Re: slow iis 6.0 performance

Tech-Archive recommends: Fix windows errors by optimizing your registry

From: Param R. (pr_at_nospam.com)
Date: 12/08/04 

Date: Wed, 8 Dec 2004 08:59:23 -0600

I find it hard to believe that MS does not recommend using a domain user
account to run IIS 6 application pools and websites. What if I needed to use
pass through authentication to a back-end database?

IIS_WPG exists on each webserver and on the DC. Which one are you referring
to be added?

thanks!

"Egbert Nierop (MVP for IIS)" <egbert_nierop@nospam.invalid> wrote in
message news:eJVVZjL3EHA.2676@TK2MSFTNGP12.phx.gbl...
> "Param R." <pr@nospam.com> wrote in message
> news:%23r$BZv80EHA.2624@TK2MSFTNGP11.phx.gbl...
>> Where could I get a list of permissions that I need to set? The way I
>> have done this is setup the domain user account on the DC. Then on the
>> member web servers I added this user to IIS_WPG. This way that user
>> should have the permissions required on the local web server? Wouldnt the
>> website not load if the permissions were incorrect? Just a thought.
>
> If the security tokens are not cached for a domain user we have a problem.
> WHy is it not cached, possibly because your assumption that adding it to
> IIS_WPG is sufficient. Unfortunately, IIS_WPG is given ---local---
> security rights on a -per server-base, so you should open domain security
> policy editor and add IIS_WPG to
>
> - logon as a batch job
>
> I still do not recommend you to use a network account since this is not a
> often used practice.
>
>> thanks!
>>
>> "Egbert Nierop (MVP for IIS)" <egbert_nierop@nospam.invalid> wrote in
>> message news:uQd%23GPu0EHA.2200@TK2MSFTNGP09.phx.gbl...
>>> "Param R." <pr@nospam.com> wrote in message
>>> news:%23RozMqj0EHA.2976@TK2MSFTNGP12.phx.gbl...
>>>> Ben:
>>>>
>>>> 1. Format & Clean Install of 2003
>>>> 2. CPU is not maxing out. It stays under 25%
>>>> 3. 3x faster in response times on client. e.g. page which took 3 secs
>>>> to load on iis5 now takes 10 secs.
>>>> 4. There are no COM+ apps. All managed .net code.
>>>> 5. SQL is configured for tcp/ip.
>>>> 6. The application pool is running under a domain account - does it
>>>> matter? If yes, why?
>>>
>>> Aha, you have set here a custom domain user?
>>> If so, this user must have some priviliges such as for schannel. Can you
>>> for the test, set this user to network service or even to SYSTEM?
>>> If the performance is normal now, you should enable some priviliges
>>> (such as logon as a batch/service) for that user using domain security
>>> policy editor.
>>>
>>>> 7. To tune IIS, what counters do I need to monitor/lookout for?
>>>
>>> IIS 6 is fast by default. You only need to tune the process pool
>>> parameters.
>>>
>>>> thanks!
>>>>
>>>> "Ben Strackany" <infoNOSPAM@developmentnow.nospam.com> wrote in message
>>>> news:%23wS5%23cj0EHA.3416@TK2MSFTNGP09.phx.gbl...
>>>>> Could be a lot of things.
>>>>>
>>>>> You might want to look into tuning IIS, looking at perfcounters (e.g.
>>>>> context switching, cpu %, disk io).
>>>>>
>>>>> Maybe you have a COM+ application that's running as a server
>>>>> application
>>>>> instead of a library application? Maybe your database connection is
>>>>> running
>>>>> named pipes instead of TCP/IP? Maybe IIS is running as a domain
>>>>> account
>>>>> instead of a local one?
>>>>>
>>>>> Hard to tell w/o knowing more about the pieces in your app.
>>>>>
>>>>> Is the CPU maxing out, or something else? When you say 3x faster you
>>>>> mean
>>>>> max requests/sec?
>>>>>
>>>>> When you upgraded to win2003, did you just upgrade the OS, or did you
>>>>> do a
>>>>> clean install?
>>>>>
>>>>> --
>>>>> Ben Strackany
>>>>> www.developmentnow.com
>>>>>
>>>>> dn
>>>>>
>>>>>
>>>>> "Param R." <pr@nospam.com> wrote in message
>>>>> news:%23Af2Xxa0EHA.3236@TK2MSFTNGP15.phx.gbl...
>>>>>> Hi all, we recently upgraded our server to 2003 and everything is
>>>>>> just
>>>>>> slowww now. Same application running on same .net version on iis 5
>>>>>> was way
>>>>>> faster. Any ideas? I read something about buffering in iis 6.0? I
>>>>>> have
>>>>>> buffering turned on under the IIS properties for the website. Does
>>>>>> that
>>>>>> help? What could be causing it to be slow?
>>>>>>
>>>>>> thanks!
>>>>>>
>>>>>>
>>>>>
>>>>>
>>>>
>>>>
>>>
>>
>>
>

Relevant Pages

  • Re: ADAM SP1 on Win2K3 SP1
    ... Assuming SSL on ADAM is working fine and i want to use antoher domain user account as the ADAM service account. ... Do i only need to grant that account READ permission to machine keys and use dsdbutil to change the ADAM service account? ...
    (microsoft.public.windows.server.active_directory)
  • Re: Workaround for 0x8007045A (!)
    ... works if you log on to the administrator account of a workstation attached to ... in a fit of social conscience that might help other WU5 ... domain account under previous versions of SBS were now missing. ... on as domain user and WU5 doesn't work. ...
    (microsoft.public.windowsupdate)
  • Re: ADMTv2 questions
    ... > account to another one. ... > resourses which only the source domain user has permission. ... > The content of SID mapping file should be like below. ... The ACEs for the OLDDOMAIN domain will be preserved. ...
    (microsoft.public.windows.server.migration)
  • RE: ISA Server Management console fails to load
    ... You may need to delete the account profile and then recreate it. ... Microsoft CSS Online Newsgroup Support ... This newsgroup only focuses on SBS technical issues. ... When opening a new thread via the web interface, we recommend you check the ...
    (microsoft.public.windows.server.sbs)
  • Re: Server 2003 Administration Pack Security Flaw?
    ... I'm not able to reproduce this with a test domain user account on my Windows ... the Domain Admin, Enterprise Admin, Administrators, or the Account Operators ...
    (microsoft.public.windows.server.active_directory)