{
	"id": "fd5ee3b7-0272-4d6f-b23a-b3357e18b196",
	"created_at": "2026-04-06T00:17:28.144516Z",
	"updated_at": "2026-04-10T13:12:38.839085Z",
	"deleted_at": null,
	"sha1_hash": "ee6330c009baff770464b0346dbb506b2d69af8c",
	"title": "IIS Modules Overview",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 274493,
	"plain_text": "IIS Modules Overview\r\nBy leanserver\r\nArchived: 2026-04-05 19:17:56 UTC\r\nby IIS Team, Mike Volodarsky\r\nCompatibility\r\nVersion Notes\r\nIIS 7.0 and later The features described in this article were introduced in IIS 7.0.\r\nIIS 6.0 and earlier The features described in this article were not supported prior to IIS 7.0.\r\nIntroduction\r\nThe IIS 7 and above Web server feature set is componentized into more than thirty independent modules.\r\nA module is either a Win32 DLL (native module) or a .NET 2.0 type contained within an assembly (managed\r\nmodule). Similar to a set of building blocks, modules are added to the server in order to provide the desired\r\nfunctionality for your applications. Likewise, all IIS modules can be removed, or replaced with custom modules\r\ndeveloped using the IIS C++ APIs, or the familiar ASP.NET 2.0 APIs.\r\nThis article describes common IIS module management tasks, and details each module including its configuration\r\nsettings and the potential effect a module removal has on the Web server. The management examples are given\r\nusing both the graphical IIS Manager and the AppCmd command line tool.\r\nPrerequisites\r\nTo follow the steps in this document it is best to do a full install of IIS.\r\nNote\r\nNot all editions of Windows support all available IIS features. To see which features of IIS are supported on your\r\noperating system, you will need to consult the documentation which shipped with your version of Windows.\r\nTo Perform a Full Installation of IIS on Windows Vista, Windows 7, Windows 8, Windows 10 or\r\nWindows 11\r\n1. Click Start and then click Control Panel.\r\n2. In the Control Panel, click Programs.\r\n3. Under Programs and Features, click Turn Windows features on or off.\r\nhttps://docs.microsoft.com/en-us/iis/get-started/introduction-to-iis/iis-modules-overview\r\nPage 1 of 23\n\n4. In the Windows Features dialog, expand Internet Information Services and select all features.\r\nYou may need to expand some categories to select all the features in that category.\r\n5. Click OK.\r\nTo Perform a Full Install of IIS on Windows Server 2008/R2, Windows Server 2012/R2, or\r\nWindows Server 2016\r\n1. Open Server Manager \u003e Roles and select Web Server (IIS).\r\n2. Check all features under Web Server.\r\nGetting Started with Modules\r\nIn order to add a module to the server, you must perform two steps:\r\n1. Install a module on the server (native modules only).\r\n2. Enable the module in an application.\r\nThe first step registers the module globally with the server, making it available within each server worker process.\r\nIt is necessary only for native modules due to the trusted nature of native code, and is available only to\r\nadministrators.\r\nNote\r\nA native module has unrestricted access to any resource available to the server worker process, just like an ISAPI\r\nfilter or extension in previous versions. Because of this unrestricted access, you should install only native modules\r\nthat come from a trusted source.\r\nThe second step enables the module to execute within a particular application and effectively allows the\r\napplication administrator to control the server features enabled for the application. This step allows both installed\r\nnative modules and managed modules to be enabled for each application.\r\nTo Install a Native Module\r\nIn order to install a native module, it must be registered with the server using one of the options below:\r\nManually editing the IIS configuration store. In IIS 7.5 and later you can use the Configuration Editor in\r\nthe IIS Manager.\r\nUsing the IIS Manager\r\nUsing the AppCmd.exe command line tool\r\nAll three of these options result in the module entry being added to the \u003cglobalModules\u003e IIS configuration\r\nsection, which can be set only at the server level. To examine the contents of this section, open the root\r\nconfiguration file located in %windir%\\system32\\inetsrv\\config\\applicationhost.config , and search for the\r\nstring \"\u003cglobalModules\u003e\".\r\nAfter a full IIS installation, this section contains an entry for each of the native modules shipped with IIS,\r\nspecifying a name and the path to the module DLL:\r\nhttps://docs.microsoft.com/en-us/iis/get-started/introduction-to-iis/iis-modules-overview\r\nPage 2 of 23\n\n...\nAll of these modules are described in detail later in this document.\nTo Uninstall a Native Module\nYou can uninstall a native module if that module is no longer in use on the server, or if you would like to replace it\nwith another module. Remove the corresponding module entry from the configuration list, and\nthe associated entry in the configuration list using one of the following options:\nManually editing the IIS configuration store. In IIS 7.5 and above you can use the Configuration Editor.\nUsing the IIS Manager\nUsing the AppCmd.exe command line tool\nNote\nBecause the configuration section can be set only at the server level, you must be an\nadministrator to uninstall a module.\nEnabling a Module for an Application\nA module must be enabled before it can provide service for a particular application. In order to enable a native\nmodule, it must first be installed on the server (see the previous section, To Install a Native Module).\nA managed module does not require installation, and can be enabled directly for each application. This allows\napplications to include their managed modules directly within the application by registering them in the\napplication's web.config file, and providing the implementation in /BIN or /App_Code directories.\nTo enable a module, do one of the following:\nManually edit the IIS configuration store, either globally to enable the module for all applications on the\nserver, or in a particular web.config file located within each application for which you would like to enable\nthis module. In IIS 7.5 or above you can use the Configuration Editor.\nUse the IIS Manager\nUse the AppCmd.exe command line tool\nAll three of these options add the module entry to the IIS configuration section, which is can be set at\nboth the server level and application level. Examine the contents of this section by opening the root configuration\nfile located in %windir%\\system32\\inetsrv\\config\\applicationhost.config , and searching for the string \"\n\".\nhttps://docs.microsoft.com/en-us/iis/get-started/introduction-to-iis/iis-modules-overview\nPage 3 of 23\n\nUnlike native modules, a managed module does not require adding an entry to the configuration\nsection.\nAfter a full IIS installation, the configuration section contains an entry for each of the modules (both managed and\nnative) that shipped with IIS. The entry indicates that all these modules are enabled by default for all applications\non the server. Each entry in this section specifies either the name of a native module that was previously installed\non the server, or the name and .NET type of a managed module:\n...\nDisabling a Module in an Application\nDisable a module if that module is no longer in use in the application, or if you want to replace it with another\nmodule. To disable a module, remove the corresponding module entry from the configuration\ncollection for a particular application where you do not want this module to execute. If the module is enabled at\nthe server level, remove it there to disable it in all applications on the server by default. Use one of the following\noptions to remove the module at the server level:\nManually edit the / configuration section in your application.\nUse the IIS Manager.\nUse the AppCmd.exe command line tool.\nAfter the module is removed from the application, it will not be active in that application. However, if the module\nis native, it will still be loaded in the server worker process, and may be used by other applications that did not\nremove it.\nNote\nThe configuration section is unlocked by default if ASP.NET is installed. This default unlocking allows\napplications to disable both native and managed modules enabled globally, and to add new managed modules.\nThis configuration section can be locked at the server level to prevent modification entirely, or prevent removal of\nspecific module entries if desired by the Administrator.\nPreconditions\nThere is another attribute on a module entry called precondition. The IIS core engine uses preconditions to\ndetermine when to enable a particular module. Performance reasons, for example, might determine that you only\nwant to execute managed modules for requests that also go to a managed handler. The precondition in the\nhttps://docs.microsoft.com/en-us/iis/get-started/introduction-to-iis/iis-modules-overview\nPage 4 of 23\n\nfollowing example (precondition=\"managedHandler\") only enables the forms authentication module for requests\nthat are also handled by a managed handler, such as requests to .aspx or .asmx files:\nsection:\nWhen you use this property, the \"managedHandler\" precondition has no effect and all managed modules run for\nall requests.\nQuerying, Adding and Removing Modules Using the IIS Manager\nThe IIS Manager provides an easy way to query, add or remove modules.\n1. To open the IIS Manager, click Start, type inetmgr in the Search box, and then press ENTER.\n2. Click the computer name of your IIS server.\n3. Click the Modules icon in the IIS category.\nhttps://docs.microsoft.com/en-us/iis/get-started/introduction-to-iis/iis-modules-overview\nPage 5 of 23\n\nFigure 1: IIS Manager\r\nTo manage the enabled modules for a particular application\r\n1. Connect to that application using the tree view on the left.\r\n2. Navigate to the Modules feature pane.\r\n3. Click Add Managed Module to add a Managed Module to your application. Add Native Module only\r\nallows you to add a module that is already registered on the Server level.\r\nTo remove a module from your application\r\n1. Click the module in the list. The Remove task displays in the left pane.\r\n2. Click Remove.\r\nhttps://docs.microsoft.com/en-us/iis/get-started/introduction-to-iis/iis-modules-overview\r\nPage 6 of 23\n\nFigure 2: Modules List in IIS Manager\r\nManaging Modules from the Command Line\r\nTo quickly manage modules from the command line, or script module management tasks, use the AppCmd.exe\r\ncommand line tool.\r\nTo install a module using AppCmd.exe\r\nAt the Command Prompt, type the following command, replacing values in italics with the values for the module\r\non your computer.\r\nAppcmd.exe install module /name:MODULE_NAME /image:PATH_TO_DLL\r\nNote\r\nInstalling a native module automatically enables it at the server level.\r\nFor example, the following command installs the Default Document module.\r\n%windir%\\system32\\inetsrv\\appcmd.exe install module /name:DefaultDocumentModule /image:%windir%\\system32\\inetsr\r\nhttps://docs.microsoft.com/en-us/iis/get-started/introduction-to-iis/iis-modules-overview\r\nPage 7 of 23\n\nIf you run the command on a computer where the module is already loaded, you wil get an error message similar\r\nto the following:\r\nERROR (message:Failed to add duplicate collection element \"DefaultDocumentModule\".)\r\nTo uninstall a module using AppCmd.exe\r\nAt the Command Prompt, type the following command, replacing values in italics with the values for the module\r\non your computer.\r\nAppcmd.exe uninstall module MODULE_NAME\r\nNote\r\nUninstalling a module automatically disables it at the server level.\r\nFor example, the following command uninstalls the Default Document module. This command is provided only as\r\nexample. You should only run it on a test server.\r\n%windir%\\system32\\inetsrv\\appcmd.exe uninstall module DefaultDocumentModule\r\nTo list the modules enabled either for an application or globally\r\nAt the Command Prompt, type the following command, replacing values in italic text with the values for the\r\nmodule on your computer.\r\nAppcmd.exe list modules [/app.name:APPLICATION_NAME]\r\nFor example, the following command lists the modules enabled for the Default Web Site.\r\n%windir%\\system32\\inetsrv\\appcmd.exe list modules /app.name:\"Default Web Site\"\r\nAnd this command lists the modules installed globally.\r\n%windir%\\system32\\inetsrv\\appcmd.exe list modules\r\nTo enable a module either for a particular application or globally\r\nAt the Command Prompt, type the following command, replacing values in italic text with the values for the\r\nmodule on your computer.\r\nAppcmd.exe add module /name:MODULE_NAME /type:MGD_TYPE\r\nhttps://docs.microsoft.com/en-us/iis/get-started/introduction-to-iis/iis-modules-overview\r\nPage 8 of 23\n\nFor example, the following command adds the Forms Authentication module to the Default Web Site.\r\n%windir%\\system32\\inetsrv\\appcmd.exe add module /name:FormsAuthentication /type:System.Web.Security.FormsAuthen\r\nAnd this command adds the Forms Authentication Module globally.\r\n%windir%\\system32\\inetsrv\\appcmd.exe add module /name:FormsAuthentication /type:System.Web.Security.FormsAuthen\r\nTo disable a module either for a particular application or globally\r\nAt the Command Prompt, type the following command, replacing values in italic text with the values for the\r\nmodule on your computer.\r\nAppcmd.exe delete module MODULE_NAME [/app.name:APPLICATION_NAME]\r\nFor example, the following command removes the Forms Authentication module from the Default Web Site.\r\n%windir%\\system32\\inetsrv\\appcmd.exe delete module FormsAuthentication /app.name:\"Default Web Site\"\r\nAnd this command removes the Forms Authentication Module globally.\r\n%windir%\\system32\\inetsrv\\appcmd.exe delete module FormsAuthentication\r\nTo get more help on the syntax for each of the App Cmd.exe commands\r\nTo display the commands supported on the Module object type the following command:\r\nAppcmd.exe module /?\r\nTo display the usage of each command, type the following command:\r\nAppcmd.exe install module /?Appcmd add module /?\r\nModule Reference\r\nThe IIS server is ready for customizing. Read the following list carefully to avoid side-effects, feature loss or\r\nremoving security features.\r\nUtility Modules\r\nThese modules do not provide request services, but instead assist the server engine with its internal operation.\r\nhttps://docs.microsoft.com/en-us/iis/get-started/introduction-to-iis/iis-modules-overview\r\nPage 9 of 23\n\nModule\r\nName:\r\nUriCacheModule\r\nDescription:\r\nImplements a generic cache for URL-specific server state, such as configuration. With this\r\nmodule, the server only reads configuration for the first request for a particular URL, and\r\nreuse it on subsequent requests until it changes.\r\nConfiguration\r\nsections:\r\nNone.\r\nDependencies: None.\r\nPotential issues\r\nwhen removing\r\nthis module\r\nPerformance loss due to state cached for each URL retrieval for every request.\r\nModule\r\nName:\r\nFileCacheModule\r\nDescription: Caches file handles for files opened by the server engine and modules.\r\nConfiguration\r\nsections:\r\nNone.\r\nDependencies: None.\r\nPotential issues\r\nwhen removing\r\nthis module\r\nPerformance loss. If file handles are not cached, the files have to be opened for every\r\nrequest.\r\nModule\r\nName:\r\nTokenCacheModule\r\nDescription:\r\nCaches windows security tokens for password based authentication schemes (anonymous\r\nauthentication, basic authentication, IIS client certificate authentication).\r\nConfiguration\r\nsections:\r\nNone.\r\nDependencies: None.\r\nPotential issues\r\nwhen removing\r\nthis module\r\nPerformance loss. The users must be logged on for every request if the token is not cached.\r\nA major performance impact may result. For example, if a password protected html page\r\nreferences 50 images that are also protected, 51 logonUser calls to the local account\r\ndatabase, or worse, to an off-box domain controller, result in a performance issue.\r\nModule\r\nName:\r\nManagedEngine\r\nhttps://docs.microsoft.com/en-us/iis/get-started/introduction-to-iis/iis-modules-overview\r\nPage 10 of 23\n\nModule\r\nName:\r\nUriCacheModule\r\nDescription:\r\nManaged Engine has a special place within all the other modules. It is responsible for\r\nproviding the IIS integration to hook up with the ASP.NET runtime.\r\nConfiguration\r\nsections:\r\nDependencies: None.\r\nPotential issues\r\nwhen removing\r\nthis module\r\nASP.NET integration will be disabled. None of the managed modules declared in the\r\n\u003cmodules\u003e or ASP.NET handlers declared in the \u003chandlers\u003e section are called when the\r\nApplication Pool runs in Integrated Mode.\r\nModule\r\nName:\r\nHttpCacheModule\r\nDescription:\r\nThe HttpCacheModule implements the IIS output cache and also the logic for caching\r\nitems in the http.sys cache. Set the cache size, output cache profiles etc. via configuration.\r\nConfiguration\r\nsections:\r\nSystem.webServer/caching\r\nDependencies: None.\r\nPotential issues\r\nwhen removing\r\nthis module\r\nContent will no longer be cached in kernel mode. Cache profiles are ignored. Removing\r\nthe HttpCacheModule will probably have adverse effects on performance and resource\r\nusage.\r\nModule\r\nName:\r\nDynamicCompressionModule\r\nDescription: Implements in-memory compression of dynamic content.\r\nConfiguration\r\nsections:\r\nsystem.webServer/httpCompression and system.webServer/urlCompression.\r\nDependencies: There will not be any dependencies because Dynamic compression is turned off by default.\r\nModule\r\nName:\r\nStaticCompressionModule\r\nDescription:\r\nImplements compression (in memory as well as persistent in the file system) of static\r\ncontent.\r\nConfiguration\r\nsections:\r\nsystem.webServer/httpCompression and system.webServer/urlCompression\r\nhttps://docs.microsoft.com/en-us/iis/get-started/introduction-to-iis/iis-modules-overview\r\nPage 11 of 23\n\nModule\r\nName:\r\nUriCacheModule\r\nDependencies: None.\r\nPotential issues\r\nwhen removing\r\nthis module\r\nPotential Bandwidth saturation due to uncompressed content being sent back to the client.\r\nModule\r\nName:\r\nDefaultDocumentModule\r\nDescription:\r\nImplements default document functionality. Requests that come in with a trailing / will be\r\nrerouted to a document in the default document list.\r\nConfiguration\r\nsections:\r\nsystem.webServer/defaultDocument\r\nDependencies: None.\r\nPotential issues\r\nwhen removing\r\nthis module\r\nRequests to /, for example http://localhost/ , return a 404 error. If a directoryBrowsing\r\nis enabled, a directory listing is generated.\r\nModule\r\nName:\r\nDirectoryListingModule\r\nDescription: Implements directory browsing functionality.\r\nConfiguration\r\nsections:\r\nsystem.webServer/directoryBrowse\r\nDependencies: None.\r\nPotential issues\r\nwhen removing\r\nthis module\r\nIf the neither the default document module nor the directoryListing Module handle a\r\nrequest for a /, an empty response returns.\r\nModule\r\nName:\r\nProtocolSupportModule\r\nDescription:\r\nImplements custom and redirect response headers. Implements the trace and Options\r\nHTTP verbs. Implements the supports which allow or turn off keep-alive support via\r\nconfiguration.\r\nConfiguration\r\nsections:\r\nsystem.webServer/httpProtocol\r\nhttps://docs.microsoft.com/en-us/iis/get-started/introduction-to-iis/iis-modules-overview\r\nPage 12 of 23\n\nModule\r\nName:\r\nUriCacheModule\r\nDependencies: None.\r\nPotential issues\r\nwhen removing\r\nthis module\r\nTRACE or OPTIONS requests return a \"405 Method not allowed\" error message.\r\nModule\r\nName:\r\nHttpRedirectionModule\r\nDescription: Implements redirect functionality.\r\nConfiguration\r\nsections:\r\nsystem.webServer/httpRedirect\r\nDependencies: None.\r\nPotential issues\r\nwhen removing\r\nthis module\r\nPotential security issue if resources were protected by redirection. When the Redirection\r\nmodule is removed, the content becomes accessible again.\r\nModule\r\nName:\r\nServerSideIncludeModule\r\nDescription:\r\nImplements server side includes. This module is mapped as a handler, only executing for\r\nrequests ending in .stm, .shtm and .shtml.\r\nConfiguration\r\nsections:\r\nsystem.webServer/serverSideInclude\r\nDependencies: None.\r\nPotential issues\r\nwhen removing\r\nthis module\r\nThe static file module handles.stm, .shtm and .shtml files. If this module has a mimeMap\r\nfor these extensions the files become served as text. Note, however, that this is not the\r\ndefault.\r\nModule\r\nName:\r\nStaticFileModule\r\nDescription:\r\nSends out static files with the file extension .html, .jpg, as well as many others. The\r\nstaticContent/mimeMap configuration collection determines the list of file extensions.\r\nConfiguration\r\nsections:\r\nsystem.webServer/staticContent\r\nDependencies: None.\r\nhttps://docs.microsoft.com/en-us/iis/get-started/introduction-to-iis/iis-modules-overview\r\nPage 13 of 23\n\nModule\r\nName:\r\nUriCacheModule\r\nPotential issues\r\nwhen removing\r\nthis module\r\nStatic files no longer become served. Requests for files return a 404 Not Found error\r\nindicating that no handler was matched.\r\nModule\r\nName:\r\nAnonymousAuthenticationModule\r\nDescription:\r\nImplements anonymous authentication. This module generates the HttpUser object if a\r\nURL is configured to allow anonymous authentication.\r\nConfiguration\r\nsections:\r\nsystem.webServer/security/authentication/anonymousAuthentication\r\nDependencies: None.\r\nPotential issues\r\nwhen removing\r\nthis module\r\nAt least one authentication module must be configured. The IIS server core checks after\r\nthe authentication phase if the HttpUser object is populated. The HttpUser object is an IIS\r\ndata structure. A 401.2 error generates if there is no authentication populating the HttpUser\r\nobject.\r\nModule\r\nName:\r\nCertificateMappingAuthenticationModule\r\nDescription:\r\nMaps SSL client certificates to an Active Directory account (Active Directory Certificate\r\nMapping).\r\nConfiguration\r\nsections:\r\nsystem.webServer/security/authentication/clientCertificateMappingAuthentication\r\nDependencies:\r\nSSL must be configured for this module to work. The IIS machine must also be a member\r\nof an Active Directory domain.\r\nPotential issues\r\nwhen removing\r\nthis module\r\nRequests are normally allowed if Active Directory Certificate Mapping is used to protect a\r\ndirectory; in this case, the module is removed.\r\nModule\r\nName:\r\nBasicAuthenticationModule\r\nDescription: implements HTTP Basic authentication described in RFC 2617.\r\nConfiguration\r\nsections:\r\nsystem.webServer/security/authentication/basicAuthentication\r\nDependencies: None.\r\nhttps://docs.microsoft.com/en-us/iis/get-started/introduction-to-iis/iis-modules-overview\r\nPage 14 of 23\n\nModule\r\nName:\r\nUriCacheModule\r\nPotential issues\r\nwhen removing\r\nthis module\r\nAt least one authentication module has must be configured. The IIS server core checks\r\nafter the authentication phase if the HttpUser object is populated. The HttpUser object is an\r\nIIS data structure. A 401.2 error generates if there is no authentication populating the\r\nHttpUser object.\r\nModule\r\nName:\r\nWindowsAuthenticationModule\r\nDescription: Implements Windows authentication (NTLM or Negotiate (Kerberos)).\r\nConfiguration\r\nsections:\r\nsystem.webServer/security/authentication/windowsAuthentication\r\nDependencies: None.\r\nPotential issues\r\nwhen removing\r\nthis module\r\nAt least one authentication module must be configured. The IIS server core checks after\r\nthe authentication phase if the HttpUser object is populated. The HttpUser object is an IIS\r\ndata structure. A 401.2 error is generates if there is no authentication populating the\r\nHttpUser object.\r\nModule\r\nName:\r\nDigestAuthenticationModule\r\nDescription: Implements digest authentication described in RFC 2617.\r\nConfiguration\r\nsections:\r\nsystem.webServer/security/authentication/digestAuthentication\r\nDependencies: IIS server must be part of an Active Directory domain.\r\nPotential issues\r\nwhen removing\r\nthis module\r\nAt least one authentication module must be configured. The IIS server core checks after\r\nthe authentication phase if the HttpUser object is populated. The HttpUser object is an IIS\r\ndata structure. A 401.2 error is generates if there is no authentication populating the\r\nHttpUser object.\r\nModule\r\nName:\r\nIISCertificateMappingAuthenticationModule\r\nDescription:\r\nImplements IIS certificate mapping. Maps SSL client certificates to a Windows account.\r\nContrary to Active Directory Certificate mapping, user credentials and mapping rules are\r\nstored within the IIS configuration store\r\nConfiguration\r\nsections:\r\nsystem.webServer/iisClientCertificateMappingAuthentication\r\nhttps://docs.microsoft.com/en-us/iis/get-started/introduction-to-iis/iis-modules-overview\r\nPage 15 of 23\n\nModule\r\nName:\r\nUriCacheModule\r\nDependencies:\r\nSSL with the requirement to receive client certificates has to be configured for this module\r\nto work.\r\nPotential issues\r\nwhen removing\r\nthis module\r\nAt least one authentication module must be configured. The IIS server core checks after\r\nthe authentication phase if the HttpUser object is populated. The HttpUser object is an IIS\r\ndata structure. A 401.2 error generates if there is no authentication populating the HttpUser\r\nobject.\r\nModule\r\nName:\r\nUrlAuthorizationModule\r\nDescription: Implements authorization based on configuration rules.\r\nConfiguration\r\nsections:\r\nsystem.webServer/security/authorization\r\nDependencies: None.\r\nPotential issues\r\nwhen removing\r\nthis module\r\nAuthorization rules which protected content are no longer evaluated. Content that was\r\nsupposed to be protected might be served.\r\nModule\r\nName:\r\nIsapiModule\r\nDescription: Implements ISAPI Extension functionality.\r\nConfiguration\r\nsections:\r\nsystem.webServer/isapiCgiRestriction\r\nDependencies: None.\r\nPotential issues\r\nwhen removing\r\nthis module\r\nISAPI Extensions mapped in the \u003chandlers\u003e section (modules=\"IsapiModule\") or\r\nexplicitly called ISAPI Extensions will no longer work.\r\nModule\r\nName:\r\nIsapiFilterModule\r\nDescription: Implements ISAPI filter functionality.\r\nConfiguration\r\nsections:\r\nsystem.webServer/isapiFilters\r\nDependencies: None.\r\nhttps://docs.microsoft.com/en-us/iis/get-started/introduction-to-iis/iis-modules-overview\r\nPage 16 of 23\n\nModule\r\nName:\r\nUriCacheModule\r\nPotential issues\r\nwhen removing\r\nthis module\r\nISAPI filters often implement functionality applications rely on. Examples are ASP.NET or\r\nSharePoint. ASP.NET for example needs the aspnet_filter.dll to protect sensitive content\r\nand to rewrite URLs. Removing this module prevents IIS from loading ISAPI filters.\r\nApplications might stop working or sensitive content may be exposed.\r\nModule\r\nName:\r\nIpRestrictionModule\r\nDescription: Implements an authorization scheme based on the IPv4 address of the client request.\r\nConfiguration\r\nsections:\r\nsystem.webServer/security/ipSecurity\r\nDependencies: IPv4 stack must be installed.\r\nPotential issues\r\nwhen removing\r\nthis module\r\nClients with IP addresses on the ipSecurity list will be allowed.\r\nModule\r\nName:\r\nRequestFilteringModule\r\nDescription:\r\nImplements a powerful set of security rules which reject suspicious request at a very early\r\nstage. This module is the successor to the ISAPI filter UrlScan.DLL that was shipped for\r\nIIS 5.0 and 6.0.\r\nConfiguration\r\nsections:\r\nsystem.webServer/security/requestFiltering\r\nDependencies: None.\r\nPotential issues\r\nwhen removing\r\nthis module\r\nIf this module is removed, the rules specified in the requestFiltering section no longer\r\napply. Potential security issues may result.\r\nModule\r\nName:\r\nCustomLoggingModule\r\nDescription:\r\nImplements the ILogPlugin interface on top of IIS. ILogPlugin is a previous COM\r\nimplementation that allowed customers to extend IIS logging. We do not recommend\r\nextending IIS using this interface. Instead, customers should write a module and subscribe\r\nto the RQ_LOG_REQUEST notification.\r\nConfiguration\r\nsections:\r\nsystem.webServer/httpLogging and\r\nsystem.applicationhost/sites/site/logFile/customLogPluginClsid\r\nhttps://docs.microsoft.com/en-us/iis/get-started/introduction-to-iis/iis-modules-overview\r\nPage 17 of 23\n\nModule\r\nName:\r\nUriCacheModule\r\nDependencies: None.\r\nPotential issues\r\nwhen removing\r\nthis module\r\nA custom log plug-in will no longer be called. For example, ODBC Logging is\r\nimplemented as ILogPlugin.\r\nModule\r\nName:\r\nCustomErrorModule\r\nDescription: Implements custom errors and the IIS detailed error feature.\r\nConfiguration\r\nsections:\r\nsystem.webServer/httpErrors\r\nDependencies: None.\r\nPotential issues\r\nwhen removing\r\nthis module\r\nIIS returns blank pages with minimal information when errors within the core server occur.\r\nRemote users may see detailed error information coming from server components which\r\ncan result in disclosing information.\r\nModule\r\nName:\r\nHttpLoggingModule\r\nDescription: Implements standard IIS logging by telling HTTP.SYS what to log.\r\nConfiguration\r\nsections:\r\nsystem.applicationHost/log and system.webServer/httpLogging\r\nDependencies: None.\r\nPotential issues\r\nwhen removing\r\nthis module\r\nStandard IIS logging will no longer work.\r\nModule\r\nName:\r\nFailedRequestsTracingModule\r\nDescription:\r\nImplements tracing of failed requests. Define and set rules for failed requests via\r\nconfiguration.\r\nConfiguration\r\nsections:\r\nsystem.webServer/tracing and system.webServer/httpTracing\r\nDependencies: None.\r\nhttps://docs.microsoft.com/en-us/iis/get-started/introduction-to-iis/iis-modules-overview\r\nPage 18 of 23\n\nModule\r\nName:\r\nUriCacheModule\r\nPotential issues\r\nwhen removing\r\nthis module\r\nTracing http requests will no longer work.\r\nModule\r\nName:\r\nRequestMonitorModule\r\nDescription:\r\nImplements the IIS Run-time State and Control Interface (RSCA). RSCA allows users to\r\nquery for run-time information such as currently executing request, start/stop state of a\r\nweb-site, or currently executing application domains.\r\nConfiguration\r\nsections:\r\nNone.\r\nDependencies: None.\r\nPotential issues\r\nwhen removing\r\nthis module\r\nTools will be unable to enumerate currently executing requests.\r\nModule\r\nName:\r\nCgiModule\r\nDescription: Implements CGI on top of IIS.\r\nConfiguration\r\nsections:\r\nsystem.webServer/cgi and system.webServer/isapiCgiRestriction\r\nDependencies: None.\r\nPotential issues\r\nwhen removing\r\nthis module\r\nCGI programs will stop working.\r\nModule\r\nName:\r\nTracingModule\r\nDescription: Implements ETW tracing.\r\nConfiguration\r\nsections:\r\nsystem.webServer/httpTracing\r\nDependencies: None.\r\nPotential issues\r\nwhen removing\r\nETW tracing will not work if this module is removed.\r\nhttps://docs.microsoft.com/en-us/iis/get-started/introduction-to-iis/iis-modules-overview\r\nPage 19 of 23\n\nModule\r\nName:\r\nUriCacheModule\r\nthis module\r\nModule\r\nName:\r\nConfigurationValidationModule\r\nDescription:\r\nValidates that ASP.NET application configuration has been migrated to work in Integrated\r\nmode.\r\nConfiguration\r\nsections:\r\nsystem.webServer/Validation\r\nDependencies: None.\r\nPotential issues\r\nwhen removing\r\nthis module\r\nApplications that specify legacy ASP.NET configuration for modules and handlers will not\r\ngenerate migration errors; a new application that has not been migrated will function\r\nincorrectly.\r\nManaged Modules:\r\nModule Name: OutputCache\r\nDescription: Implements the ASP.NET Output Caching feature.\r\nConfiguration\r\nsections:\r\nsystem.web/caching/outputCache\r\nDependencies: ManagedEngine module has to be installed.\r\nPotential issues\r\nwhen removing\r\nthis module\r\nASP.NET will be unable to output cache responses to pages configured to be output\r\ncached.\r\nModule Name: Session\r\nDescription: See ASP.NET 2.0 documentation for details\r\nConfiguration\r\nsections:\r\nsystem.web/sessionState\r\nDependencies: ManagedEngine module must be installed\r\nPotential issues\r\nwhen removing\r\nthis module\r\nManaged session state is not available.\r\nModule Name: WindowsAuthentication\r\nhttps://docs.microsoft.com/en-us/iis/get-started/introduction-to-iis/iis-modules-overview\r\nPage 20 of 23\n\nModule Name: OutputCache\r\nDescription: See ASP.NET 2.0 documentation for details.\r\nConfiguration\r\nsections:\r\nsystem.web/authentication\r\nDependencies: ManagedEngine module has to be installed\r\nPotential issues\r\nwhen removing\r\nthis module\r\nWindowsAuthentication.OnAuthenticate event will not be raised, which may prevent\r\nsome custom ASP.NET authentication code from running. Also, the authenticated user\r\nwill not be replaced with the UNC user when on UNC share (legacy ASP.NET\r\nbehavior). This module does not affect NTLM/Kerberos authentication for ASP.NET\r\napplications in Integrated mode, and is not required outside of the\r\nWindowsAuthentication.OnAuthenticate event and the legacy UNC behavior.\r\nModule Name: FormsAuthentication\r\nDescription: See ASP.NET 2.0 documentation for details.\r\nConfiguration\r\nsections:\r\nsystem.web/authentication\r\nDependencies: ManagedEngine module has to be installed\r\nPotential issues\r\nwhen removing\r\nthis module\r\nASP.NET forms-based authentication feature will not be available, resulting in clients\r\nwith forms authentication tickets not being able to access protected resources.\r\nModule Name: DefaultAuthentication\r\nDescription: See ASP.NET 2.0 documentation for details.\r\nConfiguration\r\nsections:\r\nsystem.web/authentication\r\nDependencies: ManagedEngine module has to be installed\r\nPotential issues\r\nwhen removing\r\nthis module\r\nSome ASP.NET features may not work for anonymous requests if ASP.NET\r\nauthentication mode is Forms. Also, DefaultAuthentication.OnAuthenticate event will\r\nnot be raised.\r\nModule Name: RoleManager\r\nDescription: See ASP.NET 2.0 documentation for details.\r\nConfiguration\r\nsections:\r\nNone.\r\nhttps://docs.microsoft.com/en-us/iis/get-started/introduction-to-iis/iis-modules-overview\r\nPage 21 of 23\n\nModule Name: OutputCache\r\nDependencies: ManagedEngine module must be installed.\r\nPotential issues\r\nwhen removing\r\nthis module\r\nRole Manager functionality not available.\r\nModule Name: UrlAuthorization\r\nDescription:\r\nSee ASP.NET 2.0 documentation for details. The native UrlAuthorization module\r\nimplements URL authorization functionality in native code. This provides a scalable and\r\nfast native alternative for the managed URL authorization module.\r\nConfiguration\r\nsections:\r\nsystem.web/authorization.\r\nDependencies: ManagedEngine module must be installed.\r\nPotential issues\r\nwhen removing\r\nthis module\r\nASP.NET authorization rules will be ignored, possibly resulting in information\r\ndisclosure and other security compromises.\r\nModule Name: AnonymousIdentification\r\nDescription: See ASP.NET 2.0 documentation for details.\r\nConfiguration\r\nsections:\r\nDependencies: ManagedEngine module has to be installed.\r\nPotential issues\r\nwhen removing\r\nthis module\r\nThe anonymous identification feature used by the ASP.NET Profile will not work.\r\nModule Name: Profile\r\nDescription: See ASP.NET 2.0 documentation for details.\r\nConfiguration\r\nsections:\r\nDependencies: ManagedEngine module must be installed.\r\nPotential issues\r\nwhen removing\r\nthis module\r\nThe ASP.NET Profile feature will not work.\r\nhttps://docs.microsoft.com/en-us/iis/get-started/introduction-to-iis/iis-modules-overview\r\nPage 22 of 23\n\nModule Name: OutputCache\r\nModule Name: UrlMappingsModule\r\nDescription: See ASP.NET 2.0 documentation for details.\r\nConfiguration\r\nsections:\r\nDependencies: ManagedEngine module must be installed.\r\nPotential issues\r\nwhen removing\r\nthis module\r\nThe ASP.NET URL mappings will not work.\r\nSource: https://docs.microsoft.com/en-us/iis/get-started/introduction-to-iis/iis-modules-overview\r\nhttps://docs.microsoft.com/en-us/iis/get-started/introduction-to-iis/iis-modules-overview\r\nPage 23 of 23",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"MITRE"
	],
	"origins": [
		"web"
	],
	"references": [
		"https://docs.microsoft.com/en-us/iis/get-started/introduction-to-iis/iis-modules-overview"
	],
	"report_names": [
		"iis-modules-overview"
	],
	"threat_actors": [],
	"ts_created_at": 1775434648,
	"ts_updated_at": 1775826758,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/ee6330c009baff770464b0346dbb506b2d69af8c.pdf",
		"text": "https://archive.orkl.eu/ee6330c009baff770464b0346dbb506b2d69af8c.txt",
		"img": "https://archive.orkl.eu/ee6330c009baff770464b0346dbb506b2d69af8c.jpg"
	}
}