Microsoft IIS 10.0 – Understanding available security on IIS 10.0

How to configure WordPress multisite with NGINX

In this recipe, we will install security components available in Windows Server 2016 and browse the available installed security features in IIS Manager. We will also understand NTFS permissions.

Getting ready

We require an up-and-running IIS 10.0 instance. You should have administrative privileges. There are no other prerequisites.

How to do it…

  1. Log in to Windows Server 2016 from an account with administrative privileges.
  2. Click on the Start menu or type Server Manager in the search window. You will see the Server Manager window.



  1. Click the Add roles and features link, or you can find the same option in the Manage menu, as shown here:
  1. In the Add Roles and Features wizard, click on Next until you reach the Server Roles wizard. Expand Web Server, as shown here:
  1. As seen in the figure, we expand Web Server and then we expand Security; here, we find some of security options already installed (the checked and grayed-out boxes). Check the rest of the available security features listed here, click on Next, skip the Features wizard, click on Next, and you will get the confirmation window, as shown in the following screenshot:
  1. You can see that we have selected the security features that we are going to install. Click on the Install button. You can see in the next screenshot that they are installed successfully:
  1. Click on Close. Now we have to open the IIS Manager. Click on the Start menu or type Server Manager in the search window on Windows 2016 Server. You will see the Server Manager window. Open the Server Manager, On the Server Manager click on Tools menu and select and open the IIS Manager, as shown in the following screenshot.
  1. You can see here that we have several security features available in IIS Server: Machine Key, Authentication, Authorization Rules, IP Address and Domain Restrictions, ISAPI and CGI Restrictions, Server Certificates, Request Filtering, IIS Manager Permissions, IIS Manager Users, and so on. We can set them up according to the level of security we require for our website or web application. Let’s check out NTFS permissions.


  1. Go to IIS Manager, expand the IIS server, expand the Sites folder, and click on any existing site:
  1. Go to the Actions pane, as highlighted in the previous screenshot, and click on Edit Permissions…. This is the physical directory of the selected website, The mysite physical directory property will open, as shown here:
  1. Click on the Security tab in the mysite property window. In the Security tab, you can add users and modify folder-level permissions. Not everyone can access and make changes to the mysite folder; only specific users who have permissions can. You can set this up according to how you’ve planned NTFS permissions.

How it works…

In this recipe, we installed available security components on Windows Server 2016 and browsed the available installed security features in IIS manager. We understand NTFS permissions on the mysite physical folder of the website.

Comments are closed.