What Is IIS? Windows Web Server Setup, Sites & App Pools

This is a working reference on IIS — the same material our IIS web server support team uses when taking over Windows web servers. It covers what IIS is, which IIS version ships with each Windows Server release, how to install the Web Server role, the core objects (sites, bindings, applications, application pools, virtual directories), the request pipeline, common administration tasks, and how IIS compares with Apache and nginx.

What is IIS

IIS (Internet Information Services) is Microsoft's web server. It ships as a role of Windows Server and as an optional feature of desktop Windows, and it serves HTTP, HTTPS, FTP, FTPS, SMTP, and WebSocket traffic. IIS is not a separate product with its own installer: it is part of the operating system, enabled through Server Manager or PowerShell, and versioned with the OS rather than released independently.

Architecturally, IIS splits work between a kernel-mode listener and user-mode worker processes. HTTP.sys, the kernel-mode HTTP protocol stack, accepts connections, queues requests, and handles kernel-level caching. The Windows Process Activation Service (WAS) and the World Wide Web Publishing Service (W3SVC) manage configuration and start worker processes (w3wp.exe), one set per application pool, which run the application code. This separation means a crashing application takes down its worker process, not the listener or other sites. The architecture is documented in Introduction to IIS Architecture on Microsoft Learn.

IIS versions by Windows release

The IIS version is fixed by the operating system. IIS 10.0 has been the current major version since 2016; Microsoft revises it with each OS release (version 1607, 1809, and so on) rather than incrementing the major number. New capabilities in the 10.0 line — HTTP/2, Nano Server support, and later HTTP/3 via HTTP.sys — are summarized in New Features Introduced in IIS 10.0.

A server on IIS 8.5 or earlier is on an operating system past its support dates; the fix is a Windows Server upgrade or migration, not an IIS patch.

Is there an IIS download?

No. IIS is a built-in Windows feature, not a download. There is no IIS installer to fetch: you enable the Web Server (IIS) role on Windows Server, or turn on Internet Information Services under Windows Features on desktop Windows. The only downloads are extensions — URL Rewrite, Application Request Routing (ARR), and other modules — distributed through the official IIS.net downloads site. Any third-party site offering an "IIS download" should be treated as untrusted.

Installing IIS on Windows Server

Through Server Manager: open Manage > Add Roles and Features, choose role-based installation, select the target server, tick Web Server (IIS) on the Server Roles page, accept the management tools prompt, select any additional role services, and install. No reboot is required. The wizard steps are documented in Microsoft's Web Server role installation guide.

Through PowerShell, from an elevated session:

Install-WindowsFeature -Name Web-Server -IncludeManagementTools

The -IncludeManagementTools switch matters: without it the cmdlet installs the role but not IIS Manager. Add -IncludeAllSubFeature to install every role service, though production servers should install only the services they need. Parameter details are in the Install-WindowsFeature reference. After installation, browsing to http://localhost returns the default IIS welcome page, and IIS Manager (inetmgr) is available for administration.

Core concepts

Application pools

Application pools are the isolation and recycling unit in IIS. Each pool defines the .NET CLR version (or "No Managed Code" for static content and reverse-proxied apps), the pipeline mode, the identity the worker process runs as (the per-pool virtual account ApplicationPoolIdentity by default), and recycling conditions — scheduled times, memory limits, or idle timeout. Putting each application in its own pool keeps a memory leak or crash in one application from affecting the others on the same server. Pool settings, recycling behavior, and identity configuration are covered in detail in our IIS application pool guide.

The request pipeline: modules and handlers

IIS processes every request through an ordered pipeline of modules — authentication, authorization, caching, compression, logging, and custom modules — and then hands it to a handler mapped to the request path or extension: the static file handler for plain files, the ASP.NET Core Module for Kestrel-hosted apps, or a FastCGI handler for PHP. Since IIS 7.0 the pipeline is integrated, meaning native and managed (.NET) modules run in the same chain, and features can be added or removed per application through web.config. The module reference is on Microsoft Learn's IIS modules overview.

Common administration tasks

Add a site. In IIS Manager, right-click Sites > Add Website; set the site name, physical path, and binding. The equivalent PowerShell is New-Website from the WebAdministration or IISAdministration module.

Bind an SSL certificate. Import the certificate into the machine store, then edit the site's HTTPS binding and select it. Server Name Indication (SNI) allows multiple certificates on one IP. The full procedure, including CSR generation and renewal, is in our IIS SSL certificate guide.

Read the logs. IIS writes W3C-format text logs per site under C:\inetpub\logs\LogFiles by default, one folder per site ID. Fields, locations, and analysis tooling are covered in our IIS logs reference.

IIS vs. Apache and nginx

IIS runs only on Windows and integrates with Active Directory (Windows and Kerberos authentication), the Windows certificate store, and ASP.NET; Apache and nginx run on Linux and most other platforms and are configured through text files rather than a GUI plus web.config. nginx generally handles higher static-content and reverse-proxy concurrency per unit of hardware; IIS is the standard choice where the application stack is ASP.NET or the organization is Windows-based, because the server, authentication, and application runtime come from one vendor and are covered by OS support. Mixed estates commonly run both.

What runs on IIS

ASP.NET Framework applications run in-process in the worker process. ASP.NET Core applications run behind the ASP.NET Core Module, either in-process or forwarding to Kestrel, as described in the ASP.NET Core IIS hosting documentation. PHP runs through FastCGI with a PHP handler mapping. Static sites need no runtime at all. With the Application Request Routing and URL Rewrite extensions, IIS also operates as a reverse proxy and load balancer in front of Node.js, Java, or any other HTTP backend.

FAQ

Is IIS free?

IIS carries no separate license; it is included with Windows. The Windows Server license itself is the cost.

Where do I download IIS?

Nowhere — it is a built-in Windows feature. Enable the Web Server (IIS) role on Windows Server or the Internet Information Services feature on desktop Windows. Only extensions such as URL Rewrite and ARR are downloaded, from iis.net.

What is the current IIS version?

IIS 10.0, on every supported OS from Windows Server 2016 through Windows Server 2025 and Windows 10/11. The version number no longer changes per OS release; the feature set does.

Does IIS run on Linux?

No. IIS is Windows-only. Cross-platform ASP.NET Core applications run on Linux under Kestrel, typically behind nginx or Apache.