIS to limit the size of the cache directory where the compressed files are located.

Type the number of megabytes you want to limit the cache directory to in the adjacent box.

Related Topics

To learn more about IIS 5.0 isolation mode, see Isolation Modes in IIS Help.

To learn more about HTTP compression, see Utilizing HTTP Compression in IIS Help.


Web Site Properties - Web Site Tab

Use this tab to set a friendly name for your Web site, configure access to your Web site, set connection limits to your site, and enable logging and configure the logging format for your site.

Web site identification

In order for browsers to access your Web content, both an IP address and TCP port number must be defined.

Description

Type a friendly name for your Web site. The friendly name appears in the console tree of IIS Manager.

IP address

Assign an IP address from the list box or type a new IP address to be used for accessing this site. If you do not assign a specific IP address, this site responds to all IP addresses assigned to this computer and not assigned to other sites, which makes this the default Web site. For an IP address to appear in the list, the IP address must have already been defined for use on this computer in Control Panel. See Windows Server 2003 family Help for more information. The description of the site is not required.

TCP port

Assign the TCP port on which the Web service is running; the default for the Web service is port 80. You can change the port to any unique TCP port number, but if you change the port number, clients must know in advance to request that port number, or their requests fail to connect to your server. A port number is required; this text box cannot be left blank.

SSL port

Assign the SSL port that is to be associated with this Web site identity. The default SSL port number is 443. You can change the SSL port to any unique TCP port number, but to connect to your server, clients must know in advance to request that port number, in order to connect to your server. An SSL port number is required only if SSL encryption is used. Otherwise, if SSL encryption is not enabled for your site, the SSL Port box is unavailable.

Advanced

Click to further configure the IP address, TCP port number, and Host Header value that are used to access to your site.

Connections

You can set the length of time in seconds before the server disconnects an inactive user. This ensures that all connections are closed if the HTTP protocol fails to close a connection. Most Web browsers ask the server to keep the connection open across multiple requests. This is referred to as an HTTP Keep-Alive, an HTTP specification that allows for greatly enhanced server performance. Without it, a browser has to make numerous connection requests for a page containing multiple elements, such as graphics. A separate connection may need to be made for each element. These additional requests and connections require additional server activity and resources, decreasing server efficiency. Additional requests also make a browser much slower and less responsive, especially across a high-latency (slow) connection. HTTP Keep-Alives are enabled by default during the installation process.

Connection timeout

Type a number in the box to set the length of time in seconds before the server disconnects an inactive user. This ensures that all connections are closed if the HTTP protocol fails to close a connection.

Enable HTTP Keep-Alives

Select to enable a client to maintain an open connection with your server, rather than re-opening the client connection with each new request. Disabling Keep-Alives may degrade server performance.  HTTP Keep-Alives are enabled by default.

Enable Logging

Select this option to enable your Web site's logging features, which records details about user activity and creates logs in your choice of format.

The information is stored in ASCII files or an ODBC-compliant database. Logging information in IIS goes beyond the scope of the event-logging or performance-monitoring features of Microsoft ® Windows®. The logs can include information such as who has visited your site, what the visitor viewed, and when the information was viewed last. You can use the logs to assess content popularity or identify information bottlenecks.

Active log format

Select one of the following formats for the log files.

•	Microsoft IIS Log Format:  A fixed ASCII format.

•	NCSA Common Log File Format:  A fixed ASCII format.

•	ODBC Logging:  A fixed format logged to a database that is compatible with that database.

•	W3C Extended Log File Format:  A customizable ASCII format, selected by default. To use Process Accounting, the W3SVC Extended Log File format must be selected.

Properties

Click to configure options for log file creation (for example, weekly, or by file size), or to configure properties for W3C Extended logging or ODBC logging.

Related Topics

To learn more about naming Web sites, see Naming Web Sites in IIS Help.

To learn more about encrypting data with SSL, see Encryption in IIS Help.

To learn more about HTTP Keep-Alives, see Enabling HTTP Keep-Alives in IIS Help.

To learn more about logging site activity, see Logging Site Activity in IIS Help.


Advanced Web Site Identification

Use this dialog box to add additional Web site identities, or SSL identities to your computer.

A Web site identity consists of an IP address, TCP port, and an optional host header name, which associates a name with a single static IP address to host multiple sites. You add the host name to your name resolution system (typically DNS) so that when a request reaches the server, IIS uses the host name to determine which site the clients are requesting. This host name is passed in the HTTP header.

An SSL identity consists of an IP address and an SSL port number.

Multiple identities for this Web site

You can add, remove, or edit Web site identities for this Web site. A Web site identity consists of an IP address, TCP port, and an optional host header name. Each Web site must have a unique combination of identification characteristics. Therefore, while multiple Web sites can share two of their three identification characteristics, (IP address, TCP port, and host header name), they must have at least one characteristic that is different. Because SSL certificates contain the domain name in them, Web sites using certificates cannot share an IP address with other Web sites.

Add

Click to add a Web site identity.

Remove

Click to remove the currently selected Web site identity from the list.

Edit

Click to edit the currently selected Web site identity.

Multiple SSL identities for this Web site

You can add, remove, or edit SSL identities for this Web site. An SSL identity consists of an IP address and an SSL port number. An SSL identity is required only if SSL encryption is used. If SSL encryption is not enabled on your site, the Add, Remove, and Edit buttons are unavailable.

Add

Click to add an SSL identity for this Web site, which consists of an IP address and an SSL port number. The Advanced Web Site SSL Identification dialog box appears. The default port number for SSL is 443. If a port number, other than the default is used, your clients must know in advance to request that port number as part of the URL; otherwise their requests fail to connect properly to your server.

Remove

Click to remove the currently selected SSL identity from this Web site.

Edit

Click to edit the currently selected SSL identity for this Web site.

Related Topics

To learn more about naming Web sites, see Naming Web Sites in IIS Help.

To learn more about encrypting data with SSL, see Encryption in IIS Help.


Add/Edit Web Site Identification

Use this dialog box to configure the identity of your Web site. The Web site identity consists of an IP address, TCP port, and an optional host header name. For an IP address to appear in the list box, you first must associate the address with your computer. Host header names must be registered with the Domain Name System (DNS). A DNS server maps your registered host header name (domain name) to the IP address of your computer. The mapping of the host header name to the IP address of your computer enables requests that are addressed to your host header name to be routed to your computer.

IP Address

Select an IP address from the list box that you want to associate with this Web site. Only IP addresses that have been defined on this computer, using Control Panel, appear in the IP Address list box. If you do not assign a specific IP address, this Web site responds to all IP addresses assigned to this computer that are not assigned to other Web sites.

TCP port

This setting determines the TCP port on which the World Wide Web Publishing Service (WWW service) is running. The default port is 80. You can change the port to any unique TCP port number. However, to connect to your server, clients must know in advance to request that port number.

Host Header value

You can assign multiple host names, also referred to as domain names, to one computer using a single IP address. If the Web site requested in the host header is stopped, the client receives the default Web site. Therefore, Internet service providers (ISPs) should set the default Web site as the ISP home page, rather than a customer site.

Related Topics

To learn more about naming Web sites, see Naming Web Sites in IIS Help.

To learn more about how Web site identities are used to route client requests to your Web site, see Domain Name Resolution in IIS Help.


Logging Properties - General Tab

Use this tab to specify how log files are created and saved. A file name is displayed under the Log file directory box; this name is determined by the log file format and the criterion used for starting new log files.

New log schedule (common for all log formats)

Any changes to the log schedule defined takes effect immediately after applying the new settings.

Hourly

Click to create log files hourly.

Daily

Click to create log files daily, starting with the first entry that occurs after midnight.

Weekly

Click to create log files weekly, starting with the first entry that occurs after midnight Saturday.

Monthly

Click to create log files created monthly, starting with the first entry that occurs after midnight of the last day of the month.

Note "Midnight" is midnight local time. Midnight is used for all log file formats except W3C Extended format, which by default uses midnight Greenwich Mean Time, but can be specified as midnight local time (by selecting the Use local time for file naming and rollover option below).

Unlimited file size

Click to always append data to the same log file. You can access this log file only after stopping the server.

When file size reaches

Click to create a new log file when the current log file reaches a given size. Type or click the up and down arrows to specify the size you want.

Use local time for file naming and rollover (W3C-specific)

Select to set creation time and naming format for W3C Extended log files to midnight local time rather than Greenwich Mean Time.

Log file directory

Type or browse to the directory in which log files will be saved.

Browse

Click to locate the directory to which log files will be saved.

Related Topics

To learn more about logging site activity, see Logging Site Activity in IIS Help.


Logging Properties - Advanced Tab

Use this tab to customize W3C Extended logging by choosing the fields (items) to be recorded in the log. Where appropriate, the abbreviated field name appears after the proper name. To limit log size, omit unneeded fields.

Date

Select to record the date the activity occurred.

Time

Select to record the time the activity occurred.

Extended Properties

Client IP Address

Select to record the IP address of the client that accessed your server.

User Name

Select to record the name of the authenticated user who accessed your server. This does not include anonymous users, who are represented by a hyphen (-).

Service Name

Select to record the Internet service and instance number that was accessed by a client.

Server Name

Select to record the name of the server on which the log entry was generated.

Server IP

Select to record the IP address of the server on which the log entry was generated.

Server Port

Select to record the port number the client is connected to.

Method

Select to record the action the client was trying to perform (for example, a GET command).

URI Stem

Select to record the resource accessed (for example, an HTML page, a CGI program, or a script).

URI Query

Select to record the query, if any, the client was trying to perform; that is, one or more search strings for which the client was seeking a match.

Protocol Status

Select to record the status of the action, in HTTP or FTP terms.

Protocol Substatus

Select to record additional status of the action, in HTTP terms. For more information about the Protocol Substatus property, see Substatus Error Codes in IIS Log Files in IIS Help.

Win32 Status

Select to record the status of the action, in terms used by the Microsoft® Windows® operating system.

Bytes Sent

Select to record the number of bytes sent by the server.

Bytes Received

Select to record the number of bytes received by the server.

Time Taken

Select to record the length of time the action took to complete. For all log formats except ODBC logging, Time Taken is logged in milliseconds, according to the following technical breakdown: The client-request timestamp is initialized when HTTP.sys (the kernel-mode driver) receives the first byte (before HTTP.sys begins parsing the request). The client-request timestamp is stopped when the send completion occurs (for the last send) in IIS. Time Taken does not reflect time across the network. Also note, the first request to the site shows a slightly longer time taken than other similar/same requests because HTTP.sys opens the log file with the first request.

Protocol Version

Select to record the protocol (HTTP, FTP) version used by the client. For HTTP, this is either HTTP 1.0 or HTTP 1.1.

Host

Select to record the content of the host header.

User Agent

Select to record the browser used on the client.

Cookie

Select to record the content of the cookie sent or received, if any.

Referrer

Select to record the previous site visited by the user. This site provided a link to the current site.

Related Topics

To learn more about W3C Extended logging, see Customizing W3C Extended Logging in IIS Help.

To learn more about logging site activity, see Logging Site Activity in IIS Help.


Web and FTP Site ODBC Logging Properties - ODBC Properties Tab

Use this tab to identify the data source, the table within that data source (if applicable), and the access to that data source, meaning the user name and password. A data source can be any ODBC-compliant file, such as a database or comma-delimited file.

•	Use this tab to set ODBC logging options. Before you can begin ODBC logging from IIS, do the following:

•	Use ODBC-compliant database software (such as Microsoft® Access or Microsoft SQL® Server) to create a database.

•	Within the database, create a table containing the fields listed at the end of this topic.

•	Create a Data Source Name (DSN). For more information, see Windows Server 2003 family Help.

•	Supply IIS with the DSN and Table name by using this dialog box.

•	If required, supply a user name and password for accessing the database.

ODBC Data Source Name (DSN)

Type the name of the data source to which you want to connect. When created, this name is recorded in the ODBC Data Source Administrator, which is accessed through Administrative Tools.

Table

Type the name of the table in the ODBC Data Source specified above.

User Name

Type the alias of the user permitted to access this data source and table.

Password

Type the password associated with the user name specified above.

Related Topics

To learn more about ODBC logging, see the “ODBC Logging”  section in About Logging Site Activity in IIS Help.

To learn more about logging site activity, see Logging Site Activity in IIS Help.


Web Site Properties - Performance Tab

Use this tab to set properties that affect bandwidth use, and the number of client Web connections. By configuring network bandwidth on a given site, you can better control the amount of traffic allowed to that site. For example, by restricting bandwidth and/or the number of connections on a low-priority Web site, you allow other, higher-priority sites to handle larger traffic loads. Settings are site-specific and can be adjusted as network traffic and usage changes.

Bandwidth throttling

Bandwidth throttling limits the bandwidth available to this Web site. Bandwidth throttling uses Packet Scheduler to manage when data packets are sent. When you configure a site to use bandwidth throttling using IIS Manager, Packet Scheduler is automatically installed, and IIS automatically sets bandwidth throttling to a minimum of 1024 bytes/second. However, if you use another method (for example, Active Directory® Service Interfaces [ADSI] or Windows Management Instrumentation [WMI]), you must install Packet Scheduler for bandwidth throttling to work correctly.

Limit the network bandwidth available to this Web site

Select to enable bandwidth throttling on this Web site.

Maximum bandwidth

Type a number in the box or click the up and down arrows to set the maximum bandwidth, in kilobytes per second, that you want to be available to this Web site.

Web site connections

You can configure Internet Information Services (IIS) to allow an unlimited number of concurrent connections, or to limit the number of connections it accepts for this Web site. Setting the number to an unlimited amount circumvents constant administration if your connections tend to fluctuate. However, system performance can be impacted if the number of connections exceeds your system resources. Restricting this site to a specified number of connections can keep performance stable. Settings are site-specific and can be adjusted as network traffic and usage changes.

Unlimited

Click to configure this Web site to handle an unlimited number of concurrent connections.

Connections limited to

Click to set a specific number of concurrent connections to this Web site. Type a number in the box or click the up and down arrows to set the number of connections.

Related Topics

To learn more about the bandwidth throttling feature, see Throttling Bandwidth in IIS Help.

To learn more about limiting simultaneous connections to a Web site, see Limiting Connections in IIS Help.

To learn more about the role of the performance management, see Performance Tuning in IIS Help.


Web Site Properties - ISAPI Filters Tab

Use this tab to set options for ISAPI filters. An ISAPI filter is a program that responds to events during the processing of an HTTP request. The table lists each filter's status (which can be enabled or disabled), file name, and priority for loading into memory. You can change the execution order of filters only with the same priority.

Important  If you have added or changed a filter at the global level, you must restart Internet Information Services (IIS) to load the new filter. If you have added or changed a filter at the Web site level, the filter is not loaded until a request is made to the Web site.

Add

Click to add an existing ISAPI filter by browsing for the executable file and providing a friendly name.

Remove

Click to remove the currently selected ISAPI filter from this load list.

Edit

Click to modify the properties of the currently selected ISAPI filter.

Disable

Click to prevent the currently selected ISAPI filter from loading, but keep it in the filter list.

Move up

Click to move the currently selected filter higher in the execution order.

Move down

Click to move the currently selected filter lower in the execution order.

Related Topics

To learn more about ISAPI filers, see Installing ISAPI Filters in IIS Help.


Add/Edit Filter Properties

Use this dialog box to establish ISAPI filter properties. An ISAPI filter is a program that responds to events during the processing of an HTTP request.

Filter Name

Type a friendly name for the ISAPI filter. Friendly names often include version numbers to ensure proper updates with future versions of the filter.

Executable

Type the full path to the executable program associated with this ISAPI filter.

Browse

Click to locate the ISAPI filter.

Related Topics

To learn more about ISAPI filers, see Installing ISAPI Filters in IIS Help.


Add New Application Pool

Use this dialog box to add a new application pool. An application pool is a set of one or more applications assigned to a set of one or more worker processes. Because pools are separated by process boundaries, an application in one pool is not affected by problems caused by applications in other pools.

Application pool ID

Type the ID tag for the application pool you are creating.

Use default settings for new application pool

Establish master settings by right-clicking the Applications Pools directory in the console tree of IIS Manager, and then clicking Properties. All application pool settings established at this level are considered master settings. These settings are propagated into all application pools contained in the directory.

Use existing application pool as template

Click to inherit the settings of an existing application pool on the application pool you are creating. The existing application pool settings act as a template for the application pool you are creating.

Application pool name

Identify the friendly name of the existing application pool to be used as a template for the application pool you are creating.

Related Topics

To learn more about application pools, see How to Create an Application Pool in IIS Help.


Application Pools - Recycling Tab

Use this tab to administrate the recycling of worker processes. In worker process isolation mode, you can configure IIS to periodically restart worker processes in an application pool, allowing you to manage precisely those worker processes that are faulty. This ensures that specified applications in those pools remain healthy, and that system resources can be recovered.

To recycle a worker process, the ability of the faulty worker process to receive requests is throttled until it completes processing of all remaining requests that it has stored in the request queue. To drain its current requests, the process is given a configured limit. A replacement worker process for the same namespace group starts before the old worker process stops. This prevents service interruptions. The old process completes its outstanding requests, and then shuts down normally or is explicitly terminated if it does not shut down after a configurable time limit, number of requests, on a set schedule, or when a specified limit of memory usage is reached.

Recycle worker processes (in minutes)

Select to recycle worker processes after a specific period of inactivity.

Recycle worker process (number of requests)

Select to recycle worker processes after a specific number of requests.

Recycle worker processes at the following times

Select to use a scheduling scheme to shut down a process and start a replacement.

Add

Click to add a time of day to the scheduled-based worker process recycling criteria.

Remove

Click to remove the currently selected scheduled-based criteria for worker process recycling.

Edit

Click to modify the currently selected scheduled-based criteria for worker process recycling.

Recycle worker process after consuming too much memory

This option allows use of a memory consumption limit scheme to shut down a process and start a replacement. These settings control the memory recycling thresholds when the amount of virtual memory or private memory used by a worker process becomes too high in relation to total system memory. Memory-based recycling is suited for reducing heap fragmentation and recovering memory from applications with memory leaks.

Maximum virtual memory

Select to set the maximum number of megabytes of your system’s common virtual memory to be used by a worker process before that process is recycled.

Entering too high a value can severely decrease system performance. As a starting point, use the default value and work down to the lowest value possible while maintaining good performance.

Maximum used memory

Select to set the maximum number of megabytes of privately allocated system physical memory to be used by a worker process before the process is recycled.

Entering too high a value can severely decrease system performance. As a starting point, use the default value and work down to the lowest value possible while maintaining good performance.

Related Topics

To learn more about worker processes and recycling, see Recycling Worker Processes in IIS Help.


Application Pools Properties - Performance Tab

Use this tab to configure the way that Internet Information Services (IIS) shuts down idle worker processes, the number of requests waiting to be processed, CPU monitoring, and the number of processes in a Web garden.

Idle timeout

Idle timeout limits helps conserve system resources by terminating unused worker processes by gracefully closing idle processes after a specified idle duration. This allows you to better manage the resources on particular computers when the processing load is heavy, when identified applications consistently fall into an idle state, or when new processing space is not available.

Shutdown worker processes after being idle for (time in minutes)

Select to terminate any idle worker processes after a specific period of inactivity.

Type a number in the box, or click the up and down arrows, to set the amount of minutes before an idle worker process terminates.

Request queue limit

Select to configure IIS to monitor the number of requests for a designated application pool queue before queuing a new request.

Application pool queue length limits prevent large numbers of requests from queuing up and overloading your server. If adding the new request to the queue exceeds the capacity of the queue, the server rejects the request and sends a non-customizable 503-error response to the client.

Limit the kernel request queue (number of requests)

Select to configure IIS to use a numeric-based scheme for limiting incoming HTTP requests and allow you to limit the size of the request queue. When the limit is reached, IIS does not process those additional requests, but sends a non-customizable 503-error response to the client.

Type a number in the box, or click the up and down arrows, to set the limit for the number of requests allowed in the queue.

Enable CPU monitoring

Select to configure IIS to use CPU accounting to track and terminate worker processes that consume large amounts of CPU time that exceed the specified limits. CPU monitoring is available only for applications pools and does not apply to CGI applications.

Maximum CPU use (percentage)

Type a number in the box, or click the up and down arrows, to set the percentage of CPU usage a worker process is permitted to use.

Refresh CPU usage numbers (in minutes)

Type a number in the box, or click the up and down arrows, to set how often CPU process numbers are to be refreshed in order to be used by CPU monitoring.

Action performed when CPU usage exceeds maximum CPU use

From the list box, click the best action to perform when the CPU exceeds its specified maximum usage.

•	If No action is selected, when the CPU usage for a specific application pool or group of pools reaches the set limit, IIS writes an error in the Event Log.

•	If Shutdown is selected, when the CPU usage for a specific application pool reaches the set limit, IIS initiates a shutdown of all worker processes in the application pool by allowing each worker process the application pool's specified ShutdownTimeLimit seconds to shut down. If the processes do not shut down in that time frame, IIS terminates the worker processes. The application pool shuts down and resets according to the time limit set in CPUResetInterval.

Web garden

A Web garden is an application pool using more than one worker process.

Maximum number of worker processes

Type a number in the box, or click the up and down arrows, to set the maximum number of worker processes allowed within an application pool.

Related Topics

To learn more about the timeout and CPU features, see Quality of Service in IIS Help.

To learn more about Web gardens, see Configuring Web Gardens in IIS Help.


Application Pools Properties - Health Tab

Use this tab to configure worker processes health monitoring. You can set limits for communicating with the worker processes, determine a course of action if a number of processes rapidly fail, and set startup and shutdown times.

Enable pinging

Select to configure Internet Information Services (IIS) to ping each worker process in an application pool every specified number of seconds to detect the activity of the processes.

IIS monitors the health of worker processes by periodically pinging them to determine their responsiveness. If worker processes fail to respond to a ping, the worker process is terminated and a replacement worker process is created.

Ping worker process every (frequency in seconds)

Type a number in the box, or click the up and down arrows, to set the time interval, in seconds, when worker processes are pinged for activity.

Enable rapid-fail protection

Select to configure IIS to remove this application pool from service and place it in a mode where the kernel-mode driver immediately returns a 503 Service Unavailable - out-of-service message to any requests to that application pool.

Rapid-fail protection protects your Internet service from widespread interruptions by detecting and isolating application pools where worker processes are rapidly failing.

Failures

Type a number in the box, or click the up and down arrows, to set a numerical limit on unexpected program terminations. This must be set in conjunction with the Time period setting.

Time period (time in seconds)

Type a number in the box, or click the up and down arrows, to set a time limit in which to detect the corresponding number of unexpected program terminations. This must be set in conjunction with the Failures setting.

Startup time limit

Worker process must startup within (time in seconds)

Type a number in the box, or click the up and down arrows, to set the worker process startup time in seconds.

Shutdown time limit

Worker process must shutdown within (time in seconds)

Type a number in the box, or click the up and down arrows, to set the worker process termination time, in seconds, after IIS detects inactivity.

Related Topics

To learn more about rapid fail protection, see Application Pool Health in IIS Help.


Application Pools Properties - Identity Tab

The identity of an application pool is the name of the account under which an application pool's worker process runs. By default, application pools operate under the NetworkService account, which has the least user rights that are required to run Web applications. This account provides the most security against attackers who might attempt to take over the computer on which the World Wide Web Publishing Service (WWW service) is running. You can configure application pools to run as LocalSystem, which is an account with more assigned user rights than the NetworkService account; however, running an application pool under an account with more user rights assigned presents a more serious security risk.

For example, suppose that an Internet service provider (ISP) wants to allow customers to upload Common Gateway Interface (CGI) applications and then add them to an application pool. Running the CGI-enabled applications in a separate application pool under the NetworkService account—with its minimal user rights—prevents these applications from being used to take over the server.

Predefined

Click any of the predefined security accounts in the list box.

Configurable

Click to configure your own application pool security by specifying the identity with a user name and the associated password. If you use a custom user account, that account must be part of the IIS_WPG group, or the application pool will fail.

User name

Type the alias of the user permitted to access this data source and table.

Password

Type the password that is associated with the user name specified above.

Browse

Click to view a list of available Windows user accounts on this server.

Note In previous versions of IIS, worker processes ran under the LocalSystem account. Because the LocalSystem account has access to almost all resources, this can have serious security implications. For better security, the IIS 6.O default is to run worker processes under the newly built-in NetworkService account. IIS 6.0 also allows you to configure the account on which worker processes run.

Related Topics

To learn more about the NetworkService account and the LocalSystem account in IIS, see Configuring Worker Process Identity in IIS Help.


Add/Edit Web Site SSL Identification

Use this dialog to configure the Web site Secure Sockets Layer (SSL) identity for this Web site. The Web site SSL identity consists of an IP address and an SSL port number. Only IP addresses that have been defined on this computer, using Control Panel, appear in the IP Address list box. Only one SSL connection per IP address is allowed.

IP address

Select an IP address from the list box that will is to be associated with the SSL connection to this Web site.

SSL port

Specify the port number used for SSL (Secure Sockets Layer) encryption, enter the port number in the SSL Port text box. The default port used for SSL is port is 443. You can change the port to any unique port number, but if you change the port number, clients must know in advance to request that port number, or their requests fail to connect to your server.

Related Topics

To learn more about encrypting data with SSL, see Encryption in IIS Help.

To learn more about naming Web sites, see Naming Web Sites in IIS Help.

To learn more about how Web site identities are used to route client requests to your Web site, see Domain Name Resolution in IIS Help.


Secure Communications

Use this dialog box to configure Secure Sockets Layer (SSL) settings for encrypted communication. When a Web browser supporting secure communications connects to a Web site configured to use SSL (URLs starting with https:// ), a secure connection protects the data being transferred. A client certificate is a digital identification issued by a trusted, third-party organization, referred to as a certification authority. You can configure your Web server to accept, require, or reject client certificates as a means of establishing a connection with a particular file or directory. Users attempting to access a site with client certificates can be mapped; users without client certificates can use other authentication methods. Client certificate mappings match information contained in a client's certificate against Windows user account information. A certificate trust list (CTL) is a list of approved certification authorities for a particular Web site.

Require secure channel (SSL)

Select to configure IIS to require an encrypted communication link for a Web browser to connect with this Web site, directory, or file. When this option is selected, all data sent to and from this Web site is encrypted using a certificate.

Require 128 bit encryption

Select to configure IIS to require a 128-bit encrypted communication link for a Web browser to connect with this Web site, directory, or file.

Ignore client certificates

Select to allow users access to this site without being prompted to present a client certificate.

Accept client certificates

Select to allow access for users with client certificates, without requiring the certificate. Users with client certificates can be mapped; users without client certificates can use other authentication methods.

Require client certificates

Select to allow only users with a valid client certificate to connect. Users without a valid client certificate are denied access to this site. Before you can select this option to require client certificates, you must select the Require secure channel (SSL) option.

Enable client certificate mapping

Select to configure your server to authenticate users who log on with a valid client certificate.

Edit

Click to edit or, if no certificate mapping exists, create a client certificate mapping. When a user logs on to your Web site with a certificate, their permissions match those of the user account to which the certificate is mapped.

Enable the Windows directory service mapper

Select to use Directory Service client-certificate mapping rather than one-to-one or many-to-one mapping. To enable this service, the server must be a member of the Windows Server 2003 domain.

Enable certificate trust lists

Select to edit existing CTLs or create a new one. A CTL is a list of approved certification authorities for a particular Web site and are applicable only at the Web-site level.

Current CTL

Click a CTL for this site from the list box.

New

Click to create a new CTL for this site.

Edit

Click to change the settings of the currently selected CTL in the list box.

Related Topics

To learn more about certificate mapping, see Client Certificate Mapping in IIS Help.

To learn more about certificates, see Certificates in IIS Help.


Secure Communications - Account Mappings 1-to-1 Tab

Use this tab to edit one-to-one mappings. One-to-one mappings require the Web server to have access to a text (ASCII) copy of the user's client certificate. The Web server compares the copy of the client certificate it holds with the client certificate sent by the browser. For the mapping to proceed, the two must be absolutely identical. If a client gets another certificate containing all of the same user information, it must be mapped again. To map multiple certificates to a single account, you must define a one-to-one mapping for each client certificate. For use in IIS one-to-one mapping, some certificates need to be exported using Internet Explorer.

Edit Map

Click to edit the currently selected mapping.

Add

Click to map a client certificate to a Windows user account.

Delete

Click to delete the currently selected mapping you created, and not the client certificate.

Related Topics

To learn more about certificate mapping, see Client Certificate Mapping in IIS Help.

To learn more about certificates, see Certificates in IIS Help.


Secure Communications - Account Mappings Many-to-1 Tab

Use this tab to enable many-to-one mapping. Many-to-one mapping uses wildcard matching rules that verify whether a client certificate contains specific information, such as issuer or subject. This mapping does not compare the actual client certificate, but rather accepts all client certificates fulfilling the specific criteria. If a client gets another certificate containing all of the same user information, the existing mapping will still works. You can list matching rules for a certificate by clicking the Rule Description header, or list the matching rules by the account they are mapped to, by clicking the Mapped Windows Account header. Certificates do not need to be exported for use in many-to-one mapping.

Important  To ensure that changes to matching rules are enacted, stop and restart the Web site.

Enable Wildcard Client Certificate Matching

Select to configure IIS by enabling custom matching rules that check whether client certificate fields match pre-defined criteria.

Edit Rule

Click to modify the currently selected matching rule.

Add

Click to create a custom rule for checking a client certificate's fields for specific information before mapping the certificate to a Windows user account.

Delete

Click to remove the currently selected custom matching rule. To select multiple mappings, either press the CTRL key while selecting individual accounts, or press the SHIFT key while selecting a range of accounts.

Move Up

Click to move the currently selected rule higher in the matching rules list. Moving a rule higher in the list gives it a higher priority.

Move Down

Click to move a rule lower in the matching rules list. Moving a rule lower in the list gives it a lower priority.

Note If two rules that are defined for the same certificate criteria conflict, the rule with the higher priority is used, and the other rule is ignored. You can list the rules either by their names, by clicking on the Rule Description header, or by the account they are mapped to, by clicking the Mapped Windows Account header.

Related Topics

To learn more about certificate mapping, see Client Certificate Mapping in IIS Help.

To learn more about certificates, see Certificates in IIS Help.


Edit Wildcard Mapping Rule - General Tab

Use the Edit Wildcard Mapping Rule dialog box and its associated tabs to create custom rules for mapping client certificates to Windows user accounts. The editor allows you to define whether certain client certificate fields match pre-defined criteria. Client certificates can contain identification information, such as company names, localities, or e-mail addresses, formatted into arrangements of fields and subfields.

You can create rules at any time but defer enabling to a later time.

The General tab contains the following elements:

Enable this wildcard rule

Select to configure IIS to enable the currently selected wildcard rule.

Description

Type an optional comment in the box.

Related Topics

To learn more about certificate mapping, see Client Certificate Mapping in IIS Help.

To learn more about certificates, see Certificates in IIS Help.


Edit Wildcard Mapping Rule - Rules Tab

Use this tab to create matching rules that check whether certain client certificate fields match pre-defined criteria. If a field or subfield matches the criteria, the certificate is mapped to a Windows user account. Click the Certificate Field, Sub Field, or Match Criteria column header to sort the list by that type of information.

Edit

Click to modify the currently selected certificate field and its match criteria.

New

Click to create a new certificate field and its match criteria with the Edit Rule Element dialog box.

Delete

Click to delete the currently selected certificate field and match criteria.

Related Topics

To learn more about certificate mapping, see Client Certificate Mapping in IIS Help.

To learn more about certificates, see Certificates in IIS Help.


Edit Rule Element

Use this dialog box to create or edit elements of a matching rule. Client certificates can contain identification information, such as company names, localities, or e-mail addresses, formatted into arrangements of fields and subfields. Your Web server can use this identification information to map the user's identity to a Windows user account.

Field names represent general categories of information, such as (Client) Subject and Issuer. For more information about the fields and subfields of a certificate, see the documentation for the certification authority that issued that certificate.

Subfield names represent information specific to each of the general Subject and Issuer categories. The following list describes basic subfields contained in a certificate:

(O) Organization

The top-level organization or company name, preferably International Organization for Standardization (ISO)-registered.

(OU) Organization Unit

A department within a company, (for example, Marketing).

(CN) Common Name

The domain name of the server, (for example, www.microsoft.com).

(C) Country/Region

Two-letter ISO country/region designation (for example, US, FR, AU, or UK).

(S) State or Province

The full, unabbreviated name of the state or province (for example, Washington instead of WA or Alberta instead of AB).

(L) Locality

The full name of the city where your company is located (for example, Redmond or Toronto).

Several non-standard subfield categories are supported as well, including the following:

(I) Inititals

Initials of the certificate owner.

(GN) Given Name

Given name of the certificate owner.

(T) Title

Title of the certificate owner.

(Email)

E-mail address of the certificate owner.

Consult a certification authority to obtain updated subfield information.

Match Capitalization

Select to configure IIS to make your rule element case sensitive.

Certificate Field

Click a certificate field element of a matching rule from the list box. Select this element before selecting the other elements in this dialog box.

Sub Field

Click a sub-element of the certificate field of a matching rule from the list box. Select an element from the Certificate Field list box first in order to view the entire valid list of valid subfields.

Criteria

Specify the criteria for matching field and subfield information. For example, if the subfield is "O", the criteria could be "Microsoft" to indicate to which organization the matching rule should correspond. You can use the wildcard character (*) to partially specify the text of your criteria.

Related Topics

To learn more about certificate mapping, see Client Certificate Mapping in IIS Help.

To learn more about certificates, see Certificates in IIS Help.


Edit Wildcard Mapping Rule - Mapping Tab

Use this tab to specify what action to take when a Web client sends a certificate that matches the criteria specified on the preceding tabs. You can refuse access to the Web site or map the identity of the user to a specific Windows user account.

Accept this certificate for Logon Authentication

Click to configure IIS to allow access to resources on this Web site for any certificate matching the specified rules.

Refuse Access

Click to configure IIS to refuse access to resources on this Web site for any certificate matching the specified rules.

Account

Type the Windows user account to be used as the client's identity.

Browse

Click to view a list of available Windows user accounts on this server. If you find the account that you want to use as the client's identity while navigating this Web site, click the account name in the list. The name is entered in the Account box.

Password

Type the password of the Windows user account listed in the Account box. If you change the password in Windows, you must also change it here.

Apply

Click to complete the creation of the certificate account mapping.

Related Topics

To learn more about certificate mapping, see Client Certificate Mapping in IIS Help.

To learn more about certificates, see Certificates in IIS Help.


Web Site Properties - Home Directory Tab

Use this property sheet to create and manage Web sites on your IIS server. The settings on this tab are similar to those available on the Home Directory tab of virtual directories.

Setting up local or network paths allows the request to be directed to the correct physical location. You can further configure the physical location by setting user access rights, choosing whether to log requests for these resources, and choosing whether to index this site using the Indexing Service. To specify when the request is received, applications must be identified, located, and given the appropriate execute permissions and protection.

The content for this resource should come from

This setting allows you to define the location of the home directory for this Web site.

A directory located on this computer

Click to permit users to access a specified directory on this computer to view or update Web content. You can type the directory name in the Local path text box. You can control access to the contents by implementing any Windows security method.

A share located on another computer

Click to permit users to view or update Web content on another computer that has an active connection to this computer. If you have administrative credentials on the remote computer, you can control access to the contents by implementing any Windows security method. When selected, you can enter the server name and directory name in the Network Directory box. Click Connect As to enter network user name and password information.

A redirection to a URL

Click to redirect the client application, such as a browser, to another Web site or virtual directory by entering a URL in the Redirect to box. When selected, redirect options are substituted for path options.

If you click either A directory located on this computer or A share located on another computer, the following options are available:

Local path

When content comes from a directory located on this computer, this box displays the path to the directory that stores your Web site files. By default, these files are stored in the %localdrive%\inetpub\wwwroot directory.

Browse

Click to locate the directory path.

Network directory

When content comes from another computer on the network, this box displays the computer name and share name of the content location.

Connect as

When content comes from another computer on the network, click to provide a user name and password for access to the network share.

Script source access

Select to allow users to access source code if either Read or Write permissions are set. Source code includes scripts in ASP applications.

Read

Select to allow users to read or download files or directories and their associated properties.

Write

Select to allow users to upload files and their associated properties to the enabled directory on your server or to change content in a Write-enabled file. Write access is allowed only when a browser that supports the PUT feature of the HTTP 1.1 protocol standard.

Directory browsing

Select to allow users to see a hypertext listing of the files and subdirectories in this virtual directory. Because virtual directories do not appear in directory listings, users must know a virtual directory's alias. If Directory browsing is disabled and the user does not specify a file name, the Web server displays an "Access Forbidden" error message in the user's Web browser.

Log visits

Select to configure IIS to record visits to this directory in a log file. Visits are recorded only if logging is enabled for this Web site.

Index this resource

Select to allow the Microsoft Indexing Service to include this directory in a full-text index of your Web site.

Note  Before setting this option, you must enable the Indexing Service through the Add or Remove Programs item in Control Panel.

Application name

Type the name of the root directory that contains the files and subdirectories of an application.

Starting point

This displays the metabase node where the application is configured.

Execute permissions

This option determines the program execution level allowed for this site's resources.

•	Set permissions to None to restrict access only to static files such as HTML or image files.

•	Set permissions to Scripts to allow only scripts to run, not executables.

•	Set permissions to Scripts and Executables to remove all restrictions so that all file types can be accessed or executed.

Application pool

Click the application pool in the list box that is associated with this home directory.

Remove/Create

Click to remove an application, or to create an application from the Web site while leaving the virtual directory intact.

Configuration

Click to configure application mappings, options, and debugging features.

Unload

Click to unload an isolated application from memory, or to unload a pooled application not referenced by any other application.

If you click A redirection to a URL, the following options are available:

Redirect to

Type a fully qualified URL from which the content will be served.

The exact URL entered above

Select to redirect a virtual directory to the destination URL without adding any other portions of the original URL. You can use this option to redirect an entire virtual directory to one file. For example, to redirect all requests for the /scripts virtual directory to the Default.htm file in the home directory, type /Default.htm in the Redirect to box and select this option.

A directory below URL entered

Select to redirect a parent directory to a child directory. For example, to redirect your home directory (designated by /) to a subdirectory named /newhome, type /newhome in the Redirect To box and select this option. Without this option, the Web server will continually map the parent to itself.

A permanent redirection for this resource

Click to send the following message to the client: "301 Permanent Redirect." Redirects are considered temporary, and the client browser receives the following message: "302 Temporary Redirect." Some browsers can use the "301 Permanent Redirect" message as the signal to permanently change a URL, such as a bookmark.

Related Topics

To learn more about the home directory, see Setting the Home Directory in IIS Help.

For a listing of redirect variables and redirect wildcards, see Redirect Reference in IIS Help.

To learn more about configuring applications, see Configuring Applications and Configuring Servers for Applications in IIS Help.


Network Directory Security Credentials

Use this dialog box to establish security credentials for access to the network share from which content is to be served.

Note The User name and Password boxes are not available if the Always use the authenticated user’s credentials when validating access to the network directory option at the bottom of the dialog box is selected. To establish a user name and password for all users when accessing this share, clear this check box.

User name

Type a user name. This name is used for all client connections to the remote share.

Password

Type a password. This password is used for all client connections to the remote share.

Browse

Click to locate the directory path.

Always use the authenticated user’s credentials when validating access to the network resource.

When this option is selected, connection attempts to the remote share are validated against the currently logged-on user’s name and password. When this option is cleared, all client connections to the remote share use the specific user name and password entered.

Related Topics

To learn more about directory security, see Access Control in IIS Help.


Web Site Virtual Directory Properties - Virtual Directory Tab

Use this tab to create and manage virtual directories on your Web site. Virtual directories are pointers to Web files and Web folders that are stored on your computer and are used for content management. Configuring virtual directories is similar to configuring Web sites.

Setting up local or network paths allows the request to be directed to the correct physical location. You can further configure the physical location by setting user access rights, choosing whether to log requests for these resources, and choosing whether to index this site using the Indexing Service. To specify when the request is received, applications must be identified, located, and given the appropriate execute permissions and protection.

The content for this resource should come from

This setting allows you to define the location of the content for this virtual directory.

A directory located on this computer

Click to permit users to access a specified directory on this computer to view or update Web content. You can type the directory name in the Local path text box. You can control access to the contents by implementing any Windows security method.

A share located on another computer

Click to permit users to view or update Web content on another computer that has an active connection to this computer. If you have administrative credentials on the remote computer, you can control access to the contents by implementing any Windows security method. When selected, you can enter the server name and directory name in the Network Directory box. Click Connect As to enter network user name and password information.

A redirection to a URL

Click to redirect the client application, such as a browser, to another Web site or virtual directory. When selected, redirect options are substituted for path options.

If you click either A directory located on this computer or A share located on another computer, the following options are available:

Local path

When content comes from a directory located on this computer, this box displays the path to the directory that stores your Web site files. By default, these files are stored in the %localdrive%\inetpub\wwwroot directory.

Browse

Click to locate directory path.

Script source access

Select to allow users to access source code if either Read or Write permissions are set. Source code includes scripts in ASP applications.

Read

Select to allow users to read or download files or directories and their associated properties.

Write

Select to allow users to upload files and their associated properties to the enabled directory on your server or to change content in a Write-enabled file. Write access is allowed only when a browser that supports the PUT feature of the HTTP 1.1 protocol standard.

Directory browsing

Select to allow users to see a hypertext listing of the files and subdirectories in this virtual directory. Because virtual directories do not appear in directory listings, users must know a virtual directory's alias. If Directory browsing is disabled and the user does not specify a file name, the Web server displays an "Access Forbidden" error message in the user's Web browser.

Log visits

Select to configure IIS to record visits to this directory in a log file. Visits are recorded only if logging is enabled for this Web site.

Index this resource

Select to allow the Microsoft Indexing Service to include this directory in a full-text index of your Web site.

Note  Before setting this option, you must enable the Indexing Service through the Add or Remove Programs item in Control Panel.

Application name

Type the name of the root directory that contains the files and subdirectories of an application.

Starting point

This displays the metabase node where the application is configured.

Execute permissions

This option determines the program execution level allowed for this site's resources.

•	Set permissions to None to restrict access only to static files such as HTML or image files.

•	Set permissions to Scripts to allow only scripts to run, not executables.

•	Set permissions to Scripts and Executables to remove all restrictions so that all file types can be accessed or executed.

Application pool

Click the application pool from the list box that is associated with this home directory.

Remove/Create

Click to remove an application, or to create an application from the Web site while leaving the virtual directory intact.

Configuration

Click to configure application mappings, options, and debugging features.

Unload

Click to unload an isolated application from memory, or to unload a pooled application not referenced by any other application.

If you click A redirection to a URL, the following options are available:

Redirect to

Type a fully qualified URL from which the content will be served.

The exact URL entered above

Select to redirect a virtual directory to the destination URL without adding any other portions of the original URL. You can use this option to redirect an entire virtual directory to one file. For example, to redirect all requests for the /scripts virtual directory to the Default.htm file in the home directory, type /Default.htm in the Redirect to box and select this option.

A directory below URL entered

Select to redirect a parent directory to a child directory. For example, to redirect your home directory (designated by /) to a subdirectory named /newhome, type /newhome in the Redirect To box and select this option. Without this option, the Web server will continually map the parent to itself.

A permanent redirection for this resource

Click to send the following message to the client: "301 Permanent Redirect." Redirects are considered temporary, and the client browser receives the following message: "302 Temporary Redirect." Some browsers can use the "301 Permanent Redirect" message as the signal to permanently change a URL, such as a bookmark.

Related Topics

To learn more about logging site activity, see Logging Site Activity in IIS Help.

To learn more about directory security, see Access Control in IIS Help.


Virtual Directory Properties - Virtual Directory for File Tab

Use this tab to create and manage virtual directories on your Web site. Virtual directories are pointers to Web files and Web folders that are stored on your computer and are used for content management. Configuring virtual directories is similar to configuring Web sites. Content for the virtual directory can come from one of the following sources:

The content for this resource should come from

This setting allows you to define the location of the content for this virtual directory.

The designated file

Click to specify the default file initially displayed on the client or run on the server when the browser requests that site. You can control access to this file by implementing any Windows security method.

A redirection to a URL

Click to redirect the client application, such as a browser, to another Web site or virtual directory. When selected, redirect options are substituted for path options.

Local path

When content comes from a directory located on this computer, this box displays the path to the directory that stores your Web site files. By default, these files are stored in the %localdrive%\inetpub\wwwroot directory.

Browse

Click to locate directory path.

Script source access

Select to allow users to access source code if either Read or Write permissions are set. Source code includes scripts in ASP applications.

Read

Select to allow users to read or download files or directories and their associated properties.

Write

Select to allow users to upload files and their associated properties to the enabled directory on your server or to change content in a Write-enabled file. Write access is allowed only when a browser that supports the PUT feature of the HTTP 1.1 protocol standard.

Directory browsing

Select to allow users to see a hypertext listing of the files and subdirectories in this virtual directory. Because virtual directories do not appear in directory listings, users must know a virtual directory's alias. If Directory browsing is disabled and the user does not specify a file name, the Web server displays an "Access Forbidden" error message in the user's Web browser.

Log visits

Select to configure IIS to record visits to this directory in a log file. Visits are recorded only if logging is enabled for this Web site.

Related Topics

To learn more about logging site activity, see Logging Site Activity in IIS Help.

To learn more about virtual directories, see Using Virtual Directories in IIS Help.


FTP Site Properties - FTP Site Tab

Use this tab to set a friendly name for your Web site, configure access to your Web site, set connection limits to your site, and enable logging and configure the logging format for your site.

FTP site identification

In order for browsers to access your FTP content, both an IP address and TCP port number must be defined.

Description

Type a friendly name for your Web site. The friendly name appears in the console tree of IIS Manager. The description of the site is not required.

IP address

Assign an IP address from the list box or type a new IP address to be used for accessing this site. If you do not assign a specific IP address, this site responds to all IP addresses assigned to this computer and not assigned to other sites, which makes this the default Web site. For an IP address to appear in the list, the IP address must have already been defined for use on this computer in Control Panel. See Windows Server 2003 family Help for more information.

TCP port

Type the TCP port on which the FTP service is running. The default port is 21. You can change the port to any unique TCP port number, but if you change the port number, clients must know in advance to request that port number, or their requests fail to connect to your server. A port number is required; this text box cannot be left blank.

FTP site connections

These settings determine the number of simultaneous client connections to your server.

Unlimited

Click to configure this FTP site to handle an unlimited number of concurrent connections. The server accepts connections until it runs out of memory.

Connections limited to

Click to enforce a limit of simultaneous client connections to the server. To maintain good server performance, it is recommended that you set a limit. When the limit is reached, IIS returns an error message to the client stating that the server is busy.

Connection timeout

Type a number in the box to set the length of time in seconds before the server disconnects an inactive user. This ensures that all connections are closed within the specified time period if the FTP protocol fails to close a connection.

Enable logging

Select to enable your FTP site's logging features, which records details about user activity and creates logs in your choice of format.

The information is stored in ASCII files or an ODBC-compliant database. Logging information in IIS goes beyond the scope of the event-logging or performance-monitoring features of Microsoft ® Windows®. The logs can include information such as who has visited your site, what the visitor viewed, and when the information was viewed last. You can use the logs to assess content popularity or identify information bottlenecks.

Active log format

Select one of the following formats for the log files:

•	Microsoft IIS Log Format:  A fixed ASCII format.

•	ODBC Logging:  A fixed format logged to a database that is compatible with that database.

•	W3C Extended Log File Format:  A customizable ASCII format, selected by default. To use Process Accounting, the W3SVC Extended Log File format must be selected.

Properties

Click to configure options for log file creation (for example, weekly, or by file size), or to configure properties for W3C Extended logging or ODBC logging.

Current Sessions

Click to display a list of users currently connected to your site, not to your server.

Related Topics

To learn more about setting up an FTP site, see FTP Site Setup in IIS Help.

To learn more about logging site activity, see Logging Site Activity in IIS Help.


FTP Site Logging Properties - General Tab

Use this dialog box to specify how log files are created and saved.

New log schedule (common for all log formats)

Any changes to the log schedule defined takes effect immediately after applying the new settings.

Hourly

Click to create log files hourly.

Daily

Click to create log files daily, starting with the first entry that occurs after midnight.

Weekly

Click to create log files weekly, starting with the first entry that occurs after midnight Saturday.

Monthly

Click to create log files monthly, starting with the first entry that occurs after midnight of the last day of the month.

Note "Midnight" is midnight local time. Midnight is used for all log file formats except W3C Extended format, which by default uses midnight Greenwich Mean Time, but can be specified as midnight local time (by selecting the Use local time for file naming and rollover option below).

Unlimited file size

Click to always append data to the same log file. You can access this log file only after stopping the server.

When file size reaches

Click to create a new log file when the current log file reaches a given size. Type or click the up and down arrows to specify the size you want.

Use local time for file naming and rollover (W3C-specific)

Select to set creation time and naming format for W3C Extended log files to midnight local time rather than Greenwich Mean Time.

Log file directory

Type the directory in which log files should be saved, or click Browse to locate the directory.

Browse

Click to locate the directory to which log files will be saved.

Related Topics

To learn more about setting up an FTP site, see FTP Site Setup in IIS Help.

To learn more about logging site activity, see Logging Site Activity in IIS Help.


FTP Site Logging Properties - Advanced Tab

Use this tab to customize W3C Extended logging, by choosing the fields (items) to be recorded in the log. To limit log size, omit unneeded fields.

Extended logging options

The fields are as follows:

Date

Select to record the date the activity occurred.

Time

Select to record the time the activity occurred.

Extended Properties

Client IP Address

Select to record the IP address of the client that accessed your server.

User Name

Select to record the name of the authenticated user who accessed your server. This does not include anonymous users, which are represented by a hyphen (-).

Service Name

Select to record the Internet service and instance number that was accessed by a client.

Server Name

Select to record the name of the server on which the log entry was generated.

Server IP

Select to record the IP address of the server on which the log entry was generated.

Server Port

Select to record the port number the client is connected to.

Method

Select to record the action the client was trying to perform (for example, a GET command).

URI Stem

Select to record the resource accessed (for example, an HTML page, a CGI program, or a script).

URI Query

Select to record the query, if any, the client was trying to perform; that is, one or more search strings for which the client was seeking a match.

Protocol Status

Select to record the status of the action, in HTTP or FTP terms.

Protocol Substatus

Select to record additional status of the action, in HTTP terms. For more information about the protocol substatus error codes, see Substatus Error Codes in IIS Log Files in IIS Help.

Win32 Status

Select to record the status of the action, in terms used by the Windows operating system.

Bytes Sent

Select to record the number of bytes sent by the server.

Bytes Received

Select to record the number of bytes received by the server.

Time Taken

Select to record the length of time the action took.

Protocol Version

Select to record the protocol (HTTP, FTP) version used by the client. For HTTP, this is either HTTP 1.0 or HTTP 1.1.

Host

Select to record the content of the host header.

User Agent

Select to record the browser used on the client.

Cookie

Select to record the content of the cookie sent or received, if any.

Referrer

Select to record the previous site visited by the user. This site provided a link to the current site.

Related Topics

To learn more about setting up an FTP site, see FTP Site Setup in IIS Help.

To learn more about logging site activity, see Logging Site Activity in IIS Help.


FTP Site Logging Properties - ODBC Properties Tab

Use this tab to set ODBC logging options. Before you can begin ODBC logging from IIS, complete the following tasks:

•	Use ODBC-compliant database software (such as Microsoft® Access or Microsoft SQL® Server) to create a database.

•	Within the database, create a table containing the fields listed at the end of this topic.

•	Create a Data Source Name (DSN). For more information, see Windows® Server 2003 family Help.

•	Supply IIS with the DSN and Table name by using this dialog box.

•	If required, supply a user name and password to access the database.

ODBC Data Source Name (DSN)

Type the name of the data source you want to connect to. When created, this name is recorded in the ODBC Data Source Administrator, which is accessed through Administrative Tools.

Table

Type the name of the table in the ODBC data source specified above.

User name

Type the alias of the user permitted to access this data source and table.

Password

Type the password that is the associated with the user name specified above.

Related Topics

To learn more about setting up an FTP site, see FTP Site Setup in IIS Help.

To learn more about logging site activity, see Logging Site Activity in IIS Help.


FTP Site Properties - Security Accounts Tab

Use this tab to control who can administer this FTP site. You can specify the account to be used for anonymous client requests to log on to the computer, and you can control those users with user rights as site operators.

Allow anonymous connections

Select to allow anonymous connections to the FTP site using a predefined user name and password.

User name

Type the user name that should be used for anonymous connections, or click Browse to select another user.

Browse

Click to search and select the object type, such as user, and the location, such as your computer or any accessible computer connected on the network.

Password

Type the password that is associated with the specified user name.

Allow only anonymous connections

Select to configure IIS to allow only anonymous connections. When selected, users cannot log on with user names and passwords. This option denies access to those who use an account with administrative credentials; only those who use an anonymous access account are assigned access.

Related Topics

To learn more about setting up an FTP site, see FTP Site Setup in IIS Help.

To learn more about logging site activity, see Logging Site Activity in IIS Help.

To learn more about FTP authentication and security, see FTP Site Authentication in IIS Help.


FTP Site Properties - Messages Tab

Use this tab to create a banner, welcome, and exit message that displays when a user connects to your FTP site.

Banner

Type a banner message. The FTP server displays this message before clients connect to the FTP server. The message is blank by default.

Welcome

Type a welcome message. The FTP server displays this message when clients connect to the FTP server. The message is blank by default.

Exit

Type an exit message. The FTP server displays this message when clients log off the FTP server. The message is blank by default.

Maximum connections

Type a maximum connections message. The FTP server displays this message when clients try to connect and are unable to because the FTP service has reached the maximum number of client connections allowed. The message is blank by default.

Related Topics

To learn more about messages and FTP site administration, see FTP Site Administration in IIS Help.


FTP Site Properties - Home Directory Tab

Use this tab to change the home directory for your FTP site or to modify its properties. The home directory is the central location for the published files in your FTP site. A default home directory, stored in the %localdrive%\inetpub\ftproot, was created when you installed the FTP service.

You can change the location of the home directory to one of the following:

A directory located on this computer

Click to permit users to access a specified directory on this computer to view or update FTP content. You can control access to the content by implementing any Windows security method.

In the Local Path box, type the path to the directory or the destination URL. The syntax must match the currently selected path type. For a local directory, use the full path, for example, C:\Inetpub\Ftproot). For a network share, use a Universal Naming Convention (UNC) server and share name, for example \\Webserver\htmlfiles.

A directory located on another computer

Click to permit users to view or update FTP content on another computer that has an active connection to this computer. If you have administrative credentials on the remote computer, you can control access to the content by implementing any Windows security method.

In the Network share box you can type the server name and directory name. Click the Connect As button to type or change the network user name and password information.

FTP site directory

If you click A directory located on this computer, the following options are available:

Local path

When content comes from a directory located on this computer, this box displays the path to the directory that stores your FTP site files. By default, these files are stored in the %localdrive%\inetpub\Ftproot directory.

Browse

Click to locate the directory path.

If you click A directory located on another computer, the following options are available:

Network share

Type the server name and directory name.

Connect as

Click to provide a user name and password for access to the network share.

If you click either A directory located on this computer or A directory located on another computer, the following options are available:

Read

Select to enable users to read or download files stored in a home directory or a virtual directory.

Write

Select to allow users to upload files to the enabled directory on your server. You should enable write permissions only for directories that are intended to accept files from users.

Log visits

Select to record visits to this directory in a log file. Visits are recorded only if logging is enabled for this FTP site. Logging is enabled by default.

Directory listing style

These settings allow you to choose between MS-DOS and UNIX style directory listings.

UNIX

Click to display the year in a four-digit format when the date of the file is different from the year of the FTP server. No year is returned in cases where the file date has the same year as the FTP server.

MS-DOS

Click to display the year in a date in a two-digit format by default. You can programmatically change this setting to display years in a four-digit format by enabling the FtpDirBrowseShowLongDate metabase property.

Related Topics

To learn more about FTP site administration, see FTP Site Administration in IIS Help.

To learn more about setting up an FTP site, see FTP Site Setup in IIS Help.

To learn more about logging site activity, see Logging Site Activity in IIS Help.

To learn more about the FtpDirBrowseShowLongDate metabase property, see FtpDirBrowseShowLongDate in IIS Help.


FTP Site Properties - Directory Security Tab

Use this tab to allow or block access to your FTP site to individual computers or groups of computers.

TCP/IP address access restrictions

By specifying the TCP or IP address of the computer or computers to be assigned or denied access, you can control access to FTP resources, such as sites, virtual directories, or files.

Granted access

Click this option to grant access to all computers.

To add computers, groups of computers, or domains that you want to deny access to, click Add, and type the required information in the Deny Access dialog box. The computers that are denied access appear in the Except the following list box.

Denied access

Click this option to deny access to all computers.

To add computers, groups of computers, or domains that you want to grant access to, click Add, and type the required information in the Grant Access dialog box. The computers that are granted access appear in the Except the following list box.

Add

Click to define a computer or group of computers to which you want to grant or deny access.

Note Computers accessing your server across proxy servers appear to have the same IP address as the proxy server.

Remove

Click to remove the currently selected item from the exception list.

Edit

Click to modify the specific properties of the currently selected item in the exception list.

Related Topics

To learn more about FTP site administration, see FTP Site Administration in IIS Help.

To learn more about FTP authentication and security, see FTP Site Authentication in IIS Help.


FTP Site Properties - FTP Site Tab

Use this tab to set a friendly name for your Web site, configure access to your Web site, set connection limits to your site, and enable logging and configure the logging format for your site.

FTP site identification

In order for browsers to access your FTP content, both an IP address and TCP port number must be defined.

Description

Type a friendly name for your Web site. The friendly name appears in the console tree of IIS Manager. The description of the site is not required.

IP address

Assign an IP address from the list box or type a new IP address to be used for accessing this site. If you do not assign a specific IP address, this site responds to all IP addresses assigned to this computer and not assigned to other sites, which makes this the default Web site. For an IP address to appear in the list, the IP address must have already been defined for use on this computer in Control Panel. See Windows Server 2003 family Help for more information.

TCP port

Type the TCP port on which the FTP service is running. The default port is 21. You can change the port to any unique TCP port number, but if you change the port number, clients must know in advance to request that port number, or their requests fail to connect to your server. A port number is required; this text box cannot be left blank.

FTP site connections

These settings determine the number of simultaneous client connections to your server.

Unlimited

Click to configure this FTP site to handle an unlimited number of concurrent connections. The server accepts connections until it runs out of memory.

Connections limited to

Click to enforce a limit of simultaneous client connections to the server. To maintain good server performance, it is recommended that you set a limit. When the limit is reached, IIS returns an error message to the client stating that the server is busy.

Connection timeout

Type a number in the box to set the length of time in seconds before the server disconnects an inactive user. This ensures that all connections are closed within the specified time period if the FTP protocol fails to close a connection.

Enable logging

Select to enable your FTP site's logging features, which records details about user activity and creates logs in your choice of format.

The information is stored in ASCII files or an ODBC-compliant database. Logging information in IIS goes beyond the scope of the event-logging or performance-monitoring features of Microsoft ® Windows®. The logs can include information such as who has visited your site, what the visitor viewed, and when the information was viewed last. You can use the logs to assess content popularity or identify information bottlenecks.

Active log format

Select one of the following formats for the log files:

•	Microsoft IIS Log Format:  A fixed ASCII format.

•	ODBC Logging:  A fixed format logged to a database that is compatible with that database.

•	W3C Extended Log File Format:  A customizable ASCII format, selected by default. To use Process Accounting, the W3SVC Extended Log File format must be selected.

Properties

Click to configure options for log file creation (for example, weekly, or by file size), or to configure properties for W3C Extended logging or ODBC logging.

Current Sessions

Click to display a list of users currently connected to your site, not to your server.

Related Topics

To learn more about setting up an FTP site, see FTP Site Setup in IIS Help.

To learn more about logging site activity, see Logging Site Activity in IIS Help.


FTP User Sessions

This dialog box displays a list of all currently connected users, the connection source, and the time they connected.

Disconnect

Click to disconnect only those users you have selected from the list.

Disconnect All

Click to disconnect all current users.

Close

Click to close the dialog box.

Refresh

Click to refresh the list with changes made to the list after you opened the dialog box.

Related Topics

To learn more about FTP site administration, see FTP Site Administration in IIS Help.


Network Directory Security Credentials

Use this dialog box to establish security credentials for access to the network share from which content is to be served.

Note The User name and Password boxes are not available if the Always use the authenticated user’s credentials when validating access to the network directory option at the bottom of the dialog box is selected. To establish a user name and password for all users when accessing this share, clear this check box.

User name

Type a user name. This name is used for all client connections to the remote share.

Password

Type a password. This password is used for all client connections to the remote share.

Browse

Click to locate the directory path.

Always use the authenticated user’s credentials when validating access to the network resource.

Select to validate connection attempts to the remote share against the currently logged-on user’s name and password. When this option is cleared, all client connections to the remote share use the specific user name and password entered.

Important  If you specify a user name and password to connect to a network drive, all FTP server access to that directory will use that user name and password. Choose the user name carefully to prevent possible security breaches. For tighter security, use the IUSR_computername account (the anonymous user) for the computer on the network.

Related Topics

To learn more about directory security, see Access Control in IIS Help.


FTP Site Virtual Directory Properties - Virtual Directory Tab

Use this tab to change the properties of a virtual directory in your FTP site. A virtual directory is a directory that is not physically contained within the home directory. To visitors of your site, it appears as though the virtual directory is contained within the home directory.

To add a new virtual directory to an FTP site, right-click the FTP site in IIS Manager, select Create New, and then click Virtual Directory.

The content for this resource should come from

A directory located on this computer

Click to permit users to access a specified directory on this computer to view or update FTP content. You can control access to the content by implementing any Windows security method.

In the Local Path box, type the path to the directory or the destination URL. The syntax must match the currently selected path type. For a local directory, use the full path, for example, C:\Inetpub\Ftproot). For a network share, use a Universal Naming Convention (UNC) server and share name, for example \\Webserver\htmlfiles.

A directory located on another computer

Click to permit users to view or update FTP content on another computer that has an active connection to this computer. If you have administrative credentials on the remote computer, you can control access to the content by implementing any Windows security method.

In the Network share box you can type the server name and directory name. Click the Connect As button to type or change the network user name and password information.

FTP site directory

If you click A directory located on this computer, the following options are available:

Local path

When content comes from a directory located on this computer, this box displays the path to the directory that stores your FTP site files. By default, these files are stored in the %localdrive%\inetpub\Ftproot directory.

Browse

Click to locate the directory path.

If you click A directory located on another computer, the following options are available:

Network share

Type the server name and directory name.

Connect as

Click to provide a user name and password for access to the network share.

If you click either A directory located on this computer or A directory located on another computer, the following options are available:

Read

Select to enable users to read or download files stored in a home directory or a virtual directory.

Write

Select to allow users to upload files to the enabled directory on your server. You should enable write permissions only for directories that are intended to accept files from users.

Log visits

Select to record visits to this directory in a log file. Visits are recorded only if logging is enabled for this FTP site. Logging is enabled by default.

Related Topics

To learn more about FTP site administration, see FTP Site Administration in IIS Help.

To learn more about setting up an FTP site, see FTP Site Setup in IIS Help.

To learn more about logging site activity, see Logging Site Activity in IIS Help.


New Web Service Extension

In an effort to reduce the attack surface of your Web server, IIS 6.0 serves only static content after a default installation. Programmatic functionality provided by IIS APIs (ISAPIs) or Common Gateway Interfaces (CGIs) must be manually enabled by an IIS administrator. ISAPIs and CGIs extend the ability of your Web pages and for this reason ISAPIs and CGIs are referred to here as Web service extensions. For example, in order to run Active Server Pages (ASP) with this version of IIS, the ISAPI Asp.dll must be enabled as a new Web service extension.

Use the options in this dialog box to enable or disable specific ISAPIs or CGIs.

Notes

•	ISAPI filters are not considered Web service extensions. ISAPI filters are not enabled through this dialog box.

•	For a Web service extension to run, the ISAPI or CGI must be located in the content directory on your server running IIS (for example, LocalDrive:\Inetpub\wwwroot for a default installation).

Extension name

Type the friendly name of the ISAPI or CGI (for example, Microsoft® FrontPage® Server Extensions).

Required files

This is a list of all of the ISAPIs or CGIs required for the Web service extension to run. For example, FrontPage Server Extensions is composed of five files and all five files need to be enabled before you can begin extending Web pages with FrontPage Server Extensions.

Add

Click to select required files.

Remove

Click to remove the currently selected file from the list.

Set extension status to Allowed

Select to allow the Web service extensions to run on your server. Clear this option to prohibit Web service extensions from running on your Web server. For example, by entering Nimda.dll information in this dialog box and then setting the status to Prohibit (status when option is cleared), you prohibit Nimda.dll from running on your Web server.

Related Topics

To learn more about Web service extensions, see Enabling and Disabling Dynamic Content in IIS Help.

To learn more about configuring applications, see Configuring Applications and Configuring Servers for Applications in IIS Help.


Allow all Web service extensions for a specific application

Use this dialog box to enable Web service extensions for your applications. If an application has suddenly stopped working, use this dialog box to confirm and enable all Web service extensions for that application.

Application

Click the name of the application from the list box.

Extensions to be allowed

This lists all of the required Web service extensions for the currently selected application.

Note Click OK to enable the list of allowed Web service extensions for the currently selected application.

Related Topics

To learn more about Web service extensions, see Enabling and Disabling Dynamic Content in IIS Help.

To learn more about configuring applications, see Configuring Applications and Configuring Servers for Applications in IIS Help.


Web Service Extension Properties - General Tab

Use this tab when making decisions on whether to prohibit a Web service extension. If you prohibit the current Web service extension, the applications in the Used by list might stop working correctly and other applications (not listed in this dialog box) may stop working as well. It is also possible that Internet Information Services (IIS) may not detect other dependencies that could stop applications from running correctly.

Used by

This is a list of applications known to use the designated Web service extension, identified at the top of this tab.

Related Topics

To learn more about Web service extensions, see Enabling and Disabling Dynamic Content in IIS Help.

To learn more about configuring applications, see Configuring Applications and Configuring Servers for Applications in IIS Help.


Web Service Extension Properties - Required Files Tab

Use this tab to do the following:

•	View a list of required files for the designated Web service extension.

•	Add or remove files for a specific Web service extension.

•	Customize security for a designated Web service extension (allow or prohibit files).

Files

This is a list of the required files and their current status for the designated Web service extension.

Add

Click to add a required file to the list.

Remove

Click to remove the currently selected file from the list.

Allow

Click to allow the currently selected file to run on your Web server.

Prohibit

Click to prohibit the currently selected file from running on your Web server.

Note  If all required files do not have the same status (for example, if one file has a status of Prohibited and the rest of the files have a status of Allowed), the status of the Web service extension displays as Custom.

Related Topics

To learn more about Web service extensions, see Enabling and Disabling Dynamic Content in IIS Help.

To learn more about configuring applications, see Configuring Applications and Configuring Servers for Applications in IIS Help.


Prohibit All Web Service Extensions

Prohibiting all Web service extensions from running on your Web server will cause applications to lose functionality or quit working altogether. Internet Information Services (IIS) will be able to serve only static content. If you are uncertain how prohibiting Web service extensions will impact your applications, click each Web service extension individually and note the list of dependent applications in the Used by list on the General tab.

Note  IIS might not detect all applications that depend on particular Web service extensions to run. If you prohibit all Web service extensions, other applications (not listed on the General tab) might stop working.

Related Topics

To learn more about Web service extensions, see Enabling and Disabling Dynamic Content in IIS Help.

To learn more about configuring applications, see Configuring Applications and Configuring Servers for Applications in IIS Help.


Unknown ISAPI Extensions

In an effort to reduce the attack surface of your Web server, IIS 6.0 serves only static content after a default installation. Programmatic functionality provided by ISAPIs or Common Gateway Interfaces (CGIs) must be manually enabled by an IIS administrator. ISAPIs and CGIs extend the ability of your Web pages and for this reason, ISAPIs and CGIs are referred to here as Web service extensions. For example, in order to run Active Server Pages (ASP) with this version of IIS, the ISAPI Asp.dll must be enabled as a new Web service extension.

Warning  If you chose to allow all IIS Application Program Interfaces (ISAPIs) to run on your Web server, your Web server could be susceptible to computer viruses or worms that exploit ISAPI technology. Instead, use the Web Service Extensions node in IIS Manager to select only those ISAPIs that are allowed to run on your Web server

Related Topics

To learn more about Web service extensions, see Enabling and Disabling Dynamic Content in IIS Help.

To learn more about configuring applications, see Configuring Applications and Configuring Servers for Applications in IIS Help.


Unknown CGI Extensions

In an effort to reduce the attack surface of your Web server, IIS 6.0 serves only static content after a default installation. Programmatic functionality provided by ISAPIs or Common Gateway Interfaces (CGIs) must be manually enabled by an IIS administrator. ISAPIs and CGIs extend the ability of your Web pages and for this reason, ISAPIs and CGIs are referred to here as Web service extensions. For example, in order to run Active Server Pages (ASP) with this version of IIS, the ISAPI Asp.dll must be enabled as a new Web service extension.

Warning  If you chose to allow all Common Gateway Interfaces (CGIs) to run on your Web server, your Web server could be susceptible to computer viruses or worms that exploit CGI technology. Instead, use the Web Service Extensions node in IIS Manager to select only those CGIs that are allowed to run on your Web server

Related Topics

To learn more about Web service extensions, see Enabling and Disabling Dynamic Content in IIS Help.

To learn more about configuring applications, see Configuring Applications and Configuring Servers for Applications in IIS Help.


Confirm Prohibit Extension

Because Internet Information Services (IIS) might not detect all applications that are dependent on this Web service extension, prohibiting this Web service extension might cause applications other than those listed to stop working.

Related Topics

To learn more about Web service extensions, see Enabling and Disabling Dynamic Content in IIS Help.

To learn more about configuring applications, see Configuring Applications and Configuring Servers for Applications in IIS Help.


Web Site Properties - File Tab

Use the options on this tab to determine content and user permissions for this file.

The content for this resource should come from

The designated file

Click if all content is contained in the currently selected file.

A redirection to a URL

Click to redirect the client application, such as a browser, to another Web site or virtual directory. When selected, redirect options are substituted for path options.

Setting up local or network paths allows the request to be directed to the correct physical location. You can further configure the physical location by setting user access properties, choosing whether to log requests for these resources, and choosing whether to index this site using the Indexing Service. To specify when the request is received, applications must be identified, located, and given the appropriate execute permissions and protection.

Note  Enable the Indexing Service through the Add or Remove Programs item in Control Panel.

If you click The designated file, the following options are available:

Script source access

Select to allow users to access source code if either Read or Write permissions are set.

Read

Select to allow users to read or download this file.

Write

Select to allow users to change content in the currently selected file. Write actions can be performed only with a browser that supports the PUT feature of the HTTP 1.1 protocol standard.

Log visits

Select to configure IIS to record visits to the currently selected file in a log file. Visits are recorded only if logging is enabled for this Web site.

If you click The designated file, the following options are available:

Redirect to

Type the target URL to which the client will be sent.

The exact URL entered above

Select to redirect requests for this resource to the destination URL without adding any other portions of the original URL.

A permanent redirection for this resource

Select to send the following message to the client: "301 Permanent Redirect." In most cases, redirects are considered temporary, and the client browser receives the following message: "302 Temporary Redirect." Some browsers can use the "301 Permanent Redirect" message as the signal to permanently change a URL, such as a bookmark.

Related Topics

To learn more about logging site activity, see Logging Site Activity in IIS Help.

To learn more about setting up a Web site, see Web Site Setup in IIS Help.


Import Configuration

With Internet Information Services (IIS) 6.0, you can import and export the configuration of your FTP sites, Web application pools, and Web sites. Before you can import a configuration file, you must export a configuration file from an existing FTP site, Web application pool, or Web site. Exporting a configuration file in IIS Manager is called Save Configuration to a File. The exported configuration is stored as a metabase XML configuration file. After you have exported the configuration file, you can then import that file into a different location on the same Web server or to a different Web server.

Exporting and importing sites and application pools as configuration files allows administrators to quickly migrate sites and application pools between servers. This feature also allows administrators to import Web applications when the developer has stored the application in a configuration file.

File

Type the full path to the configuration file.

Browse

Click to locate the configuration file.

Read File

Click to populate the Select a configuration to import list box with all configurations contained in the currently selected configuration file.

Select a configuration to import

One metabase XML configuration file can contain several configurations. After you click Read File, this list box is automatically populated with all configurations contained in the currently selected XML configuration file. Click a configuration in this list and then click OK to import the configuration.

Related Topics

To learn more about metabase configurations files, see Configuring the Metabase in IIS Help.


Save Configuration to a File

With Internet Information Services (IIS) 6.0, you can import and export the configuration of your FTP sites, Web application pools, and Web sites. When you save a configuration to a file, you export all metabase property configurations for the currently selected FTP site(s), Web application pool(s), or Web site(s) to a metabase XML configuration file. After you have exported the configuration file, you can then import that file to a different location on the same Web server or to a different Web server. Exporting and importing sites and application pools as configuration files allows administrators to quickly migrate sites and application pools between servers. This feature also allows administrators to export Web applications when the developer has stored the application in a configuration file.

Exporting a configuration file in IIS Manager is called Save Configuration to a File. Use this dialog box to store the exported configuration as a metabase XML configuration file. After you have exported the configuration file, you can then import that file into a different location on the same Web server or to a different Web server.

File name

Type a name for the configuration file.

Path

Type the full path where you would like to store the configuration file.

Browse

Click to locate a directory where you would like to store the configuration file.

Encrypt configuration using password

Select to secure the configuration file with an encrypted password.

Password

Type the password.

Confirm password

Type the password again to confirm.

Related Topics

To learn more about metabase configurations files, see Configuring the Metabase in IIS Help.


Inheritance Overrides

You have changed a setting also defined in one or more child nodes. The new setting differs from the setting in the child nodes. You can choose whether the child nodes should inherit this new setting.

If you want the child nodes to retain their current setting, do not select any nodes and click OK.

If you want child nodes to use the new setting, select the nodes that should inherit the new setting, and click OK.