A Former Microsoft IIS PM

Leaving Microsoft: Saying Goodbye...

Wed, 18 Jul 2007 21:15:07 GMT

A term often expressed at the end of a journey is "its been a great ride." I can't argue or complain with that expression as it is exactly how I feel after 7 years of fun at Microsoft. The loose ends to tie up after this amount of time is vast so please do accept my apology for making a blog post one of the last things I did.

My career has taken me down various paths and along the way I have made hundreds of friends. They will be missed.

My Microsoft Career in a Snapshot

It is pretty straight forward. At the center of my universe was IIS back when it was in version 4 while v5 was just about to hit the door. I lived through the bad times - Code Red & Nimda - and many good times as we watched one happy customer after another deploy IIS 6.0. I then spent time watching IIS 7.0 in it's infant stages to where it is basically complete and the next generation Web platform.

In either event, here were my roles:

May 2000 - August 2001: Product Support Services IIS Engineer
August 2001 - August 2002: Product Support Services Technical Lead - IIS
August 2002 - July 2005: Product Support Services Beta Lead - IIS
July 2005 - July 2007: Program Manager - IIS Product Unit

During IIS Product Unit tenure, here are some quick facts:

Building Moves: 1
Offices: 3
Managers: 2
Number of PMs (since Aug '02): 19
Releases: 3
Re-orgs: 6

To my credit...

The one thing that many folks do while reflecting on a "career" at a place is think about the things they did. Beyond that, they think about the things they also didn't do...As a quick glimpse, I thought I might share what are some of the things I am most proud of while working at Microsoft. A discussion of the things I could have done better (or worse) then check out my new blog location. I will also be talking a bit more about my experiences at MS that might answer the question you might ask...why would you leave?

Created SSL Diagnostics 1.0 with the help of Ulad Malashanka (UladM)
Developed Content for and Created the IIS Webcast Series
Developed AuthDiag 1.0 with the help of UladM
Created the IIS Diagnostics Toolkit suite (not all the tools, just the branded kit)
Led the TechEd 2005 team for IIS & ASP.NET
Delivered 4 TechEd talks
Visited 10 Countries and presented in the first-ever IIS Roadshow
Negotiated and owned the IIS.NET project

...Then I retired.

The final goodbye...

I left Microsoft officially on Monday, July 16th. A great deal of folks found it odd that I chose Monday rather than the traditional Friday but I felt like I had good reason. Friday, well... it was Friday the 13th. I didn't want to tempt fate and throw caution to the wind and leave on this well-publicized Americanized bad day. On Monday, I came to work for my final day to find that my buddies which I will miss dearly did me one final farewell. It was sad while all along very funny. I have been known over the years as they guy who carries a football to meetings, to the guy who talks funny (southern accent), and lastly to the guy who would usually have a well-stocked beer fridge in his office. My leaving posed a serious threat to some on the team who find the ability to grab a beer during the day to chase away the daily Microsoft blues very appealing...

They blocked it - and did so in great fashion.

For more, go here

Lets just say that I will you y'all too.

Find me on the Web...

Chris's YuppieRedneck Blog

First IT Pro Focused IIS7 Book Hits Market: How to Cheat at IIS7

Fri, 13 Jul 2007 17:15:12 GMT

One of the moonlighting activities I have been doing is driving the release of the first IT Pro (sysadmin, etc.) IIS7 book on the market. This book started way back when we released Windows Vista & IIS7 and focuses heavily on giving many of you a head start on understanding the huge changes in IIS7. I was the technical editor for this book and I did everything I possibly could to ensure that the book was 100% technically accurate though as is expected some things might just fall through the cracks. In either event, you should certainly pick up a copy if you would like to learn about the IIS7 setup, brand new configuration core server, new administration tools, as well as diagnostics.

With a preface by Bill Staples, Product Unit Manager, this book packs 300+ pages of goodness about IIS7. You will not dive deep into the internals of IIS7 but you will quickly close the delta between not knowing anything about IIS7 & knowing a lot! Get started using this product today with insight from me, Gene, Conrad, and many others.

Look at the Changes to IIS7

Compare IIS 7.0 to 6.0, take a look at its new core server, review its command-console utility, and see how to use Request Tracing

Review the Important IIS 7.0 Modules

See how modules perform specific functions and how they allow the IIS footprint of IIS 7.0 to be small while providing the required functionality

Understand IIS Development Advantages

IIS 7.0 offers a new landscape for developers - see how it provides access to early pipeline events, such as authenticating requests

Enable Managed Code

Managed code running under integrated mode provides direct access to the unified pipeline

Enable Delegated Administration

Learn how delegation is a powerful management tool and see how delegating administrative capabilities is accomplished in ApplicationHost.config

Accomplish Tasks Using IIS Manager

IIS Manager offers easy access to all relevant features, and creating Web sites and virtual directories is simple & intuitive

Use IIS 7.0's Custom Detailed Errors

Unlike previous versions, IIS 7.0 includes Custom Detailed Errors that offer administrators console access to the most detailed error messages

Extend IIS 7.0's Tracing

The ability for a developer who developers custom modules using IIS 7.0's APIs to also push his module's errors into the same error log used by IIS is arguably the most powerful feature in all of IIS 7.0

NOTE: This book was written with Windows Vista functionality in mind. IIS 7.0 was well along the way to fully baked minus some server-centric features like centralized configuration, IIS Manager delegation changes, and a other changes. For a detailed understanding of these changes, please read What's New in IIS7 in Beta 3 on IIS.NET.

A Special Thanks to...

Purchase

Amazon Barnes & Noble Borders

Diagnostics, Deployments, and History in IIS...

Mon, 25 Jun 2007 15:39:42 GMT

In a recent trip back to Nashville, TN., I had the pleasure of meeting with some other IT professionals at a local Microsoft "shop." We discussed several different things such as my feelings of Windows Server 2008, IIS7, and other various questions that most Microsoft employees get when they are chattin with customers.

During this 1 hour conversation with these 3 Operations gurus, I learned some valuable things that I just couldn't hepl but come back and share. The purpose of this post is to just share some of the answers I gave to them to their questions.

<legal>NOTE: These are the sole answers from me to others that hopefully will shed light for others out there who have the same or similar questions. They are not warranted, per se, nor guaranteed in any form. </ legal>

First: What about diagnostics?

The first question that was really brought up was around diagnostics. I quickly started talking about IIS7's Failed Request Tracing and how it is the heart and soul of troubleshooting and diagnostics in IIS, now and in the future. I explained how it worked and further how it can combat a lot of the questions that most folks have on the why something is or is not happening.

Second: Can you drop cutting-edge and talk more about today?

I wasn't shocked at all by this question because it often is the reality of the corporate IT world. Bleeding, or cutting-edge, is a risky business for most and because of that they weren't asking What about diagnostics to hear about something they will deploy in 2+ years. They quickly pointed out that they still have Windows 2000 & IIS 5.0 servers that they can't move to IIS 6.0 for various political and technical reasons. Ouch!

After checking what ego I had at the door, I found myself back in the comfort zone that I so adore - talking about today rather than tomorrow. The next 20 minutes was spent talking about their first question - Diagnostics for IIS 5.0 or 6.0. I am proud of the work that Microsoft, in particular the IIS Team and IIS Product Support, did in this area to try and really aid customers in solving problems quicker, and more efficiently on a already shipped platform.

It shouldn't be a shock to many that I am proud of this as it was something that I drove either from a PM perspective (design, spec, etc.) or as the release manager (get it out the door).

IIS Diagnostics Toolkit

I explained to them where the idea came from to have a toolkit...so let me tell you. I have some friends on the Exchange team that I have had some conversations with in the past and I loved to hear how focus this team is on reducing the labor associated with troubleshooting Exchange. They went as far as to create an Exchange Best Practices (EBP) analyzer to try and reduce the number of people who configure themselves into broken situation. Secondly, they also released a consolidated toolkit that had a ton of cool tools that would help solve many of the problems folks have with Exchange.

It wasn't a light-bulb that went off in my head though it was "something" as I started asking myself - why? Why the heck do we not have an IIS set of tools that cover the top major pain points that our customers hit. Hmmm...

If we only had the tools to begin with ...

Wait, we have...

...SSL Diagnostics to help solve problems with Secure Socket Layer (SSL) issues

...Authentication & Access Control Diagnostics (AuthDiag) to help find problems related to authentication & authorization

...We have Debug Diagnostics to simplify the capture of debugging and analysis

...We have WFetch to help isolate when problems are created by the browser, not IIS

...Exchange released SMTP Diagnostics (SMTPDIAG) to help find issues with the SMTP server shipping with IIS or Exchange

...We have the infamous, and invaluable, Log Parser that lets you zoom in with laser accuracy on the problems using easy SQL-commands to access IIS logs, event viewer, or even NetMon traces.

...oh, and Trace Diagnostics that simplifies the creation of tracing in IIS 6.0 with IISREQMON.exe & IISTRACE.exe. And to boot gives you a nice UI for seeing currently executing requests with IIS Request Viewer.

What do you know...

It wasn't rocket science or anything but just work (e.g. labor.) This means simple labor, some politics, and a little magic voodoo and IIS could have a toolkit. The difference is that the idea came about while DebugDiag, WFetch, TraceDiag were in development. The first toolkit had only 4 tools and was released a couple years back. In January of 2006, we updated this toolkit to support the additional tools mentioned above.

Shocked: "Very cool..."

My IT friends were shocked to hear of the extensive set of tools built to aid them in troubleshooting their Web environment. They hadn't heard of several of the tools and I went on to explain in detail what each can do for them based on the symptoms. They loved Debug Diagnostics & Log Parser (previous knowledge existed) but were stunned by the existence of AuthDiag & TraceDiag.

A few months back, I added to IIS.NET the Diagnostics page where www.iisdiagnostics.com points to for folks to learn about about each of the tools. It wasn't publicize very well so I will use this blog as the portal without all the marketing jibberish ...

Your IIS Diagnostics Tool Cheat Sheet...

Tool Name	What it can do for you...
SSL Diagnostics 1.1	Quickly check your SSL Configuration in the Metabase Find registry keys that are affecting your SSL Configuration Quickly make a SSL requests to a specified website Generate a test certificate to validate \ invalidate your SSL Certificate Create self-signed certificates (command-line only - ssldiag /selfssl) Monitor incoming SSL requests in real-time using SSL Monitor
Authentication & Access Control Diagnostics 1.0	Test authentication (anonymous, basic, integrated, digest) to a specified URL Check website authentication configuration versus desired configuration Check permissions to website content path and key IIS components like asp.dll Check OWA permissions when running Exchange Server 2003 Check system permissions based on original permissions defined in Knowledge base articles from Microsoft View Kerberos Service Principle Names (SPNs) stored in Active Directory Enable AuthMon, a real-time monitoring system, to watch and analyze authentication and authorization requests
Debug Diagnostics 1.0	Capture and pull together with ease all pertinent troubleshooting data like event viewer, metabase, and IIS log files Setup a Crash rule to capture failures causing the worker process to fail Use a hang rule to capture a memory dump at the point of failure Analyze memory failures with ease using DebugDiag's LeakDiag feature for monitoring allocations of memory without de-alloc ...and a whole lot more!
WFetch 1.4	Internet Explorer or Firefox never cause failures...but in case they do use this simple tool to validate server-side or client-side issues Test all types of authentication supported in IIS (minus Passport) Add custom headers to test server behavior See raw HTTP request and response headers and body
SMTP Diagnostics 1.0	Test SMTP Check DNS settings for SMTP success ...a whole lot more I don't know about since we didn't build the tool <g>
Trace Diagnostics 1.0	View currently executing requests in a IIS 6.0 SP1 worker process See what state the request is in and what handler has it ...and how long it has taken Use IISREQMON to enable and capture currently executing requests for a URI from a command-line Use IISTrace to setup a trace of a particular type of request using a certain provider for particular URI (simplified a 3-step process to 1 command)
Log Parser 2.2	Parse log files in seconds to find specific data using simple or complex commands Convert log files from one log type (W3C) to another (IIS) and back again Parse log files for specific data and create, and insert, into a SQL database for archiving Use built-in functions to convert data such as IP address to hostname, etc. along with counting ...a whole lot more!

Third: Deployments...how do you deploy new code to IIS.NET?

I am the person in charge of IIS.NET - for better or for worse <g>. I am the first to say that a Webmaster position is one that takes a lot of patience, guts, and even more work than I originally ever believed possible. The notion of a self-sustaining website is impossible (or at least when you have a marketing department.) after a couple of years of running this site. My gratitude goes out to all you Webmasters out there -

They asked how, as the Webmaster, we deployed new features and functionality to IIS.NET. Carefully, I said...<g>

In truth, though, I said that the nice thing about our situation is that we only say when to deploy and don't actually do any work related to the physical deployment. Thus, I can't say in detail how we deploy to IIS.NET. The development team for IIS.NET is not done by Microsoft but instead by our Microsoft Gold Partner Telligent. They develop the code, manage the infrastructure, and deploy the bits. A nice position to be in as a Webmaster for certain!

Until IIS7, you have choices for Diagnostics

I used to, in college, live from test-to-test (or beer-to-beer). I often found myself very frustrated by the fact that I always was planning from the future back to the present. I decided after graduating to not make that mistake - don't live for tomorrow but instead play today. With that said, it isn't hard for me to get compassion for our customers' whom is undeniably interested in the future of IIS but only within a certain context. The future (e.g. IIS7) is for many a fantasy, an unreachable milestone, that often just makes you more sad than happy. The average IT person isn't even sure if his or her role will be the same by the time they deploy the "future."

Instead, reality is "What can you do for me today" and I can't blame it when they get tired of hearing about the props of the future when IT today is about the past. The one point that I love is that with both IIS7 and the diagnostics toolkit, I am positioned to have a great conversation either way - a Win-Win situation. I love IIS, always will...

Getting Started with IIS7 & Longhorn Server Beta 3

Fri, 04 May 2007 12:57:00 GMT

Back when I lived in the real world, I remember tearing into Windows 2000 at beta milestones. This included running 2000 professional on my desktop as well as building, stealing, or whatever I had to do to test hardware for my beta 2000 servers. It was so much fun but so much darn time to just try and figure out how Microsoft was innovating from NT4. There is cutting-edge and then there is "day job" security. Fast forward 9 years and I find myself so antique, old as many would put it...

First: No Hardware Problems?

There is this technology called Virtual PC or Virtual Server. There is no painful process of trying to scour up these old pieces of hardware to make a system only to find out the EISA driver isn't supported anymore. Now, at the comfort of your own workstation you can run as many of these beta OS's as your heart can phathom (oh, well - you might need some additional memory though so be warned.)

Second: Microsoft Walks me through Learning Longhorn?

What? Did I hear you correctly? Did you say that Microsoft has published to the Web over 380 walkthrough scenarios for the various technologies updated in Windows Server Codenamed Longhorn Beta 3?

Dude, this is a blueprint for learning that I didn't have 'back in da day' and it simply is amazing. With 43 categories crossing both x86 & x64 platforms and over 380 walkthroughs, one should be able to get up to speed in no-time flat.

For Review...

You don't need hardware - get Virtual PC
Use your Windows Live Id (or Get One) to Sign-in to Windows Beta
Choose your Platform...
Have Fun!

So - What's your excuse? Get started learning Windows Server "Longhorn" right now with Virtual PC for free, and 380 walkthroughs. Of course, start with the IIS7 scenarios first - k? By the way, you can also get the IIS7 Walkthroughs on IIS.NET.

IIS7: Gettin' Ready...Are you Ready?

Tue, 24 Apr 2007 05:58:00 GMT

For months, in fact years, the IIS team has found itself fighting an uphill battle with IIS7 and customers. It is a proven fact that you can build amazing technology with a bucket-full of wanted features but until it is "real" - it is mostly hot air. For quite some time, IIS7 hasn't been a real thing - the thing that you can get your hands on and deploy. It is the moving target of "buzz words" and flashy demos to pull out the oohhs and ahhhs. Buckle up podro - only the strong survive.

The date: Wednesday, April 25th, 2007. The mission: Learn and deploy IIS7

T-2: Here Comes IIS.NET Navigation

The rush of shipping software and beating deadlines is second to none, at least for me. It is 10:36 PM and I am still focused on pushing through on stage 1 of what should certainly be a whirlwind of weeklong events as finally - and I do mean finally - we release Window Server Codename "Longhorn" Beta 3. For over 9 weeks, my life has been consumed by a date other than "tax day" and it was April 25th. It was the doomsday of put-it-up or don't collect $200 (monopoly folks) - less than 36 hours away and I think we are about to rock the world. There is no rush like knowing that, while deployments are the key to the game, your role in the grand scheme of things is to bring customers to the product - or as I like to say - the rubber to the road.

On Wednesday, we will release our next major update to IIS.NET for the IIS community and most, if not all, of this update is about IIS7. The theme is without a doubt simple - It's Ready! A few weeks of torturous demands and unbelievable hours will finally culminate with relief, joy, and satisfaction. Our sweat and tears is your gain - and WE LOVE IT!

We (IIS.NET team) have several goals leading up to this big release of Longhorn server where we go "public" as they say. Head-to-head with Apache, laser-focused on deployments, and driven by community, Beta 3 is like no release before for IIS.NET. We have the foundation set for the community to submit cool, useful tools in the DownloadCENTER. We have the perfect desktop suite of tools for IIS7 development with Visual Studio 2005 and Windows Vista (e.g. IIS7). Last, we finally have a Serveri for the magic you build with the impemending release. To make the learning curve short, we focused heavily on content and building the perfect pipeline to complement content creation and we opened the doors.

The results are a site driven by content awareness - from the homepage to the physical content we will ensure you are perfectly centered on what is the meat of IIS.NET - CONTENT. Yes, there are ads. Yes, there are graphics. However, In a couple of days we will release a major update that introduces powerful navigation features in most places on the site to raise your awareness of the great quality of content we have available for IIS7. The TechCENTER, our card catalog of content, is cool but in-your-face all the time is the only way to git 'r done.

Are we READY? Sheesh...

Are you serious? You better believe we are ready - the question is whether you are. We're releasing content all over the place with cool support directly from the product group in the forums and we know we are ready, are you? Go Live on IIS7 and we will know...

Getting Virtual Server '05 R2 Working on IIS7 in Longhorn Server

Mon, 16 Apr 2007 15:57:00 GMT

Introduction

With some nifty work and helpful insight, you can get Virtual Server 2005 working on Windows Server Code-named "Longhorn" just as I did this past weekend. I took some time to also validate (i.e doc) what I was doing as to maybe help someone else out there who is trying the same darn thing. The nice thing - I know a lot about IIS7 making it much, much easier than if someone doesn't.

I recently came up with this policy - "WENK" - which in the technology world fits right in as an acronym. WENK (Weekends Equal No Work) is designed to let me spend time with family as well as do things I love like play with technology. This weekend, while the wife was off at a horse show, I had time to start a migration from my existing dual core server to a more powerful dual core server for my home system (websites, email, sql, ad, etc.).

Off we go...

Are the IIS7 bits needed for Virtual Server installed?

Unlike any previous versions of IIS, IIS7 doesn't just come with every feature installed. In IIS 6.0, we would install all the binaries on the box but used something called "Web Service Extensions" to turn on\off any feature that the user desired. The default state (unlike IIS 5.0) was everything "off" equaling a simple static server out-of-box.

IIS7 introduces a all-new modular Web server where binaries aren't installed that aren't explicitly asked for. This is the first challenge that will be faced to get your existing Web applications working in IIS7. The hope is that many software Web application providers will take the necessary hit to ensure that their setup installs the binaries needed for their application.

I am not currently privy to the plans for the Virtual Server team so I didn't take time worrying about it. The first thing that is helpful is knowing that Virtual Server 2005 is a CGI-based (VSWebApp.exe) application and as such we need to ensure we have the CGI binary installed.

To install the CGI binary, do the following:

On your Longhorn Server Beta 3, open the Server Manager (Start - Administrative Tools - Server Manager)
In the roles section, the Server Manager should display the following -

In the Role Sections, you should see a list of the features that are installed and not installed like the following:

The basic process from this point forward is to installed the CGI feature which is really easy. To add this functionality, simply check CGI under Application Development and click Install Now and away you go. After completion, you should see the following in your Role Services with CGI showing installed -

Getting Virtual Server Application Setup and Configured

The goal here is to simply get your Virtual Server up and running - which this is where the rubber meets the road. We will do the following in this section:

Install the VSWebApp.exe CGI Handler
Ensure that the appropriate authentication is setup for the Web application
Add VSWebApp as Default Document
Validate that Virtual Server works

Install the CGI for Virtual Server

In this step, we will simply use the all-new IIS Manager to install the CGI application. This is done using the 'Add Script Map' under the Handlers section. The IIS Manager should look like the following -

Let's add the CGI...

In the Add Script Map form, add the following information -

Request Path: VSWebApp.exe

Executable: %programfiles%\Microsoft Virtual Server\WebSite\VirtualServer\VSWebApp.exe

Name: Virtual Server 2005

You will receive a pop-up asking if you would like to add this Handler to the ISAPI & CGI restriction list and you should select Yes

Enable Windows Authentication

The next step was to enable Windows authentication to ensure that you can access the Web application using the Administrator credentials. This is a crucial step otherwise you will get errors such as 'An error occurred accessing the website application data folder' and the event viewer area of the application will show 'You do not have permission to access the event viewer' because by default the Web application is accessed as the anonymous user.

To save in brevity here, I will tell you that you need to ensure that you have Windows Authentication installed using the same steps above for CGI (Windows authentication is not enabled by default.)

After confirming this, we need to disable anonymous authentication and ensure that Windows is the only authentication type enabled for the Virtual Server website.

Enable by double-clicking Authentication while Virtual Server website is selected as shown in this screenshot -

The final step is to ensure that only Windows is enabled which simply done by selecting Anonymous

Add VSWebApp as the Default Document

At this stage, you should have a working Virtual Server Web application. You can validate this by doing entering the following into your IE address bar -

The thing is that some of you might not realize that one nice thing done by the Virtual Server install on IIS 6.0 was to change the default document property to remove un-needed items and add the one important one. In this case, VSWebApp.exe would be at minimum at the top of your list while you can also delete the entire list (e.g. <clear /> for <defaultDocument> section) if you so desire. To do this, you can open Virtual Server website and use the Default Document feature and add to the textbox VSWebApp.exe. The following shows an example of this configuration -

Summary

This was my small, enjoyable task for this weekend as I have happily upgraded my home server to the latest greatest in hardware (Dual Core, DDR2, etc., etc.) and I wanted to move my current Windows Server 2003 R2 server serving as my Virtual Server hosting email, etc. to LHS Pre-Beta3. It was a lot of fun figuring out how to get Virtual Server 2005 R2 working on LHS & IIS 7.0 and it wasn't easy but I managed. I found some bugs along the way and I am going to re-validate this tomorrow again on another image I have so updates might be coming! Either way, fun stuff...

Next: Upgrade Exchange 2007 to LHS and see if I can get Edge services (OWA, etc.) to work with IIS7

Resources

The following will be helpful in getting up to speed with IIS7. As part of the IIS team, I know where most of the resources are for learning IIS7 but I can't say the same for the Virtual Server team. Thus, if you have good resources (like more detailed instructions than I provide in this blog) then send them on via comments. I will certainly add them...

Learning IIS7

Web:

IIS7 Homepage on IIS.NET
Inside Core Server in IIS7
Setup Home on IIS7

Webcasts:

Getting Started with IIS7
An Insider's Look into IIS7 Features
End-to-End Overview of IIS7
Putting the Lego set together: Inside IIS7's Componentization

Tracing ASP.NET Provider on Windows Vista

Wed, 11 Apr 2007 02:13:00 GMT

Introduction

As many of you know, Windows Vista ships with our all-new Web Platform IIS7. I recently got an email from a customer who was struggling with getting a Failed Request Tracing rule setup on IIS7 on Vista Ultimate and asked the following question:

Hi,
I’m trying to configure a “Failing Request tracing Rule” on IIS 7 in Vista. During the Wizard, in the “Select Trace Provider” step, I see the following providers: asp, isapi Extensions, WWW Server, but I don’t see the ASP.NET provider. How can I install it?

Let's Review...

The first thing I do when not obvious is to ensure that someone has reviewed whatever documentation I know about on the topic. In this case, I pointed this customer to a couple of IIS.NET articles that discussed this feature and it's functionality.

Troubleshooting Failed Requests Tracing Using Failed Request Tracing in IIS7

How to capture ASP.NET Page Trace Events in Failure Request Tracing (i.e. logs)

Assuming that these have been reviewed, I move to the next step. I quickly realized that there is a difference between the feature as-is on IIS7 in Windows Vista & that on Windows Server code-named "Longhorn" by simplying reviewing the UI. In Windows Vista, you will notice the following User Interface in IIS Manager -

This, compared to other User Interfaces such as LHS, is odd as there is no ASP.NET -

Oh boy, now how the heck did that happen? Furthermore, what in the heck am I going to do to fix it?

Getting your ASP.NET Trace Provider Back

On some installations of Windows Vista, you might find yourself in this dilemma. If you do then I am not delivering any superman-like details but I do have a solution provided by our Tracing guru - Eric Deily. If you haven't already viewed his forum post then I recommend you do so because I am just blogging about it!

To workaround this issue and get the ASP.NET Trace Provider back, do the following in your favorite XML editor:

NOTE: Ensure that you are running elevated as an administrator and avoid the nasty User Account Control

Ensure that you have ASP.NET & .NET Extensibility installed via Start - Control Panel - Programs - Turn Windows Features On or Off

Open %windir%\system32\inetsrv\config\applicationHost.config
Add the following to the <traceProviderDefinitions>

<traceProviderDefinitions>

       …other providers defined…
                <add name="ASPNET" guid="{AFF081FE-0247-4275-9C4E-021F3DC1DA35}">
                    <areas>
                        <add name="Infrastructure" value="1" />
                        <add name="Module" value="2" />
                        <add name="Page" value="4" />
                        <add name="AppServices" value="8" />
                    </areas>
                </add>
</traceProviderDefinitions>

That's it. Basically, the IIS Manager builds it lists of providers from this section of the applicationHost.config thus meaning that once define then you will see the provider in the IIS Manager.

Summary

I will do my best in the future to blog more frequently and start to trim down the list of blog ideas. The downside to this is that it takes time, energy, and more importantly effort to maintain a blog. This blog is maintained as a "best effort" and by no means is my way to reach the world. Instead, I like traditional ways like email.

Connection_Dropped in HTTP.sys Error Log - An Explanation

Sat, 10 Mar 2007 08:16:00 GMT

A recent question came into my queue asking about the meaning of the Connection_Dropped log entry in the Http.sys error log (%windir%\system32\logfiles\httperr). This error message, by defination, is not clear to most users -

The reason phrase indicates that a zombie connection was dropped by IIS and not resolved correctly

Example log:

2007-01-01 23:48:12 [IP] 3362 [IP] 80 HTTP/1.0 POST /URL/Page - 1 Connection_Dropped

2007-01-01 23:48:12 [IP] 4187 [IP] 80 HTTP/1.0 POST /URL/Page - 1 Connection_Dropped

2007-01-01 23:48:12 [IP] 4212 [IP] 80 HTTP/1.0 POST /URL/Page- 1 Connection_Dropped

No Zombies 'Round Here

The nice thing about working at Microsoft is two-fold:

a) You *might* have access to source code

b) You don't have access to source code but you do have access to someone who does

Luckily, we recently got one of the experts on HTTP.sys to share the real "reason" that you might get an out of body experience out of your Windows & IIS server. It isn't rocket science, yet more that someone got creative with their use of terms an came up with the nice zombie term just to scare you <g>

Under Load - Data has been Lost

The Connection_Dropped error message isn't overly scary. It most likely means that you Web application is under heavy load and because of this no threads are available to currently provide logging data to HTTP.sys. The most "typical" situation is when an ISAPI is too busy to provide IIS with logging data, which in turn slows communication to HTTP.sys, which in turn gives up and assumes the connection is no longer valid.

But wait, it is still valid. Too late - HTTP.sys has moved on to bigger and better things. This happens approxiatmely at the 2 minute threshold.

As gracefully noted by the expert (not me), think more of this error message meaning LoggingTimeout rather than a connection failure. I like that meaning, or rather name, better than any alien-like experience.

Application Sends are Failing

It is possible as is usual with MIcrosoft technology that there is never just one explanation for the problem, rather, there are a couple. There is a possiblity that the issue isn't related to load or disconnects between IIS & HTTP.sys but instead related to your application. There is the possibility that your application who is responsible for building the response is failing to send the response. In short, it is broke. The key narrowing point to this problem is to understand your threads and their status - use the Event Viewer. If your application is not sending the response then it will typically mean that threads running in usermode are blocking and\or failing. Use SP1's tracing to really watch these things...

An Insiders Look at IIS7 Features - Let's Chat

Mon, 05 Mar 2007 03:09:00 GMT

The 50,000 foot view often isn't what you are looking for especially when you can't see the topic and\or features in action. Instead, often you are only interested in seeing the functionality working and in action so that you can make sense out of it. I recently took time during the IIS Webcast Series - a part of the Live from Redmond Series - to take on both perspectives. You can see the higher level overiew in this webcast, while you can get the more visually appealing drill-down in this webcast - An Insider's Look into IIS7 Features.

Agenda: Cover it All!

In the latter webcast, I covered a little bit of everything in this 78-minute webcast. I started with looking at the new core server, in particular deploying a native module and then protecting my entire Web application with a managed code module that does basic authentication. I reviewed the new architectural changes in IIS7 and also how these changes, along with the new core server, make IIS7 very appealing to everyone.

Moving on to security, I showed how URLScan's functionality previously delivered as an ISAPI filter, is now a native part of IIS7. In particular, I limited the query string characters allowed for my Web application. Lastly, I used our new command-line utility AppCmd to locate the currently executing requests as well as the new IIS Manager.

To review, I showed the following:

Extending the server with a Native Module (ModExpire)
Extend the server with managed code to protect Web application with Basic Authentication
Strip the Web server to a few, small running pieces
Add to the stripped down Web server by adding an ISAPI extension
Restrict query string parameters accepted by my Web application using IIS7's Request Filtering feature
Detect long running requests using AppCmd & IIS Manager
Add IIS Manager modules with custom functionality
View IIS log files & trace files in IIS Manager

Are you ready?

As new as IIS7 is to many of you, I suspect that any or all of the above will is intriguing. If this is the case, you might be interested in learning more by viewing this webcast.

View Online - An Insider's Look at IIS7 Features

Get the Powerpoint - and Read up!

Webcasts are a nice medium for many to visually learn. For many though, it simply takes too much time and too much investment. These individuals often subscribe to the "Just the Facts, Ma'am, Just the Facts" :) and just want the meat. For those of you in this category, I have made available the slide deck while for others they can read a plethora of good articles on IIS.NET's IIS7 homepage. Finally, there are some really good videos available on IIS.NET about IIS7 that are great overviews of the strong feature base that many of you love to watch.

Lego Set & IIS7 - Componentization Rules!

Sun, 04 Mar 2007 05:59:00 GMT

In a recent webcast, I talked about how nice it is to have a componentize Web server. It is more important for IT Professionals because nothing is more frustrating than having to patch, patch, and do more patching. When our server, hopefully soon after Longhorn Server, gets true componentization of the Web sku it will be an awesome accomplishment. For now, I will live with putting specialized IIS Web servers with minimal components on the internet, extranet, or heck the intranet where we have long dominated - with pleasure. I spent an hour talking about the 40+ modules that comprise IIS, mostly native modules, and showed how we could strip them from our running processes.

Inside IIS7's Componentization

IIS 6.0, don't get me wrong, was a rockin' Web server and if you aren't running IIS 6.0 right now - well shame on you. IIS 5.0 was the pseudo-dominant Web server for a couple years until Windows Server 2003 shipped - for good reason. The rest is kinda history...

The one thing to understand about IIS 6.0 is that, albeit secure as heck, it still has a pretty big footprint. It doesn't offer you the ability to really scale back the number of modules running in the process. Instead, it just turns off features by default to ensure that they can't execute. It doesn't guarantee against vulnerabilities *if* the scenario is right because it does allow the binary to be executed because it is loaded in the worker process. Use Microsoft's (formerly systernals) Process Explorer to see the difference, just like I did in this webcast. IIS7 is slim, efficient, and flexible - and absolutely extensible. You don't believe me... try it for yourself!

View the Webcast online or Download

If you don't know about IiS7's componentization - learn today. It is a fundmental reason to start your development & deployment plans for our next generation Web platform.

View Putting Together the Lego Set - Inside IIS7's Componentization Online

Download the Powerpoint

For some, the time isn't available to spend ~60 minutes watching the webcast. This is certainly understandable and so to help I am including the powerpoint for download. Also, you might check out another reference on the same topic here on IIS.NET - IIS7 Module Overview.

Get the Facts on Windows Vista & IIS 7.0 Compatibility

Fri, 02 Mar 2007 05:59:00 GMT

For many, the first question asked when a new version of IIS is released - what is known not to work? In a recent webcast, I discussed what the known issues were for IIS 7.0 vs. IIS 6.0 and how to workaround. The functionality often still works but differently because of the fundamental changes in the platform. For some features, though, it simply didn't make sense to keep shipping the binary as today's Web technologies offer much more robust functionality.

Agenda for Webcast

The purpose of this webcast was to talk about the different changes in IIS7 that might cause functionality not work as you expect. In particular, what features were retired, have changed significantly, and lastly things to think about when moving from Windows XP to Vista when IIS is installed.

We will continue to drill-down on these topics in more webcasts in the IIS Webcast Series, part of the Live from Redmond series.

The Goals & Agenda for this webcast are the following:

Understand what and why features are broke
Discuss Eliminated features in IIS 7.0
Understand upgrade issues from Windows XP & IIS 5.1 (in-place)

You may reference this webcast or you can also use this article published by IIS Team on IIS.NET.

Viewing the Webcast or Downloading

This webcast is available on Microsoft's Webcast portal as well as available on IIS.NET.

View Online

Downloading the Slide Deck

If you prefer to only have the slide deck, I have posted this for you to download.

Getting Started with IIS 7.0

Thu, 01 Mar 2007 05:13:00 GMT

Introduction

I recently delivered a webcast on Getting Started with IIS 7.0 aimed at educating newbies on IIS7 and bring them up to speed with what they have in front of them, and why it is so important that they do it! Reviewing the top reasons to upgrade in 60 minutes or less is like asking a Porsche to governer at 28 MPH. It was stressful, yet exciting nonetheless. A good, non-textual based (like an article - this is great, just some like other ways to learn), review of what differs between IIS 6.0 & 7.0.

Viewing or Downloading the Webcast

The IIS Webcast Series started over 3+ years ago with the goal of simply offering a direct, straight forward, learning approach outside of product documentation or Microsoft Learning from Microsoft. With over 100+ webcasts since that date, the IIS team embarked on bringing IIS7 to the masses. It started in mid-February with our first official Webcast on IIS 7.0 in the IIS Webcast Series.

It isn't a lie or a secret that during this process, I will be researching and learning the IIS 7.0 topics and bringing the experts in as necessary along with you. The difference is that it comes from a seasoned IIS 6.0 veteran with lots of IIS knowledge - a good opportunity to get up to speed quickly with IIS7.

You can view online or download this webcast on IIS 7.0.

Powerpoint slidedeck from Webcast

For some who attended, and others who didn't, you might simply be interested in the slide deck. You can download the Slide Deck for viewing as an alternative to viewing the webcast.

If you would like to participate in live events in the IIS Webcast Series, please check back for information to see the March through June topics.

Managing IIS 6.0 Servers from Windows Vista (and other Management Stuff)

Wed, 03 Jan 2007 19:03:00 GMT

Introduction

To my surprise, it seems there have been several questions from customers on how to manage their IIS 6.0 servers when running Windows Vista. It is surprisingly easy assuming that during the Vista & IIS7 setup process they installed the right components. To simplify things, I felt it necessary to share quickly how you can manage your IIS 6.0 servers using Windows Vista.

Installing the IIS Manager for IIS 6.0

This MMC Snap-in is shipped as part of IIS7 on Windows Vista to many surprise. There are two main reasons this snap-in is available on Windows Vista since IIS7 offers a brand new IIS Manager:

The brand-new IIS Manager for IIS7 does not work for managing non-IIS7 servers.
Other services, in particular FTP, does not use the new IIS Manager but instead uses the existing Snap-in from IIS 6.0

The key here is that many of you might miss installing the IIS Manager for IIS 6.0 during a "typical" install for IIS7. IIS7, as did IIS6, installs with a minimal install base for security purposes and because of this the snap-in might often be missed or removed during the install process.

The following steps should help you install the IIS Manager for IIS 6.0:

1. Open the Vista Control Panel

2. Click Programs

3. Under Program and Features, Turn Windows features on or off

4. If User Account Controll is not disabled, accept the warning to elevate privileges for the Windows Features dialog to appear

5. Under Internet Information Services, expand "Web Management Tools", then expand "IIS 6 Management Compatibility"

Quick Explanation of these options:

IIS 6.0 Management Console:

This is the IIS Manager for IIS 6.0 as you have been looking for all along. It is hosted using the Microsoft Management Console (MMC) and allows you to connect to multiple machines from within that console (IIS7 also allows you to do this as well as of Longhorn Beta 3).

IIS 6.0 Scripting Tools

The infamous .vbs files used by some to manage their web servers from the command-line. These include items like adsutil.vbs, iisext.vbs, iisapp.vbs, etc.

IIS 6.0 WMI compatibility

The most common instance where you will install this functionality will be when selecting the IIS 6.0 Scripting Tools as many of them depend on the WMI provider shipped with Windows Server 2003. However, if you have written your own custom WMI scripts for IIS 6.0 and need them to function on IIS7 then you would install this feature.

IIS Metabase and IIS 6 configuration compatibility

The backbone of all these features is the ability to understand, write to, and configure IIS using the legacy "Metabase." This feature installs what we call the ABO Mapper functionality which is a intercepter of all low-level metabase calls and "maps" those calls to the new IIS7 configuration system. When selecting any options, such as the MMC or scripting tools, this feature will be selected and needs to be installed. Without this installed, Windows Vista does not require Inetinfo.exe nor should it have it unless other features (like SMTP) need this process.

Running IIS Manager for IIS 6.0 & IIS Manager for IIS 7.0 Side-by-Side

You are in fact reading this clearly and the situation is this - you will have 2 IIS Manager's if you intend to manage both IIS 6.0 & IIS7 on a single box. This was necessary in order for us to completely re-vamp and rebuild the IIS Manager to support all the powerful features that come with IIS7. Beyond that, the new User Interface offers a lot more easy-to-use approach than the past IIS Manager by not cluttering up your mind with tabs, mis-placed feature headings, and so forth.

The question that comes to mind is why not make IIS7's new UI support IIS 6.0 using the compatibility features listed above. This is a great question and one that Microsoft didn't take lightly. However, with everything comes a price and time and in order to deliver the next world-class web platform on Windows Vista - well, we needed to make some cuts. It was easier to deliver 2 snap-ins than to integrate the features and functionality to detect and manage from a single interface.

Besides...that would just be too easy, right? <g>

Managing IIS7 on your Windows XP Desktop

The begging question from many non-Vista fans is how can I manage IIS7 from my XP desktop. There are many of you who simply aren't ready to 'experience' Windows Vista and have too much invested in your XP machine to jump ship. The IIS team hasn't forgotten you either and is delivering the new IIS Manager for IIS7 directly to you via a download. It currently is in "beta" and can be download directly from the DownloadCENTER on IIS.NET.

The IIS Manager for IIS7 does require that the .NET Framework 2.0 is installed on your XP Desktop.

Summary

Though confusion might exist at first, with a little education and knowledge you will quickly get the hang of all this "compatibility" stuff. IIS7 does all it can to effectively support your current envirionment and with a few easy switches can work using your environment of tools, scripts, etc.

Resources

IIS7 Setup Resources

Install IIS7 on Windows Vista

IIS7 Administration

IIS7 Configuration & Compatiblity

Configuration Compatibility

Managing other Services on 2003 with Windows Vista (Admin Pack)

Enjoy!

-Chris

Christmas Project: Getting Exchange Server 2007 Installed

Sun, 31 Dec 2006 03:12:00 GMT

Introduction

One of my many holiday projects was to get Microsoft Exchange Server 2007 installed and running over the weekend at home to replace my Exchange 2003 installation. The most logical (and possibly the easiest, but who knows) thing to do is upgrade but that would be too simple. It took me just over six total hours to get a brand new working installation of Exchange 2007 on my Yuppie Redneck domain at home - not bad considering the pretty massive changes made to Exchange.

This blog entry is just to outline what a fairly novice Exchange person ran into through the process, along with some other interesting tidbits I came across during the process. They might be useful, while they also might not be...

Goals

Install Exchange Server 2007 on Windows Server 2003 (no, Longhorn isn't supported yet)
Configure Exchange Organization for Receiving\Sending mail for my Public (yuppieredneck.com) & Private domains
Learn some new things...

Installation Gotchas

The first thing to do in any "new" situation is to do what - install CD and see what happens. A "fire first, aim second" approach is the only way for this geek to go - ain't no different here. The nice thing though is that Exchange Server 2007 gives you some pretty nice pre-reqs list before letting you chase your tail. Thus, the first two things I had to do being the novice is to install the following:

Microsoft Management Console (MMC) 3.0 (from the web)
Windows PowerShell (codename: Monad)

There might be a few of you who ask - wait, my install asked to first install the .NET Framework 2.0 - why not yours? It did, though being a web guy, I don't usually ever install a new server without dropping the framework bits on the server. Thus, it was already installed.

Getting SMTP flowing in\out of the Building

The first major thing is to get email back up & running since my wife will let me know pretty quickly if email is down. This took a little bit of time but not a great deal considering that most of the work I could do with just a few hints from the Exchange help. Yes, I admit it, I read some of the manual. However, it wasn't all that easy and did require one email to our internal alias for help to solve the problem. I will share more details...

It was easy to configure the Client Access role for the organization and\or server at first because my org consisted of exactly one server. This isn't the Exchange Server 2007 best practice blog so please don't think that I am suggesting this setup. In fact, I *highly* recommend that you don't install Exchange in this configuration if your budget can afford it.

The whole point though is that in single configuration environments you install several roles on the single server. This includes the Client Access Role, Hub Transport Role, and a few other various roles. For my installation purposes, I didn't get involved with Unified Messaging Role (Telephony) or even the Edge Server Role. The Edge Server Role is a interesting principle that is put forth by the Exchange team whereby you place the server with this role in the DMZ and ask the world to talk with just this server. It didn't suit me just right because I don't use the concept of a DMZ at home because I just can't trust throwing a full server out there, instead, I use my firewall (SonicWall TZ-170 Wireless) Access Rules to define what traffic gets through and where it goes. For many, this is nothing more than Port Forwarding.

Thus, this put forth my first interesting issue:

Issue 1: By default, the Hub Transport Role is locked down by default to only allow communication from the Internet using Client Authentication. This is obviously isn't my goal since I want to have all MX traffic for my domain pointing to this server and it translate & deliver as appropriate. My first error message was pretty straight forward:

530 5.7.1 Client was not authenticated (from the NDR sent to me as the sender)

I then went on to find out this "locked down" problem and went off seeking to solve it. I quickly stumbled upon a few examples of how to resolve the problem using the Exchange Management Shell though what the "documentation" told me to do didn't work. I would have liked to have been able to do this using the Exchange Management Console though I was running on Beta 2 build (for fun) and a nice little note was found below this image:

Thus, I found the Exchange Management (Monad) command to use via a blog on the MS Exchange Team Blog -

Set-ReceiveConnector "[Your Receive Connector Name (i.e. Default {ServerName})]" -PermissionGroups:"AnonymousUsers,ExchangeLegacy,ExchangeServers,ExchangeUsers"

If you struggle, this is the RTM documentation for Exchange Server 2007 for the Exchange Management Shell for connectors -

Management Shell Command-lets Options

At this point, the command worked and all of sudden mail started flying into my domain and my inbox. It was mostly spam, but that is another day and another piece (ForeFront).

The last thing I needed to do is ensure to setup a New Send connector and I did so by using the same documentation and using this command:

New-SendConnector -Name "Friendly Name" -AddressSpaces {your domain name}

Management Shell Command-lets Options

Crazy as it may sound, it all just worked from this point on. I enjoyed the experience and boy have "da boys" in Exchange come a long way since 5.5 & 2000!

Resources for SMTP Flow:

Wait, a better way to do it...Client Access Role on Web Server

Issue 2: I ran into my second dilemma as I realized that I would need to open ports for two servers inside my network if my current environment stayed the same. Basically, my primary access method for clients (i.e. Chris's Outlook, Mom's OWA, etc.) is via port 80 (RPC over HTTP & HTTP) and I don't have but one web server (by choice). Thus, I was faced with an interesting dilemma - setup redirects to get clients to the mail server's OWA installation or change my network.

It dawned on me at this point that this is where the brilliance came in from the Exchange team. Just like the brains in IIS came up with the modular IIS server for IIS7, the Exchange team was able to divorce "Mailbox" roles & "Client Access" role. The lightbulb went off (instead of me reading it which I am sure I could have done) and I realized - wait...Install the Client Access Role on the Web Server and it will take care of finding the mailbox storage server. It was then that Issue #2 was solved by doing the following:

On Web Server, install Exchange 2007 Client Access Role ONLY
Removed Client Access Role from the Mailbox Role Server (i.e. Mail Server)

Thus, today we have a single port open for HTTP access to email - Yuppie's E2K7 Mail Server and a single, internal mailbox & transport server.

In a perfect world, all things would have just worked but this just wasn't the case. Instead, the first problem I had was that on my IIS server I had done my typical practice of deleting the "Default Web Site". Thus, during the "Client Access Role" pre-requirsites check it barked, scream, in fact just cored that it didn't have that "Default Web Site." I even, though knowing already what the issue was, clicked on their link that was to help *solve* resolve the problem and get Client Access to install on this system. It was then that I dropped my chips, my Diet Coke spilled over, and my chair flipped back ...you want to know why?

The *recommended* steps to resolve this problem was to "Un-install & Re-install IIS 6.0"

In particular, I am referring to the following Error in the picture:

Error:

Unable to access the 'Default Web Site' on this server

If you click that little "Recommended Action" you will get this awesome, though totally not logical, suggestion to resolve your problem. If anything in this blog might be helpful, let me just say it is this one piece of knowledge. My day job is spent in the Web (i.e. IIS) world and the first thing I know is that they are looking for one thing:

W3SVC/1

If you don't have your 'Default Web Site' because you are like me and just can't fathom having something that you aren't going to use then you will quickly be in a "pickle." Though, my friend, they great thing is that you can easily fix this problem *WITHOUT* un-installing IIS. If you are like me, I can imagine my world isn't too far off. I often run more than one Web site on my Web servers and things don't come out very pretty when you remove IIS 6.0. Especially, and more noteworthy, if you don't have a stable and good backup.

Resolution:

I need to install Client Access Role on my Web server (IIS) and I need to do it without uninstalling and re-installing IIS 6.0. I need Exchange's setup to detect that I have now returned the Default Web Site to its glory as the first, and most important, website on this server installation. What may I do...?

The options are several, the one I pick is easy. I forewarn, though, that I didn't say the *easiest* so your way might be easier (um, like turn on Edit-While-Running and do Find\Replace) but I like being careful.

Steps:

I installed the IIS 6.0 Resource Kit Tools to get the Metabase Explorer (MBExplorer) tool on the Server (or just copy it over or connect remotely)
I opened up the Metabase, and located the Default Web Site:
The problem is fairly easy to locate - after re-creating the Default Web Site, it doesn't get installed to W3SVC/1 so the install is failing
Right-click on the W3SVC/998577302 and choose Rename
Rename to 1

At this point, the install will succeed. However, you should note that you are not finished. After the install is completed, you will need to use this tool one more time to change a few other locations where the wrong path is put in during the install.

Locate the AppRoot property for /Exchange VDir and you will see a path like "W3SVC/998577302/Root" and this is invalid
Change the # from 998577302 to 1
Do the same for /owa, /exchweb, /public, and the other various virtual directories.

Conclusion

In the end, I have learned a lot over the holiday about Exchange Server 2007 and I like a lot of what has been done. It is clear to me that the Exchange team takes customer's voices very serious and it shows in 2007. I was able, as a past Exchange Administrator, and a fairly novice skill-level get mail up and running on my new domain pretty quickly.

The one major disappointment I had was with the Recommended Action for Issue #2. This is a dangerous act and I know there are better ways to accomplish this without possibly leading to downed Web servers. However, all in all, it has been a fun and enjoying time spent -

Happy New Year folks...

-Chris

IIS7 Deployments calls for ETag Usage Review if using

Tue, 19 Dec 2006 06:16:00 GMT

Introduction

Entity Tags (ETags) are commonly used in Web applications to effectively leverage the power of using web farms, which is a non-fancy term for HTTP/S load balancing. In web farms, a common practice is to set what is called ETags as it helps enhance performance in web farm scenarios. ETags is controlled in IIS by a metabase property (ETAG_CHANGENUMBER) and this value is sent back to clients via response headers as instructed by the HTTP RFC 2616.

If the ETag value is the same across a number of servers, then clients are not required to re-download content that already exists in the clients cache. Without this value set to the same, clients might communicate on subsequent requests to another server in the web farm and receive an unnecessary response of data from the IIS server.

For purposes of this blog, I will focus on modifications rather than further definition of ETags. However, you can read more in the IIS 6.0 documentation on ETags to get more familiar with them.

...Web Farms, IIS 6.0 & RTM

A change that has caused a few of our customers issues when upgrading to Windows Server 2003 & IIS 6.0 is a change to our ETag computation. At RTM, we changed our behavior from IIS 5.0 hence causing IIS customers large problems as increase in traffic began to occur once migrating to IIS 6.0. The cause of this issue was a known bug, 823544, and was fixed prior to the release of Service Pack 1. Beyond that, we found an additional bug, 900245, that caused the ETag value to change when the IIS 6.0 metabase configuration was changed. This would be an expensive change in web farms because this would cause sync scripts to be sure to validate this new ETag value across all servers during their deployment.

As with any major update, it is in the best interest for customer's to avoid these bugs by installing Service Pack 1 which integrates these two fixes for delivery in a major milestone.

...Web Farms, IIS 6.0 & Service Pack 1 (slipstream)

In slipstream installs, you do not need to do anything other than set the ETag value to match across your web farm servers. The problems with ETag mentioned above have been fixed and should work as designed.

...IIS 6.0 & IIS 7.0 - Making it work

In comes IIS7, the next generation platform for web applications for Microsoft. The headaches caused by these changes in IIS 6.0 were heard loud and clear as we have changed this behavior. In IIS7, the ETAG_CHANGENUMBER value is now set to "0" as to not interfere with deployments to web farms.

The key take away is that as IIS7 servers start to integrate into your environment with other IIS 6.0 servers is that you will need to change the ETAG value property to "0" to match the IIS7 servers. If you do not, then you will see performance go down as client's caches are invalidated.

To do so, do the following:

Locate adsutil.vbs (typically in %systemroot%\inetpub\adminscripts)
In that directory, issue the following command:

cscript adsutil.vbs set w3svc/etag_changenumber 0

Summary

I bring this up as it recently came up internally as we have some internal deployments that had this value set in the metabase on their IIS 6.0 installations. Upon deploying IIS7, they came upon this problem and had to modify the behavior as they integrated IIS7 & IIS 6.0 servers together in their web farms.

As mentioned above, if you dedicate your IIS7 servers to their own web farm as to avoid this problem. I hope this might help some of you avoid this issue in your future deployments.

Additional Resources

Ever get too Busy? Take the time...Learn

Wed, 13 Dec 2006 19:01:00 GMT

I thought I would take a moment today and re-invigorate a passion I have had for quite some time and that is blogging. I apologize in advance for the incredible gap between this post and my last and certainly want to ensure you that I will try and avoid this type of gap in the future. This post, though, is dedicated to my father who I lost on October 29th, 2006. My hero would have wanted me to move forward and continue to seek the passion that is my life. I miss you dad..

Introduction

Why the title? It is easy to sometimes get caught up in life's day-to-day activites and forget to seek your passion. I am often challenged by this because of the sheer volume of email that crosses my inbox daily - the typical life of someone working at Microsoft. As reflection in the past few weeks has been a hot topic on my mind, I decided that it was time to make sure that I never got too busy to do what I love. I have two passions in life - (one I got honestly from my father who served 23 years in the US Army training soldiers in the classrooms) technology & teaching. I love to learn anything new about technology and in turn take time to teach others what I have learned. For anyone wondering if I have ever used either of these two skills, take a moment to review the IIS Webcast Series and count the number of times you see my name as the presenter.

Recently, prior to my father's death, I got too "busy" to remember what makes me tick and why I love my job. I love my product - IIS - and I love to teach my product to all of you. I got too busy recently fighting this fire or that fire or running this project or that project that I failed to do what I love. Reflection the past few weeks reminded me that we can never go back so make the most of today and never "wish" anything. Because of that, I just want to let the world know that I promise two things: to learn, to teach. Oh, and to have fun...(guess that is 3, huh?)

Webcasts

First, the IIS Webcast Series will be re-born again starting early next year. The focus of these webcasts will be on educating all of you on the current Windows Vista release with IIS7, as well as what is new and upcoming in Longhorn Server's release of IIS7. You should believe me when I say that if you thought there was a lot to learn in IIS 6.0, let me just say "You ain't seen nuttin yet!" IIS7 is an incredible release with unbelievable potential for all of you but what comes with all this potential is complexity and a learning curve.

These webcasts will target a blended audience as I try and help both IT Professionals & Developers learn more about IIS7 than they ever thought possible. If TechNet will not have us, then I will use MSDN. If MSDN will not take us, then I will use Live Meeting. In either way, we will "Git-R-Done!"

The topics are in the works right now (if you want any, let me know) but as soon as they are approved I will post them to IIS.NET's Webcast home.

Videos

Second, I am going to spend a lot of time these next few weeks not only experiencing IIS7 but also learning Camtasia Studio as it will become my next best friend. I will apologize up front that I have tackled the task of making videos with my southern accent but each will be only 4-6 minutes long (limited time listening for your ears) and focused on a particular topic of interest to many of you. When complete, we will make sure to get them posted to IIS.NET so those of you who don't have time to actually "do" stuff can actually just watch and learn. We will start simple and if you have anything in particular you would like me to cover, drop me an email or a comment and I will see what I can do.

Articles

Last, it wouldn't be complete if I didn't also publish some articles on IIS.NET while at it. This is well under way as I am currently in the process of moving all of our IIS Insider columns from TechNet to IIS.NET. A huge thanks goes to Brett Hill, our Technical Evangelist for IIS, for starting this column way back in 2001 and it will be re-born once again on IIS.NET. This time we will continue the tradition of having MVPs write the column and will pick this back up in February of next year. For a review of the current IIS Insider columns, take a look at this archive. Have a topic idea not already covered, shoot it over to me.

The next action item is to create a diagnostics portal on IIS.NET complete with details, descriptions, download links, and much more for all of the IIS diagnostics tools. Today, you can pull the entire toolkit or individual tools from IIS.NET though you don't have a handy little area to review prior to download to see if that tool fits your needs. We will have that soon so that you can make an informed decision and to also raise awareness of the tools themselves.

Oh, and lastly I can't idly sit by and help everyone else clean up their nice articles for publishing on IIS.NET. I didn't sit on the sidelines when growing up and my dad wouldn't have wanted me to start today. I will tackle the writing of my own, unique, articles with topics of interest that target IT Professionals. Why not developers? My roots are genuine and although I seek and strive to wear the propeller hat <g>, I will stay true to my colors and ensure to help my fellow comrades - IT Professionals.

Blogs

I can hear it now..."Dude, I am reading your blog - are you kidding me?"

Oh my friend, I will not forget all you RSS junkies either. In my downtime while doing some soul searching (i.e. mourning), I have collected a laundry list of posts waiting to happen. They are coming my RSS friend and they will start very soon. Blogs are a nice, quick mechanism to learn new stuff but they do lack structure to be a true learning opportunity (my opinion which might cause fuss.) I like the above three better but will also tap this new resource call RSS for an opportunity to learn.

One promise: My blog will not be an advertisement. It will be posts only dealing with real questions and real answers. It might not be up there with the top blogs of our time (i.e. our previous favorite David Wang, BillS, ScottGu and others) but it will hopefully serve useful. If not, drop me a line and tell me to zip it and focus on other mediums...

Summary

I got too busy "doing my job" that I have forgotten to do my job. An idle quote from a movie, but nonetheless dead on and recently I have been able to focus my attention on what drives me. I don't design features, but I help design minds that use these features. I offer many of you an outlet for learning that isn't available and most of all for Free.

As I said to my dad in his last minutes, "Dad, there is going to be so many things that I would have wished I said, or I wish I had done and I am not going to be able to say it or do it. Because of this, I just want you to know and remember this - You are my hero, my best friend, my mentor, and most of all a incredible father." I might not have said or done all things I would have liked for Dad, but I am going to try and make sure I say all things and do all things I can to help you. I vow to never get "too busy..."

The sparkle of IISSuba...(oh, that is the IIS Sub Authenticator for those that don't know it)

Wed, 15 Nov 2006 02:42:00 GMT

IIS SubAuthentication - Magic? You bet it is...

For many years, IIS administrators didn't have the first clue what the IIS sub-authenticator was more less how it worked. It wasn't until the security PM (http://iisgeek.no-ip.com/) sat down and really went over subauth did I understand how it works and why it existed. More importantly, I certainly know why it isn't enabled by default today on IIS 6.0.

A couple of weeks ago I was demonstrating a demo of a new tool that Microsoft is working called Authentication and Access Control Diagnostics (AuthDiag) to a group of IIS program managers. During this demonstration, I made the slight mistake of thinking I knew how to break IIS Subauthentication in respect to anonymous access. Little did I know that I would quickly be wrong and corrected by the developer and learn about a slight code path I ceased to know existed...

Did you know...

There is this little checkbox in IIS 5.0 that says “Allow IIS to control Password.“ This isn't voodoo magic checkbox that makes everything just work, but close ;-). This check box is designed to tell IIS to ignore logon attempts that fail because of bad password. This feature was very doable because Inetinfo, where logon user is called, runs as Local System and hence we really didn't need to call logon user in the first place. Local system has the ability to logon a user via impersonation without having the password for the account. This is, by default, a privilege of running as Local System.

For those who didn't know this, slowly pick yourself back up off the floor and relax and know that this isn't enabled by default on IIS 6.0 and you can check for yourself. If you check the metabase, you will find that AnonymousPasswordSync is set to false or doesn't exist (false by default). Oh, and that little checkbox is not there either in the IIS Manager...;-)

This feature, albeit convienent in domain policy driven environments, did live for a reason. Security just happen to not be one of them...since it effectively logs on the anonymous user even though the IIS metabase property AnonymousUserPass was set incorrectly.

Back to this demo, I was trying to show how AuthDiag would capture configuration failures such as these and warn the administrator that their anonymous user settings were invalid. I set the appropriate metabase property (using a script I created), and then ran AuthDiag and it returned - Done! (that is another problem with AuthDiag 1.0 RC 1, but outside the scope here...I knew this meant it didn't find any errors!)

Then, at that moment, I wanted to hit my laptop, bury myself under the table, and say “must be a bug...“ I said just that - but was corrected by the developer of the tool who said - (insert Russian accent) - no, no, not a bug - password work. With a blank stare, I said - if the password is correct, then IIS will call logonuser even if AnonymousPasswordSync is set to true???? He said, yes. Repeat - If IIS has the correct credentials in the metabase (aka - AnonymousUserName and AnonymousUserPass) then it will use those EVEN if anonymouspasswordsync is enabled.

Funny, I thought after living and breathing this product for 4 years I knew a thing or two...turns out I was wrong! ;-)

~Chris

Deploying applications via MSI to IIS Servers

Wed, 15 Nov 2006 02:35:00 GMT

I recently received from a IIS administrator a message which posed a very good question. He asked, I develop a ASP.Net application that I “zip” into a single .msi to deploy to a web application server. I have 2 websites defined, each using a unique host header.

The users issues though was related to where the MSI is installed to as it always defaults to the “Default Web Site” on IIS 6.0. This includes even if he stops all other sites. In IIS 5, he could effectively stop all sites except the one he is interested in and then run the .msi and it would work like a champ. This isn't the case on IIS 6.0 ...

This was a really interesting question for which I pose to any or all listeners out there - ideas? I would love to hear them.

To simplify, I am going to insert parts of this customers email for you to validate information against -

Email with more details

Thanks for the response. Let me clarify. This is not an Asp.Net deployment issue, but rather deploying a web app written in asp.net, deployment issue. Also, it's really not an IIS issue (probably msi or vs

studio) but I have been unsuccessful in getting feedback.

I packaged a asp.net application into a .msi file for deployment to the prod web server. This is a Win2k3 (IIS 6.0) box. We've created two separate websites on this machine using dns entries, 1 IP address. We removed the default website. When we run the installer file, it always installs to the first web site.

In IIS 5.0, the behavior was to "shut down" all active websites except for the one you want to install too. This does not seem to work in IIS 6.0.

Do you have any suggestions or idea for targeting a specific website for a asp.net application using an installer file? I really can't use xcopy or manual techniques because it's a locked down server.

Original Email:

I'm having trouble finding support with an deployment issue I'm having

with asp.net and IIS 6.0. We have setup multiple websites on a server.

However, asp.net installer always installs to the first website it

finds. What technique can i use to have application install to a

specific website? I know this may be a windows installer issue, but I

figured, why not?

Look forward to hearing from everyone!

~Chris

ASP.NET 2.0, 1.1 Sharing Environments: Careful with your web.configs

Wed, 15 Nov 2006 02:30:00 GMT

We recently got a pretty typical question around ASP.NET’s 2.0 release and its influence on IIS installations using ASP.NET 1.1. The first thing you will notice when you have a failure that is caused by mismatches…

The question is:

In testing ASP.NET 2.0, you will have an issue when the user has an ASP.NET 2.0-style web.config sitting in the root of their website, and a 1.1 app installed in a virtual directory.

It appears that the 1.1 runtime is looking at the 2.0 web.config in the parent directory, and trying to parse this as if it were a parent 1.1 web.config. When I remove the web.config at the root, the error goes away.

"Is there a way around this behavior? If not – it would seem that we cannot support Windows Shared Hosting apps on sites which have an ASP.NET 2.0 app installed at the root of the website."

After talking with those in the “know” we have found that the following: (By Design)

We do not support a v1.1 application having a web.config file from v2.0 in the config hierarchy, as you have in this case:

/web.config contains v2.0 settings

/app is mapped to v1.1

I recommend following the guidance from the URL below…

Learn ASP.NET 2.0 & IIS 6.0

"The solution is, simply, to *not* create an Application in the root. The root should remain un-configured, as a container for all Applications, and never be used as an Application itself."

This is interesting stuff. I hope it helps…

WARNING: ChrisAd has not tested nor played with this solution. Try at your own Risk!

P.S. Thanks to Michael Johnson, Hosting Evangelism at Microsoft, for bringing this question to the Development team.

Timeless Question about Installing IIS on a Non-System partition

Wed, 15 Nov 2006 02:29:00 GMT

A question was asked — Why does Microsoft still force customers to install as the webroot to the system partition (i.e. C:\inetpub) when all security-related documentation advises to not do this?

I casually grinned, then openly smiled and said…”just because. Kidding!” It is a very legitimate question and my response was fairly lengthy but went something like this…

Starting with Windows 2000, IIS was installed using Windows installation technology (SysOcMgr). The technical reason we don’t allow this is based on the fact that there is no means of doing a “custom action” in SysOcMgr. If you ever think back to anything you do in Add\Remove programs, Windows never “prompts” you to enter any information. The only actions you take is to click a check mark and then all the magic occurs — except if you don’t have the source files from Windows still available which that is considered an error (not a custom action.)

There is actually a simple solution around this but often many think the tax is to large to do it. The Microsoft answer to this non-system partition webroot is to automate IIS’s installation. This often scares many of our customers as they don’t want to go down that path. However, it should be noted though that you don’t have to do a full OS install through automation but instead just automate the install of IIS. This is easy.

1). Create a file called Unattend.txt and open it with Notepad

2). Paste the following into that file:

[SetupMgr]
    DistFolder=d:\i386

[Components]
    aspnet=off
    complusnetwork=on
    dtcnetwork=on
    bitsserverextensionisapi=off
    iis_common=on
    iis_ftp=on
    fp_extensions=on
    iis_inetmgr=on
    iis_nntp=off
    iis_smtp=off
    iis_asp=on
    iis_internetdataconnector=off
    sakit_web=off
    tswebclient=off
    iis_serversideincludes=off
    iis_webdav=off
    iis_www=on
    appsrv_console=off
    inetprint=off

[InternetServer]
    PathFTPRoot={YourDesiredFTPRootPath}
    PathWWWRoot={YourDesiredWebRootPath}

3). The next step is to open a command-prompt (Start – Run – CMD) and type the following:

SysOcMgr.exe /i:sysoc.inf /u:$PathToUnattendFileCreatedInStep2$

This will magically install IIS based on your parameters. The above file, unattend.txt, installs and enables the following:

WWW Server
FTP Server
Enables ASP & FPSE

The key is to understand that you don’t have to automate the entire OS installation in order to do this. It can be done afterwards. You can also cover all your bases and build a full automated installation of the OS and IIS. This is completely an option. The major thing that changes is that you have a couple of options -

1). Install from a CD

2). Install from a Shared UNC Location

In my case, I chose to install from a CD. This was done by creating a winnt.sif file and placing it on a floppy drive. The Winnt.sif had the following information:

[Data]
    AutoPartition=1
    MsDosInitiated="0"
    UnattendedInstall="Yes"

[Unattended]
    UnattendMode=FullUnattended
    OemSkipEula=Yes
    OemPreinstall=No
    TargetPath=\WINDOWS
    Repartition = Yes

[GuiUnattended]
    AdminPassword=ca8d43d0eae56d10197a3608820ae698fa3254ef3d8ce553674c94fb185
    EncryptedAdminPassword=Yes
    OEMSkipRegional=1
    TimeZone=4
    OemSkipWelcome=1

[UserData]
    ProductKey=**InsertValidKey**
    FullName="MyName"
    OrgName="MyCompany"
    ComputerName=MyComputer

[Display]
    BitsPerPel=24
    Xresolution=800
    YResolution=600
    Vrefresh=70

[LicenseFilePrintData]
    AutoMode=PerServer
    AutoUsers=5

[TapiLocation]
    CountryCode=1
    Dialing=Tone
    AreaCode=425
    LongDistanceAccess="9"

[Networking]
    InstallDefaultComponents=Yes

[Components]
    aspnet=off
    complusnetwork=on
    dtcnetwork=on
    bitsserverextensionisapi=off
    iis_common=on
    iis_ftp=on
    fp_extensions=on
    iis_inetmer=on
    iis_nntp=off
    iis_smtp=off
    iis_asp=on
    iis_internetdataconnector=off
    sakit_web=off
    tswebclient=off
    iis_serversideincludes=off
    iis_webdav=off
    iis_www=on
    appsrv_console=off
    inetprint=off

[InternetServer]
    PathFTPRoot=c:\FTPSites
    PathWWWRoot=c:\WebSites

[GUIRunOnce]
"a:\SetupIIS.Bat"

The only execution I have to do now is the following:

Winnt32.exe /unattend:AnswerFile /s:InstallSource

•I call your attention to the GUIRunOnce section as this is the most convienant means of automating the IIS installation as part of the OS. If you are interested in also setting up and creating your entire environment with zero-effort, then this section is your friend. For example, what if your servers have 30 websites, each with 5 applications, with 12 Application Pools, and custom configuration per-site. You either manually do this work or you could create and\or use existing scripts and push them into this section. In my case, here is my sample file called SetupIIS.bat -

@ECHO OFF

REM
REM Make Dir Structure for Website
cd \
cd websites
mkdir MySite

REM
REM CREATE ADDITIONAL WEBSITES

iisweb /create c:\websites\mysite "My Site" /b 81

REM
REM ADD ADDITIONAL VIRTUAL DIRECTORIES

iisvdir /create "My Site" Upload c:\ftpsites

REM
REM MODIFY THE AUTHENTICATION FOR ONE OF THE NEWLY CREATED VDIR'S

CD \
CD \INETPUB\ADMINSCRIPTS
CSCRIPT /NOLOGO ADSUTIL.VBS SET W3SVC/858812021/ROOT/Upload/AUTHNTLM 0
CSCRIPT /NOLOGO ADSUTIL.VBS SET W3SVC/858812021/ROOT/Upload/AUTHBasic 1

This script creates a directory structure for my new site, creates the website and assigns to that directory just created, and bound the site to a specific port, added a virtual directory, and then customized that virtual directories authentication to Basic and turned off NTLM.

This is just a sample and there is much more powerful things you can do but in the end with the push of a power button you can truly walk away and come back to a fully functional webserver.

The time spent up front is worth thousands of time-off in the future (or spent doing better things!). For a complete and more in-depth discussion of this, view the following webcast I did on this topic and used these scripts — http://msevents.microsoft.com/CUI/WebCastEventDetails.aspx?EventID=1032280620&EventCategory=5&culture=en-US&CountryCode=US.

Enjoy,

~Chris

P.S. Thanks to the person who asked the question and spawned me thinking about this for my blog!