IIS Hacks — Server & System Administration Archive

IIS Hacks is an independent, non-commercial archive of Windows server administration notes published between May 2007 and October 2013. The original site was a working practitioner's notebook rather than a publication: short, specific write-ups of problems met on Microsoft server stacks — an Exchange error code, an IIS 6 to IIS 7 migration, a disk counter that would not come down, a solid-state drive that stalled for seconds at a time — written up as they were solved. That material is preserved here at its original URLs.

Nothing on this site is for sale. There is no contact form, no email address, no advertising, no comment system and no newsletter. The archive is not affiliated with, sponsored by, or endorsed by Microsoft, Intel, VMware, Dell, Asus, Oracle or any other company whose products are named in these notes. Product, version and error names appear because the subject matter cannot be described without them.

The archive is closed. Publication stopped in October 2013 and nothing has been added to the original corpus since. What is here is a record of how a particular generation of Windows infrastructure was actually run, not a running feed.

What the archive covers

The corpus is 128 dated posts across seven years, and it clusters into a handful of subjects that dominated small and mid-sized Microsoft estates of the period.

The web server. Internet Information Services, in the era when IIS 6 shipped with Windows Server 2003 and IIS 7 arrived with Windows Server 2008 and replaced the binary metabase with an XML applicationHost.config. The Internet Information Server notes cover the migration itself, host headers, FTP start-up failures, log formats, response headers, media streaming, and the long-running problem of getting PHP to run acceptably on Windows — first as an ISAPI module, later under FastCGI.

Mail. Exchange Server, from 2003 through 2010 and 2013, plus the Outlook symptoms that turn out to be server-side. The Exchange Server notes are heavy on error codes and on outbound mail: send connectors, SMTP, SPF records, spam filtering, and reading message headers to work out where a message actually went.

The operating system. Windows Server 2003 and 2008 alongside the client side — Windows XP, Vista and 7 — because in a small estate the same person owns both. The Windows and Server notes run from component-store growth and servicing to desktop icon caches, scheduled tasks from the command line and the Windows 7 beta as it was being tested.

Security. Not policy documents but the operational end of it: filtering traffic with IPsec policies where no hardware firewall existed, ICMP and firewall profiles, password policy, the anatomy of a compromised web server, and anti-malware false positives that broke working machines. Those are collected under Security, Viruses, Trojans.

Storage and hardware. The archive spans the arrival of consumer solid-state drives, and the Hardware notes track that transition closely: secure erase, firmware and TRIM, drives that froze under load, and the disk-performance counters used to work out whether the storage was actually the bottleneck. Direct-attached enclosures and motherboard oddities sit in the same section.

Two smaller strands run throughout — MySQL on Windows, and the general trade commentary a working administrator produced between problems. Both are indexed in the complete post archive along with everything else.

How to read a fifteen-year-old sysadmin note

Most of this material describes software that is out of support. Windows Server 2003 and Windows XP are long past end of life; Exchange 2010 and Exchange 2013 have both reached end of support; the IIS 6 metabase model no longer exists. Microsoft publishes the dates in its product lifecycle documentation, and it is worth checking before treating anything here as current.

What transfers is the diagnostic reasoning. A note that works out which of three subsystems is responsible for a stall does that by naming a symptom, proposing a mechanism, and then finding a measurement that separates the candidates. The measurement itself may be obsolete; the shape of the argument is not. The disk-queue note is the clearest example in the archive — the counter it uses still exists, and the point it makes about queue length being meaningless without knowing the spindle count is still true.

What does not transfer is anything typed at a prompt. Commands are deprecated, switches are renamed, registry paths move, and management consoles are replaced wholesale — the Exchange Management Console gave way to the web-based Exchange admin centre, and netsh firewall gave way to netsh advfirewall. Several procedures here are actively wrong as current advice, which is why every note carries its original publication date and a visible archival warning rather than being quietly modernised. Current documentation for the two largest subjects lives at Microsoft's IIS documentation and the Windows Server documentation.

The third thing worth reading for is context. A 2008 post arguing about whether IIS deserved its reputation, or a 2009 post asking why so many Windows servers were compromised, is evidence about what the job felt like at the time. That is the part an archive preserves that a rewrite would destroy.

Where to start

The most cited notes are practical and self-contained. On storage there is secure-erasing an Intel solid-state drive and the later companion piece on an SSD freezing on Windows 7, which should be read next to high average disk queue length. On the web server, installing PHP 5.3 under FastCGI on IIS 7 supersedes the earlier ISAPI procedure, and both sit inside the IIS 6 to IIS 7 transition that the web-server section sets out in full. On the operating system, reducing the size of the WinSxS folder is the single most linked note in the archive.

Everything else — including the many posts for which only the title and date survived — is listed in the complete post archive, and the about page explains how this archive was assembled and what was deliberately left out of it.