Default Website - Best Practise?

Hi,

Can anybody let me know what the current 'best practise' is in regards to
the Default Web Site?

Depending on who I speak to I get a different answer, therefore, I am trying
to find where it is defined (whitepaper, KB article etc.)

Is it best to delete the Default Website or disable it?
If I keep the Default Web Site, is setting the home folder path and log file
path to a dedicated NTFS volume enough in regards to file location?

Thanks in advance...
Shaun

RE: Default Website - Best Practise?

Hi Shaun,

Yes, deleting the default web site is not recommended. This is because the
Default Web Site's ID in IIS metabase is 1 by default, i.e: /LM/W3SVC/1 .
You can check this by using Metabase Explorer utility in IIS 6.0 resource
kit tools:

Internet Information Services (IIS) 6.0 Resource Kit Tools
http://www.microsoft.com/downloads/details.aspx?displaylang= en&familyid=56fc
92ee-a71a-4c73-b628-ade629c89499

Some web application's uses the path /LM/W3SVC/1 by default. If the site is
deleted, the installer cannot find this path and the installation process
fails.

Setting the home folder path of the default web site and log file path to a
dedicated NTFS volume shouldn't affect anything because most of web
application installation are using virtual directories. Even if it refers
to the Default Web Site's physical path, the installer should look for the
Path property under /LMW3SVC/1/Root to locate it and copy files.

Please let me know if you have any further question.

Thanks for using MSDN newsgroup and have a nice day.

Sincerely,

WenJun Zhang

Microsoft Online Community Support

==================================================

Get notification to my posts through email? Please refer to:
http://msdn.microsoft.com/subscriptions/managednewsgroups/de fault.aspx#notif
ications.

Note: The MSDN Managed Newsgroup support offering is for non-urgent issues
where an initial response from the community or a Microsoft Support
Engineer within 1 business day is acceptable. Please note that each follow
up response may take approximately 2 business days as the support
professional working with you may need further investigation to reach the
most efficient resolution. The offering is not appropriate for situations
that require urgent, real-time or phone-based interactions or complex
project analysis and dump analysis issues. Issues of this nature are best
handled working with a dedicated Microsoft Support Engineer by contacting
Microsoft Customer Support Services (CSS) at:

http://msdn.microsoft.com/subscriptions/support/default.aspx .

==================================================

This posting is provided "AS IS" with no warranties, and confers no rights.

Re: Default Website - Best Practise?

Personally, if I attempt to install something and it is so dumb
as to assume the w3svc instance into which I want it installed,
then I do not what that crap code installed anyway.

The practice of moving the default site, or any other for that
matter, to a NTFS partition used only for web content originated
with attempts to prevent use of parent path traversal from getting
to executables. If parent paths is enabled, this is still a valid
practice as far as I can tell, although not necessarily to prevent
execution of what it can potentially make accessible.

Roger

""WenJun Zhang[msft]"" wrote in message
news:IauxvBdVHHA.4088@TK2MSFTNGHUB02.phx.gbl...
> Hi Shaun,
>
> Yes, deleting the default web site is not recommended. This is because the
> Default Web Site's ID in IIS metabase is 1 by default, i.e: /LM/W3SVC/1 .
> You can check this by using Metabase Explorer utility in IIS 6.0 resource
> kit tools:
>
> Internet Information Services (IIS) 6.0 Resource Kit Tools
> http://www.microsoft.com/downloads/details.aspx?displaylang= en&familyid=56fc
> 92ee-a71a-4c73-b628-ade629c89499
>
> Some web application's uses the path /LM/W3SVC/1 by default. If the site
> is
> deleted, the installer cannot find this path and the installation process
> fails.
>
> Setting the home folder path of the default web site and log file path to
> a
> dedicated NTFS volume shouldn't affect anything because most of web
> application installation are using virtual directories. Even if it refers
> to the Default Web Site's physical path, the installer should look for the
> Path property under /LMW3SVC/1/Root to locate it and copy files.
>
> Please let me know if you have any further question.
>
> Thanks for using MSDN newsgroup and have a nice day.
>
> Sincerely,
>
> WenJun Zhang
>
> Microsoft Online Community Support
>
> ==================================================
>
> Get notification to my posts through email? Please refer to:
> http://msdn.microsoft.com/subscriptions/managednewsgroups/de fault.aspx#notif
> ications.
>
> Note: The MSDN Managed Newsgroup support offering is for non-urgent issues
> where an initial response from the community or a Microsoft Support
> Engineer within 1 business day is acceptable. Please note that each follow
> up response may take approximately 2 business days as the support
> professional working with you may need further investigation to reach the
> most efficient resolution. The offering is not appropriate for situations
> that require urgent, real-time or phone-based interactions or complex
> project analysis and dump analysis issues. Issues of this nature are best
> handled working with a dedicated Microsoft Support Engineer by contacting
> Microsoft Customer Support Services (CSS) at:
>
> http://msdn.microsoft.com/subscriptions/support/default.aspx .
>
> ==================================================
>
> This posting is provided "AS IS" with no warranties, and confers no
> rights.
>

RE: Default Website - Best Practise?

Thanks WenJun,

I was aware of the metabase property. If a default website I assumed, i
usually get around that by temporarilly setting the ID to 1 during the
website installation and setting back to the original site ID when the
installation has completed.

As I have to reference the Microsoft Best Practise recomendation in my
design documentation (company requirement), could you point to where this is
stated?

Thanks again
Shaun


""WenJun Zhang[msft]"" wrote:

> Hi Shaun,
>
> Yes, deleting the default web site is not recommended. This is because the
> Default Web Site's ID in IIS metabase is 1 by default, i.e: /LM/W3SVC/1 .
> You can check this by using Metabase Explorer utility in IIS 6.0 resource
> kit tools:
>
> Internet Information Services (IIS) 6.0 Resource Kit Tools
> http://www.microsoft.com/downloads/details.aspx?displaylang= en&familyid=56fc
> 92ee-a71a-4c73-b628-ade629c89499
>
> Some web application's uses the path /LM/W3SVC/1 by default. If the site is
> deleted, the installer cannot find this path and the installation process
> fails.
>
> Setting the home folder path of the default web site and log file path to a
> dedicated NTFS volume shouldn't affect anything because most of web
> application installation are using virtual directories. Even if it refers
> to the Default Web Site's physical path, the installer should look for the
> Path property under /LMW3SVC/1/Root to locate it and copy files.
>
> Please let me know if you have any further question.
>
> Thanks for using MSDN newsgroup and have a nice day.
>
> Sincerely,
>
> WenJun Zhang
>
> Microsoft Online Community Support
>
> ==================================================
>
> Get notification to my posts through email? Please refer to:
> http://msdn.microsoft.com/subscriptions/managednewsgroups/de fault.aspx#notif
> ications.
>
> Note: The MSDN Managed Newsgroup support offering is for non-urgent issues
> where an initial response from the community or a Microsoft Support
> Engineer within 1 business day is acceptable. Please note that each follow
> up response may take approximately 2 business days as the support
> professional working with you may need further investigation to reach the
> most efficient resolution. The offering is not appropriate for situations
> that require urgent, real-time or phone-based interactions or complex
> project analysis and dump analysis issues. Issues of this nature are best
> handled working with a dedicated Microsoft Support Engineer by contacting
> Microsoft Customer Support Services (CSS) at:
>
> http://msdn.microsoft.com/subscriptions/support/default.aspx .
>
> ==================================================
>
> This posting is provided "AS IS" with no warranties, and confers no rights.
>
>

Re: Default Website - Best Practise?

I agree entirely; unfortunately I have to deal with some dumb software until
the company gets it act together and rewrites it code.....

"Roger Abell [MVP]" wrote:

> Personally, if I attempt to install something and it is so dumb
> as to assume the w3svc instance into which I want it installed,
> then I do not what that crap code installed anyway.
>
> The practice of moving the default site, or any other for that
> matter, to a NTFS partition used only for web content originated
> with attempts to prevent use of parent path traversal from getting
> to executables. If parent paths is enabled, this is still a valid
> practice as far as I can tell, although not necessarily to prevent
> execution of what it can potentially make accessible.
>
> Roger
>
> ""WenJun Zhang[msft]"" wrote in message
> news:IauxvBdVHHA.4088@TK2MSFTNGHUB02.phx.gbl...
> > Hi Shaun,
> >
> > Yes, deleting the default web site is not recommended. This is because the
> > Default Web Site's ID in IIS metabase is 1 by default, i.e: /LM/W3SVC/1 .
> > You can check this by using Metabase Explorer utility in IIS 6.0 resource
> > kit tools:
> >
> > Internet Information Services (IIS) 6.0 Resource Kit Tools
> > http://www.microsoft.com/downloads/details.aspx?displaylang= en&familyid=56fc
> > 92ee-a71a-4c73-b628-ade629c89499
> >
> > Some web application's uses the path /LM/W3SVC/1 by default. If the site
> > is
> > deleted, the installer cannot find this path and the installation process
> > fails.
> >
> > Setting the home folder path of the default web site and log file path to
> > a
> > dedicated NTFS volume shouldn't affect anything because most of web
> > application installation are using virtual directories. Even if it refers
> > to the Default Web Site's physical path, the installer should look for the
> > Path property under /LMW3SVC/1/Root to locate it and copy files.
> >
> > Please let me know if you have any further question.
> >
> > Thanks for using MSDN newsgroup and have a nice day.
> >
> > Sincerely,
> >
> > WenJun Zhang
> >
> > Microsoft Online Community Support
> >
> > ==================================================
> >
> > Get notification to my posts through email? Please refer to:
> > http://msdn.microsoft.com/subscriptions/managednewsgroups/de fault.aspx#notif
> > ications.
> >
> > Note: The MSDN Managed Newsgroup support offering is for non-urgent issues
> > where an initial response from the community or a Microsoft Support
> > Engineer within 1 business day is acceptable. Please note that each follow
> > up response may take approximately 2 business days as the support
> > professional working with you may need further investigation to reach the
> > most efficient resolution. The offering is not appropriate for situations
> > that require urgent, real-time or phone-based interactions or complex
> > project analysis and dump analysis issues. Issues of this nature are best
> > handled working with a dedicated Microsoft Support Engineer by contacting
> > Microsoft Customer Support Services (CSS) at:
> >
> > http://msdn.microsoft.com/subscriptions/support/default.aspx .
> >
> > ==================================================
> >
> > This posting is provided "AS IS" with no warranties, and confers no
> > rights.
> >
>
>
>

RE: Default Website - Best Practise?

You are welcome Shaun.

There is indeed not a 'Best Practise' article on this. However the
following is the standard guide about how to make a new Default Web Site
and change the identifier to 1:

1) Backup the metabase

2) Rename the Default Web Site eg. old Default Web Site, and add a Host
Header to it eg. old

3) Create a new web site, name it Default Web Site, keep default settings:

- make sure to add proper Web Site Home Directory Path eg.c:\inetpub\wwwroot

4) Note the identifier of the new web site (click on web sites), close IIS

5) open cmd prompt, cd \inetpub\adminscripts

6) adsutil move w3svc/1 w3svc/20050831

7) adsutil move w3svc/ w3svc/1

8) Open IIS, expand Default Web Sites

You should now see everything was recreated inside the Default Web Site.


Please let me know if you have any further question or concern on this.

Have a great day.

Sincerely,

WenJun Zhang

Microsoft Online Community Support

==================================================

Get notification to my posts through email? Please refer to:
http://msdn.microsoft.com/subscriptions/managednewsgroups/de fault.aspx#notif
ications.

Note: The MSDN Managed Newsgroup support offering is for non-urgent issues
where an initial response from the community or a Microsoft Support
Engineer within 1 business day is acceptable. Please note that each follow
up response may take approximately 2 business days as the support
professional working with you may need further investigation to reach the
most efficient resolution. The offering is not appropriate for situations
that require urgent, real-time or phone-based interactions or complex
project analysis and dump analysis issues. Issues of this nature are best
handled working with a dedicated Microsoft Support Engineer by contacting
Microsoft Customer Support Services (CSS) at:

http://msdn.microsoft.com/subscriptions/support/default.aspx .

==================================================

This posting is provided "AS IS" with no warranties, and confers no rights.

RE: Default Website - Best Practise?

Hi Shaun,

Just want to check if you have any further question or concern regarding to
this issue? If so, please feel free to post here and we will follow up.

Have a nice day.

Sincerely,

WenJun Zhang

Microsoft Online Community Support

==================================================

Get notification to my posts through email? Please refer to:
http://msdn.microsoft.com/subscriptions/managednewsgroups/de fault.aspx#notif
ications.

Note: The MSDN Managed Newsgroup support offering is for non-urgent issues
where an initial response from the community or a Microsoft Support
Engineer within 1 business day is acceptable. Please note that each follow
up response may take approximately 2 business days as the support
professional working with you may need further investigation to reach the
most efficient resolution. The offering is not appropriate for situations
that require urgent, real-time or phone-based interactions or complex
project analysis and dump analysis issues. Issues of this nature are best
handled working with a dedicated Microsoft Support Engineer by contacting
Microsoft Customer Support Services (CSS) at:

http://msdn.microsoft.com/subscriptions/support/default.aspx .

==================================================

This posting is provided "AS IS" with no warranties, and confers no rights.

RE: Default Website - Best Practise?

Hi WenJun

I think that you have provided some very helpful advice; especially the
adsutil commands that have now made their way into a very useful batch file!!
Thank you for all your assistance, it is most appreciated.

Regards
Shaun

""WenJun Zhang[msft]"" wrote:

> Hi Shaun,
>
> Just want to check if you have any further question or concern regarding to
> this issue? If so, please feel free to post here and we will follow up.
>
> Have a nice day.
>
> Sincerely,
>
> WenJun Zhang
>
> Microsoft Online Community Support
>
> ==================================================
>
> Get notification to my posts through email? Please refer to:
> http://msdn.microsoft.com/subscriptions/managednewsgroups/de fault.aspx#notif
> ications.
>
> Note: The MSDN Managed Newsgroup support offering is for non-urgent issues
> where an initial response from the community or a Microsoft Support
> Engineer within 1 business day is acceptable. Please note that each follow
> up response may take approximately 2 business days as the support
> professional working with you may need further investigation to reach the
> most efficient resolution. The offering is not appropriate for situations
> that require urgent, real-time or phone-based interactions or complex
> project analysis and dump analysis issues. Issues of this nature are best
> handled working with a dedicated Microsoft Support Engineer by contacting
> Microsoft Customer Support Services (CSS) at:
>
> http://msdn.microsoft.com/subscriptions/support/default.aspx .
>
> ==================================================
>
> This posting is provided "AS IS" with no warranties, and confers no rights.
>
>

RE: Default Website - Best Practise?

You are welcome Shuan. It's always my pleasure to be of assistance.

Sincerely,

WenJun Zhang

Microsoft Online Community Support

==================================================

Get notification to my posts through email? Please refer to:
http://msdn.microsoft.com/subscriptions/managednewsgroups/de fault.aspx#notif
ications.

Note: The MSDN Managed Newsgroup support offering is for non-urgent issues
where an initial response from the community or a Microsoft Support
Engineer within 1 business day is acceptable. Please note that each follow
up response may take approximately 2 business days as the support
professional working with you may need further investigation to reach the
most efficient resolution. The offering is not appropriate for situations
that require urgent, real-time or phone-based interactions or complex
project analysis and dump analysis issues. Issues of this nature are best
handled working with a dedicated Microsoft Support Engineer by contacting
Microsoft Customer Support Services (CSS) at:

http://msdn.microsoft.com/subscriptions/support/default.aspx .

==================================================

This posting is provided "AS IS" with no warranties, and confers no rights.