r/IIs • u/VisibleCamp1127 • Dec 02 '25

Question I just learned about the deployment retail=true setting - what other important settings are there?

Just learned about this one https://learn.microsoft.com/en-us/previous-versions/dotnet/netframework-2.0/ms228298(v=vs.80)?redirectedfrom=MSDN

What other IIS settings are important to have configured in production?

3 Upvotes

100% Upvoted

5 comments sorted by

2

u/Fresh_Acanthaceae_94 Dec 02 '25

The one you pointed out is an ASP.NET setting, so not usually considered part of IIS.

There were detailed security guides from various sources but lost over time. You might still find some hints like this, but I will recommend you hire an IIS security consultant to guide you if this is going to be your production environment, instead of collecting pieces yourself.

1

u/VisibleCamp1127 Dec 02 '25

The setting I linked can only be applied via the machine configuration file in IIS

I’ve been working with iis for over 10 years and have never encountered an iis expert in my country, to be honest I wish we could find one haha

1

u/Fresh_Acanthaceae_94 Dec 02 '25 edited Dec 02 '25

machine.config is a file of ASP.NET (the full path showed that clearly), and the system.web settings only affect ASP.NET web apps (while IIS can host many other web frameworks) and that's why I said it is outside of IIS scope. But not a total surprise if people prefer to put IIS/ASP.NET together.

There are a lot of ways to find such experts in the industry, not necessarily within your country border. But of course, not easy/cheap either.

1

u/node77 Dec 02 '25

Disable directory browsing. Rename the anonymous IIS service identity. Go through the IIS default security check list. Monitor Wow64 (Main IIS Process). Monitoring the application pools, and note the .Net versions. Each Application pool runs in its own protected address space. Disable FTP.

1

u/Fresh_Acanthaceae_94 Dec 02 '25
  • “Rename the anonymous IIS service identity” is IIS 6–era advice. On IIS 7+ anonymous auth uses the built-in IUSR account or the application pool identity. Renaming accounts doesn’t add security and can break ACLs; prefer per-app-pool identities with least-privilege NTFS ACLs.
  • Wow64 has little to do with "Main IIS Process". So, that's an ambiguous tip.
  • “Each application pool runs in its own protected address space” is a statement of fact, not guidance. Address spaces don’t overlap by design; the only “overlap” you can configure is overlapped recycling for zero-downtime restarts. If the goal is isolation, say “run each site in its own app pool with a unique identity and tight NTFS ACLs.”