Running IIS on Windows Server: A Beginner’s Practical Setup Guide

Internet Information Services (IIS) is the built-in web server on Windows Server. It handles HTTP and HTTPS requests, serves static files, runs ASP.NET applications, and can act as a reverse proxy. This guide takes you from a fresh Windows Server installation to a live IIS website with HTTPS, covering the essential configuration steps that every beginner needs to know.

Installing IIS

IIS is a Windows Server role that is not installed by default. Install it via PowerShell in under a minute:

Install-WindowsFeature -Name Web-Server -IncludeManagementTools

This installs IIS with the default module set. For ASP.NET support, add the relevant features:

Install-WindowsFeature -Name Web-Asp-Net45, Web-WebSockets, Web-Mgmt-Console

After installation, open a browser and navigate to http://localhost. You should see the default IIS welcome page, confirming that IIS is running.

Understanding the Default Site Structure

The default IIS website is located at C:\inetpub\wwwroot. This folder contains the files that IIS serves. The IIS configuration is stored in C:\Windows\System32\inetsrv\config\applicationHost.config — an XML file that you can edit directly, though using IIS Manager or PowerShell is safer.

IIS uses a hierarchical configuration system. Settings at the server level apply to all sites, but individual sites and applications can override them.

Creating Your First Website

To host a website on IIS, you need to create a site with a binding, a physical path, and an application pool. Use PowerShell:

New-Item -ItemType Directory -Path "D:\Sites\MySite" -Force
New-WebSite -Name "MySite" -PhysicalPath "D:\Sites\MySite" -Port 80 -HostHeader "www.mysite.com"

This creates a site listening on port 80 with the host header www.mysite.com. Place your HTML files in D:\Sites\MySite and access the site via the configured hostname.

Setting Up HTTPS with a Free Certificate

HTTPS is mandatory for modern websites. IIS supports Let’s Encrypt certificates via the ACME client (such as win-acme). Here is a quick setup:

• Download and run the win-acme tool on the server.
• Select option M: Create/renew certificate with a simple menu.
• Choose the IIS site binding for the domain you want to secure.
• Select the option to install the certificate in IIS and create an HTTPS binding.
• Set up automatic renewal (win-acme creates a scheduled task by default).

After the certificate is installed, configure IIS to redirect HTTP to HTTPS:

Install-WindowsFeature -Name Web-URL-Rewrite
# Then use IIS Manager > URL Rewrite > Add Rule > Redirect to HTTPS

Enable HTTP Strict Transport Security (HSTS) by adding this header in IIS Manager under HTTP Response Headers: Strict-Transport-Security: max-age=31536000; includeSubDomains.

Application Pools: Isolation and Recycling

Each IIS website runs in an application pool, which is a separate worker process (w3wp.exe). This isolates sites from each other — if one site crashes, the others remain unaffected. For production, create a dedicated application pool for each site:

New-WebAppPool -Name "MySitePool"
Set-ItemProperty -Path "IIS:\AppPools\MySitePool" -Name recycling.periodicRestart.time -Value "00:00:00"

By default, application pools recycle every 1740 minutes (29 hours). For production, set a specific time for recycling (e.g., 3:00 AM) or configure overlapping recycling where a new worker process starts before the old one shuts down.

IIS Logging and Monitoring

IIS logs every request to C:\inetpub\logs\LogFiles. The W3C extended log format records the client IP, request method, URI, status code, user agent, and time taken. Use these logs to monitor traffic, diagnose errors, and detect attacks:

• Check for 404 errors to find broken links or probing attacks.
• Monitor 500 errors for application crashes.
• Look for repeated requests to common admin paths — these are probing bots.

Combine IIS logging with Failed Request Tracing for detailed error debugging. Enable FREB on specific status codes (e.g., 500) to capture the full request trace when an error occurs.

Security Basics

Before going live, apply these security configurations:

• Remove the default website: Remove-WebSite -Name "Default Web Site"
• Disable directory browsing: Set-WebConfigurationProperty -Filter "system.webServer/directoryBrowse" -Name enabled -Value $false
• Remove unused modules: Remove WebDAV, ASP (if not using classic ASP), and CGI if not needed via Remove-WindowsFeature
• Set request filtering: Limit URL length, query string length, and file upload size to safe values
• Use a dedicated application pool identity: Run the app pool under ApplicationPoolIdentity (default) rather than NetworkService or LocalSystem

Summary

IIS is a production-ready web server that is easy to set up on Windows Server. The key steps for a beginner are: install the IIS role, create a site with a physical path and binding, set up HTTPS with a free certificate, configure application pools for isolation, and enable logging for monitoring. These fundamentals give you a stable, secure web server. If you are looking for a Windows VPS with IIS pre-configured, compare Windows VPS plans on our comparison table to see which providers offer the best balance of performance and features for your web hosting needs.