Steve Schofield Weblog

Getting AWStats installed and configured on IIS 7.5

Tue, 10 Jan 2012 04:31:24 GMT

One of things I’ve wanted to evaluate is AWStats for doing analytics on a variety of sites I run. AWStats (www.awstats.org) is a free Open Source (Perl based) package. One of the things I couldn't find that covered the steps to get IIS 7.5 up and running. I’m still working on a few config items within AWStats, which if you have suggestions, please let me know.

Here is the order of what I did to get my server up and running. I’ll assume you have a Windows Server 2008 or 2008 R2 server with IIS Installed. If you have any further questions, comments please feel free to add to the article.

Steps

Download, Install ActivePerl
Download AWStats
Setup DNS (Optional)
Setup IIS Site
Configure App Pool as 32 bit
Setup Perl Handler, approve isapi
Setup AWStats conf files.
Enable frequent updates
Misc things

Download, Install ActivePerl

http://www.activestate.com/activeperl

The first thing you'll need is a method to run PERL on Windows. Thankfully, ActiveState provides an x86 and x64 Perl implementation. From my testing, I can only get the x86 edition running within IIS. For purposes of this article, download and install the x86 (32 bit) edition of ActiveState. Later in the article, we'll configure IIS.

I installed ActiveState (32 bit ) to C:\Perl If IIS is installed, you’ll want to confirm if the HTTP Handler is already setup. If not, I’ve included a command later in the article how to setup.

Download AWStats

The next step, download and extract Awstats. The current version available is AWStats 7.0. Go to http://www.awstats.org , download and extract somewhere on your system.

Setup DNS (Optional)

For my purposes, I setup a single separate websites to access my stats. The link I used is in the format below to access various domains. I setup an A record called Stats in DNS.

http://stats.example.com/cgi-bin/awstats.pl?config=<DomainName1>

http://stats.example.com/cgi-bin/awstats.pl?config=<DomainName2>

Setup IIS Site

I'm going to take assumptions on folder names for this article, you can adjust them to fit your environment.

1) Create a folder in c:\inetpub\stats.example.com ‘mkdir c:\inetpub\stats.example.com’

2) In the AWStats extracted files, copy all folders in the 'wwwroot' to c:\inetpub\stats.example.com.

These folders will store the various domains stats.

a) create a folder called c:\inetpub\stats.example.com\stats\Domain1
‘mkdir c:\inetpub\stats.example.com\stats\domain1’

b) create a folder called c:\inetpub\stats.example.com\stats\Domain2
‘mkdir c:\inetpub\stats.example.com\stats\domain2’

Create a IIS site with Internet Manager or AppCMD, for this article, I've provided AppCMD commands

'Create app pool

C:\Windows\System32\inetsrv\appcmd add apppool /name:Stats.Example.com

'Set App Pool to integrated mode. This can be v2.0 or v4.0

C:\Windows\System32\inetsrv\appcmd set config /section:applicationPools /[name='stats.Example.com'].managedPipelineMode:Integrated

'Add site

C:\Windows\System32\inetsrv\appcmd add site /id:12345 /name:Stats.Example.com /bindings:http/*:80: /physicalPath:c:\inetpub\stats.example.com

'Assign app pool to the site.

C:\Windows\System32\inetsrv\appcmd set app /app.name:stats.example.com/ /applicationPool:stats.Example.com"

'Set to 32 bit mode

C:\Windows\System32\inetsrv\appcmd set config -section:system.applicationHost/applicationPools /[name='Stats.Example.com'].enable32BitAppOnWin64:"True" /commit:apphost

‘Setup Perl Handler, approve isapi

Through IIS Manager, go to Internet Manager

Click on Website
IIS Section
Handler Mappings
Add Script Map
Request Path - *.pl
Executable - C:\Perl\bin\PerlEx30.dll
Name - Perl
Click OK

When prompted for this, go ahead and click Yes. This attribute sets at a server level.

Configure Perl Handler

c:\windows\system32\inetsrv\appcmd.exe set config "Stats.Example.com" -section:system.webServer/handlers /[name='PERL'].name:"PERL" /[name='PERL'].path:"*.pl" /[name='PERL'].modules:"IsapiModule" /[name='PERL'].scriptProcessor:"C:\Perl\bin\PerlEx30.dll" /[name='PERL'].resourceType:"Unspecified" /[name='PERL'].requireAccess:"Script" /[name='PERL'].preCondition:"bitness32"

Setup AWStats conf files.

I’m going to defer to the AWStats FAQ section configuring the conf files. A couple things I did

0) Make a copy of the awstat.module.conf to (awstats.StatsExampleCom.conf)

1) make sure to set the DirData attribute is “DirData="c:/inetpub/stats.example.com/stats/DomainName1"”

2) Follow the AWStats FAQ, check out the Demo / ScreenShots section. They set a few attributes.

3) I learned NOT to do Reverse DNS lookup, that really slows down.

4) You might need to adjust permissions on the IIS Logs folders you are reading, it’ll depend on which account you run the application Pool run as. By default, the IIS Log folders only grant permissions to Administrators and SYSTEM. You could either setup the stats.example.com app pool to run as a specific account, or use ApplicationHostIdentity. What I did was use the default account, ApplicationHostIdentity. I’d suggest using Process Monitor (by sysinternals)

Here are the attributes I updated so far, this could change as I learn more about AWStats

LogFile="c:/inetpub/logs/logfiles/w3svc1/u_ex%YY-0%MM-0%DD-0.log" (You might need to tweak this setting)
LogFormat=2
SiteDomain="stats.example.com"
HostAliases="localhost 127.0.0.1 REGEX[stats.example\.com$]"
DirData="c:/inetpub/stats.example.com/stats/DomainName1"”

Enable frequent updates

I setup a batch file and put the following commands, then I scheduled to run frequently as an account (Administrator) to access the IIS Logs. You could also run the scheduled task as SYSTEM.

Here is the command, it assumes the file is named awstats.DomainName1.conf and will reside in c:\inetpub\stats.example.com\cgi-bin folder

perl C:\inetpub\s.iislogs.com\cgi-bin\awstats.pl -config=<DomainName1> –update

Misc Things - Here are a few lessons learned.

Use the LogResolveMerge.pl script to create a single file or several files to import to AWStats. I found if you have very large (many MB or GB), you’ll need to take an approach of having smaller files. I didn’t find an automated way when importing existing files. So in my example, I created a few files, would import into AWStats, this require you update the awstats.example.conf file, run the perl awstats.pl –config=Example –update over and over. It was a little clunky, but seemed to work.

Here is the command I ran

C:\inetpub\stats.example.com\tools>perl logresolvemerge.pl c:\inetpub\logs\LogFiles\W3SVC5\*.log > StatsExampleCom.log

When LogResolveMerge.pl creates an import file, it doesn’t have the IIS Headers created in the log files, you’ll need to add the IIS headers like your website and awstats.example.conf is setup. What seems to work for me is 1) Create a blank file with just the headers, then run the command below, notice the two arrows. “>>” This forces the command prompt to append, then you can run the import.

C:\inetpub\stats.example.com\tools>perl logresolvemerge.pl c:\inetpub\logs\LogFiles\W3SVC5\*.log > StatsExampleCom.log

Doing one-time imports files

Add IIS Logs headers to the new one time import files

Create a file, add headers

#Software: Microsoft Internet Information Services 7.0

#Version: 1.0

#Date: 2011-05-18 00:01:55
#Fields: date time s-sitename s-ip cs-method cs-uri-stem cs-uri-query s-port cs-username c-ip cs(User-Agent) cs(Cookie) cs(Referer) sc-status sc-substatus sc-win32-status sc-bytes cs-bytes time-taken

HTTP Error 502.2 - Bad Gateway

I got this error below when I tried using the x64 bit version of ActiveState. I found a few errors posted on the website with no resolution. I’m not sure if the posts were trying x86 or x64.

HTTP Error 502.2 - Bad Gateway

The specified CGI application misbehaved by not returning a complete set of HTTP headers. The headers it did return are "".

dd-wrt references

Sun, 01 Jan 2012 23:14:36 GMT

I’ve been tinkering with dd-wrt firmware, what an incredible piece of open source software.

Repeater Bridge (Same as primary network to bridge)
http://www.dd-wrt.com/wiki/index.php/Image:Repeater_Bridge.jp

Repeater (Different network from primary)
http://airfart.blogspot.com/2008/03/how-to-set-up-wifi-repeater-mode-on-dd.html

Stay tuned! More references to come

IIS Community Newsletter - December 2011 edition released

Tue, 27 Dec 2011 04:49:48 GMT

IIS Community Newsletter - December 2011 edition released
http://www.iisnewsletter.com/archive/december2011.html

Enjoy

Steve

BlogPost #1441

Fri, 09 Dec 2011 10:09:22 GMT

BlogPost #1441

So it begins

Fri, 09 Dec 2011 10:05:39 GMT

So it begins

MAC Links

Mon, 05 Dec 2011 03:08:02 GMT

Yes, you are right, these are Mac as in Apple Mac on a Microsoft and IIS blog. I was given a eMac running 10.3.9, I have NO idea if that is old. The box is a single processor, 256 MB of RAM. After a couple days of hacking around, and some assistance from Mac Forums IRC channel, they helped me add an admin user account. I know nothing about Macs besides my iPhone, does that count? I know more about FreeBSD and the internals than a Mac. Here are some links that helped. Now I want to figure out how to remote control this thing from my laptop (yes it’s currently windows). I’m primarily a server guy so I remote all the time! Stay tuned..

Cheers

Steve

Great SEO article

Sat, 03 Dec 2011 00:20:48 GMT

I ran across a great SEO article via Twitter, the link is here

http://www.seomoz.org/blog/what-every-seo-should-know-about-iis

There was a comment I wanted to add a few ideas, I tried to format the comment, however it didn’t format to cleanly so I thought I’d add here. Review the comments in the article too, there are some additional items mentioned worth checking out. I hope he picks up this post and adds the couple links for reference.

Couple other things to reference to this great article. Here are three commands I run on all servers. I use the compression level 9 on a very high volume with no impact, Here is another article on other properties and http://learn.iis.net/page.aspx/206/dynamic-compression/

Scott Forsyth wrote an article on compress level and performance which is a good read. http://weblogs.asp.net/owscott/archive/2009/02/22/iis-7-compression-good-bad-how-much.aspx

Enables

c:\windows\system32\inetsrv\appcmd set config /section:urlCompression /doDynamicCompression:true

Sets the compression level
c:\windows\system32\inetsrv\appcmd set config /section:system.webServer/httpCompression -[name="'gzip'"].dynamicCompressionLevel:9"Mkdir D:\Data\IISTemporaryCompressedFiles"

Sets the directory path
c:\windows\system32\inetsrv\appcmd set config /section:httpCompression /directory:D:\Data\IISTemporaryCompressedFiles /maxDiskSpaceUsage:100 /minFileSizeForComp:256"

Hope this helps

Steve Schofield

Microsoft MVP – IIS

IIS Community Newsletter - November 2011 edition

Wed, 30 Nov 2011 19:15:17 GMT

#IIS Community Newsletter - November 2011 edition has been released. Lots of interesting and original content available on the web!

http://www.iisnewsletter.com/archive/november2011.html

Take care,

Steve Schofield
Microsoft MVP – IIS

http://www.iislogs.com/steveschofield

October 2011 IIS community newsletter available

Mon, 14 Nov 2011 03:54:27 GMT

After a few issues trying to send the October 2011 IIS community newsletter, we have got it published!

http://www.iisnewsletter.com/archive/october2011.html is

btw – if you need excellent windows hosting, visit www.orcsweb.com (ORCS Web) it’s awesome!

Steve

2011 MVP award (ASP.NET/IIS)

Sun, 02 Oct 2011 02:01:44 GMT

“Congratulations! We are pleased to present you with the 2011 Microsoft® MVP Award! This award is given to exceptional technical community leaders who actively share their high quality, real world expertise with others. We appreciate your outstanding contributions in ASP.NET/IIS technical communities during the past year.”

I’m humbled and thanks to Microsoft for the recognition.

Steve

July/August/September 2011 IIS Community Newsletter is available

Fri, 16 Sep 2011 02:31:09 GMT

Here is the July/August/September 2011 IIS Community Newsletter

http://www.iisnewsletter.com/archive/JulyAugustSept.html

Thank you,

Steve Schofield
Windows Server MVP - IIS
http://www.iislogs.com/steveschofield

http://www.IISLogs.com
Log archival solution
Install, Configure, Forget

Questions on Microsoft SMTP Service - visit http://www.smtp.ws
IIS Community Newsletter - visit http://www.iisnewsletter.com

Win8 / IIS 8 are available!

Thu, 15 Sep 2011 06:20:49 GMT

Microsoft has released the latest Windows OS preview. Nice new shiny logo.

Download here

http://msdn.microsoft.com/en-us/windows/apps/br229516

Server edition is available on MSDN.

Enjoy!

Steve

Interesting post to solve 500.19 Network BIOS Command Limit Reached

Sun, 11 Sep 2011 01:31:59 GMT

ran across this post browsing the forums @ http://forums.iis.net It’s a real problem dealing with UNC content. Thread: New Solution to 500.19 Network BIOS Command Limit Reached

http://forums.iis.net/p/1181293/1994882.aspx#1994882

Thought I’d pass along.

Steve Schofield

IISLogsLite 2.0 available for download

Thu, 04 Aug 2011 18:54:52 GMT

We’ve made IISLogsLite 2.0 (free edition available). Please feel free to download at

http://www.iislogs.com/help/iislogslite20/configure_iislogs_lite_version20.htm

The IISLogs 2.0 and 4.0 full versions are available here.

http://www.iislogs.com/eval.aspx

IISLogs 4.0

-------------

Practical uses of IISLogs - 2 sections

http://www.iislogs.com/help/iislogs40/123goconfigure.htm

Phase 2 Configuration - First Time

http://www.iislogs.com/help/iislogs40/123goconfigure2.htm

IISLogs 2.0

-------------

Practical uses of IISLogs - 2 sections

http://www.iislogs.com/help/iislogs20/123goconfigure.htm

Phase 2 Configuration - First Time

http://www.iislogs.com/help/iislogs20/123goconfigure2.htm

Enjoy,

Steve Schofield

FreeBSD, UNC, IIS

Sun, 31 Jul 2011 04:13:23 GMT

Here are some basic instructions I used to get FreeBSD, SAMBA running. The plan is to have a more complete guide to hooking up to IIS in the future. I downloaded FreeBSD 8.2 and Centos 5.6 to see what it would take to hookup a virtual directory in IIS 7.5 to a *nix Samba share. I have prior experience getting FreeBSD for various server roles. It was the first Unix based OS I have experience with. Getting Samba was super easy with the link below. I have no experience in a production environment running a virtual directory from IIS to a *nix share. This was strictly to “see if I could do it”.

Download FreeBSD 8.2 ISO from www.freebsd.org
Create a new VM in Hyper-V or VMware (I used Hyper-V) – I had to add the legacy network connection once the VM was created. Mount the ISO and let the install go as normal. Here is the docs http://www.freebsd.org/doc/handbook/install.html
Once FreeBSD is done installing

Ssh to FreeBSD using Putty

winuser

Su root

Bash

Cd /user/ports/net

Cd samba

Type make && make install (add / remove programs for FreeBSD)

Prompted, here are the items I selected

Ldap
Ada
Cups
Winbind
With acl support
Aio aupport
With syslog support
With utmp accounting support
DNSupdate
With system wide POPT library
With IPv6 support

Defaults for Python 2.6.6 were taken

Text displayed at the end of Samba install
This port has installed the following startup scripts which may cause these network services to be started at boot time. /usr/local/etc/rc.d/samba If there are vulnerabilities in these programs there may be a security risk to the system. FreeBSD makes no guarantee about the security of ports included in the Ports Collection. Please type 'make deinstall' to deinstall the port if this is a concern. For more information, and contact details about the security status of this software, see the following webpage:

http://www.samba.org/

Running IIS Manager

http://support.microsoft.com/kb/813615

How to setup a share on FreeBSD box

http://www.us-webmasters.com/FreeBSD/Install/Samba/

Cheers,

Steve

UNC post on http://forums.iis.net

Sat, 23 Jul 2011 17:44:10 GMT

I try to keep track of UNC based posts in my “UNC” tag if it’s something that would help the community. http://forums.iis.net/p/1180183/1990052.aspx If you can provide assistance, that would be great. My intention is to setup some Linux and FreeBSD boxes locally using NFS, Samba and connecting to IIS. It’s on the geek list!

UNC tag

http://www.iislogs.com/tags/unc

Enjoy,

Steve

Hosting PERL on IIS 7.x thread

Thu, 14 Jul 2011 11:36:13 GMT

Every now and then, a thread will get my interest doing something different with IIS on http://forums.iis.net. I’ve never setup PERL within IIS even though I knew it was possible to host PERL. I figured what the heck, lets see if I can get it working even though I don’t really know how to program in PERL. The post is asking how to secure PERL in a shared hosting model.

Forum thread on securing PERL. As of this post, no one has responded who has secured PERL for shared hosting. I’ve asked a couple questions for my own interest. If you know, feel free to respond with more information. I’d be interested.

http://forums.iis.net/p/1179875/1988997.aspx

Helpful post getting PERL setup.
http://forums.iis.net/p/1178679/1984038.aspx

ActivePERL by ActiveState
http://www.activestate.com/activeperl

PERL information
http://www.perl.org/

Tips

Have to run app pool in 32 bit mode. I found many reports of issues with 64 bit version
Run process monitor to determine exactly which folders are being blocked
i.e the PERL folder, %TEMP% variable etc..
Make sure to install the CGI role service (otherwise you’ll get errors, I did)

Cheers,

Steve Schofield
Windows Server MVP - IIS
http://www.iislogs.com/steveschofield

http://www.IISLogs.com
Log archival solution
Install, Configure, Forget

Questions on Microsoft SMTP Service - visit http://www.smtp.ws
IIS Community Newsletter - visit http://www.iisnewsletter.com

Have CNAME point to a Windows Host and access via SMB

Wed, 13 Jul 2011 19:18:39 GMT

I was trying to map \\servername\sharename which would be \\Web1\Sharename. Web1 would be an actual NetBIOS name and ‘ServerName’ would be a DNS CNAME to Web1. I was getting an error. “because a duplicate name exists on the network”

Got To:
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\LanmanServer\Parameters

Create a new DWORD with the following details:
Value name: DisableStrictNameChecking
Data type: REG_DWORD
Radix: Decimal
Value: 1

http://support.microsoft.com/?id=281308

Web Stress testing tools thread

Tue, 12 Jul 2011 21:50:57 GMT

Here is a thread on http://forums.iis.net that discusses Stress testing tools. There is a wide variety tools available. I personally use a powershell script to create a single log file, then load test with Web Application Stress tool (retired by Microsoft). For my personal needs this has been sufficient. I thought I would pass along as an FYI.

http://forums.iis.net/p/1179857/1988763.aspx

If you have tools that you’ve found successful, feel free to add to the comments section

PS – And a great tool to help analyze the data is using PAL (performance analysis of logs)

http://pal.codeplex.com/

Thank you,

Steve Schofield
Windows Server MVP - IIS
http://www.iislogs.com/steveschofield

http://www.IISLogs.com
Enterprise Log Management solution
Install, Configure, Forget

Questions on Microsoft SMTP Service - visit http://www.smtp.ws
IIS Community Newsletter - visit http://www.iisnewsletter.com

IIS 7 / IUSR account, SCCM 2007 client, Status messages not working

Sun, 10 Jul 2011 12:24:59 GMT

Background

This is one of those posts that has been “years in the making”. I’ve been working with SMS / ConfigMgr 2007 since version 2.0. In my IT career, I’ve used SMS / ConfigMgr 2007 on the server side exclusively. Traditionally SMS / ConfigMgr has been mainly a desktop software deployment, management tool. I’ve never talked with anyone who has used ConfigMgr strictly “ in a Server environment” for other things besides patching, OSD. Using ConfigMgr for DCM, Software Distribution, Querying, reporting etc.

Problem

I recently came across a situation where I was getting inconsistent status messages being sent back to the site server. Here is the message Failed to submit event to the Status Agent. Attempting to create pending event. For those familiar with ConfigMgr, all components send their status messages through the StatusAgent component. Advertisements, task sequences would work. the status messages would not be updated however.

Side Bar
Introduced in IIS 7 was the ability to set the Anonymous Authentication module to inherit from the application pool identity automatically. Here is a screenshot of the setting.

\

In previous IIS versions, the IUSR account was a local account with it’s own SID (Security Identifier). The administrator had to be aware of this account along with the application pool account (App pools started in Windows 2003/IIS 6). The IUSR account was introduced in Windows Server 2008 as a ‘machine’ account with the same SID across all boxes. In IIS 6, I would set the IUSR_MachineName and application pool identity accounts the same. Although I was administering two locations, it made troubleshooting a lot easier only dealing with one account. When Windows Server 2008 came out and provided the ability to inherit the application pool identity automatically, from an IIS Administrators perspective, I quickly adopted this architecture. PS – I’m not 100% sure why inheriting Application Pool Identity isn’t the default setting, I once heard it was to support Classic ASP applications. Not sure.

Back to ConfigMgr 2007

From an IIS perspective, administrators may implement this type of architecture (I did!). What I discovered, the IUSR setting at server level is required if a machine has IIS installed. What I did to prove the ConfigMgr client was checking for the existing of the IUSR account.

I enabled more logging on the ConfigMgr client. Here is article showing How to enable DebugLogging & Verbose logging on ConfigMgr client.
I set the IUSR account at server level to the picture above. All sites would inherit the application pool identity
Execute an advertisement (task sequence or advertisement)

Here is the status messages that appeared in the logs. Notice the highlighted sections, and the function being called.

ccmperf.log:<![LOG[Security::LookupIUSRAccountSid(sIUSRSid), HRESULT=80004005 (e:\nts_sms_fre\sms\framework\ccmperf\perfobject.cpp,1484)]LOG]!><time="00:14:21.853+240" date="01-09-2011" component="ccmperf" context="" type="0" thread="14748" file="perfobject.cpp:1484">
ccmperf.log:<![LOG[GetIISAccounts(sIUSRSid), HRESULT=80004005 (e:\nts_sms_fre\sms\framework\ccmperf\perfobject.cpp,1559)]LOG]!><time="00:14:21.853+240" date="01-09-2011" component="ccmperf" context="" type="0" thread="14748" file="perfobject.cpp:1559">
ccmperf.log:<![LOG[Security::LookupIUSRAccountSid(sIUSRSid), HRESULT=80004005 (e:\nts_sms_fre\sms\framework\ccmperf\perfobject.cpp,1484)]LOG]!><time="00:14:21.862+240" date="01-09-2011" component="ccmperf" context="" type="0" thread="14748" file="perfobject.cpp:1484">
ccmperf.log:<![LOG[GetIISAccounts(sIUSRSid), HRESULT=80004005 (e:\nts_sms_fre\sms\framework\ccmperf\perfobject.cpp,1559)]LOG]!><time="00:14:21.862+240" date="01-09-2011" component="ccmperf" context="" type="0" thread="14748" file="perfobject.cpp:1559">
ccmperf.log:<![LOG[Security::LookupIUSRAccountSid(sIUSRSid), HRESULT=80004005 (e:\nts_sms_fre\sms\framework\ccmperf\perfobject.cpp,1484)]LOG]!><time="00:14:22.678+240" date="01-09-2011" component="ccmperf" context="" type="0" thread="13344" file="perfobject.cpp:1484">
ccmperf.log:<![LOG[GetIISAccounts(sIUSRSid), HRESULT=80004005 (e:\nts_sms_fre\sms\framework\ccmperf\perfobject.cpp,1559)]LOG]!><time="00:14:22.680+240" date="01-09-2011" component="ccmperf" context="" type="0" thread="13344" file="perfobject.cpp:1559">
StatusAgent.log:<![LOG[Security::LookupIUSRAccountSid(sAccount), HRESULT=80004005 (e:\nts_sms_fre\sms\framework\core\ccmcore\comobjectsecurity.cpp,58)]LOG]!><time="00:14:58.883+240" date="01-09-2011" component="StatusAgent" context="" type="0" thread="11300" file="comobjectsecurity.cpp:58">

As I mentioned earlier, I work strictly in a server environment, which many boxes have IIS installed (Mostly Windows Server 2008 / R2 boxes). For some reason Microsoft has logic in SCCM to check for the existence of the IUSR account. Here is a post I did “IUSR Account and ConfigMgr 2007 R3 agent”. This explains I temporarily had to set the IUSR account enabled at server level so the ConfigMgr agent would install.

A configuration workaround

The ConfigMgr agent doesn’t seem to check for IUSR at site level. This means an administrator who has ConfigMgr installed on a server OS with IIS can enable the IUSR setting at server level, and set the inherit application pool identity at site level. From my testing, this configuration works. I did a PowerShell script to:

Backup current applicationHost.config with appcmd
Enable IUSR at server level
Disable IUSR and inherit application pool identity.
Stop / Start SMS Agent Host
Watch the SCCM logs

A little precaution before running the script. The logic assumes you are using the application pool identity for securing resources. I’d recommend you review your IIS architecture to ensure this setup would work in your environment. I ALWAYS encourage people to try scripts in a non-production environment first. The script does make a backup copy of the applicationHost.config before making changes. If something happens, just restore the applicationHost.config.

After years of not quite understanding how IUSR was used. I thank God for helping me finally understand what is happening! I hope you find this post useful. Hope this workaround isn’t needed in CM2012. Time will tell.

Thank you,

Steve Schofield
Windows Server MVP - IIS
http://www.iislogs.com/steveschofield

http://www.IISLogs.com
Log archival solution
Install, Configure, Forget

Questions on Microsoft SMTP Service - visit http://www.smtp.ws
IIS Community Newsletter - visit http://www.iisnewsletter.com

Here is the script.

$ExitCode = 0
try
{
function EnableIUSRServerLevel
{
$Command = "$Env:SystemRoot\system32\inetsrv\appcmd.exe set config /section:system.webServer/security/authentication/anonymousAuthentication /userName:`"IUSR`" /commit:apphost"
Write-Host $Command
Invoke-Expression -Command $Command
}

function DisableIUSRSiteLevel([string]$SiteName)
{
$Command = "$Env:SystemRoot\system32\inetsrv\appcmd.exe set config `"$SiteName`" /section:system.webServer/security/authentication/anonymousAuthentication /userName:`"`" /commit:apphost"
Write-Host $Command
Invoke-Expression -Command $Command
}

#Use Powershell provider to get a list of sites, one of these will error
#windows Server 2008 needs powershell provider installed before using
#Windows Server 2008 R2 has powershll provider already
#There is some better logic that could be implemented on this option

Import-Module -Name "WebAdministration"
Add-PSSnapin -Name "WebAdministration"
#Backup ApplicationHostConfig
$FileDate = (Get-Date).tostring('dd-mm-yyyy-mm-hh')
$Command = "$Env:SystemRoot\system32\inetsrv\appcmd.exe add backup `"BeforeSettingIUSRData$FileDate`""

Write-Host $Command
Write-Host "applicationHost.config backed up"
Invoke-Expression -Command $Command

#Set IUSR at server level
Write-Host "Set IUSR at server level enabled"
EnableIUSRServerLevel

#Get List of Sites using get-childitem
$sites = gci IIS:\Sites

#Set Each site on the box with IUSR disabled
foreach($site in $sites)
{
Write-Host $site.name
Write-Host ""
DisableIUSRSiteLevel -SiteName $site.name
}

Write-Host "Done"
}
catch
{
$ExitCode = 1
Write-Host "error"
}