IIS Hacks — Server & System Administration Notes

IIS Hacks published Windows server administration notes between May 2007 and October 2013. The blog was a working practitioner's notebook rather than a publication: short, specific write-ups of problems met on Microsoft server stacks — an Exchange error code, an IIS 6 to IIS 7 migration, a disk counter that would not come down, a solid-state drive that stalled for seconds at a time — written up as they were solved. The result is a historical account of practical work on Microsoft server stacks.

Nothing on this site is for sale. There is no contact form, no email address, no advertising, no comment system and no newsletter. This site is not affiliated with, sponsored by, or endorsed by Microsoft, Intel, VMware, Dell, Asus, Oracle or any other company whose products are named in these notes. Product, version and error names appear because the subject matter cannot be described without them.

IIS Hacks stopped publishing in October 2013. Its 128 dated posts document how a particular generation of Windows infrastructure was actually run.

What the notes cover

The corpus is 128 dated posts across seven years, and it clusters into a handful of subjects that dominated small and mid-sized Microsoft estates of the period.

The web server. Internet Information Services, in the era when IIS 6 shipped with Windows Server 2003 and IIS 7 arrived with Windows Server 2008 and replaced the binary metabase with an XML applicationHost.config. The Internet Information Server notes cover the migration itself, host headers, FTP start-up failures, log formats, response headers, media streaming, and the long-running problem of getting PHP to run acceptably on Windows — first as an ISAPI module, later under FastCGI.

Mail. Exchange Server, from 2003 through 2010 and 2013, plus the Outlook symptoms that turn out to be server-side. The Exchange Server notes are heavy on error codes and on outbound mail: send connectors, SMTP, SPF records, spam filtering, and reading message headers to work out where a message actually went.

The operating system. Windows Server 2003 and 2008 alongside the client side — Windows XP, Vista and 7 — because in a small estate the same person owns both. The Windows and Server notes run from component-store growth and servicing to desktop icon caches, scheduled tasks from the command line and the Windows 7 beta as it was being tested.

Security. Not policy documents but the operational end of it: filtering traffic with IPsec policies where no hardware firewall existed, ICMP and firewall profiles, password policy, the anatomy of a compromised web server, and anti-malware false positives that broke working machines. Those are collected under Security, Viruses, Trojans.

Storage and hardware. The notes span the arrival of consumer solid-state drives, and the Hardware notes track that transition closely: secure erase, firmware and TRIM, drives that froze under load, and the disk-performance counters used to work out whether the storage was actually the bottleneck. Direct-attached enclosures and motherboard oddities sit in the same section.

Two smaller strands run throughout — MySQL on Windows, and the general trade commentary a working administrator produced between problems. Both are indexed in the complete post index along with everything else.

How to read a fifteen-year-old sysadmin note

Most of this material describes software that is out of support. Windows Server 2003 and Windows XP are long past end of life; Exchange 2010 and Exchange 2013 have both reached end of support; the IIS 6 metabase model no longer exists. Microsoft publishes the dates in its product lifecycle documentation, and it is worth checking before treating anything here as current.

What transfers is the diagnostic reasoning. A note that works out which of three subsystems is responsible for a stall does that by naming a symptom, proposing a mechanism, and then finding a measurement that separates the candidates. The measurement itself may be obsolete; the shape of the argument is not. The disk-queue note is the clearest example in the collection — the counter it uses still exists, and the point it makes about queue length being meaningless without knowing the spindle count is still true.

What does not transfer is anything typed at a prompt. Commands are deprecated, switches are renamed, registry paths move, and management consoles are replaced wholesale — the Exchange Management Console gave way to the web-based Exchange admin centre, and netsh firewall gave way to netsh advfirewall. Several procedures here are actively wrong as current advice. Each note therefore carries its publication date and a visible age warning. Current documentation for the two largest subjects lives at Microsoft's IIS documentation and the Windows Server documentation.

The third thing worth reading for is context. A 2008 post arguing about whether IIS deserved its reputation, or a 2009 post asking why so many Windows servers were compromised, is evidence about what the job felt like at the time. That contemporary context would be lost in a modern rewrite.

Where to start

The most cited notes are practical and self-contained. On storage there is secure-erasing an Intel solid-state drive and the later companion piece on an SSD freezing on Windows 7, which should be read next to high average disk queue length. On the web server, installing PHP 5.3 under FastCGI on IIS 7 supersedes the earlier ISAPI procedure, and both sit inside the IIS 6 to IIS 7 transition that the web-server section sets out in full. On the operating system, reducing the size of the WinSxS folder is the single most linked note in the collection.

All 128 posts are listed by title and date in the complete post index, and the about page summarizes the publication history and safety notes.