View source for Backing up and Restoring IIS configuration

== Backing up and Restoring IIS configuration ==

An automated backup process already exists in Windows IIS in every 
installation but only to C: drive. This article discusses how to get it 
backed up properly off-server by NEOSYS backup processes for servers 
with lots of installations. Small installations hardly need backup of 
IIS since it takes little time to reconfigure a single website.

The main point of this article is to give an understanding of the backup 
process and perhaps most importantly how it can be used to restore on 
servers with large numbers of web sites like win3/win4.

All IIS configuration performed in IIS manager seems to be backed 
up/restored by the following procedures ... EXCEPT imported certificates 
and the binding/mapping of port numbers to certificates which is 
discussed later on in [[Backing up and Restoring IIS 
configuration#Backing up certificate bindings]].

This article does not include backup or restore of actual web site 
directories, files and permissions.

A simple backup of IIS configuration can be done any time and quickly at 
before doing some change you are uncertain of in IIS.

 c:\windows\system32\inetsrv\appcmd add backup SOMEBACKUPNAME

A simple restore will put everything back as it was. It appears that 
sites unaffected by the restore are not restarted so this can be done 
while users are online to unaffected websites. In the worst case, users 
will have to login again but as this is a popup in the middle of 
existing NEOSYS screens, they should not lose any work they are doing or 
documents they are entering.

c:\windows\system32\inetsrv\appcmd restore backup SOMEBACKUPNAME

Essentially the whole of IIS configuration for all sites is stored in a 
single text file which can be edited, backed up and restored manually by 
simple file copy, or by using the APPCMD.EXE programs which has the 
advantage of automatically reloading IIS at the appropriate time.

 applicationHost.config

Windows provides a command "appcmd.exe" to manage IIS configuration from 
the command line. All APPCMD commmands either need to be run in the 
following directory or to be prefixed with "%windir%\system32\inetsrv\" 
as follows:

 c:
 cd %windir%\system32\inetsrv
 appcmd list backup

or all in one line

 %windir%\system32\inetsrvz\appcmd list backup

=== Set IIS automatic backup location to d: ===

By default, Windows automatically backups the last 10 IIS configurations 
to c:\inetpub\history, looking for changes every 2 minutes.

Below steps are already done on win3/win4

We need to:

1. Change the location of the automatic backups since NEOSYS backup 
procedures dont backup C: drive. ESSENTIAL
2. Increase the number of backups. OPTIONAL

Configure the new backup location on d: and increase the number of 
historical backups kept from 10 to 100

 mkdir d:\inetpub\history
 appcmd.exe set config -section:system.applicationHost/configHistory /path:"d:\inetpub\history" /commit:apphost
 appcmd.exe set config -section:system.applicationHost/configHistory /maxHistories:"100" /commit:apphost

Check that automatic backups are in fact now going to D: by making some 
trivial change in IIS and waiting 2 minutes to see the backup appear in D:

=== Using other IIS configuration commands ===

Other APPCMD configuration commands are as follows. Here showing setting 
the default configuration.

 appcmd set config -section:system.applicationHost/configHistory /enabled:"True" /commit:apphost
 appcmd set config -section:system.applicationHost/configHistory /period:"00:02:00" /commit:apphost

=== Manually triggering backup of IIS ===

 appcmd add backup SOMEBACKUPNAME

Manual backups are just copies of the IIS configuration file, the same 
as the automatic backups ... but they are stored in a different place

 C:\Windows\System32\inetsrv\backups\SOMEBACKUPNAME

=== Restoring IIS backups ===

IIS backups can be listed, restored and deleted.

 appcmd list backup
 appcmd restore backup SOMEBACKUPNAME
 appcmd delete backup SOMEBACKUPNAME

Each backup is stored in a separate directory and you can rename them by 
simply changing the directory name.

The list of available backups is a merged set from the default automatic 
location, the configured automatic location (changed from the default C: 
to D:), and default manual backup location

 c:\inetpub\history (AUTOMATICALLY TRIGGERED ORIGINALY)
 D:\inetpub\history\ (AUTOMATICALLY TRIGGERED AFTER RECONFIGURATION)
 c:\windows\system32\inetsrv\backups (MANUALLY TRIGGERED)

There is no need to restart IIS after restoring using APPCMD RESTORE but 
you may need to press F5 to refresh in IIS manager to see results of 
restore if restore changes anything.

=== Manually editing IIS configuration ===

You can edit the configuration files in any backup and then restore that 
backup.

This is useful in order either to make custom changes that cannot be 
done in the UI, eg removing an https binding without affecting other 
sites that use the same certificate, or to make mass changes that can be 
done quicker by editing a text file than navigating a complex GUI, such 
as removing all http site bindings.

 applicationHost.config

=== other IIS APPCMD config commands ===

 appcmd list site
 appcmd list site demo
 appcmd list config

=== Backing up certificate bindings ===

There is not a lot too this really but it is better that it is automated.

To make a backup file called bindcerts.sh

Find the hash of the current standard *.hosts.neosys.com certificate. 
This will change only once a year or however often the https certificate 
is renewed, probably once a year. Check the expiry date on the 
certificate. Run the following command and pick the hash next to a port 
you know is currently bound to the certificate. probably most or all 
ports will be bound to the same certificate hash.

 netsh http show sslcert|grep -B1 Hash

Make the backup file called bindcerts.sh. put CERTHASH=.. what you found 
in the previous step. NO SPACES OR QUOTES

 CERTHASH=06249326271595871fd935a37bd1334bb761e519

 netsh http show sslcert| \
 grep -B1 "$CERTHASH"| \
 grep port| \
 awk -v CERTHASH="$CERTHASH" '{print "netsh http add sslcert ipport=" $3 " certhash= " CERTHASH " appid={4dc3e181-e14b-4a21-b022-59fc669b0914}"}' \
 | tee bindcerts.sh

=== Restoring certificate bindings ===

If you dont have the backup file then you can just import the 
certificate and redo the bindings without much effort anyway. This 
process is more to enable automated restores on warm backup servers.

This will only ADD bindings, it will not delete, nor overwrite any 
existing bindings so you might have to delete bindings first to allow 
changes.

Get the bindcerts.sh file from the restore stage

Make the file executable and execute it

 chmod +x bindcerts.sh
 ./bindcerts.sh

If you get a message "parameter incorrect" then check that your hash is 
correct and everything else is exactly correct. Check characters one by 
one from the BACK of the sentence SLOWLY to ensure you are not suffering 
from inattention to detail!

 The parameter is incorrect.

If you get a message "already exists" then perhaps you have already 
bound the port to the right certificate .. or a wrong/old certificate

 SSL Certificate add failed, Error: 183
 Cannot create a file when that file already exists.

... delete the binding and try again. Here is an example of deleting 
binding on port 43999

 netsh http delete sslcert ipport=0.0.0.0:43999