Re: How to deploy IIS 6.0 MetaBase to server group

Tech-Archive recommends: Repair Windows Errors & Optimize Windows Performance

From: Terry (Terry_at_discussions.microsoft.com)
Date: 01/24/05 

Date: Mon, 24 Jan 2005 08:17:02 -0800

If I use domain credentials for everything, can I also use iiscnfg /export
and /import to deploy changes to single sites without worrying about deleting
"machine-specific" keys?

Also, can you give me a better (more complete and accurate) explanation of
what the /inherited and /merge switches do? The IIS documentation is very
terse on both.

Thanks!

"David Wang [Msft]" wrote:

> The behavior you observe with /copy ( IUSR/IWAM ) is by-design.
>
> When you have a group of machines running IIS6 that are supposed to be "the
> same", you have the following strategies:
> 1. Make sure all configured user credentials on all servers are identical --
> i.e. AnonymousUsername, WAMUsername, UNCUsername, AppPool Identity, etc.
> This way, restoring metabase configuration won't look like duplication
> 2. Instead of local user credentials on #1, use common domain credentials
>
> #2 is probably the smoothest way to go since the domain credential ensures
> that all ACLs (and their SIDs) are the same on all the servers in the group.
> #1 only ensures that the user credential is the same (so IIS authenticates
> ok), but the SIDs on each server's ACLs are not the same, so you can't copy
> files between the servers with expectation of similar ACL since the SID is
> not the same.
>
> --
> //David
> IIS
> http://blogs.msdn.com/David.Wang
> This posting is provided "AS IS" with no warranties, and confers no rights.
> //
> "Terry" <Terry@discussions.microsoft.com> wrote in message
> news:00951D10-3469-4AFE-BDF9-4AF2049AF80A@microsoft.com...
> I have spent days trying to determine the best way to deploy our MetaBase
> changes to a server group and cannot be confident that I have the answer.
>
> The best result has been with using:
>
> > iiscnfg /copy /s stage01 /u dom\user /p pass /ts prod01 /tu dom\user /tp
> pass
>
> The documentation says that /copy "changes the computer-specific and
> system-specific properties in the metabase so that they are valid on the
> target computer."
>
> I read the iiscnfg.vbs script, and can not see where any metabase
> information is changed. It simply maps the admin$ shares on the 2 computers
> issues the command:
>
> > iisback /backup /s svr1 /u usr /p pwd /b iisreplback /overwrite
>
> Next it copies the backup files to the target computer and issues:
>
> > iisback /restore /s svr1 /u usr /p pwd /b iisreplback
>
> It never changes anything in the metabase as far as I can see. So the
> question is, are the AdminACLs and IUSR and IWAM account settings valid on
> the target server?
>
> Everything seems to work. The only problem is that the /copy command creates
> local IUSR and IWAM accounts on the destination server that match the source
> server name.
>
> Before I use this method to build my production Web servers, can anyone tell
> me if this is not a valid way to do a metabase deployment. Any advice would
> be greatly appreciated.
>
>
>

Relevant Pages

  • [Full-Disclosure] RE: [Owasp-dotnet] Re: (Asp.Net Full Trust Vulnerabilities) RE: Apache VS IIS Secu
    ... > b) Each client of the server (say, each department of a company, or each ... > c) Each website is placed into its own custom application pool ... ALL website's Metabase entries, then the malicious script could (after ... download the ANBS (Asp.Net Baseline Security) Open Source tool (that I ...
    (Full-Disclosure)
  • Re: IIS 6.0 FTP Authentication
    ... you should get Metabase Explorer not MetaEdit. ... > However, when I did a CD to the folder on the remote server, I received a> login failure message. ... > I exported the metabase information using MetaEdit, and the UNCPassword> field for this virtual directory was empty - why would that be? ...
    (microsoft.public.inetserver.iis.security)
  • Re: Exchange Server POP3 protocol not started after reboot
    ... I downloaded the metabase explorer and checked the entries. ... >Server" in Exchange System Manager. ... >If the "Default POP3 Virtual Server" is still stopped after that, ...
    (microsoft.public.windows.server.sbs)
  • How to deploy IIS 6.0 MetaBase to server group
    ... I have spent days trying to determine the best way to deploy our MetaBase ... changes to a server group and cannot be confident that I have the answer. ... Next it copies the backup files to the target computer and issues: ... are the AdminACLs and IUSR and IWAM account settings valid on ...
    (microsoft.public.inetserver.iis)
  • Re: Can not use UNC path in Windows server 2003 server 64 bit OS
    ... If it does you have a name resolution process though your ... ping results of successful ping by name tend to rule that out. ... See if you can access the target computer from ... Use secpol.msc to open Local Security Policy on a Windows 2003 server. ...
    (microsoft.public.security)