IIS on Nano Server

Applies to: Windows Server 2016

You can install the Internet Information Services (IIS) server role on Nano Server by using the -Package parameter with Microsoft-NanoServer-IIS-Package. For information about configuring Nano Server, including installing packages, see Install Nano Server.

In this release of Nano Server, the following IIS features are available:

A series of articles on other configurations of IIS (such as using ASP.NET, PHP, and Java) and other related content is published at https://iis.net/learn.

Installing IIS on Nano Server

You can install this server role either offline (with the Nano Server off) or online (with the Nano Server running); offline installation is the recommended option.

For offline installation, add the package with the -Packages parameter of New-NanoServerImage, as in this example:

New-NanoServerImage -Edition Standard -DeploymentType Guest -MediaPath f:\ -BasePath .\Base -TargetPath .\Nano1.vhd -ComputerName Nano1 -Package Microsoft-NanoServer-IIS-Package

If you have an existing VHD file, you can install IIS offline with DISM.exe by mounting the VHD, and then using the Add-Package option. The following example steps assume that you are running from the directory specified by BasePath option, which was created after running New-NanoServerImage.

1. mkdir mountdir
2. .\Tools\dism.exe /Mount-Image /ImageFile:.\NanoServer.vhd /Index:1 /MountDir:.\mountdir
3. .\Tools\dism.exe /Add-Package /PackagePath:.\packages\Microsoft-NanoServer-IIS-Package.cab /Image:.\mountdir
4. .\Tools\dism.exe /Add-Package /PackagePath:.\packages\en-us\Microsoft-NanoServer-IIS-Package_en-us.cab /Image:.\mountdir
5. .\Tools\dism.exe /Unmount-Image /MountDir:.\MountDir /Commit

At this point, you can start Nano Server with IIS.

Installing IIS on Nano Server online

Though offline installation of the server role is recommended, you might need to install it online (with the Nano Server running) in container scenarios. To do this, follow these steps:

1. Copy the Packages folder from the installation media locally to the running Nano Server (for example, to C:\packages).

2. Create a new Unattend.xml file on another computer and then copy it to the Nano Server. You can copy and paste this XML content into the XML file you created:

    <unattend xmlns=urn:schemas-microsoft-com:unattend>
    <servicing>
        <package action=install>
            <assemblyIdentity name=Microsoft-NanoServer-IIS-Package version=10.0.14393.0 processorArchitecture=amd64 publicKeyToken=31bf3856ad364e35 language=neutral />
            <source location=c:\packages\Microsoft-NanoServer-IIS-Package.cab />
        </package>
        <package action=install>
            <assemblyIdentity name=Microsoft-NanoServer-IIS-Package version=10.0.14393.0 processorArchitecture=amd64 publicKeyToken=31bf3856ad364e35 language=en-US />
            <source location=c:\packages\en-us\Microsoft-NanoServer-IIS-Package_en-us.cab />
        </package>
    </servicing>
    <cpi:offlineImage cpi:source= xmlns:cpi=urn:schemas-microsoft-com:cpi />
</unattend>

3. In the new XML file you created (or copied), edit C:\packages to the directory you copied the content of Packages to.

4. Switch to the directory with the newly created XML file and run

   dism /online /apply-unattend:.\unattend.xml

5. Confirm that the IIS package and its associated language pack are installed correctly by running:

   dism /online /get-packages

   You should see Package Identity : Microsoft-NanoServer-IIS-Package~31bf3856ad364e35~amd64~~10.0.14393.1000 listed twice, once for Release Type : Language Pack and once for Release Type : Feature Pack.

6. Start the W3SVC service either with net start w3svc or by restarting the Nano Server.

Starting IIS

Once IIS is installed and running, it is ready to serve web requests. Verify that IIS is running by browsing the default IIS web page at http://<IP address of Nano Server>. On a physical computer, you can determine the IP address by using the Recovery Console. On a virtual machine, you can get the IP address by using a Windows PowerShell prompt and running:

Get-VM -name <VM name> | Select -ExpandProperty networkadapters | select IPAddresses

If you are not able to access the default IIS web page, double-check the IIS installation by looking for the c:\inetpub directory on the Nano Server.

Enabling and disabling IIS features

A number of IIS features are enabled by default when you install the IIS role (see the table in the Overview of IIS on Nano Server section of this topic). You can enable (or disable) additional features using DISM.exe

Each feature of IIS exists as a set of configuration elements. For example, the Windows authentication feature comprises these elements:

The full set of IIS sub-features is included in Appendix 1 of this topic and their corresponding configuration elements is included in Appendix 2 of this topic.

Example: installing Windows authentication

1. Open a Windows PowerShell remote session console on the Nano Server.

2. Use DISM.exe to install the Windows authentication module:

   dism /Enable-Feature /online /featurename:IIS-WindowsAuthentication /all
   

   The /all switch will install any feature that the chosen feature depends on.

Example: uninstalling Windows authentication

1. Open a Windows PowerShell remote session console on the Nano Server.

2. Use DISM.exe to uninstall the Windows authentication module:

   dism /Disable-Feature /online /featurename:IIS-WindowsAuthentication
   

Other common IIS configuration tasks

Creating websites

Use this cmdlet:

PS D:\> New-IISSite -Name TestSite -BindingInformation *:80:TestSite -PhysicalPath c:\test

You can then run Get-IISSite to verify the state of the site (returns the web site name, ID, state, physical path, and bindings).

Deleting web sites

Run Remove-IISSite -Name TestSite -Confirm:$false.

Creating virtual directories

You can create virtual directories by using the IISServerManager object returned by Get-IISServerManager, which exposes the .NET Microsoft.Web.Administration.ServerManager API. In this example, these commands access the Default Web Site element of the Sites collection and the root application element (/) of the Applications section. They then call the Add() method of the VirtualDirectories collection for that application element to create the new directory:

PS C:\> $sm = Get-IISServerManager
PS C:\> $sm.Sites["Default Web Site"].Applications[/].VirtualDirectories.Add(/DemoVirtualDir1, c:\test\virtualDirectory1)
PS C:\> $sm.Sites["Default Web Site"].Applications[/].VirtualDirectories.Add(/DemoVirtualDir2, c:\test\virtualDirectory2)
PS C:\> $sm.CommitChanges()

Creating application pools

Similarly you can use Get-IISServerManager to create application pools:

PS C:\> $sm = Get-IISServerManager
PS C:\> $sm.ApplicationPools.Add(DemoAppPool)

Configuring HTTPS and certificates

Use the Certoc.exe utility to import certificates, as in this example, which shows configuring HTTPS for a website on a Nano Server:

1. On another computer that is not running Nano Server, create a certificate (using your own certificate name and password), and then export it to c:\temp\test.pfx.

   $newCert = New-SelfSignedCertificate -DnsName www.foo.bar.com -CertStoreLocation cert:\LocalMachine\my

   $mypwd = ConvertTo-SecureString -String YOUR_PFX_PASSWD -Force -AsPlainText

   Export-PfxCertificate -FilePath c:\temp\test.pfx -Cert $newCert -Password $mypwd

2. Copy the test.pfx file to the Nano Server computer.

3. On the Nano Server, import the certificate to the My store with this command:

   certoc.exe -ImportPFX -p YOUR_PFX_PASSWD My c:\temp\test.pfx

4. Retrieve the thumbprint of this new certificate (in this example, 61E71251294B2A7BB8259C2AC5CF7BA622777E73) with Get-ChildItem Cert:\LocalMachine\my.

5. Add the HTTPS binding to the Default Web Site (or whatever website you want to add the binding to) by using these Windows PowerShell commands:

   $certificate = get-item Cert:\LocalMachine\my\61E71251294B2A7BB8259C2AC5CF7BA622777E73
   # Use your actual thumbprint instead of this example
   $hash = $certificate.GetCertHash()
   
   Import-Module IISAdministration
   $sm = Get-IISServerManager
   $sm.Sites["Default Web Site"].Bindings.Add("*:443:", $hash, "My", "0")    # My is the certificate store name
   $sm.CommitChanges()
   

   You could also use Server Name Indication (SNI) with a specific host name with this syntax: $sm.Sites["Default Web Site"].Bindings.Add("*:443:www.foo.bar.com", $hash, "My", "SNI")

Appendix 1: List of IIS sub-features

• IIS-WebServer
• IIS-CommonHttpFeatures
• IIS-StaticContent
• IIS-DefaultDocument
• IIS-DirectoryBrowsing
• IIS-HttpErrors
• IIS-HttpRedirect
• IIS-ApplicationDevelopment
• IIS-CGI
• IIS-ISAPIExtensions
• IIS-ISAPIFilter
• IIS-ServerSideIncludes
• IIS-WebSockets
• IIS-ApplicationInit
• IIS-Security
• IIS-BasicAuthentication
• IIS-WindowsAuthentication
• IIS-DigestAuthentication
• IIS-ClientCertificateMappingAuthentication
• IIS-IISCertificateMappingAuthentication
• IIS-URLAuthorization
• IIS-RequestFiltering
• IIS-IPSecurity
• IIS-CertProvider
• IIS-Performance
• IIS-HttpCompressionStatic
• IIS-HttpCompressionDynamic
• IIS-HealthAndDiagnostics
• IIS-HttpLogging
• IIS-LoggingLibraries
• IIS-RequestMonitor
• IIS-HttpTracing
• IIS-CustomLogging

Appendix 2: Elements of HTTP features

Each feature of IIS exists as a set of configuration elements. This appendix lists the configuration elements for all of the features in this release of Nano Server

Common HTTP features

Default document

The StaticFile <handlers> entry might already be present; if so, just add DefaultDocumentModule to the <modules> attribute, separated by a comma.

Directory browsing

The StaticFile <handlers> entry might already be present; if so, just add DirectoryListingModule to the <modules> attribute, separated by a comma.

HTTP errors

Static content

The StaticFile \<handlers> entry might already be present; if so, just add StaticFileModule to the <modules> attribute, separated by a comma.

HTTP redirection

Health and diagnostics

HTTP logging

Custom logging

Request monitor

Tracing

Performance

Static content compression

Dynamic content compression

Security

Request filtering

Basic authentication

Client certificate mapping authentication

Digest authentication

IIS client certificate mapping authentication

IP and domain restrictions

URL authorization

Windows authentication

Application development

Application initialization

CGI

ISAPI extensions

ISAPI filters

Server-side includes

WebSocket protocol