IIS 6.0 architecture

[wh1974]

I've just been reading up on the architecture of IIS 6.0. There are a
couple of issues I would appreciate clarification on:

1. When IIS is running in "IIS 5.0 isolation mode", I assume that IIS
6.0 will still use w3wp.exe as the (out-or process) worker process.
Does this still run under the ASPNET account when impersonation is
turned off? And is machine.config still used to determine the account
to run under (ASPNET)?

2. When running is the default "worker process isolation mode", the
w3wp.exe process executes under the NETWORKSERVICE account when
impersonation is turned off. Does this replace the ASPNET account used
in IIS5.0?

Thanks,
Wayne.

 

[Juan T. Llibre]

re:

1. When IIS is running in "IIS 5.0 isolation mode", I assume that IIS
6.0 will still use w3wp.exe

No. It will use aspnet_wp.exe


Depending on how the isolation mode is configured (either in-process, pooled,
or out-of-process) the request will be processed in either Inetinfo.exe or
DLLHost.exe.

When running IIS 6.0 in worker process isolation mode ( the default for
new installations ) the w3wp.exe is used.

re:

Does this still run under the ASPNET account when impersonation is turned off?

When running in IIS 5.0 isolation mode, ASP.NET will run as
the MACHINENAME\ASPNET account.

When running IIS 6.0 in worker process isolation mode,
ASP.NET will run as the MACHINENAME\NETWORK SERVICE account.

re:

is machine.config still used to determine the account to run under ?

You can impersonate by configuring in web.config
or machine.config using either mode of operation.

re:

impersonation is turned off. Does this replace the ASPNET account used in IIS5.0?

Yes. The default account for ASP.NET when using worker process
isolation mode, when impersonation is not in effect, was changed from
ASPNET (IIS 5.0) to NETWORK SERVICE (IIS 6 work proc iso mode).


For further information on IIS 6.0 Architecture, see :
http://www.microsoft.com/technet/pr...IIS/843df643-1dbb-4fb6-910d-ec1965fa9e43.mspx

 

[wh1974]

Thanks for the reply. Much appreciated.

Some comments:

In IIS 5.0, no matter what application protection (low, medium, high)
is set from within IIS management, the aspnet isap dll *always*
launches (an out-of process) aspnet_wp.exe to handle the requests.

In ASP.NET, an entry in machine.config specifies the user account the
worker process runs under (i.e. MACHINENAME\ASPNET). My question wasn't
to do with impersonation, but with what account the worker process (in
both IIS 5.0 isolation and IIS6.0 worker process isolation mode).

Thanks again,
Wayne.

 

[Juan T. Llibre]

re:

with what account the worker process (in
both IIS 5.0 isolation and IIS6.0 worker process isolation mode).

You can configure that account using the IIS MMC,
(right-click Application Pools, and then the Identity tab ) for each
Application Pool, when using IIS 6.0 worker process isolation mode.

Unfortunately, since there's no Application Pools when running
in IIS 5 isolation, the Application Pools node disappears from
the IIS MMC if you use IIS 5 isolation mode.

 

[wh1974]

Ah yes. Thanks for your comments.