The Web Management Service will fail to start with a "Code 5" error in the console and an "Access Denied" event in the Windows security logs if you have the Block untrusted fonts policy enabled. This is a known issue that has been fixed as of build 1903.
Here's the Microsoft Tech Community post from a Microsoft support escalation engineer ...
If you only have one IP address, you need to set all sites that are using HTTPS to require Server Name Identification so that IIS knows what cert to use for clients connecting to which site. Either each site needs to use SNI, or you must use different ports, or different IP addresses.
By default most webservers assume that if you're coming to them with HTTPS,...
According to my own experience:
First you should have a FTP Site Installed on your IIS.
Then you create a user (your ftp user) in Local User Manager.
Next you create a virtual directory as a subdirectory under your FTP Site pointing to the directory you want it to be the root directory for your FTP User. The virtual directory should have the same name as ...
Sure. When that's the URL, the extension being blocked is simply .. You have to explicitly allow . or it will be blocked. I blogged about it a decade ago, https://docs.microsoft.com/en-us/archive/blogs/lexli/iis-7-dot-tricks-part-ii
somehow the server has to know whether the presented ticket from the client is valid.
In the Microsoft Active Directory implementation of Kerberos, the privileges and roles (group memberships) are stored in a part of the Kerberos token called the Privileged Attribute Certificate (PAC). When a token is presented to another system or process, ...
So apparently IIS cannot handle the permessage-deflate extension for the Sec-WebSocket-Extensions header. The solution is to clear the header as that is the only extension used by FoundryVTT:
<set name="HTTP_SEC_WEBSOCKET_EXTENSIONS" value="" />
Do not forget to add ...
Throwing this out there if it helps someone.
I manually deleted the certificate from MMC -> Certificates -> Personal -> Certificates, and then added the certificate manually in IIS through the Complete Certificate Request, but here's the deviation - I added it to Personal instead of "Web Hosting".
DNS Records to have a TTL - a Time To Live in seconds. So on the machine(s) where you get the old IP address, the record is in some kind of cache. Just to spice things up, there might also be a cache on an intermediate server that is configured between your host and the root DNS provider for your domain.
On windows, simply call ipconfig /flushdns, on other ...
The following HTTP errors can't be customized: 400, 403.9, 411, 414, 500, 500.11, 500.14, 500.15, 501, 503, and 505.
I have a bad feeling some of these technologies are being deprecated without mention. I was looking at IISNode as we have some apps that run on IIS, and it seemed like a good idea, but installing has been rough. URL Rewrite is needed for it, which led me here.
Searching Microsoft's site is getting tough, from the main link they didn't have IIS 10 and URL ...
Thanks to @LexLi for pointing me to Setting up IIS reverse proxy to preserve host headers. If I set system.webServer/proxy.preserveHostHeader=True then the requested host is logged in both the ARR server and in the other IIS servers.
I still think it's odd that the rewritten hostname is logged on the server with ARR if I don't have that setting to True, but ...
While I have no idea what the initial cause was..
One of these two things 'fixed' it. Unfortunately, the specific change was change was not identified.
Copied inetsvr's applicationHost.config from another machine.
While this might have affected various globalModules, etc, the same
AppPool and Site definitions were used as they are installed through
Even with IIS setup on a shared config with all the nodes, each node's Operating system is able to set SSL binds outside of IIS, which wouldnt be shared between the nodes. So what I believe the issue is an SSL binding on the OS side (not IIS) on the one node and thereby not allowing the match that IIS was asking it to do. To fix that look at the OS SSL ...
The solution is to increase the FastCGI activity timeout.
Use appcmd, the IIS command line tool, to modify the IIS configuration XML file.
Run cmd in an administrator mode.
To check the current settings use:
The second PC needs to know that my.site.com can found on the first PC; you can achieve this either using DNS or by editing the hosts file on the second PC.
Without this, the second PC has no way of knowing where to look for my.site.com.