Setting up a website on IIS is very easy to do. However, it can get very tedious when we have to migrate multiple IIS websites to a new server. For a really brand new server, the easiest to migrate all those settings of course is to clone the server and then we can reconfigure the IP addresses for each web instance from IIS on the new server. But what if that option is not possible?

In this post, we’ll discuss two ways to migrate multiple IIS websites from one server to another. Ideally, this is done to an imaged server that does not have any websites set up yet. Otherwise, more tweaking is needed so we do not override the already existing sites on the new server.

Method 1: Using Shared Configuration in IIS

This method is the simplest to implement, but only use this if you have a brand new server. DO NOT use this method when migrating websites in addition to an already existing website (or websites) on the destination server.

Please be aware though if you migrate websites from one version of IIS to a newer one, the process can be messy but doable as long as you’re aware of all the gotchas.

1. Launch IIS Manager and click on the main server node and click on Shared Configuration.

   

2. In Shared Configuration screen, click the Export Configuration link.

   

3. In the Export Configuration window, enter a Physical Path where you want the configuration files stored. Make sure whichever path you use, it’s an existing folder. Otherwise, you will get an error message that the path does not exist.

   Enter a strong Encryption keys password then click OK.

   

4. Check your export configuration folder, there should be three files created for you:

   1. administration.config
   2. applicationHost.config
   3. configEncKey.key

   

5. Copy all three files to the new server.

6. Launch IIS Manager on the new server and click on Share Configuration.

   

7. This time, check on the Enable shared configuration option and type in all required information to import the configuration from the first server. Click on Apply after you’re done.

   

8. Optional: Typically you don’t need to user User name and Password, unless if you need your credential to access the Physical path where you store the export files. In this case, you can type in your user name (NTID or a service account) and password.

   

9. After clicking Apply link from either step 7 or step 8 (not both), you will be asked to enter your Encryption Keys Password you entered from step 3.

10. If you entered the correct Encryption Keys Password, you’ll see a notice such as this:

    

    Your existing IIS encryption keys will be backed up in the current configuration directory on your local computer. To restore these keys at a later time, turn off shared configuration.
    

    Just click the OK button.

11. Finally, you’ll see a succesful message below:

    

    The changes have been successfully saved.
    
    You must close and reopen IIS Manager for it to recognize the configuration changes that you have made.
    

    Just click OK button again.

12. Close and reopen IIS Manager to see the changes take effect.

That’s it.

Method 2: Using AppCmd.exe

From the Microsoft’s own documentation:

AppCmd.exe is the single command line tool for managing IIS 7 and above. It exposes all key server management functionality through a set of intuitive management objects that can be manipulated from the command line or from scripts.

One of the things you can do with AppCmd is to search, manipulate, export, and import IIS and ASP.NET configuration and configure application pools. So with that, what are the steps to migrate websites to a different server?

1. From the server where you want to export all the websites, launch Command Prompt and type the following:

           C:\> %windir%\System32\inetsrv\appcmd list apppool /config /xml > C:\Temp\AppPools.xml
           

2. This command exports all Application Pools in the server, so if you never delete the default ones, you might run into an issue when importing them to the new server. It’s harmless but at some point, you will need to delete them before you can successfully import it.

3. Once we completed exporting the Application Pools, we still need to export the website settings separately.

   Back in Command Prompt, type in the following:

           C:\> %windir%\System32\inetsrv\appcmd list site /config /xml > C:\Temp\Websites.xml
           

4. Copy the two XML files to the new server. As an example here, the assumption here is the files are copied to the same folder on the new server (C:\Temp).

5. On the new server, launch Command Prompt and type the following:

           C:\> %windir%\System32\inetsrv\appcmd add apppool /in < C:\Temp\AppPools.xml
           

6. If successful, you can right away import the websites by typing the following still in the Command Prompt:

           C:\> %windir%\System32\inetsrv\appcmd add site /in < C:\Temp\Websites.xml
           

That’s all there is to it. You might still need to do some adjustments in terms of changing the IP addresses etc. But at least the bulk majority of the settings are already transferred and doing it this way will save you a lot of time instead of doing it one by one.

Further Reading

How do you migrate an IIS 7 site to another server?
Exporting & Importing App Pools and Websites configuration between multiple IIS instances
Getting Started with AppCmd.exe
How to Get Application Pool Identity Password With AppCmd

Continuing from the last post on customizing 401 error page on IIS, there’s a different way to do so by using 302 Redirection.

Using this method is actually a bit more simple to do, it’s just that you have to create a second website with a landing page to serve as your error page. Not everyone has this privilege to just have a second instance created in production environment, so it’s always good to have more options.

When you need to restrict access to your web application on IIS, any unauthorized users will see the standard 401 Error Page from IIS:

401 – Unauthorized: Access is denied due to invalid credentials. You do not have permision to view this directory or page using the credentials that you supplied.

Instead of serving a default 401 Error Page, it’s always good to show a customized 401 page that is more user-friendly. Here’s a one way to do it by using a page redirect.

Steps to Use Custom 401 Error Page using 302 Redirect in IIS

1. Create an HTML page as our custom 401 page. In this example, it will be called ITNOTA-Custom-401.htm.

   

2. Create an instance in IIS just for this file and set this file as the main landing page (or use it as your index.htm). For this example, we’ll set this up as fwd.itnota.com with a file name of ITNota-Custom-401.htm.

3. Next, launch Internet Information Services (IIS) Manager and click on your site on the left pane.

4. Click on Error Pages.

   

5. On the next screen, you will see a list of default error pages according to its Status Code. In this example, we want to select 401.

   

6. On the Edit Custom Error Page window, click on the Respond with a 302 redirect radio button and type in the URL of the second website where your custom 401 page resides, including the file name, then click OK.

   

That’s all there is to it.

As a test, we can try to load the page and this is also where using 302 redirect is different than using a static page within the same instance. If using Windows Authentication, you will not see the Windows Security screen to enter your NTID and password. It does the authentication in the background and if you’re not authorized, you will right away be redirected to the second web page that hosts the 401 custom page.

Yes, it’s almost like an anti-climax to see a plain custom 401 error page being displayed. I hope you can come up with a much better design than my example to make all the effort worthwhile.

This setting for a custom 401 using 302 redirect works for both ASP.NET and Classic ASP.

Further Reading

How to Use Custom 401 Error Page on IIS
How to Fix Access Denied (401) Error in Microsoft IIS

When you need to restrict access to your web application on IIS, any unauthorized users will see the standard 401 Error Page from IIS:

401 – Unauthorized: Access is denied due to invalid credentials. You do not have permision to view this directory or page using the credentials that you supplied.

Often times, though, you want to show your end users a custom error page with specific instructions on what to do. That is certainly a more graceful way of handling the error than just showing the standard windows 401 error page.

If you have the flexibility to setup your own web instances, you might want to try using 302 Redirect instead as it’s much simpler to setup. Otherwise, this is also a viable option, although a bit long.

Steps to Use Custom 401 Error Page in IIS

1. Create an HTML page as our custom 401 page. In this example, it will be called ITNOTA-Custom-401.htm.

   

   For simplicity, we’ll save the file in C:\Temp folder.

2. Next, launch Internet Information Services (IIS) Manager and click on your site on the left pane.

3. Click on Error Pages.

   

4. On the next screen, you will see a list of default error pages according to its Status Code. In this example, we want to select 401.

   

5. On the Edit Custom Error Page window, click on the Set… button.

   

6. Under Set Localized Custom Error Path window, type in the location where the custom 401 HTML page resides in the Directory path box. Only type in the path/folder. The file name itself should be in the Relative file path textbox, then click OK.

   

7. You should see something similar to this. Click OK again.

   

8. At this point, we’re done setting up the custom 401 error page. However, unless if you still use the default for other settings, you may run into this error:

           HTTP Error 500.19 – Internal Server Error
           Absolute physical path "c:\temp" is not allowed in system.webServer/httpErrors section in web.config file. Use relative path instead.
           

   

   If you read the error message, it points exactly at the problem in the configuration, that is in the system.webServer/httpErrors section.

9. In IIS Manager, click on the server on the left navigation pane and click on Configuration Editor

   

10. In the Configuration Editor, under Section:, click on the drop-down and select system.webServer, then httpErrors.

    

11. Click on allowAbsolutePathsWhenDelegated, then click on the Unlock Attribute if it’s locked. If it’s already unlocked (no padlock sign), then you’re good. Then click Apply under Actions.

    

12. Now, click on your site on the left pane of navigation, and also click on Configuration Editor.

    

13. Repeat the step to get to the system.webServer/httpErrors and set allowAbsolutePathsWhenDelegated to True. Then, click Apply.

    

14. At this point, depending on your Authentication setting, you should be able to see the custom 401 error page in your browser (if you failed to authenticate). However, if you use Windows Authentication, you might see a 401.2 error page.

            HTTP Error 401.2 - UnauthorizedYou are not authorized to view this page due to invalid authentication headers.
            

    

    Rest easy, we just need to redirect this 401.2 error to our custom 401 error page.

15. Go back to Internet Information Services (IIS) Manager and click on your site on the left
    and Error Pages on the right.

    

16. This time, we create an additional entry for 401.2 error by clicking on the Add… link under Actions on the right pane. You can duplicate the entry for 401 setup, except this time the Status code should have a value of 401.2. Click OK.

    

17. Now you should see the list in your Error Pages windows similar to this.

    

That’s all there is to it.

As a test, we can try to load the page and when prompted to type in the a credential, you can leave it blank and click the Cancel button.

If you purposely fail the authentication to access your test website, you should see your custom 401 error page is displayed in your browser now.

Yes, it’s almost like an anti-climax to see a plain custom 401 error page being displayed. I hope you can come up with a much better design than my example to make all the effort worthwhile.

If you go to your web folder, you will see a web.config file, and your configuration is saved there:

  <httpErrors allowAbsolutePathsWhenDelegated="true">
    <remove statusCode="401" subStatusCode="-1" />
    <error statusCode="401" prefixLanguageFilePath="c:\temp" path="ITNOTA-Custom-401.htm" responseMode="File" />
    <error statusCode="401" subStatusCode="2" prefixLanguageFilePath="c:\temp" path="ITNOTA-Custom-401.htm" responseMode="File" />
  </httpErrors>
</system.webServer>

This setting for a custom 401 works for both ASP.NET and Classic ASP.

Further Reading

How to Customize 401 Error Page with 302 Redirect on IIS
How to Fix Access Denied (401) Error in Microsoft IIS
Custom 401 page in IIS with ASP.NET
Error: Vault Pre-check fails on TestASPNet.aspx – IIS shows absolute physical path is not allowed
500.19 error in IIS7 when an error occurs