What Is Internet Information Services (IIS)
4 min readNov 28, 2021
IIS stands for Internet Infomation Services. In simple terms, it is a Microsoft Windows HTTP Web Server with support for protocols such as HTTPS, FTP, SMTP, FTPS, among others. IIS hosts websites, web applications, and services needed by users.
Internet Information Services Basic Architecture
- Internet Service Application Programming Interface (ISAPI): application interface for the Microsoft web server. Enables programmers to develop web-based applications that process much more quickly as they are more integrated with the web server.
- Modules: modifies and enhances the functionality provided by IIS. They can provide URL rewrite, authentication, tracing capabilities, compression, and much more.
- HTTP.sys: listens for HTTP requests and routes them to the appropriate handler. In addition, it caches requests and can queue requests until they can be serviced by the corresponding worker process. It runs in kernel mode, having full access to all hardware and system data.
- Windows Activation Service (WAS): It starts the worker process for the application pool to which the request was made. It requests the configuration information from the configuration store(applicationHost.config). It runs in user mode, code executed in this mode cannot access hardware or reference memory.
- World Wide Web Publishing Service: component of IIS on Microsoft Windows Server Operating Systems that allows users to publish their content on the internet. It receives the configuration information from the WAS, such as application pool and site configuration, and uses this to configure the HTTP.sys. It runs in user mode.
- Application Pool: defines a group of one or more worker processes, configured with common settings that serve requests to one or more applications that are assigned to that application pool. It is a logical grouping of web applications that will execute in a common process. They provide better security, reliability, and availability.
- Worker Process(w3wp.exe): provide the execution environment for all websites and applications configured in IIS. It processes the requests and returns a response to the HTTP.sys for the configured IIS application pool.
How A Request Is Processed:
- The request comes in.
- Request enters the HTTP.sys driver.
- HTTP.sys contacts Windows Activation Services (WAS) which request the configuration in the “applicationHost.config”(IIS configuration) file.
- WWW Publishing Service receives this configuration and uses it to configure the HTTP.sys.
- Windows Activation Services (WAS) initializes a worker process for the application pool to which the request was made.
- The worker process returns a response to the HTTP.sys.
- HTTP.sys receives the response from the worker process and passes it to the client.
- The client receives a response.
Key Takeaways:
- Internet Information Services (IIS) is a web server.
- Modules can modify and enhance the functionality provided by IIS.
- HTTP.sys is the driver that intercepts HTTP requests and routes them to the appropriate handler.
- An Application Pool defines a group of one or more worker processes, configured with common settings that serve requests to one or more applications that are assigned to that application pool.
- Worker processes provide the execution environment for all websites and applications configured in IIS. The name of the IIS worker process is ‘w3wp.exe’.
As a rule of thumb, each website should have its own application pool and one worker process (1:1:1). Although it is true you can have multiple worker processes within an application pool, this can lead to unusual behavior.
After you create a website and assign it an application pool, go to the ‘IIS Manager’, ‘Application Pools’, select the App Pool for your website, ‘Advanced Settings’, and check that the ‘Maximum Worker Processes’ is set to ‘1’.
