IIS Modules Overview
By leanserver
Archived: 2026-04-05 19:17:56 UTC
by IIS Team, Mike Volodarsky
Compatibility
Version Notes
IIS 7.0 and later The features described in this article were introduced in IIS 7.0.
IIS 6.0 and earlier The features described in this article were not supported prior to IIS 7.0.
Introduction
The IIS 7 and above Web server feature set is componentized into more than thirty independent modules.
A module is either a Win32 DLL (native module) or a .NET 2.0 type contained within an assembly (managed
module). Similar to a set of building blocks, modules are added to the server in order to provide the desired
functionality for your applications. Likewise, all IIS modules can be removed, or replaced with custom modules
developed using the IIS C++ APIs, or the familiar ASP.NET 2.0 APIs.
This article describes common IIS module management tasks, and details each module including its configuration
settings and the potential effect a module removal has on the Web server. The management examples are given
using both the graphical IIS Manager and the AppCmd command line tool.
Prerequisites
To follow the steps in this document it is best to do a full install of IIS.
Note
Not all editions of Windows support all available IIS features. To see which features of IIS are supported on your
operating system, you will need to consult the documentation which shipped with your version of Windows.
To Perform a Full Installation of IIS on Windows Vista, Windows 7, Windows 8, Windows 10 or
Windows 11
1. Click Start and then click Control Panel.
2. In the Control Panel, click Programs.
3. Under Programs and Features, click Turn Windows features on or off.
https://docs.microsoft.com/en-us/iis/get-started/introduction-to-iis/iis-modules-overview
Page 1 of 23

4. In the Windows Features dialog, expand Internet Information Services and select all features.
You may need to expand some categories to select all the features in that category.
5. Click OK.
To Perform a Full Install of IIS on Windows Server 2008/R2, Windows Server 2012/R2, or
Windows Server 2016
1. Open Server Manager > Roles and select Web Server (IIS).
2. Check all features under Web Server.
Getting Started with Modules
In order to add a module to the server, you must perform two steps:
1. Install a module on the server (native modules only).
2. Enable the module in an application.
The first step registers the module globally with the server, making it available within each server worker process.
It is necessary only for native modules due to the trusted nature of native code, and is available only to
administrators.
Note
A native module has unrestricted access to any resource available to the server worker process, just like an ISAPI
filter or extension in previous versions. Because of this unrestricted access, you should install only native modules
that come from a trusted source.
The second step enables the module to execute within a particular application and effectively allows the
application administrator to control the server features enabled for the application. This step allows both installed
native modules and managed modules to be enabled for each application.
To Install a Native Module
In order to install a native module, it must be registered with the server using one of the options below:
Manually editing the IIS configuration store. In IIS 7.5 and later you can use the Configuration Editor in
the IIS Manager.
Using the IIS Manager
Using the AppCmd.exe command line tool
All three of these options result in the module entry being added to the <globalModules> IIS configuration
section, which can be set only at the server level. To examine the contents of this section, open the root
configuration file located in %windir%\system32\inetsrv\config\applicationhost.config , and search for the
string "<globalModules>".
After a full IIS installation, this section contains an entry for each of the native modules shipped with IIS,
specifying a name and the path to the module DLL:
https://docs.microsoft.com/en-us/iis/get-started/introduction-to-iis/iis-modules-overview
Page 2 of 23

...
All of these modules are described in detail later in this document.
To Uninstall a Native Module
You can uninstall a native module if that module is no longer in use on the server, or if you would like to replace it
with another module. Remove the corresponding module entry from the configuration list, and
the associated entry in the configuration list using one of the following options:
Manually editing the IIS configuration store. In IIS 7.5 and above you can use the Configuration Editor.
Using the IIS Manager
Using the AppCmd.exe command line tool
Note
Because the configuration section can be set only at the server level, you must be an
administrator to uninstall a module.
Enabling a Module for an Application
A module must be enabled before it can provide service for a particular application. In order to enable a native
module, it must first be installed on the server (see the previous section, To Install a Native Module).
A managed module does not require installation, and can be enabled directly for each application. This allows
applications to include their managed modules directly within the application by registering them in the
application's web.config file, and providing the implementation in /BIN or /App_Code directories.
To enable a module, do one of the following:
Manually edit the IIS configuration store, either globally to enable the module for all applications on the
server, or in a particular web.config file located within each application for which you would like to enable
this module. In IIS 7.5 or above you can use the Configuration Editor.
Use the IIS Manager
Use the AppCmd.exe command line tool
All three of these options add the module entry to the IIS configuration section, which is can be set at
both the server level and application level. Examine the contents of this section by opening the root configuration
file located in %windir%\system32\inetsrv\config\applicationhost.config , and searching for the string "
".
https://docs.microsoft.com/en-us/iis/get-started/introduction-to-iis/iis-modules-overview
Page 3 of 23

Unlike native modules, a managed module does not require adding an entry to the configuration
section.
After a full IIS installation, the configuration section contains an entry for each of the modules (both managed and
native) that shipped with IIS. The entry indicates that all these modules are enabled by default for all applications
on the server. Each entry in this section specifies either the name of a native module that was previously installed
on the server, or the name and .NET type of a managed module:
...
Disabling a Module in an Application
Disable a module if that module is no longer in use in the application, or if you want to replace it with another
module. To disable a module, remove the corresponding module entry from the configuration
collection for a particular application where you do not want this module to execute. If the module is enabled at
the server level, remove it there to disable it in all applications on the server by default. Use one of the following
options to remove the module at the server level:
Manually edit the / configuration section in your application.
Use the IIS Manager.
Use the AppCmd.exe command line tool.
After the module is removed from the application, it will not be active in that application. However, if the module
is native, it will still be loaded in the server worker process, and may be used by other applications that did not
remove it.
Note
The configuration section is unlocked by default if ASP.NET is installed. This default unlocking allows
applications to disable both native and managed modules enabled globally, and to add new managed modules.
This configuration section can be locked at the server level to prevent modification entirely, or prevent removal of
specific module entries if desired by the Administrator.
Preconditions
There is another attribute on a module entry called precondition. The IIS core engine uses preconditions to
determine when to enable a particular module. Performance reasons, for example, might determine that you only
want to execute managed modules for requests that also go to a managed handler. The precondition in the
https://docs.microsoft.com/en-us/iis/get-started/introduction-to-iis/iis-modules-overview
Page 4 of 23

following example (precondition="managedHandler") only enables the forms authentication module for requests
that are also handled by a managed handler, such as requests to .aspx or .asmx files:
section:
When you use this property, the "managedHandler" precondition has no effect and all managed modules run for
all requests.
Querying, Adding and Removing Modules Using the IIS Manager
The IIS Manager provides an easy way to query, add or remove modules.
1. To open the IIS Manager, click Start, type inetmgr in the Search box, and then press ENTER.
2. Click the computer name of your IIS server.
3. Click the Modules icon in the IIS category.
https://docs.microsoft.com/en-us/iis/get-started/introduction-to-iis/iis-modules-overview
Page 5 of 23

Figure 1: IIS Manager
To manage the enabled modules for a particular application
1. Connect to that application using the tree view on the left.
2. Navigate to the Modules feature pane.
3. Click Add Managed Module to add a Managed Module to your application. Add Native Module only
allows you to add a module that is already registered on the Server level.
To remove a module from your application
1. Click the module in the list. The Remove task displays in the left pane.
2. Click Remove.
https://docs.microsoft.com/en-us/iis/get-started/introduction-to-iis/iis-modules-overview
Page 6 of 23

Figure 2: Modules List in IIS Manager
Managing Modules from the Command Line
To quickly manage modules from the command line, or script module management tasks, use the AppCmd.exe
command line tool.
To install a module using AppCmd.exe
At the Command Prompt, type the following command, replacing values in italics with the values for the module
on your computer.
Appcmd.exe install module /name:MODULE_NAME /image:PATH_TO_DLL
Note
Installing a native module automatically enables it at the server level.
For example, the following command installs the Default Document module.
%windir%\system32\inetsrv\appcmd.exe install module /name:DefaultDocumentModule /image:%windir%\system32\inetsr
https://docs.microsoft.com/en-us/iis/get-started/introduction-to-iis/iis-modules-overview
Page 7 of 23

If you run the command on a computer where the module is already loaded, you wil get an error message similar
to the following:
ERROR (message:Failed to add duplicate collection element "DefaultDocumentModule".)
To uninstall a module using AppCmd.exe
At the Command Prompt, type the following command, replacing values in italics with the values for the module
on your computer.
Appcmd.exe uninstall module MODULE_NAME
Note
Uninstalling a module automatically disables it at the server level.
For example, the following command uninstalls the Default Document module. This command is provided only as
example. You should only run it on a test server.
%windir%\system32\inetsrv\appcmd.exe uninstall module DefaultDocumentModule
To list the modules enabled either for an application or globally
At the Command Prompt, type the following command, replacing values in italic text with the values for the
module on your computer.
Appcmd.exe list modules [/app.name:APPLICATION_NAME]
For example, the following command lists the modules enabled for the Default Web Site.
%windir%\system32\inetsrv\appcmd.exe list modules /app.name:"Default Web Site"
And this command lists the modules installed globally.
%windir%\system32\inetsrv\appcmd.exe list modules
To enable a module either for a particular application or globally
At the Command Prompt, type the following command, replacing values in italic text with the values for the
module on your computer.
Appcmd.exe add module /name:MODULE_NAME /type:MGD_TYPE
https://docs.microsoft.com/en-us/iis/get-started/introduction-to-iis/iis-modules-overview
Page 8 of 23

For example, the following command adds the Forms Authentication module to the Default Web Site.
%windir%\system32\inetsrv\appcmd.exe add module /name:FormsAuthentication /type:System.Web.Security.FormsAuthen
And this command adds the Forms Authentication Module globally.
%windir%\system32\inetsrv\appcmd.exe add module /name:FormsAuthentication /type:System.Web.Security.FormsAuthen
To disable a module either for a particular application or globally
At the Command Prompt, type the following command, replacing values in italic text with the values for the
module on your computer.
Appcmd.exe delete module MODULE_NAME [/app.name:APPLICATION_NAME]
For example, the following command removes the Forms Authentication module from the Default Web Site.
%windir%\system32\inetsrv\appcmd.exe delete module FormsAuthentication /app.name:"Default Web Site"
And this command removes the Forms Authentication Module globally.
%windir%\system32\inetsrv\appcmd.exe delete module FormsAuthentication
To get more help on the syntax for each of the App Cmd.exe commands
To display the commands supported on the Module object type the following command:
Appcmd.exe module /?
To display the usage of each command, type the following command:
Appcmd.exe install module /?Appcmd add module /?
Module Reference
The IIS server is ready for customizing. Read the following list carefully to avoid side-effects, feature loss or
removing security features.
Utility Modules
These modules do not provide request services, but instead assist the server engine with its internal operation.
https://docs.microsoft.com/en-us/iis/get-started/introduction-to-iis/iis-modules-overview
Page 9 of 23

Module
Name:
UriCacheModule
Description:
Implements a generic cache for URL-specific server state, such as configuration. With this
module, the server only reads configuration for the first request for a particular URL, and
reuse it on subsequent requests until it changes.
Configuration
sections:
None.
Dependencies: None.
Potential issues
when removing
this module
Performance loss due to state cached for each URL retrieval for every request.
Module
Name:
FileCacheModule
Description: Caches file handles for files opened by the server engine and modules.
Configuration
sections:
None.
Dependencies: None.
Potential issues
when removing
this module
Performance loss. If file handles are not cached, the files have to be opened for every
request.
Module
Name:
TokenCacheModule
Description:
Caches windows security tokens for password based authentication schemes (anonymous
authentication, basic authentication, IIS client certificate authentication).
Configuration
sections:
None.
Dependencies: None.
Potential issues
when removing
this module
Performance loss. The users must be logged on for every request if the token is not cached.
A major performance impact may result. For example, if a password protected html page
references 50 images that are also protected, 51 logonUser calls to the local account
database, or worse, to an off-box domain controller, result in a performance issue.
Module
Name:
ManagedEngine
https://docs.microsoft.com/en-us/iis/get-started/introduction-to-iis/iis-modules-overview
Page 10 of 23

Module
Name:
UriCacheModule
Description:
Managed Engine has a special place within all the other modules. It is responsible for
providing the IIS integration to hook up with the ASP.NET runtime.
Configuration
sections:
Dependencies: None.
Potential issues
when removing
this module
ASP.NET integration will be disabled. None of the managed modules declared in the
<modules> or ASP.NET handlers declared in the <handlers> section are called when the
Application Pool runs in Integrated Mode.
Module
Name:
HttpCacheModule
Description:
The HttpCacheModule implements the IIS output cache and also the logic for caching
items in the http.sys cache. Set the cache size, output cache profiles etc. via configuration.
Configuration
sections:
System.webServer/caching
Dependencies: None.
Potential issues
when removing
this module
Content will no longer be cached in kernel mode. Cache profiles are ignored. Removing
the HttpCacheModule will probably have adverse effects on performance and resource
usage.
Module
Name:
DynamicCompressionModule
Description: Implements in-memory compression of dynamic content.
Configuration
sections:
system.webServer/httpCompression and system.webServer/urlCompression.
Dependencies: There will not be any dependencies because Dynamic compression is turned off by default.
Module
Name:
StaticCompressionModule
Description:
Implements compression (in memory as well as persistent in the file system) of static
content.
Configuration
sections:
system.webServer/httpCompression and system.webServer/urlCompression
https://docs.microsoft.com/en-us/iis/get-started/introduction-to-iis/iis-modules-overview
Page 11 of 23

Module
Name:
UriCacheModule
Dependencies: None.
Potential issues
when removing
this module
Potential Bandwidth saturation due to uncompressed content being sent back to the client.
Module
Name:
DefaultDocumentModule
Description:
Implements default document functionality. Requests that come in with a trailing / will be
rerouted to a document in the default document list.
Configuration
sections:
system.webServer/defaultDocument
Dependencies: None.
Potential issues
when removing
this module
Requests to /, for example http://localhost/ , return a 404 error. If a directoryBrowsing
is enabled, a directory listing is generated.
Module
Name:
DirectoryListingModule
Description: Implements directory browsing functionality.
Configuration
sections:
system.webServer/directoryBrowse
Dependencies: None.
Potential issues
when removing
this module
If the neither the default document module nor the directoryListing Module handle a
request for a /, an empty response returns.
Module
Name:
ProtocolSupportModule
Description:
Implements custom and redirect response headers. Implements the trace and Options
HTTP verbs. Implements the supports which allow or turn off keep-alive support via
configuration.
Configuration
sections:
system.webServer/httpProtocol
https://docs.microsoft.com/en-us/iis/get-started/introduction-to-iis/iis-modules-overview
Page 12 of 23

Module
Name:
UriCacheModule
Dependencies: None.
Potential issues
when removing
this module
TRACE or OPTIONS requests return a "405 Method not allowed" error message.
Module
Name:
HttpRedirectionModule
Description: Implements redirect functionality.
Configuration
sections:
system.webServer/httpRedirect
Dependencies: None.
Potential issues
when removing
this module
Potential security issue if resources were protected by redirection. When the Redirection
module is removed, the content becomes accessible again.
Module
Name:
ServerSideIncludeModule
Description:
Implements server side includes. This module is mapped as a handler, only executing for
requests ending in .stm, .shtm and .shtml.
Configuration
sections:
system.webServer/serverSideInclude
Dependencies: None.
Potential issues
when removing
this module
The static file module handles.stm, .shtm and .shtml files. If this module has a mimeMap
for these extensions the files become served as text. Note, however, that this is not the
default.
Module
Name:
StaticFileModule
Description:
Sends out static files with the file extension .html, .jpg, as well as many others. The
staticContent/mimeMap configuration collection determines the list of file extensions.
Configuration
sections:
system.webServer/staticContent
Dependencies: None.
https://docs.microsoft.com/en-us/iis/get-started/introduction-to-iis/iis-modules-overview
Page 13 of 23

Module
Name:
UriCacheModule
Potential issues
when removing
this module
Static files no longer become served. Requests for files return a 404 Not Found error
indicating that no handler was matched.
Module
Name:
AnonymousAuthenticationModule
Description:
Implements anonymous authentication. This module generates the HttpUser object if a
URL is configured to allow anonymous authentication.
Configuration
sections:
system.webServer/security/authentication/anonymousAuthentication
Dependencies: None.
Potential issues
when removing
this module
At least one authentication module must be configured. The IIS server core checks after
the authentication phase if the HttpUser object is populated. The HttpUser object is an IIS
data structure. A 401.2 error generates if there is no authentication populating the HttpUser
object.
Module
Name:
CertificateMappingAuthenticationModule
Description:
Maps SSL client certificates to an Active Directory account (Active Directory Certificate
Mapping).
Configuration
sections:
system.webServer/security/authentication/clientCertificateMappingAuthentication
Dependencies:
SSL must be configured for this module to work. The IIS machine must also be a member
of an Active Directory domain.
Potential issues
when removing
this module
Requests are normally allowed if Active Directory Certificate Mapping is used to protect a
directory; in this case, the module is removed.
Module
Name:
BasicAuthenticationModule
Description: implements HTTP Basic authentication described in RFC 2617.
Configuration
sections:
system.webServer/security/authentication/basicAuthentication
Dependencies: None.
https://docs.microsoft.com/en-us/iis/get-started/introduction-to-iis/iis-modules-overview
Page 14 of 23

Module
Name:
UriCacheModule
Potential issues
when removing
this module
At least one authentication module has must be configured. The IIS server core checks
after the authentication phase if the HttpUser object is populated. The HttpUser object is an
IIS data structure. A 401.2 error generates if there is no authentication populating the
HttpUser object.
Module
Name:
WindowsAuthenticationModule
Description: Implements Windows authentication (NTLM or Negotiate (Kerberos)).
Configuration
sections:
system.webServer/security/authentication/windowsAuthentication
Dependencies: None.
Potential issues
when removing
this module
At least one authentication module must be configured. The IIS server core checks after
the authentication phase if the HttpUser object is populated. The HttpUser object is an IIS
data structure. A 401.2 error is generates if there is no authentication populating the
HttpUser object.
Module
Name:
DigestAuthenticationModule
Description: Implements digest authentication described in RFC 2617.
Configuration
sections:
system.webServer/security/authentication/digestAuthentication
Dependencies: IIS server must be part of an Active Directory domain.
Potential issues
when removing
this module
At least one authentication module must be configured. The IIS server core checks after
the authentication phase if the HttpUser object is populated. The HttpUser object is an IIS
data structure. A 401.2 error is generates if there is no authentication populating the
HttpUser object.
Module
Name:
IISCertificateMappingAuthenticationModule
Description:
Implements IIS certificate mapping. Maps SSL client certificates to a Windows account.
Contrary to Active Directory Certificate mapping, user credentials and mapping rules are
stored within the IIS configuration store
Configuration
sections:
system.webServer/iisClientCertificateMappingAuthentication
https://docs.microsoft.com/en-us/iis/get-started/introduction-to-iis/iis-modules-overview
Page 15 of 23

Module
Name:
UriCacheModule
Dependencies:
SSL with the requirement to receive client certificates has to be configured for this module
to work.
Potential issues
when removing
this module
At least one authentication module must be configured. The IIS server core checks after
the authentication phase if the HttpUser object is populated. The HttpUser object is an IIS
data structure. A 401.2 error generates if there is no authentication populating the HttpUser
object.
Module
Name:
UrlAuthorizationModule
Description: Implements authorization based on configuration rules.
Configuration
sections:
system.webServer/security/authorization
Dependencies: None.
Potential issues
when removing
this module
Authorization rules which protected content are no longer evaluated. Content that was
supposed to be protected might be served.
Module
Name:
IsapiModule
Description: Implements ISAPI Extension functionality.
Configuration
sections:
system.webServer/isapiCgiRestriction
Dependencies: None.
Potential issues
when removing
this module
ISAPI Extensions mapped in the <handlers> section (modules="IsapiModule") or
explicitly called ISAPI Extensions will no longer work.
Module
Name:
IsapiFilterModule
Description: Implements ISAPI filter functionality.
Configuration
sections:
system.webServer/isapiFilters
Dependencies: None.
https://docs.microsoft.com/en-us/iis/get-started/introduction-to-iis/iis-modules-overview
Page 16 of 23

Module
Name:
UriCacheModule
Potential issues
when removing
this module
ISAPI filters often implement functionality applications rely on. Examples are ASP.NET or
SharePoint. ASP.NET for example needs the aspnet_filter.dll to protect sensitive content
and to rewrite URLs. Removing this module prevents IIS from loading ISAPI filters.
Applications might stop working or sensitive content may be exposed.
Module
Name:
IpRestrictionModule
Description: Implements an authorization scheme based on the IPv4 address of the client request.
Configuration
sections:
system.webServer/security/ipSecurity
Dependencies: IPv4 stack must be installed.
Potential issues
when removing
this module
Clients with IP addresses on the ipSecurity list will be allowed.
Module
Name:
RequestFilteringModule
Description:
Implements a powerful set of security rules which reject suspicious request at a very early
stage. This module is the successor to the ISAPI filter UrlScan.DLL that was shipped for
IIS 5.0 and 6.0.
Configuration
sections:
system.webServer/security/requestFiltering
Dependencies: None.
Potential issues
when removing
this module
If this module is removed, the rules specified in the requestFiltering section no longer
apply. Potential security issues may result.
Module
Name:
CustomLoggingModule
Description:
Implements the ILogPlugin interface on top of IIS. ILogPlugin is a previous COM
implementation that allowed customers to extend IIS logging. We do not recommend
extending IIS using this interface. Instead, customers should write a module and subscribe
to the RQ_LOG_REQUEST notification.
Configuration
sections:
system.webServer/httpLogging and
system.applicationhost/sites/site/logFile/customLogPluginClsid
https://docs.microsoft.com/en-us/iis/get-started/introduction-to-iis/iis-modules-overview
Page 17 of 23

Module
Name:
UriCacheModule
Dependencies: None.
Potential issues
when removing
this module
A custom log plug-in will no longer be called. For example, ODBC Logging is
implemented as ILogPlugin.
Module
Name:
CustomErrorModule
Description: Implements custom errors and the IIS detailed error feature.
Configuration
sections:
system.webServer/httpErrors
Dependencies: None.
Potential issues
when removing
this module
IIS returns blank pages with minimal information when errors within the core server occur.
Remote users may see detailed error information coming from server components which
can result in disclosing information.
Module
Name:
HttpLoggingModule
Description: Implements standard IIS logging by telling HTTP.SYS what to log.
Configuration
sections:
system.applicationHost/log and system.webServer/httpLogging
Dependencies: None.
Potential issues
when removing
this module
Standard IIS logging will no longer work.
Module
Name:
FailedRequestsTracingModule
Description:
Implements tracing of failed requests. Define and set rules for failed requests via
configuration.
Configuration
sections:
system.webServer/tracing and system.webServer/httpTracing
Dependencies: None.
https://docs.microsoft.com/en-us/iis/get-started/introduction-to-iis/iis-modules-overview
Page 18 of 23

Module
Name:
UriCacheModule
Potential issues
when removing
this module
Tracing http requests will no longer work.
Module
Name:
RequestMonitorModule
Description:
Implements the IIS Run-time State and Control Interface (RSCA). RSCA allows users to
query for run-time information such as currently executing request, start/stop state of a
web-site, or currently executing application domains.
Configuration
sections:
None.
Dependencies: None.
Potential issues
when removing
this module
Tools will be unable to enumerate currently executing requests.
Module
Name:
CgiModule
Description: Implements CGI on top of IIS.
Configuration
sections:
system.webServer/cgi and system.webServer/isapiCgiRestriction
Dependencies: None.
Potential issues
when removing
this module
CGI programs will stop working.
Module
Name:
TracingModule
Description: Implements ETW tracing.
Configuration
sections:
system.webServer/httpTracing
Dependencies: None.
Potential issues
when removing
ETW tracing will not work if this module is removed.
https://docs.microsoft.com/en-us/iis/get-started/introduction-to-iis/iis-modules-overview
Page 19 of 23

Module
Name:
UriCacheModule
this module
Module
Name:
ConfigurationValidationModule
Description:
Validates that ASP.NET application configuration has been migrated to work in Integrated
mode.
Configuration
sections:
system.webServer/Validation
Dependencies: None.
Potential issues
when removing
this module
Applications that specify legacy ASP.NET configuration for modules and handlers will not
generate migration errors; a new application that has not been migrated will function
incorrectly.
Managed Modules:
Module Name: OutputCache
Description: Implements the ASP.NET Output Caching feature.
Configuration
sections:
system.web/caching/outputCache
Dependencies: ManagedEngine module has to be installed.
Potential issues
when removing
this module
ASP.NET will be unable to output cache responses to pages configured to be output
cached.
Module Name: Session
Description: See ASP.NET 2.0 documentation for details
Configuration
sections:
system.web/sessionState
Dependencies: ManagedEngine module must be installed
Potential issues
when removing
this module
Managed session state is not available.
Module Name: WindowsAuthentication
https://docs.microsoft.com/en-us/iis/get-started/introduction-to-iis/iis-modules-overview
Page 20 of 23

Module Name: OutputCache
Description: See ASP.NET 2.0 documentation for details.
Configuration
sections:
system.web/authentication
Dependencies: ManagedEngine module has to be installed
Potential issues
when removing
this module
WindowsAuthentication.OnAuthenticate event will not be raised, which may prevent
some custom ASP.NET authentication code from running. Also, the authenticated user
will not be replaced with the UNC user when on UNC share (legacy ASP.NET
behavior). This module does not affect NTLM/Kerberos authentication for ASP.NET
applications in Integrated mode, and is not required outside of the
WindowsAuthentication.OnAuthenticate event and the legacy UNC behavior.
Module Name: FormsAuthentication
Description: See ASP.NET 2.0 documentation for details.
Configuration
sections:
system.web/authentication
Dependencies: ManagedEngine module has to be installed
Potential issues
when removing
this module
ASP.NET forms-based authentication feature will not be available, resulting in clients
with forms authentication tickets not being able to access protected resources.
Module Name: DefaultAuthentication
Description: See ASP.NET 2.0 documentation for details.
Configuration
sections:
system.web/authentication
Dependencies: ManagedEngine module has to be installed
Potential issues
when removing
this module
Some ASP.NET features may not work for anonymous requests if ASP.NET
authentication mode is Forms. Also, DefaultAuthentication.OnAuthenticate event will
not be raised.
Module Name: RoleManager
Description: See ASP.NET 2.0 documentation for details.
Configuration
sections:
None.
https://docs.microsoft.com/en-us/iis/get-started/introduction-to-iis/iis-modules-overview
Page 21 of 23

Module Name: OutputCache
Dependencies: ManagedEngine module must be installed.
Potential issues
when removing
this module
Role Manager functionality not available.
Module Name: UrlAuthorization
Description:
See ASP.NET 2.0 documentation for details. The native UrlAuthorization module
implements URL authorization functionality in native code. This provides a scalable and
fast native alternative for the managed URL authorization module.
Configuration
sections:
system.web/authorization.
Dependencies: ManagedEngine module must be installed.
Potential issues
when removing
this module
ASP.NET authorization rules will be ignored, possibly resulting in information
disclosure and other security compromises.
Module Name: AnonymousIdentification
Description: See ASP.NET 2.0 documentation for details.
Configuration
sections:
Dependencies: ManagedEngine module has to be installed.
Potential issues
when removing
this module
The anonymous identification feature used by the ASP.NET Profile will not work.
Module Name: Profile
Description: See ASP.NET 2.0 documentation for details.
Configuration
sections:
Dependencies: ManagedEngine module must be installed.
Potential issues
when removing
this module
The ASP.NET Profile feature will not work.
https://docs.microsoft.com/en-us/iis/get-started/introduction-to-iis/iis-modules-overview
Page 22 of 23

Module Name: OutputCache
Module Name: UrlMappingsModule
Description: See ASP.NET 2.0 documentation for details.
Configuration
sections:
Dependencies: ManagedEngine module must be installed.
Potential issues
when removing
this module
The ASP.NET URL mappings will not work.
Source: https://docs.microsoft.com/en-us/iis/get-started/introduction-to-iis/iis-modules-overview
https://docs.microsoft.com/en-us/iis/get-started/introduction-to-iis/iis-modules-overview
Page 23 of 23