Microsoft IIS

Data Collection Setup

Metrics are collected via the IIS Administration API.
##Setting up the IIS Administration API
The IIS Administration API needs to be installed and configured on each monitored IIS server before data collection can occur.

Installing the Administration API

1. Enable and start your Windows Server running IIS.
2. As an Administrator, install the IIS Administration API from: https://manage.iis.net/get
3. Restart the Windows Server running IIS.

📘

Check Port 55539 for Firewall Issues

Installing the IIS Administration API should automatically open port 55539, but we recommend ensuring it is opened prior to continuing.

Configuring API

1. Go to directory: C:\Program Files\IIS Administration\Microsoft.IIS.Administration\config.

2. Change the owner of the appsettings.json file from SYSTEM to Administrators group.

3. Edit the appsettings.json file by configuring the following properties:

• Set security.require_windows_authentication to false.
• Set security.access_policy.api.users to Everyone.
• Set security.access_policy.api.access_key to false. (NOTE: This will temporarily disable authentication, which will be re-enabled after generating an access token later on.)
• Add the security.access_policy.api.read_only property and set it to true.

"security": {
    "require_windows_authentication": false,
  
    "access_policy": {
      "api": {
        "users": "Everyone",
        "access_key": false,
        "read_only": true
      },
    }
  },

4. Restart the IIS Services

Network Requirements

Port: 55539 (TCP) Default connection to the IIS Administration API

Least Privileged User

Microsoft IIS Access Token

Assigning an IIS Least-Privileged User

In Microsoft's IIS Administration documentation, the Application Settings topic (Security section) discusses the default access settings:

BindPlane uses an access token for authentication. Setting the require_windows_authentication property to false as indicated in Configuring the IIS Administration API above allows the user to authenticate using that access token, which will be generated next in the Generating an Access Token section.

Adding the Windows user to the IIS API administrators and owners roles allows that user to generate the access token and execute requests to the API using that token.

Generating an Access Token

Next, you must generate an access token to be used for authentication

1. Open https://localhost:55539/.
2. Click on the ACCESS KEY link.
3. Click the Create Access Key button. Set the key name and expiration period.
4. Save the access key for use when configuring the IIS Source

Re-enabling Authentication

Now that your access token has been generated, you must go back into the appsettings.json file and re-enable authentication:

1. Go to directory: C:\Program Files\IIS Administration\Microsoft.IIS.Administration\config
2. Edit the appsettings.json file by configuring the following properties:

Set security.access_policy.api.access_key to true.

3. Restart the IIS Administration API service.

"access_policy": {
      "api": {
        "users": "Everyone",
        "access_key": true,
        "read_only": true
      },
    }

Supported Versions

Microsoft Windows Server:

• Windows Server 2019
• Windows Server 2016
• Windows Server 2012 R2
• Windows Server 2012
• Windows Server 2008 R2

Microsoft IIS:

• 10
• 8.5
• 8.0
• 7.5

Connection Parameters

Metrics

Application

Application Pool

Virtual Directory

Web Server

Website

Worker Process