Issues with IIS 5.0

Microsoft InterNet Information Services (IIS) 5.0 is supplied as part of the Windows 2000 Professional operating system as a web server, designed as much as anything to serve up ASP pages. However, it can also be used to host PHP. There is an equivalent for Windows XP, Windows 2000 and 2003 Server.

Installing IIS

Generally IIS is set up at the time of installation, and so is probably running on the system in question. One test to run the IIS help system from http://localhost/iisHelp/iis/misc/default.asp on the machine in question (Only click on the link if you are viewing this page on the computer you are planing to use as the MonTel Web Report Server). However, on some system this file has been removed to reduce security risks. This should be done on IIS machines acting as web servers to the internet.

The help provided by IIS give the following instruction about installing IIS:

Installing IIS

Internet Information Services is not installed on Windows 2000 Professional by default. You can install IIS or select additional components by using the Add/Remove Programs application in Control Panel.

To install IIS, add components, or remove components

Click Start, point to Settings, click Control Panel and start the Add/Remove Programs application.

Select Add/Remove Windows Components and then follow the on-screen instructions to install, remove, or add components to IIS.

Note If you upgraded to Windows 2000, IIS 5.0 will be installed by default only if PWS was installed on your previous version of Windows.

However, there are additional security issues that should be considered. When installing IIS the server should be disconnected from the InterNet. Once you have a successfully installed IIS you should use "Internet Services Manager" to stop IIS, and check that it is fully patched. One way to force this is to delete the registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Hotfix and run windows update. It may be better to download the MS Baseline security analyser from http://support.microsoft.com/default.aspx?kbid=303215#1 and run it (you may discover a host of other issues).

The IIS Lockdown Tool should also be used to secure the server: http://www.microsoft.com/technet/security/tools/locktool.mspx.

Security is a moving target, and the above should not be consider a definitive list of steps to take. More up to date information should be available from Microsoft and other IT sources. (Try a google search for "IIS Security install").

Troubleshooting

Trouble shooting hint 1: IIS has all sorts of problems (some subtle) if some versions of Zone Alarm is present on the machine (disable while installing).

Trouble shooting hint 2: Try installing IIS using safe mode with networking if it does not appear to work.

Other information

IIS Hosting Kit White Papers and Articles is avaliable from microsoft: http://www.microsoft.com/serviceproviders/whitepapers/iis_hosting.asp.