Microsoft internet information services 5. 0 documentation Book

#config, 321-324
#echo, 324-327
#exec, 327-328
#flastmod, 328-329
#fsize, 329-330
#include directives
    described, 224
    reference, 330-331
    simple example, 12
    troubleshooting, 225-226
% Processor Time, recommendations, 163
%SYSTEM32%, default value, 62

A
.asp extension, without scripts, 175
.asp files. See also Active Server Pages.
    caching, 59
    securing, 98
.bat files, mapping, 62
.cdf files, 223
.cdx extension, 223
.exe files, compiled by CGI, 61
.inc extension, 223
.ncsa extension, 143
.sct extension, registering, 211
128-bit encryption, 102-103
40-bit encryption, 101-103
404 error, 127
@ directives reference, 879-883
@ENABLESESSIONSTATE, 879, 880
@LANGUAGE, 879, 881
@LCID, 880, 881-882
@TRANSACTION, 880, 882-883
Abandon
    reference, 815-816
    using to end session, 228
aborting transactional scripts, 250
AcceptByteRanges, 338
access, anonymous. See anonymous access.
access control, 42-44, 85-99, 124-126
    anonymous connections, 86
    computers, specific, 94-96
    DACLs. See discretionary access control lists.
    databases, 98-99
    described, 65, 86, 901
    diagram, 87
    IP addresses, 88, 94-96
    setting permissions, 42-43, 93-94
    TCP/IP, properties of, 24
    vs. authentication, 114
    WebDAV, 65, 86-87
access control lists (ACLs), 901. See also discretionary access control lists.
AccessExecute, 484-485
AccessFlags, 485-487
accessibility, for disabled, 896
AccessNoRemoteExecute, 487-488
AccessNoRemoteRead, 488-489
AccessNoRemoteScript, 489-490
AccessNoRemoteWrite, 490-491
AccessRead, 491-492
AccessScript, 492-493
AccessSource, 493-494
AccessSSL, 494-495
AccessSSL128, 495-496
AccessSSLFlags, 496-497
AccessSSLMapCert, 497-498
AccessSSLNegotiateCert, 498-499
AccessSSLRequireCert, 499-500
AccessWrite, 500-501
ACLs. See access control lists.
Active Directory Service Interfaces (ADSI)
    changes for IIS 5.0, 474-477
    container object methods, 469-475
    container object overview, 316
    container object properties, 469
    described, 901, 903
    features, 314-315
    new features, xxxii
    object methods, 458-469
    object overview, 315-316
    object properties, 457-458
    properties, 479-740
    properties added to IIS 5.0, 475-476
    properties changed in IIS 5.0, 474-477
    properties removed from IIS 5.0, 475
    property key type changes for IIS 5.0, 477
    reference, 457-478
    socket pooling, 150
    timeouts, 369-371
    vs. Base Object Data types, 737
active scripting, 901
Active Server Pages (ASP)
    applications. See ASP applications.
    built-in objects, 212, 257-258, 741-817
    caching data, 275-277
    caching files, 148-150
    caching scripts, 59
    client-side scripts, using with, 193-194
    collections, 197-202
    COM scripting host, using as, 184-185
    components, installable, 819-878
    core functionality, 266
    database access, 282-286
    debugging, 60, 253-257
    defining subroutines and functions, 274
    described, 7, 10-11, 173, 174-178, 902, 906
    directives. See ASP directives.
    error list, 529
    error messages, enabling, 131
    events, 352-359
    example, 11-12
    flow control, 271-274
    mapping file name extensions, 62
    new features, xxxii, 175-176
    output directive in procedure, 195
    pages. See ASP pages.
    requirements, minimum, 11
    scripting reference, 879-892
    security, 98, 291
    sending content to browsers, 217-224
    shorthand notation, using, 198
    site administration, examples, 11-12
    site management with, 6-7, 10-12
    VBScript features disabled, 185
    Web applications, 261-300
    Web site management with, 10-12
    white space, 183-184
    XML integration, 175-176
ActiveX, 902
ActiveX Controls, 902
ActiveX Data Objects (ADO)
    accessing databases, 282-284
    as ASP base object, 209
    client networking library, 284
    Connection object, 238-242, 246-248
    connection strings, 235-237
    defining constants, 191-192
    defining parameters, 239
    described, 235, 902-903
    ODBC drivers, 282-284
    OLE DB drivers, 282-283
    recommendations, 216, 282-284
    Recordset object, 240-243
    retrieving data, 235-248
    stored procedures, 283-284
    transaction support, 282-284
Ad Rotator
    application scope example, 215-216
    Border property, 212
    creating an instance of, 210
    described, 819, 820-821
    method, 826-827
    properties, 824-826
    Schedule file, 821-823
ADC. See Advanced Data Connector.
adCmdText, 239, 244
Add, 202
AddHeader, 789-791
adding Web sites, 28
Address Resolution Protocol (ARP), 902
addresses
    friendly names, 47-48
    IP vs. domain name, 48
    resolving. See name resolution.
    restricting access by, 94-96
adExecuteNoRecords, 239
AdminACL, 502-503
administration, remote. See remote administration.
administration, site. See site administration.
administration privileges, limited, 36-37
Administration Web Site, default, 26, 37
Administrative account, 68
administrative privileges, granting, 24-25
administrator’s reference, 319-376
AdminServer, 503-504
ADO. See ActiveX Data Objects.
ADSI. See Active Directory Server Interfaces.
Adsutil.vbs utility, 36
Advanced Data Connector (ADC), 286
aggregation, defined, 903
algorithms, hashing, 78
alias, virtual directory, 5, 903
AllowAnonymous, 504-505
AllowGuestAccess, 336
AllowKeepAlive, 505
AllowPathInfoForScriptMappings, 505-506
AllowSpecialCharsInShell, 338
American National Standards Institute (ANSI), 903
AnnotateDirectories, 341
annotating scripting, 186-187
annotation file, 904
anonymous access. See Anonymous authentication.
Anonymous authentication, 42, 64, 74, 86, 89
    account, changing, 75, 82
    domain controllers, 82
    FTP, 80
    security context, 290
    WWW, 75-76
Anonymous user account, changing, 75
anonymous-only logons, defined, 904
AnonymousOnly, 506-507
AnonymousPasswordSync, 507-508
AnonymousUserName, 508-509
AnonymousUserPass, 509-510
ANSI. See American National Standards Institute.
Apartment-threaded objects, 216, 217, 904
API. See application programming interface.
AppAllowClientDebug, 510
AppAllowDebugging, 510-511
AppCreate, 427-428
AppCreate2, 428-429
AppDelete, 429-430
AppDeleteRecursive, 430-431
AppDisable, 431
AppDisableRecursive, 431-432
AppEnable, 432-433
AppEnableRecursive, 433-434
AppendToLog, 791
AppFriendlyName, 511-512
AppGetStatus, 434
AppIsolated, 512-513
applet, defined, 904
application boundaries
    defining, 269-271
    described, 54
    removing directories from, 56
    vs. namespace, 269
application mappings, setting, xxxiii, 57
Application object
    collections, 745-747
    COM objects in, 252
    described, 257, 741-745
    methods, 747-750
    storing variables in, 191
application programming interface (API), 905
application roots, 54-55, 905
application scope
    described, 215, 905
    example script, 191
    performance issues, 217
    recommendations, 215-216, 217
    threading model recommended, 217
    variables, 189-191
    vs. session scope, 189-191
applications
    ASP. See ASP applications.
    caching, 58-59
    configuring, 60-62, 306
    controlling flow, 271-279
    CPU recommendations, 152-153
    creating, 55, 56, 268-281, 295-305
    described, 53-54, 905
    developing, 261-306
    isolating, 54, 57-60
    logging, 132-138
    mapping, 57
    metabase access, 270-271
    MTS architecture, 267
    multiple, per Web site, 54
    out-of-process, 54-55, 57-58
    overriding properties, 60
    performance tuning, 155-158
    RAM recommendations, 148-150
    removing, 56
    Script Source Access, 97
    scripting language, setting, 185
    security considerations, 289-292
    server-side includes, 19-20
    setting properties, 60
    starting-point directory, 54-56
    stopping, out-of-process, 59-60
    transactional, 286-289
Application_OnEnd, 885-886
Application_OnStart, 884-885
AppOopRecoverLimit, 513-514
AppPackageID, 514-515
AppPackageName, 515-516
AppRoot, 516-517
AppUnload, 435
AppUnloadRecursive, 435-436
AppWamClsID, 517-518
argument, defined, 905
ARP. See Address Resolution Protocol.
arrays, passing to procedures, 197
ASCII, defined, 903-904
ASP. See Active Server Pages.
ASP applications, 174-178
    caching data, 275-177
    client certificate access, 290
    configuring, 60
    developing, 297-300
    HTML forms, 244-245
    performance tips, 216-217
    redirecting, 272
    scripting optimization, 298-300
    Server object, 176
    tools for monitoring, 144-147
    transactional, 286-289
    transactions across multiple pages, 249
    vs. CGI, xxxii, 174
ASP directives, 178-184, 917
ASP pages
    application properties, 60
    caching on proxy servers, 222
    creating, 178-258
Asp.dll, 57
AspAllowOutOfProcComponents, 518
AspAllowSessionState, 518-519
AspAppRestart, 436
AspBufferingOn, 519-520
ASPCode, 752
AspCodepage, 520
ASPDescription, 754
AspEnableApplicationRestart, 521-522
AspEnableAspHtmlFallback, 522
AspEnableChunkedEncoding, 522-523
AspEnableParentPaths, 523-524
AspEnableTypelibCache, 524-525
ASPError object, 258, 750-754
AspErrorsToNTLog, 525-526
AspExceptionCatchEnable, 527
AspLogErrorRequests, 527-530
AspProcessorThreadMax, 530-531
AspQueueConnectionTestTime, 531-532
AspQueueTimeout, 532
AspRequestQueueMax, 533
AspScriptEngineCacheMax, 533-534
AspScriptErrorMessage, 534-535
AspScriptErrorSentToBrowser, 535-536
AspScriptFileCacheSize, 536-537
AspScriptLanguage, 537-538
AspScriptTimeout, 538-539
AspSessionMax, 539-540
AspSessionTimeout, 540-541
AspThreadGateEnabled, 541-542
AspThreadGateLoadHigh, 542-543
AspThreadGateLoadLow, 543-544
AspThreadGateSleepDelay, 544-545
AspThreadGateSleepMax, 545-546
AspThreadGateTimeSlice, 546-547
AspTrackThreadingModel, 547-548
assigning
    host header names, 29-30, 51-52
    IP addresses, 48
    Web site names, 29-30
associating, 13-14, 906
asynchronous transfer mode (ATM), 157, 906
atEnd, 199
AtEndOflog, 853
ATM. See asynchronous transfer mode.
atomicity, defined, 907
attacks, detecting and deterring. See security.
attribute, defined, 907
auditing, 120-126
    described, 67, 120-121, 907
    directory or file access, 120-121
    events vs. file access, 120-121
    logs, 67, 125-126
    NTFS required, 121
    policies, setting, 120-124
    privileges, 122
    server events, 120-121
    server performance issues, 123
    using Event Viewer, 124-125
    using IIS logs, 120
    using MMC, 121-122
    using Windows Explorer, 121
AuthAnonymous, 549-550
AuthBasic, 550-551
authentication
    Anonymous. See Anonymous authentication.
    Basic. See Basic authentication.
    browser requirements, 76, 79
    challenge/response. See challenge/response authentication.
    configuring, 80-83
    described, 64-65, 74, 907
    Digest. See Digest authentication.
FTP methods, 80, 81
    integrated. See Integrated Windows authentication.
    mapping to user accounts, 115-120
    methods, list of, 64, 74
    SSL, 79
    vs. access control, 114
    Web site, directory, file levels, 74
    Windows vs. SQL Server, 98-99
    WWW methods, 74-79, 80-81
AuthFlags, 551-552
AuthNTLM, 552-553
authoring tools, 7-9, 86-87
authorization, defined, 907
AuthPersistence, 553-555
AuthPersistSingleRequest, 556
AuthPersistSingleRequestAlwaysIfProxy, 558-559
AuthPersistSingleRequestIfProxy, 557
automatic directory listing, defined, 907
Automation, defined, 907
Automation servers, 209
AWK, requirements for using, 61

B
Backup, 392-393
backups
    metabase, 35
    server certificate, 110, 111-112
bandwidth, defined, 908
bandwidth usage
    counters, 359, 363
    HTML forms, 206
    per connection type, 156-157
    throttling, 155, 160-161
Basic authentication
    Base64 encoding, 67, 76
    described, 64, 74, 76, 908
    enabling, 80-81
    Log On Locally rights required, 83
    remote administration, using for, 20
    setting, 82-83
    standards supported by IIS, 67
    using, 76, 84
    vs. other methods, 76
    WebDAV, 42
BinaryRead, 776-777
BinaryWrite, 791-792
bits, encryption key strength, 101-103
Boolean, defined, 909
Border, 212
Both-threaded objects, defined, 909
bottlenecks
    CPU, 152, 156
    hard disk, 147
    HTTP compression-related, 163
boundaries, application. See application boundaries.
breakpoints, 255
Browscap.ini, 828-832
Browser Capabilities, 176, 278-279, 819, 827-833
browsers, 909
    authentication methods supported, 76, 79
    browser-based administration, 37
    caching pages, preventing, 15-16, 222-223
    certificates, version required for, 113-114
    client capabilities, 277-279
    customizing content for, 7, 12
    detecting version, 12
    encryption requirements, 101
    IIS documentation, viewing remotely, 26
    international, 279-281
    passwords, prompting for, 78-79
    redirecting, 6, 14, 15, 33-34
browsers, older
    customizing content for, 12
    host header support, 29-30, 32-34, 52
    serializing requests, 235
    supporting cookies, 227, 233
    supporting frames, 12
    WebDAV not supported, 77
browsing, directory, 42-43, 917
Buffer, 781-782
buffering, 219
built-in objects, ASP, 212, 216, 257-258, 741-817
business logic
    defined, 909
    in COM component, 209
    in Web applications, 263, 297-298
    scalability, 300
BytesReceived, 856-857
BytesSent, 857

C
Cache Hits %, recommendations, 149-150
CacheControl, 782-783
CacheControlCustom, 559
CacheControlMaxAge, 560
CacheControlNoCache, 561
CacheISAPI, 562
CacheSecurityDescriptor, 333
caching
    applications, 58-59
    counters related to, 363, 368
    files, 148-150
    defined, 910
    input caching, 276-277
    ISAPI DLLs, 59
    on proxy servers, 222
    output caching, 275-276
    preventing on browser, 15-16, 222-223
    recommendations for ISAPI, 59
call, defined, 910
calling methods, 212
calling procedures
    using VBScript, JScript, 196-197
    vs. Server.Execute, 220
capacity planning, 154-158
    bandwidth usage, throttling, 155, 160-161
    compression. See HTTP compression.
    connection types, 156-157
    described, 154
    limiting connections, 155-156, 161-162
    network connections, 156
    RAM recommendations, 148-150
    users supported, by connection type, 158-160
capitalization
    in cookies, 233
    in scripts, 187
capture filters and capture triggers, 147
CAs. See certification authorities.
case sensitivity, 187, 233
CertCheckMode, 562-563
certificate revocation lists (CRLs), 106, 911
Certificate Server, Microsoft, xxxvii
Certificate Services, Microsoft, xxxvii, 108, 110, 113
certificate trust lists (CTLs), 106
Certificate Wizard
    described, xxx, 108
    Key Manager, replacement for, 110-111
    using to enable encryption, 102
    using to set up SSL, 106-107
certificates
    browser, 113-114
    certificate trust lists (CTLs), 106, 112-113. See also CTL Wizard.
    CertMapper metabase key, 309
    client. See client certificates.
    client vs. server, 104
    described, 64, 104, 910
    exporting, 117-118
    Fortezza, xxxi, 85
    issuing your own, 105, 106-107
    limitations for host headers, 30
    mapping, 79, 115-120
    multiple Web sites, using for, 79
    obtaining, 108, 110-112
    quick tips, 897-898
    remote administration, 26
    replacing, 108
    requirements, 104, 113
    revoked. See certificate revocation lists.
    root certificates, 112-113
    server. See server certificates.
    storing, xxxi
    transferring, 108
    vs. access control, 114
    vs. other authentication methods, 79
certification authorities (CAs)
    choosing, 111
    described, 65, 105-106, 909
    limitations of, 106
    list of, 111
    sending requests to, 108
    verifying, 112-113
    vs. issuing certificates, 110
    waiting for approval, 107
CGI applications
    Cgi-bin directory, 61
    configuring, 61-62
    described, 61-62, 912
    mapping, 57, 62
    permissions required, 61-62
    processing requests, 268
    script interpreter required, 61
    security recommendations, 62
    special characters, 62
    timeout vs. process throttling, 153
    timeouts, setting, 58-59
    using with SSI, 19-20
    vs. ASP applications, xxxii, 174
    vs. ISAPI applications, 61
CGITimeout, 563-564
challenge/response authentication, 78
changes, IIS 4.0 to 5.0. See IIS, earlier versions.
channels
    channel definition file, 223
    dynamic, 223-224
    encrypted, 101-102
Charset, 783-784
CheckCertRevocation, 333
checklist, security, 68-73
ChooseContent, 843-844
class, defined, 911
class factory, defined, 911
class ID (CLSID), defined, 911
Clear, 792
clear-text passwords, 76, 77, 80
Clickable, 825
client certificates, 66, 104, 113-115
    accessing with ASP, 290
    described, 105
    enabling, 114-115
    mapping, 79, 115-120
    obtaining, 113-114
    revoked, 106
    using, 79
client/server
    applications, 274-279
    architecture, 262-264, 912
client-side scripting
    with ASP, 193-194
    detecting client capabilities, 277-279
    verifying HTML form input, 205-208
ClientCertificate, 760-763
ClientIP, 857
clients, 911. See also client certificates.
    client-side RDS components, 284
    determining capabilities, 277-279
    networking library for ADO, 284
    security context impersonated, 290-291
CloseLogFiles, 853-854
CLSID. See class ID.
clustering
    described, 165, 912
    diagram, 166
    FTP servers, 167-168
    IIS issues, 166-169
    requirements, 166-168
    restarting clusters, 27
    Web servers, 167-168
    Windows requirements, 164
code page for string conversions, 280-281
CodePage, 812-813
collections
    accessing read-only, 198
    Application, 745-747
    ASP, 197-202
    Contents. See Contents collection.
    defined, 197
    eliminating name, 198
    Enumerator object, 199
    indexed access, 197-198
    iterating through, 198-201
    keys, 197
    o