IIS — Internet Information Services and Hosting .NET Applications

How IIS works inside (HTTP.sys, WAS, W3SVC, worker processes), sites, bindings, applications and virtual directories, application pools (identity, pipeline mode, recycling, idle timeout), hosting ASP.NET Web Forms/MVC 5 and ASP.NET Core (in-process vs out-of-process, ASP.NET Core Module, Hosting Bundle), web.config, HTTPS certificates and SNI, authentication modes, URL Rewrite and ARR reverse proxy, compression and caching, logging and Failed Request Tracing, troubleshooting 500.x/502.5/503 errors, web farms and deployment with Web Deploy and PowerShell, security hardening, and IIS interview questions.

What it is & where it is used

IIS (Internet Information Services) is Microsoft's web server built into Windows and Windows Server. It hosts websites, ASP.NET Framework applications (Web Forms, MVC 5, Web API 2, WCF), ASP.NET Core apps (via the ASP.NET Core Module), static sites, PHP/Node (via modules) and acts as a reverse proxy.

Concept	Meaning
Site	A website with one or more bindings (protocol + IP + port + host name) and a physical path
Application	A sub-path of a site with its own application pool (e.g. `/api`)
Virtual directory	A URL path mapped to another physical folder
Application pool	A group of apps served by the same worker process (`w3wp.exe`) — isolation boundary
Bindings	`http :80 www.shop.com`, `https :443 www.shop.com` + certificate
Modules / handlers	Pipeline components (authentication, compression, rewrite) and request processors (static files, ASP.NET, ASP.NET Core Module)

Versions & history

IIS	Windows	Highlights
1.0–4.0	NT 3.51 / NT 4.0	Early web server, ASP classic (3.0)
5.0 / 5.1	Windows 2000 / XP	ASP.NET 1.0 hosting (aspnet_wp.exe)
6.0	Server 2003	Application pools, HTTP.sys kernel driver, w3wp.exe worker processes
7.0	Server 2008 / Vista	Modular architecture, integrated pipeline, XML config (`applicationHost.config`), WAS
7.5	Server 2008 R2 / 7	ApplicationPoolIdentity default, PowerShell module
8.0 / 8.5	Server 2012 / 2012 R2	SNI (many HTTPS sites on one IP), centralised certificates, application initialization, dynamic IP restrictions
10.0	Server 2016 / 2019 / 2022 / 2025, Windows 10/11	HTTP/2, HSTS support (1709+), HTTP/3 over QUIC (Server 2022+), TLS 1.3 (Server 2022+), IIS Administration API

Lifecycle

How IIS processes a request:

HTTP.sys (kernel-mode driver) receives the request on port 80/443, decrypts TLS (or the worker does), and checks its kernel-mode cache — cached static responses return immediately without user mode.
HTTP.sys routes the request to the request queue of the right application pool (based on the site binding and URL).
WAS (Windows Process Activation Service) and W3SVC manage configuration and start a worker process (w3wp.exe) for the pool if none is running (on-demand start).
The worker process runs the IIS integrated pipeline: native and managed modules handle events in order — BeginRequest → Authenticate → Authorize → ResolveCache → MapHandler → AcquireState → ExecuteHandler → ReleaseState → UpdateCache → Log → EndRequest.
The handler chosen by path/extension produces the response: StaticFileModule (files), ASP.NET (System.Web for .aspx/MVC 5), or AspNetCoreModuleV2 (ASP.NET Core).
The response goes back through HTTP.sys to the client; the request is logged (W3C log).

App pool lifecycle: started on first request (or always running) → serves requests → idle timeout (20 min default) shuts it down → recycled periodically (1,740 minutes default = 29 h), on config changes, memory limits or crashes (rapid-fail protection stops the pool after repeated crashes).

Tools used to develop

IIS Manager (inetmgr), PowerShell (WebAdministration, IISAdministration modules), appcmd.exe (%windir%\system32\inetsrv).
Configuration files: %windir%\System32\inetsrv\config\applicationHost.config, site web.config.
Web Deploy (MSDeploy), Visual Studio publish profiles, Azure DevOps "IIS Web App Deploy" task.
URL Rewrite and Application Request Routing (ARR) modules, Web Platform Installer (retired) → direct downloads.
Diagnostics: Event Viewer (Application/System logs), IIS logs (%SystemDrive%\inetpub\logs\LogFiles), Failed Request Tracing (FREB), Worker Processes view, DebugDiag, PerfMon counters.