Microsoft Internet Information Server

Securing:

http://windowsupdate.microsoft.com DO NOT FAIL TO KEEP UP TO DATE
http://www.securityfocus.com/infocus/1311 How to lock down NT. Lots of tips and tricks to make sure NT is solid.
http://www.microsoft.com/technet/security/tools/locktool.mspx IIS Lockdown wizard. Just excellent! Takes about 10 seconds (if you select the file security options it takes a several minutes to finish) and does many good things. Also includes:
- http://www.microsoft.com/technet/security/tools/urlscan.mspx URL scan. Just kills all malformed URL requests. Options can be lax to restrictive. You may want to install this seperately after reading the docs. The default install seems to re-direct malformed URLs to a malformed URL and so causes infinate loops

Scripting

.NET
ASP
- Scripting Language
- tools
  - Active Components
Requests come into the queue (ServerListenBacklog) via a socket on a port(MaxEndpointConnections). As threads are available to execute the requests, the are de-qued and assigned. If the thread needs to wait for something else, it is blocked. When all threads are blocked, no more requests can be processed and the que grows. Threads may be blocked by lack of processor time (ProcessorThreadMax), an external resource (such as an SQL server) or a component on the same server which is external to IIS. The queue exists to handle short-term spikes, ensure response time by deleting requests that have waited to long (ASPQueueTimeout), and throttle the system to avoid overload with sustained, unexpected spikes by limiting the number of requests that may wait in the que (RequestQueueMax).
http://support.microsoft.com/kb/229814/ Configuring IIS 4 to handle heavy usage
- ServerListenBacklog: Limits the number of outstanding sockets that can be queued. Defaults to 40, maximum 500. Larger settings use more memory but allow more connections. MS recommends 500.
- MaxEndpointConnections: Limits maximum number of listen sockets that will be aggregated on a network endpoint. e.g. @ 15, a maximum of 15 total connections can be made to a single port, even if more than one domain is bound to the port. Defaults to 100, can be 0 to unlimited (represented by -1). Larger settings consume more memory but allow more conections. MS recommends 500.
http://support.microsoft.com/kb/235461/en-us Enhancing performance in Internet Information Server 4.0
- Script Engines cached property in MMC: MS recomends 100
- Max ASP Files Cached property in MMC: MS recommends a value of 25% of all the ASP scripts. e.g. with 100 different asp scripts, set the value to 25.
- Performance Optimization to 100,000+ visits.
- ASPQueueTimeout: time (in seconds) that an ASP script request is allowed to wait in the queue. As requests are de-qued, any who have waited longer than this are sent a "Server too busy" reply. May be 0 to unlimited. (defaults to -1 which means unlimited). MS recommends 30s.
- ProcessorThreadMax can be added at HKEYLOCALMACHINE\SYSTEM\CurrentControlSet\Services\W3svc\Asp\Parameters. MS recommends 20 or a setting that causes 50% processor utilization under heavy load. If the blockage is elsewhere (not IIS processor time) then increasing this can actually reduce throughput. E.g. an external component (SQL server, CGI exe) may be the limiting factor and increasing time spent on IIS reduces time spent on the actual bottleneck.
- RequestQueueMax at HKEYLOCALMACHINE\SYSTEM\CurrentControlSet\Services\W3svc\Asp\Parameters. How many requests can be queued. Too small will yield too many Server Too Busy messages under load spikes; with a queue too large, the site will look hung and the user will give up.
http://www.microsoft.com/serviceproviders/resources/techresarticlesiistuning.mspx

http://techref.massmind.org/techref/inet/iis/iis/default.htm

Every so often, IIS 4 will start exibiting strange behaviors that fall in to one of two catagories: A) it will shut down for no apparent reason without any error messages or continue running but consume all the processors cycles (100% Processor Time) or B) it will start throwing error messages that don't make any sense.

If you get the error messages, you can generally look them up in the Microsoft Knowledge Base (MSKB) and find a solution. For the sudden shut down and hangs, you will find it very hard to find a solution with Microsoft. They have information on finding a buggy component or script (which may also cause these problems) but they will not tell you to do the following, which has solved the problem for me every time....

...simply rebuild the site definition in the IIS 4 manager. E.g. if you have a site called "default" then make a new one called "default2" and set it up just like the first. Then stop default and start default2. I believe this is related to the "corrupt metabase" issue that is addressed on the MSKB, but their instructions for correcting the problem did not work for me.

Another problem with CPU overload is caused by Index Server

And it would appear that waiting for a response from an overloaded SQL server can cause the number of Current Anonymous Users to climb skyward while the web servers CPU stays quite. If you don't have a max users limit set, the web server will eventually "500 Internal Server Error" and just sit there like a lump. I'm experimenting with reduceing the connection and command timeouts for the ADO objects

As per Q235461:

Rather than let ASP pages hold forever waiting for the CPU to get to them, you can set a parameter that kills ASP page requests older that some time; The AspQueueTimeout property specifies the amount of time (in seconds) that an ASP script request is allowed to wait in the queue. When requests are pulled from the queue, they are checked to see if they have expired (have waited longer than the value of this parameter). Expired requests are rejected with a message indicating the server is too busy. From the \system32\inetsrv\adminsamples folder, type:
cscript adsutil.vbs set w3svc/1/AspQueueTimeout 30
The ServerListenBacklog property specifies the number of outstanding sockets that can be queued. The value is based on the AcceptEx operating system parameter, and the server size specified in the ServerSize property. Valid values for this property range from 5 to 500
cscript adsutil.vbs set w3svc/1/ServerListenBackLog 500
The MaxEndpointConnections property specifies the maximum number of "listen" sockets that will be aggregated on a network endpoint. For example, if this value is set to 15, then a maximum of 15 total connections can be made to a single port, even if more than one domain is bound to the port.
cscript adsutil.vbs set w3svc/1/MaxEndPointConnections 500