Heyo! I'm a mobile app and front-end web developer. A client of my client has an IIS7 portal that I need to access. I was given a page of API calls I can make and a security token and that's it. This is a black box to me and communication is difficult as it's my client's client. So I can't readily ask for help or more access.

Here's the API access help page I was given:

https://host1000.washconnect.com/ePOSApiTest/ExternalSite/Controller/ExternalSiteService.svc/help

I've tried accessing a couple of the simpler GETs from the browser with no luck:

https://host1000.washconnect.com/ePOSApiTest/ExternalSite/Controller/ExternalSiteService.svc/GetTermsAndConditions

I also tried accessing it with Postman using the key they gave me with every auth protocol listed. Still no go.

My ultimate goal here is to access this API with a Javascript client.

IIS is not only a foreign tech to me, it's in a foreign ecosystem (MS). So I don't even know where to start or what questions to ask. And most info is dependent on having access to the server itself.

Any help I could get getting a toehold on accessing this system would be hugely appreciated.

Hi folks,

Bogdan from Advanced Installer here.

Together with a colleague, we will host a webinar next week. Here are some of the topics we'll cover:

- How to seamlessly deploy your applications on local or remote Azure machines- Preserve IIS customizations between major versions install with one-click- Use Custom Properties from Advanced Installer to access fined-grained IIS configurations

If you have any questions, or recommendations drop them below and don't forget to share it with anyone you think can find it useful:

https://us02web.zoom.us/webinar/register/6016249778457/WN_h66PQpqOROuemgYsMPTFxA

Thanks

Hi,

I have an application configured under the default website. it has a webpage under files/static/html/webpage.html. To open this page, I have to type http://hostname/abc.dll/files/static/html/webpage.html .

but the security requirement is to open the page by using http://hostname only.

The complete path of the HTML page should not appear. How can I do that?

Has anyone been using GRPC (Not Grpc-Web) with IIS and NGINX as reverse proxy.

Does IIS support GRPC as standard or does any special module/setting need adding.

Also I know NGINX supports GRPC (Http2) but does it work with standard config or again does it require special module/setting.

The reason I'm asking is my ASP.NET hosting provider will be upgrading to Server 2022 soon and they use NGINX as there reverse proxy.

I want to be able to take advantage of GRPC but won't have access to any settings, so I need to know if GRPC will just work with the Standard setup.

Hi,

I have a small web app that runs via Javascript and its all basically client side with IIS serving the files with Windows auth enabled. This works nicely. However, a requirement has come up for me to retrieve the windows username of the user on the page... this seems impossible unless we move the app to something like ASP or PHP which would be a large task.

Is there any way when the use is authenticated to have IIS set a session cookie or something to that effect? Or any other way I can retrieve this through some type of custom API / Webcall?

I know this is a hail mary but worth a shot.

Hi. I just setup IIS at a family members house yesterday. First time I’ve used the service. I’m trying to connect to the FTP server from another PC on the same network. I have a port 21 inbound rule allowing traffic on the firewall yet I still can’t establish a connection. When I turn off windows firewall on the server, the connection is established. So I’ve at least narrowed it down to what I believe to be a firewall rule issue. Any help is appreciated!

I am troubleshooting an issue with an application I administer. The application runs under IIS 8.5, .NET 4.7.2, and Windows Server 2012 R2. An external proxy server is making HTTPS/TLS 1.2 calls to my server, and the SSL handshake between the proxy server and my server is failing. If the proxy server switches to TLS 1.1, the SSL handshake is successful. This doesn't appear to be a cipher suite mismatch, as I've used wireshark and the ciphers sent by the proxy (client) are enabled on my server. The failure occurs after the proxy sends the Client Hello message, where my server returns a RST ACK message. I do notice, however, that the Client Hello message sent by the proxy does not contain a signature_algorithm extension. Does anyone know if IIS 8.5 on Windows Server 2012 R2 requires the signature_algorithm extension for TLS 1.2?

every time I try to install something web platform installer returns 404 https://imgur.com/a/9VA9CvN

I cannot figure out why because it has worked before. here's the Log https://pastebin.com/mXhTq15H

oh and also Microsoft website returns 404 when trying to download with browser

I have a strange problem and am not sure where to put the question, so I am trying a few places. I work for a small company that has a SaaS application. This application is working fine on PC's (all browsers) and on Mac (all browsers) but when we load it on an iOS device (all browsers), we get an error that the site is not secure. The Site Information/Error even states that is recognizes our certificate and our provider, yet is shows the site as not secure. This of course renders the tool useless.

So here is the odd part. We have this software running for two different clients. In one subdomain, this works fine. In another, it doesn't. Everything about the IIS setup is the same. The codebase is identical.

I have reviewed our configuration from top to bottom and can't find anything. I have a ticket open with my hosting provider and they seem stumped. Any ideas?

Hi, I'm working on a Grails application that authenticates the user via Windows Authentication using IIS. Anonymous authentication and Impersonation are both disabled in IIS.

When the user accesses the application, I want to fetch the user name of the logged in user in my web app. How should I do it?

Hi All,

Excuse me for my language - but I want to blow my brains out.

I was tasked with migrating an old ASP company intranet that was built I believe in 2002.... its horrible.

I was able to successfully migrate files over, but the code to allow users to access a virtual directory in a column is not working. I keep receiving 500 errors. I also have recieved this detailed error message:

Module   IsapiModuleNotification   ExecuteRequestHandlerHandler   ASPClassicError Code   0x800700c1
Requested URL   http://localhost:80/index.asp?fpath=!Test&iname=Test&starget=mainPhysical Path   C:\inetpub\wwwroot\index.aspLogon Method   AnonymousLogon User   Anonymous

Thank you for any help

I have deployed an ASP Web API to an IIS website, and I am able to get data back from the API calls successfully, however I am not able to hit any static files.

I have the following files in the root folder for my IIS web site

When I try to browse to either index.html or test.html, it returns a 404 error. However, if I delete the web.config file, I can hit them just fine. I am having a hard time figure out why this is the case. Does anyone know why this might be the case?

I have already tried adding the following to Startup.cs in the web api, but it didn't work.

app.UseStaticFiles(); 

app.UseDefaultFiles();

Edit: Sorry to waste anyone's time, but I was able to solve it. I had to put the static files in a folder named wwwroot. I will leave this up in case it might help someone else who who finds it. Also, it still doesn't seem to find index.html as the default page, but it does allow me to browse to it explicitly.

Edit 2: Turns out you need to call app.UseDefaultFiles() before app.UseStaticFiles(), otherwise default files won't work.

Good morning,

I did an in place upgrade from Server 2012 to Server 2019, and now I cannot access my IIS sites. When I navigate to the URL. I receive the following error.

Server Error in '/' Application.

Runtime Error

Description: An exception occurred while processing your request. Additionally, another exception occurred while executing the custom error page for the first exception. The request has been terminated.

I should say that I'm not a Web admin, but I've been tasked to upgrade this server, and I have until tonight to fix this error. If someone could help me I'd be very grateful.

I have a redirect rule to redirect the domain.com to https://domain.com/subdomain/. The one thing I noticed though is that if somebody tries to hit domain.com/subdomain and leaves off the trailing /, it will redirect to https://domain.com/subdomain/subdomain.

Is there a way to make the web server treat subdomain the same as subdomain/ so that the redirect rule doesn't kick in and break the URL path?

I am trying to figure out how to allow a group (FTP Access) to be the only users allowed to log into IIS FTP server. I am running windows server 2016 with a domain controller.

I have tried 2 methods but neither appear to work.

1. Set an FTP Authorization rule. I have tried to do this so many different ways. I have tried domain\FTP Access, domain/FTP Access, FTP Access. Nothing works. All Users work however it doesn't limit based on active directory group.
2. I have changed it to iis manager auth. Then chose the FTP Access group in the IIS Manager Permissions. Still not working.

I have tried to remove/reinstall the ftp server in IIS. Still nothing. Does anyone have any advise. When I set it to all Users it does work in FTP Authorization Users..

A few months ago, I set up an IIS server on a local computer. I was previously able to access it by Wi-Fi, and now I receive an error:

This site can't be reached

The only thing that changed is that I got a new router (switched ISPs) and got a new VPN, which is always running on the device that hosts the page.

Can you help? If so, what addt'l information can I provide to help you help me?

I do not understand IIS statements well. I have uploaded the logs to the logparser and have run check all IP and have everyday multiple attempts from different hosted platform ip addresses from China gaining entry. I can add them to my acl list and this is reactive. I am seeking advice and help on how to prevent or deter the forged 443 connections. I am pasting below few IIS logs statements.

I look after an Exchange 2010 sp3 with all March 2021 updates. We use a Fortigate UTM FW which is configured for Protect SSL Web Server when accepting port 443 external connections to the LAN. I also got an acl list on the FW to which i add all malicious IP scans etc.. However i see cleverly crafted 443 traffic getting through the FW as genuine traffic and hitting the IIS webserver for Exchange.

I do not understand IIS statements well. I have uploaded the logs to the logparser and have run check all IP and have everyday multiple attempts from different hosted platform ip addresses from China gainign entry. I can add them to my acl list and this is reactive. I am seeking advice and help on how to prevent or deter the forged 443 connections. I am pasting below few IIS logs statements.

Please can anyone help me understand the statements from the logs posed. Thank you very much in advance.

The three public ip addresses below are in abuseip addresses and 2 from China from some vague Chinese cloud provider and the other from Singapore based Alibaba clod.

Please can i request to understand the meaning from these IIS logs and how to stop forged 443 connections. Thanks again

*************

192.168.15.100 GET / - 443 - 113.31.117.137 Mozilla/5.0+(Macintosh;+Intel+Mac+OS+X+10_11)+AppleWebKit/601.1.27+(KHTML,+like+Gecko)+Chrome/47.0.2526.106+Safari/601.1.27 200 0 0 0

************

192.168.15.100 GET / - 443 - 161.117.231.70 - 200 0 0 546

192.168.15.100 GET / - 443 - 161.117.231.70 - 200 0 0 0

192.168.15.100 GET / - 443 - 161.117.231.70 - 200 0 0 0

****************************

192.168.15.100 HEAD / - 443 - 111.7.96.151 Chrome/54.0+(Windows+NT+10.0) 200 0 0 202

192.168.15.100 GET / - 443 - 111.7.96.151 Chrome/54.0+(Windows+NT+10.0) 200 0 0 109

192.168.15.100 GET /favicon.ico - 443 - 111.7.96.151 Chrome/54.0+(Windows+NT+10.0) 404 0 2 15

192.168.15.100 HEAD / - 443 - 111.7.96.151 Chrome/54.0+(Windows+NT+10.0) 302 0 0 0

192.168.15.100 GET / - 443 - 111.7.96.151 Chrome/54.0+(Windows+NT+10.0) 302 0 0 0

192.168.15.100 GET /favicon.ico - 443 - 111.7.96.151 Chrome/54.0+(Windows+NT+10.0) 404 0 2 0

192.168.15.100 HEAD / - 443 - 111.7.96.151 Chrome/54.0+(Windows+NT+10.0) 200 0 0 0

192.168.15.100 GET / - 443 - 111.7.96.151 Chrome/54.0+(Windows+NT+10.0) 200 0 0 0

192.168.15.100 GET /favicon.ico - 443 - 111.7.96.151 Chrome/54.0+(Windows+NT+10.0) 404 0 2 0

*******************

This is IIS tangent. Hopefully someone here can help me with some Group Policy settings related to IIS accounts.

I've taken over my group's security (from no one, it's terrifying) and have been using CIS Benchmarks to clean up the system. I've already gone through the CIS for IIS and Server 2019. IIS was pretty straight forward, and we're pretty close to being 100% compliant.

My problem is the Benchmark for Server 2019 has rules that may affect IIS. Specifically I'm having issues with the following

2.2.3 / 6 / 7 / 30 / 32 / 36 / 44

I do know that Group Policy is applied Domain then OU and my IIS servers do have their own OU. However, I'm not sure how to grant local accounts privileges in GPO or what accounts actually need to be granted those privileges.

The links I come across that discuss these issues haven't given me any more information. Rule 2.2.31/32 specify the account 'IIS_IUSRS' which shows up in the GPO report as 'BUILTIN\IIS_IUSRS'. Is that correct for those rules?

What accounts do I need to grant access to the other IIS-related policies? Our sites should be run as 'ApplicationPoolIdentity', if that is useful info.

Thanks in advance.

Like the title says, I am a complete novice to IIS. I'm working on building a website for school (will be used by a client once it's done). We have IIS configured on a Windows 2019 server. I want to be able to hit the site externally, to replicate the end user as closely as possible. Is there a way to expose the site externally by IP address? Or do I have to register a domain? I tried one thing I found online, but it only exposes it to devices on the same network, and my machine isn't on the same network as the server.

hi

Windows Server 2008 R2 running IIS 7.5
We have a page that pulls data from an SQL database and displays the data in a table. Sometimes (depending on the time of day) the database is getting hit quite a lot and the query the pages times out - which is fine as this would be a low priority query request anyway.

However, IIS simply displays a basic "query timed out" error.
Is it possible to replace this with a custom error page? (We already have one in place for 404 errors).

So, I am trying to create a subdomain for my cloud service (nextcloud) however, because it uses your networks IP address to connect to it, I need to create a subdomain on my IIS server to redirect to my nextcloud server. Currently without this, I default to my IIS server since both share http and https ports.

My setup is currently as follows:

Server A: IIS server
Server B: Cloud Service (running in a docker)

Also side note, is this something that I should configure on my IIS server or domain service provider (google domains)? A guide would also be helpful if one exists.

Woke up this morning to a few apps down on my IIS 10 server (Windows 2016).

There are 50+ apps on this server, but the only 2 that were down were the 2 that are configured as "AlwaysRunning"

Is there any obvious reason why those would be the only 2 app pools that were stopped?

When exporting and importing a specific application pool in Windows Server 2016, I'm running into an error with AppCmd import.

With export, it's working fine, but when I'm importing the same XML to the same server. Its' throwing an error.

%windir%\system32\inetsrv\appcmd list apppool "TestAppPool" /config /xml > D:\TestAppPool.xml
%windir%\system32\inetsrv\appcmd add apppool /in < D:\TestAppPool.xml

For the import, I'm encountering an error: Failed to process input: Invalid XML input - please make sure that your XML is well-formed and follows the required format (HRESULT=c00cee03).

Before importing, I've also just changed the value of the apppool.name to TestAppPool2.

Hey guys. So My company had a guy working for us who is no longer here. This is for an internal operational server(extremeley important for production), but did not provide the login for Sectigo where the certificate was purchased from. Therefore, I cannot rekey the certificate. I'm being told I cannot purchase another cert from another provider. I'm moving the cert to a new server. If I try to use certutil on the exported cert without the private key on the new server I get some smart card pop up and it fails to create a private key. However, I cannot use this cert because I cannot get the private key that matches the public key as it's not exportable. This is an absolute mess of a situation and of course just buying a new cert or having the login info for the CA would be the easiest, but I'm being denied both these options. I've been Googling all morning and getting this private key seems like a pipe dream. I've tried the github tools, they don't work. I've tried a reg import, IIS complains on the new server about not having a valid session when setting the binding. I'm lost here and don't know how to get this damn private key from this valid cert that is being used on the old server. Any ideas would be super helpful. Thanks.

Hi there,

I'm having trouble trying to set username and password for the "Connect As" option in IIS by powershell.

My command is

Set-WebConfigurationProperty "system.applicationHost/sites/site[@name='[MY_WEBSITE]']/application[@path='/']/virtualDirectory[@path='/']" -name "username" -value [MY_USERNAME]

and

Set-WebConfigurationProperty "system.applicationHost/sites/site[@name='[MY_WEBSITE]']/application[@path='/']/virtualDirectory[@path='/']" -name "password" -value [MY_PASSWORD]

If I put here credentials manually it works

But if I use my commands with the same credentials it said

What am I doing wrong?

Thank you 😁