Backing up and Restoring IIS configuration
Backing up and Restoring IIS configuration
An automated backup process already exists in Windows IIS in every installation but only to C: drive. This article discusses how to get it backed up properly off-server by NEOSYS backup processes for servers with lots of installations. Small installations hardly need backup of IIS since it takes little time to reconfigure a single website.
The main point of this article is to give an understanding of the backup process and perhaps most importantly how it can be used to restore on servers with large numbers of web sites like win3/win4.
All IIS configuration performed in IIS manager seems to be backed up/restored by the following procedures ... EXCEPT imported certificates and the binding/mapping of port numbers to certificates which is discussed later on in [[Backing up and Restoring IIS configuration#Backing up certificate bindings]].
This article does not include backup or restore of actual web site directories, files and permissions.
A simple backup of IIS configuration can be done any time and quickly at before doing some change you are uncertain of in IIS.
c:\windows\system32\inetsrv\appcmd add backup SOMEBACKUPNAME
A simple restore will put everything back as it was. It appears that sites unaffected by the restore are not restarted so this can be done while users are online to unaffected websites. In the worst case, users will have to login again but as this is a popup in the middle of existing NEOSYS screens, they should not lose any work they are doing or documents they are entering.
c:\windows\system32\inetsrv\appcmd restore backup SOMEBACKUPNAME
Essentially the whole of IIS configuration for all sites is stored in a single text file which can be edited, backed up and restored manually by simple file copy, or by using the APPCMD.EXE programs which has the advantage of automatically reloading IIS at the appropriate time.
applicationHost.config
Windows provides a command "appcmd.exe" to manage IIS configuration from the command line. All APPCMD commmands either need to be run in the following directory or to be prefixed with "%windir%\system32\inetsrv\" as follows:
c: cd %windir%\system32\inetsrv appcmd list backup
or all in one line
%windir%\system32\inetsrvz\appcmd list backup
Set IIS automatic backup location to d:
By default, Windows automatically backups the last 10 IIS configurations to c:\inetpub\history, looking for changes every 2 minutes.
We need to:
1. Change the location of the automatic backups since NEOSYS backup procedures dont backup C: drive. ESSENTIAL 2. Increase the number of backups. OPTIONAL
Configure the new backup location on d: and increase the number of historical backups kept from 10 to 100
mkdir d:\inetpub\history appcmd.exe set config -section:system.applicationHost/configHistory /path:"d:\inetpub\history" /commit:apphost appcmd.exe set config -section:system.applicationHost/configHistory /maxHistories:"100" /commit:apphost
Check that automatic backups are in fact now going to D: by making some trivial change in IIS and waiting 2 minutes to see the backup appear in D:
Using other IIS configuration commands
Other APPCMD configuration commands are as follows. Here showing setting the default configuration.
appcmd set config -section:system.applicationHost/configHistory /enabled:"True" /commit:apphost appcmd set config -section:system.applicationHost/configHistory /period:"00:02:00" /commit:apphost
Manually triggering backup of IIS
appcmd add backup SOMEBACKUPNAME
Manual backups are just copies of the IIS configuration file, the same as the automatic backups ... but they are stored in a different place
C:\Windows\System32\inetsrv\backups\SOMEBACKUPNAME
Restoring IIS backups
IIS backups can be listed, restored and deleted.
appcmd list backup appcmd restore backup SOMEBACKUPNAME appcmd delete backup SOMEBACKUPNAME
Each backup is stored in a separate directory and you can rename them by simply changing the directory name.
The list of available backups is a merged set from the default automatic location, the configured automatic location (changed from the default C: to D:), and default manual backup location
c:\inetpub\history (AUTOMATICALLY TRIGGERED ORIGINALY) D:\inetpub\history\ (AUTOMATICALLY TRIGGERED AFTER RECONFIGURATION) c:\windows\system32\inetsrv\backups (MANUALLY TRIGGERED)
There is no need to restart IIS after restoring using APPCMD RESTORE but you may need to press F5 to refresh in IIS manager to see results of restore if restore changes anything.
Manually editing IIS configuration
You can edit the configuration files in any backup and then restore that backup.
This is useful in order either to make custom changes that cannot be done in the UI, eg removing an https binding without affecting other sites that use the same certificate, or to make mass changes that can be done quicker by editing a text file than navigating a complex GUI, such as removing all http site bindings.
applicationHost.config
other IIS APPCMD config commands
appcmd list site appcmd list site demo appcmd list config
Backing up certificate bindings
There is not a lot too this really but it is better that it is automated.
To make a backup file called bindcerts.sh
Find the hash of the current standard *.hosts.neosys.com certificate. This will change only once a year or however often the https certificate is renewed, probably once a year. Check the expiry date on the certificate. Run the following command and pick the hash next to a port you know is currently bound to the certificate. probably most or all ports will be bound to the same certificate hash.
netsh http show sslcert|grep -B1 Hash
Make the backup file called bindcerts.sh. put CERTHASH=.. what you found in the previous step. NO SPACES OR QUOTES
CERTHASH=06249326271595871fd935a37bd1334bb761e519
netsh http show sslcert| \
grep -B1 "$CERTHASH"| \
grep port| \
awk -v CERTHASH="$CERTHASH" '{print "netsh http add sslcert ipport="
$3 " certhash= " CERTHASH " appid={4dc3e181-e14b-4a21-b022-59fc669b0914}"}' \
| tee bindcerts.sh
Restoring certificate bindings
If you dont have the backup file then you can just import the certificate and redo the bindings without much effort anyway. This process is more to enable automated restores on warm backup servers.
This will only ADD bindings, it will not delete, nor overwrite any existing bindings so you might have to delete bindings first to allow changes.
Get the bindcerts.sh file from the restore stage
Make the file executable and execute it
chmod +x bindcerts.sh ./bindcerts.sh
If you get a message "parameter incorrect" then check that your hash is correct and everything else is exactly correct. Check characters one by one from the BACK of the sentence SLOWLY to ensure you are not suffering from inattention to detail!
The parameter is incorrect.
If you get a message "already exists" then perhaps you have already bound the port to the right certificate .. or a wrong/old certificate
SSL Certificate add failed, Error: 183 Cannot create a file when that file already exists.
... delete the binding and try again. Here is an example of deleting binding on port 43999
netsh http delete sslcert ipport=0.0.0.0:43999
