Install IIS on Windows Server: Quick, Scriptable, and Secure Web Hosting

If you need a reliable Windows Server web host on-premises or in your datacenter, installing Internet Information Services (IIS) is the obvious first step—and it’s far simpler than many administrators expect. Built into Windows Server but not enabled by default, IIS can be installed interactively via Server Manager, scripted with PowerShell, or deployed at scale using DISM and automation tooling. This guide condenses practical, production-ready steps, explains the most useful optional components, and walks through common pitfalls and hardening guidance so your server is web-ready and secure.

Background​

IIS is Microsoft’s HTTP server built into Windows Server and available as a role in Server Manager. It hosts static sites, ASP.NET web apps, APIs, reverse-proxies (with ARR), and can serve internal dashboards or containerized workloads. The tools to enable it include Server Manager (GUI), PowerShell’s Install-WindowsFeature cmdlet, and DISM for low-level feature enabling—each approach has trade-offs for interactivity, automation, and scripting. The core GUI workflow and the basic PowerShell and DISM commands are widely documented and form the basis of the straightforward install procedures administrators use in the field. (learn.microsoft.com)

---

Quick summary: three ways to install IIS​

• Server Manager (GUI): best for one-off installs, visual selection of optional features, and environments where you want to review role services before enabling.
• PowerShell: best for automation and repeatable scripts on a single machine or small set of servers—fast, idempotent, and integrates into configuration management workflows.
• DISM: ideal for scripted image servicing or Server Core/container host scenarios where GUI components are not available or desirable.

Each method installs the same underlying feature set; the difference is how you select optional role services (ASP.NET support, management console, WebSockets, etc.) and whether you include management tools.

---

Installing IIS via Server Manager (step-by-step)​

1. Open Server Manager and click Manage > Add Roles and Features.
2. Choose "Role-based or feature-based installation", select the target server from the server pool, then select Web Server (IIS) on the Select server roles page.
3. When prompted, add the required features and choose any optional role services (for example, ASP.NET, .NET Extensibility, ISAPI Extensions, URL Rewrite).
4. On the Select features page you can include management tools such as IIS Management Console and IIS Management Scripts and Tools.
5. Review selections and click Install; when complete, validate by opening a browser on the server and navigating to http://localhost to confirm the default IIS welcome page.

This GUI path is exactly what administrators expect for ad-hoc installs and is useful when you want to visually confirm feature dependencies before committing them. The high-level Server Manager flow and on-screen prompts guide the selection of features and will add dependent components automatically.

---

What to include during a GUI install (recommended selections)​

• Web Server (IIS) > Common HTTP Features: Static Content, Default Document, HTTP Errors
• Web Server (IIS) > Application Development: ASP.NET (if you host .NET apps), .NET Extensibility
• Security: Windows Authentication (if needed for intranet apps)
• Management Tools: IIS Management Console, IIS Management Scripts and Tools

Choosing only what you need is a best practice—every additional feature enlarges the attack surface and increases patching scope.

---

PowerShell method: fast, repeatable, and scriptable​

PowerShell is the simplest way to enable IIS non-interactively.

• Minimal install (web server + management tools):
  Install-WindowsFeature -Name Web-Server -IncludeManagementTools
• Add common extras (example: ASP.NET and management tools):
  Install-WindowsFeature -Name Web-Server, Web-ASP, Web-Mgmt-Tools, Web-WebSockets

Run these commands in an elevated PowerShell session. For Server Core installations, PowerShell is the preferred method because the GUI is not present. These cmdlets are supported on Windows Server and return a result object so scripts can check success and trigger a reboot if required. For feature-by-feature installs you can also enumerate available features and include only those you need. (learn.microsoft.com)

---

DISM method: image and Server Core friendly​

DISM (Deployment Image Servicing and Management) is the underlying tool used to enable Windows features when you’re working against an image or in automated Server Core/containerized workflows.

• Basic command to enable the Web Server role:
  dism /online /enable-feature /featurename:IIS-WebServerRole /all
• Example additional features:
  dism /online /enable-feature /featurename:IIS-ASPNET45 /all
  dism /online /enable-feature /featurename:IIS-WebSockets /all

Use /all to include all dependencies. If the feature files aren’t available locally, specify /source:D:\sources\sxs with installation media and add /limitaccess to prevent fallback to Windows Update. DISM is extremely useful for scripted image building and Server Core hosts but requires precise feature names; list features with dism /online /get-features. (codingeasypeasy.com) (learn.microsoft.com)

---

Verifying the installation​

After installation, validate these things:

• The default site responds: open a browser on the server and visit http://localhost and expect the IIS welcome page.
• Required services are running: confirm World Wide Web Publishing Service (W3SVC) and Windows Process Activation Service (WAS) are started.
• Management tools are present if requested: open IIS Manager (inetmgr) and verify sites, application pools, and modules.

If you used PowerShell, confirm the role is installed with Get-WindowsFeature -Name Web-Server and review the output. If DISM was used, run dism /online /Get-Features to confirm feature state.

---

Optional components and when to include them​

• ASP.NET / .NET Extensibility — required when hosting classic ASP.NET or .NET Framework apps.
• WebSockets — required for apps that use real-time WebSocket communications.
• URL Rewrite (module) — necessary for friendly URLs, redirects, and reverse-proxy routing when paired with ARR.
• Application Request Routing (ARR) — transforms IIS into a powerful proxy/load-balancer and reverse-proxy for microservices and clustered back ends; ARR depends on URL Rewrite. Use ARR when you need HTTP-level routing, caching, A/B testing, or affinity. (learn.microsoft.com) (iis.net)

Include only the features you plan to use; unnecessary modules increase attack surface and maintenance overhead.

---

Post-install configuration: sites, bindings, and SSL​

After the role is enabled you’ll typically:

• Create a new site or update the default site physical path (C:\inetpub\wwwroot is the default).
• Configure host headers and bindings: set ports (80/443), IP bindings, and host names.
• Add SSL: bind an HTTPS certificate to the site. For production, use certificates from a trusted CA or your internal PKI and enable TLS 1.2+ only.
• Configure application pools: choose an appropriate .NET CLR version and identity (use a managed service account or least-privilege custom identity when required).

Document and version your site bindings and certificate setup; this makes recovery and audits far simpler.

---

Automation and Infrastructure-as-Code suggestions​

1. Use PowerShell DSC, Ansible, or Terraform+Packer when building images that include IIS to ensure consistent role services and configuration across servers.
2. For image-level installs, run DISM against an offline image or use image factory tooling to bake IIS into golden images.
3. Include Idempotent checks in scripts (Get-WindowsFeature / dism /online /Get-Features) so repeated runs do not change system state unexpectedly.

Automated provisioning reduces human error and accelerates reproducible deployments.

---

Hardening and security best practices​

• Disable unused features and modules; keep the minimal footprint required for your applications.
• Force TLS 1.2+ by disabling older protocols and weak cipher suites at the OS level.
• Enable request filtering and request limits to reduce attack surface from malformed requests.
• Run application pools under least-privileged identities and separate apps into different pools to contain faults.
• Keep Windows Server and .NET patched on a scheduled cadence with rollback-tested updates.

Hardening IIS is as much about OS-level controls as it is about IIS configuration—apply defense-in-depth and test patches in a staging environment.

---

Common installation problems and troubleshooting​

• DISM fails because required files aren't present: use the installation media as the source with /source:D:\sources\sxs and /limitaccess. (codingeasypeasy.com)
• iisreset or appcmd reporting permissions or service-start failures: confirm you are running as Administrator and inspect Event Viewer for service startup errors; ensure WAS and W3SVC are not blocked by UAC or service policy. Community troubleshooting also recommends checking membership in Administrators and IIS_IUSRS groups if management scripts fail.
• WSUS post-install failures during the ConfigureWebsite step often point to missing virtual directories, incorrect content paths, or permission problems on WSUS content folders—validate virtual directories and permissions for NETWORK SERVICE and IIS_IUSRS. Several community posts and recovery guides show step-by-step recreating of WSUS virtual directories and ensuring the proper application pool exists.

If installation problems persist, collect logs (DISM logs under C:\Windows\Logs\DISM\dism.log, Windows Event logs, and wsus setup logs when applicable) and inspect them for precise error codes before taking destructive steps.

---

Real-world troubleshooting scenarios (what experienced admins check first)​

• Confirm feature dependencies: .NET-based IIS features fail if .NET Framework components are not installed—install .NET Framework before enabling those role services. (learn.microsoft.com)
• Verify physical paths and virtual directories: many configuration errors trace back to an incorrect path or missing folder that the installer expects to exist. Create paths manually if needed and re-run postinstall tasks.
• Check application pool identities and permissions: ensure the identity used by an app pool has sufficient rights on the content folders and any database resources the application needs to contact. Community guides repeatedly call out NETWORK SERVICE and IIS_IUSRS permissions as a frequent culprit.

Document your troubleshooting steps and changes—reproducibility makes root-cause analysis faster.

---

Using IIS as a reverse proxy with ARR​

When you need HTTP-level routing, caching, or load balancing in a Windows-native stack, Application Request Routing (ARR) is the supported Microsoft module that works with IIS and URL Rewrite. ARR provides cookie-based affinity, multiple load-balancing algorithms, disk caching, and health monitoring. Install URL Rewrite first, then ARR; ARR will create rewrite rules to forward requests to backend server farms and can be managed from the IIS Manager UI or via appcmd for scripted deployments. ARR is especially useful for staged rollouts, A/B testing, or simple proxying without adding external load balancers. (learn.microsoft.com) (learn.microsoft.com)

---

Backups and rollback: configuration safety nets​

• Use appcmd add backup "BackupName" to capture the entire IIS configuration (applicationHost.config and related settings). Store backups off-server.
• Export site or application-level configuration to XML when migrating between servers.
• Keep exported copies of SSL certificates (with secure passphrase) to speed certificate rebinds after a rebuild.

Regularly scheduled backups and a tested restoration procedure significantly reduce downtime during misconfigurations or server failure.

---

Caveats and unverifiable claims​

• Some third-party guides and aggregated posts recommend enabling many legacy IIS 6 compatibility features by default. That increases risk and should only be done for legacy app support; avoid those features in new deployments.
• Mentions of unrelated articles or product-specific hacks (for example, reinstalling WMIC or addressing Intune Management Extension service issues) are operationally orthogonal to installing IIS—treat them as separate troubleshooting threads unless you have explicit evidence they affect your IIS install. If a claim about a non-IIS component looks critical, verify its relevance before applying system-wide changes.

Where claims in community posts cannot be independently validated, treat them as pointers for further investigation—not as authoritative fixes.

---

Recommended checklist before production go-live​

1. Confirm role services installed match application requirements.
2. Test sites and APIs locally (http://localhost) and from the network.
3. Configure and test HTTPS bindings and certificate renewals.
4. Harden TLS, cipher suites, and disable obsolete protocols.
5. Enable monitoring and failed request tracing logs for early detection.
6. Back up appHost configuration and document all changes.

Following a short checklist avoids common oversights and reduces rollback time if something breaks after changes.

---

Conclusion​

Installing IIS on Windows Server is straightforward but benefits vastly from a disciplined approach: pick the right installation method (Server Manager for interactive installs, PowerShell for automation, DISM for image-based work), include only the role services you need, verify and harden the environment, and establish backups and monitoring. For advanced needs like reverse proxying or load balancing, ARR + URL Rewrite adds powerful HTTP routing capabilities without introducing new infrastructure. When problems arise, start with logs, confirm feature and .NET dependencies, and validate permissions and virtual paths—these are the most frequent root causes encountered in real-world installations. The commands and workflows in this guide reflect vendor documentation and practical community recovery patterns, and they provide a dependable path from a bare server to a hardened web host. (learn.microsoft.com) (learn.microsoft.com)

---

Source: Windows Report How to Install IIS on Windows Server