2. Authentication

3. Access control

4. Encryption (SSL)

5. Caching

6. Web site isolation

7. Bandwidth throttling

8. Load balancing

9. Web frameworks and middleware

10. Configuration files and management APIs

12. Firewall-friendly Remote Administration of IIS sites via HTTPS

13. Dynamic and static caching improvements for faster response time for PHP or ASP.NET applications.

14. Support for fine-grained, secure delegation of administration functions to other administrators or non-administrators who work with IIS servers.

15. Command-line tool (appcmd).

16. Granular tracing of requests, which speeds troubleshooting.

17. Greatly improved application hosting for FastCGI compliant applications, with many popular PHP applications tested and documented on IIS.

19. Health and diagnostics features such as HTTP logging and request monitoring

20. Security features such as request filtering

21. Performance features such as static content compression

22. Management tools, including the IIS Management Console

23. Windows Process Activation Service to start the Worker Process on the first requestAdditional modules are included to provide functionality for authentication, authorization, compression, application frameworks (such as CGI and the .NET Framework), health monitoring, diagnostics, and logging.<br />Since the release of IIS 7.0, Microsoft has developed new modules for bit-rate throttling and URL rewriting, which provides functionality similar to the mod_rewrite module available for Apache. Outside of Microsoft, modules are available from software vendors, and open-source modules can be found on CodePlex.com.<br />As James Hanauer, a senior software engineer at ServiceU, explains, “The modular architecture of IIS 7.0 and its integration with the newest version of the Microsoft .NET Framework contribute to increased Web server performance. These same characteristics provide a customizable platform where specialized server components such as authentication and logging can be extended or replaced.”<br />Rich Korb, assistant manager of Data Center Operations for WeatherBug, says, “We really like the ability to pick which components of IIS 7.0 we need—whether it’s using the integrated mode to run ASP.NET applications, using the classic pipeline to run ASP.NET through the ISAPI filter, or just running a streamlined HTTP Web server.”<br />Apache is an innovative platform. What about IIS?<br />You can expect Microsoft, the ISV ecosystem, and the open-source developer community to continue to innovate with IIS to meet future hosting provider, developer and corporate needs. The modular architecture of IIS 7.0 ensures that important innovation can happen even outside of Microsoft, and Microsoft continues to listen to customers and partners alike.<br />IIS 7.0 includes a number of important innovations. It is fully scriptable and able to operate with no GUI. Microsoft also enhanced IIS 7.0 by allowing it to run FastCGI applications, such as PHP, very effectively. <br />To Apache administrators, these innovations may seem to imply that IIS is only catching up to Apache, but in reality, IIS has its own set of unique innovations. In addition to its new GUI administrative interface, IIS 7.0 includes many performance enhancements that permit it to host more sites and handle more traffic on the same hardware. Windows Process Activation Service can start up the Worker Process on the first HTTP request. IIS includes application pools and sandboxing to let you control reliability and isolation on a per-site basis. IIS supports editing of configuration files while the server is live, and automatically applies the changes. IIS also includes robust static and dynamic output caching, as well as object caching for back-end data.<br />Microsoft continues to evolve IIS to meet the needs of a diverse audience that includes companies hosting their own sites, sites hosted through co-location that require remote management, and hosters that service hundreds or thousands of customers.<br />According to hosting company eLinia, “Microsoft really listened to the hosting community when it developed Windows Server 2008. The changes in Internet Information Services 7.0 mean that we can tailor the system to do exactly what we want.”<br />Craig Tadlock, chief systems architect for Spot Runner, says, “IIS 7.0 is a more feature-rich platform than previous Web servers. IIS 7.0 reduces the amount of foundational technology, such as logging and auditing, that we need to develop on our own and thereby simplifies our services and, ultimately, our systems.”<br />Troubleshooting Web applications can be complicated. What does IIS offer to simplify troubleshooting?<br />Apache records errors in a log file that includes information from the Apache HTTP server and additional information from the relevant modules. Apache also lets users control the amount of information logged, ranging from emergency issues only to verbose debugging information. If users need additional information, they can add such things as mod_log_forensic to capture entire requests.<br />IIS also logs errors, and Microsoft has focused on ensuring that IIS error messages are understandable and useful. IIS defaults to providing verbose error information on the localhost and a more generic message to remote users to ensure that security information is not remotely disclosed. Error information often includes suggested causes and solutions. IIS also provides Failed Request Tracing, which lets users capture entire requests. Failed Request Tracing lets you set the number of log files to keep, which URLs should be traced, and which response codes should generate a trace. Users can even specify that requests for certain URLs be captured only if those requests take over a certain amount of time to process. <br />Dawn Getteau, systems architect at Continental Airlines, explains, “The troubleshooting features in IIS 7.0 have been enhanced by leaps and bounds. At the end of the day, what matters to us and our users is not just how well our IIS applications run, but also how fast we can troubleshoot them if they go down.”<br />Hostbasket’s Van Pottelberghe says, “There’s nothing cryptic about it. If something goes wrong, we track it, repair it, and quickly finish the configuration.”<br />Gregory Storme, systems engineer of COMBELL, comments, “Before, when a client’s Web site wasn’t performing well, the old debugging tools provided a lot of output. With 500 Web sites running, it was nearly impossible to find the relevant error information. Failed Request Tracing in IIS 7.0 makes it a lot easier to see just the requests that we’re interested in, with the status codes and other details that we need to debug the site or the application.”<br />I depend on a wide variety of Web architectures. Can I run them on IIS?<br />IIS provides more application choice. This may seem counterintuitive, as there are innumerable open-source Web projects such as blogs, forums, customer relationship management (CRM) systems, content management systems (CMS), and wikis. But many of these popular Web applications run on IIS and Apache. Microsoft has provided simple step-by-step instructions for running Drupal, LimeSurvey, phplist, Coppermine, Gallery2, Mambo, WordPress, XOOPS, MediaWiki, and other popular applications on IIS. SpikeSource offers simple installers for phpBB, WebCalendar, Moodle, and Mantis on IIS. SugarCRM, Alfresco, JBoss, and many other corporate-backed open-source projects are also supported on IIS. <br />In addition, there are a number of popular Web applications—including SharePoint, and Outlook Web Access—that run on IIS only. This lets you consolidate your Web sites onto fewer servers. For example, IIS permits you to host WordPress and SharePoint on the same machine, which is exactly what Web hoster CrystalTech does. Jon Thompson, CrystalTech’s server operations manager, explains, “We can work with whatever our customers want to write. They have access to ASP, ASP.NET, PHP, and Perl as well.”<br />Yes, PHP applications can run on IIS, but is it really a good idea?<br />Microsoft invested heavily in FastCGI and Windows Server 2008 to ensure that PHP and other CGI frameworks would run as first-class citizens on Windows.<br />In addition to providing the basic infrastructure for running PHP applications, IIS-specific features are also available for those workloads. For example, you can use IIS authentication mechanisms such as NTLM that integrate with Active Directory. You can use the SQL Server driver for PHP. In addition, PHP applications get the benefit of IIS application pools and sandboxing. PHP also benefits from the performance that IIS Kernel Mode Caching offers. PHP and ASP.NET can be combined for quick development by leveraging certain functionality that ASP.NET provides out of the box, such as Forms Authentication. Users can apply the exact same modules across PHP and ASP.NET sites, such as, URL Rewriter. By running PHP on Windows, you’re able to use the same management tools to monitor your PHP workloads that you use to monitor your Windows workloads.<br />Companies such as COMBELL are providing their customers the capability of running PHP on Windows and today are seeing the results. As Frederik Poelman, technical director of COMBELL, explains “In the past, if customers asked for PHP hosting, we offered them Linux; if they asked for ASP or ASP.NET hosting, we offered Windows Server. Now we have a bunch of test customers running PHP on IIS 7.0, and it is working very well for them. The more customer requirements we can support with one operating system, the more experts we can have developing new solutions on that operating system.”<br />Will IIS be more expensive than Apache?<br />If you do your own cost comparisons, you’ll likely find that the total cost of IIS on Windows is the same or less than Apache on Linux.<br />Apache may be free software, but users should keep in mind that up-front cost is not the only type of price to be paid. Software vendors often market against free software by talking about the total cost of ownership (TCO). Even though TCO has become a widely used marketing term, certain commonsense TCO concepts apply from an administrator’s perspective. <br />For example, although Apache is free, it does not come with support. Organizations deal with this lack of support in two ways. One method involves paying for support though a Linux subscription such as Red Hat Enterprise Linux or Novell SUSE Linux Enterprise.<br />But some organizations quickly find that the costs of Linux support subscriptions are comparable to, or even more expensive than, Windows licensing. These companies can turn to the second method: supporting Apache with internal expertise. This means that organizations have to hire highly skilled experts in order to run mission-critical applications on Apache—in some regions these experts are hard to find. In contrast, Windows expertise is relatively common. <br />Some organizations may also find that administrative tasks can be performed more quickly on IIS. Since software acquisition is 7 percent of TCO, while staffing is 60 percent, staff costs can quickly outweigh acquisition costs. <br />Consider one case study: “At aruba.it, Italy’s largest hosting service provider, Microsoft found that the TCO of its existing Windows-based shared hosted services was 16 percent lower than the TCO of its Linux-based offerings. Moreover, the contribution margin from the Windows-based services was 14 percent higher than the contribution margin from the analogous Linux-based services. Finally, the profit margin for Windows was 81 percent compared to 77 percent for Linux.”<br />Conclusions<br />It is apparent that Apache is a capable Web server. Over the past years Microsoft has invested heavily in the development of IIS which has proven to be not only as capable as Apache, but also able to host a greater variety of applications such as SharePoint, Outlook Web Access, and ASP.NET sites. IIS also hosts popular PHP applications, such as Wordpress, Drupal, phpBB, and MediaWiki.. In addition to being highly secure and reliable, IIS is easy to manage through administrative GUIs and scripts. It runs many Web sites that have extremely high performance and availability requirements.<br />The benefits of a modular architecture are self-evident to Apache administrators—and IIS now shares this type of architecture. IIS 7.0 includes 40 modules that are fully supported by Microsoft, giving administrators one company to hold responsible for problem resolution. <br />Starting with IIS 6.0 and continuing with IIS 7.0, Microsoft has invested in improving the reliability and fault tolerance of its Web server. IIS 6.0 introduced application pools that allow users to make isolation decisions on a per-site basis; IIS 7.0 extends this capability with sandboxing, which provides many of the isolation benefits of separate processes but without the overhead. In addition, IIS 7.0 provides great diagnostics with Failed Request Tracing, a feature that makes it easy to get to the bottom of problems. <br />To evaluate IIS and determine if it’s right for your workloads, visit learn.iis.net.<br />IIS 7.0 Resources<br />Technical Communities, Webcasts, Blogs, Chat and User Groups<br />http://www.microsoft.com/communities/default.mspx <br />Microsoft Learning and Certification<br />http://www.microsoft.com/learning/default.mspx <br />Microsoft Developer Network (MSDN) & TechNet<br />http://microsoft.com/msdn <br />http://microsoft.com/technet<br />Trial Software and Virtual Labs<br />http://www.microsoft.com/technet/downloads/trials/default.mspx <br />IIS.NET Walkthroughs, Forums, Blogs and More<br />http://www.iis.net<br />http://blogs.iis.net<br />http://forums.iis.net <br /> <br />The information contained in this document represents the current view of Microsoft Corporation on the issues discussed as of the date of publication. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information presented after the date of publication.<br />This white paper is for informational purposes only. MICROSOFT MAKES NO WARRANTIES, EXPRESS OR IMPLIED, IN THIS DOCUMENT.<br />Complying with all applicable copyright laws is the responsibility of the user. Without limiting the rights under copyright, no part of this document may be reproduced, stored in, or introduced into a retrieval system, or transmitted in any form or by any means (electronic, mechanical, photocopying, recording, or otherwise), or for any purpose, without the express written permission of Microsoft Corporation.<br />Microsoft may have patents, patent applications, trademarks, copyrights, or other intellectual property rights covering subject matter in this document. Except as expressly provided in any written license agreement from Microsoft, the furnishing of this document does not give you any license to these patents, trademarks, copyrights, or other intellectual property.<br />© 2007 Microsoft Corporation. All rights reserved.<br />