I have a bare server that will be hosting 1 or 2 domains. What things can I configure on the server (IIS etc.) to optimize for performance? (non-application tweaks).

I am new to adminstration and would like to get up to speed on things.

  • The answer to this question depends heavily on exactly how the server will be used, and how the applications running on it will behave. There aren't a lot of general "always do x optimization on a new server". – phoebus Dec 6 '09 at 22:34

If it were me I'd start looking at security rather than prematurely optimizing for performance, here's a question about hardening Windows 2003 and IIS6 and here's a community wiki about generally securing Windows web servers.

  • my server has a firewall, so only port 80 and ssl port are open. – user2659 Dec 6 '09 at 22:30
  • Setting up a firewall is only part of the hardening process. – rodjek Dec 6 '09 at 22:32
  • Today exploiting a server is typically done by finding a flaw in a public facing application or service - no firewall or port block will prevent that as port 80 is likely used. General server (and of course application) hardening however will help a lot in preventing evil ^^ – Oskar Duveborn Dec 7 '09 at 9:49
  • Windows alreadys has a firewall built in. NIDS and/or HIDS is a requirement for any public facing website these days regardless of the underlying OS. Oskar is right in that most of the successful penetrations are done by exploiting application flaws. – Jim B Dec 7 '09 at 14:52

Take a look at the Windows Server 2003 Performance Tuning Guide which lists guidelines for optimizing the OS for the following workloads:

  • Performance Tuning for Networking
  • Performance Tuning for Storage
  • Performance Tuning for IIS 6.0
  • Performance Tuning for File Servers
  • Performance Tuning for Active Directory
  • Benchmarking Web Workloads (WebBench)
  • Benchmarking File Server Workload (NetBench)
  • Benchmarking Active Directory Workload (DirectoryMark)
  • Benchmarking Networking Workloads (Ttcp, Chariot)

It really depends on what the applications will be doing before you can even think about tuning and hardening (which is often an inclusive process) for example, it would improve performance and help secure the system if asp were removed if you were only serving html pages. The same goes if it were a .net application. Before even thinking about performance tuning, you need to establish a baseline. The PAL tool can help with that. Once you have that you can look at the IIS6 performance tuning operations guide. While there you should also take a look at the security guide. However the simplest and arguably the best performance boost and security boost is to upgrade to server 2008 R2. If the server is brand new and you have the time I'd download benchmark the sites under 2003 and then rebuild with an eval copy of 2008r2, and rebenchmark. Then you can see if the upgrade will be worth the cost.


Quick tip: Change the pagefile minimum and maximum numbers to be identical. Do not allow the system to automatically resize the pagefile.


Do nothing. Windows Server 2003 is incredibly light on modern hardware (it is a 6 year old OS, after all), so my belief is that you shouldn't touch it.

OK, that's a bit over-general, so to elaborate a little: there is really no point in optimizing if you don't need to, and you're at a stage where you don't yet know if you need to. The trick is to get the basic stuff done (server built, apps installed, stuff configured) and then start letting real-life users at it for a month or so. You can look at performance counters during that time, but you can also listen to your users giving feedback on it. Only then will you know if there is any payback in optimizing anything.

Having said that, you might need the /3GB switch in the boot.ini, but only if you have a 32-bit OS and only if you have apps running on it that recommend using it.

Bottom line with a server however is that reliability is always more important than performance, and every optimization is nearly always a tradeoff.


Is there anything wrong with the server? Do you have any bottlenecks?

Especially if this server is in production, then i would not go changing setting willy-nilly in order to get some extra 'performance'.

"Pre-mature optimization is the root of all evil"

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.