| name | windows-iis |
| description | Use when inventorying or diagnosing IIS sites, application pools, bindings, certificates, HTTP.sys, logs, configuration, deployment, or rollback; use windows-network-admin for path failures. |
| metadata | {"portable":true,"compatible_with":["claude-code","codex"]} |
Windows IIS
Use when
- Diagnose HTTP status, app-pool, binding, certificate, config, or log issues.
- Capture IIS state before deployment or certificate rotation.
- Plan a staged IIS change with workload verification.
Do not use when
- Application code, database, DNS, or CA is the proven owner.
- IIS is absent or unsupported on the target.
Inputs
Target, site/app pool, URL/host/port/protocol, expected status/content, config
scope, certificate identifier without private key, deployment owner, and rollback.
Platform and privilege boundary
Discovery is R0. Bindings, pools, configuration, certificates, URL ACLs, and
deployment are R2/R3. Mutations are NOT_ASSESSED in 0.1.
Workflow
- Confirm IIS role and target fingerprint.
- Capture sites, pools, bindings, config hierarchy, certificates, HTTP.sys,
listeners, logs, events, and dependency state.
- Reproduce with exact URL and record status, headers, timing, and correlation.
- Attribute failure to network, TLS, HTTP.sys, IIS, app pool, application, or dependency.
- For authorised change, validate config, stage, probe, observe, and roll back.
Mutation, verification, and recovery
Verification uses the external URL and critical journey plus pool/service/events.
Recovery restores exact configuration and binding/certificate reference, then
repeats the external probe.
Stop conditions
Stop on private-key export request, unowned DNS/certificate, shared binding
collision, unknown application dependency, invalid config backup, or no health probe.
Capability contract and degraded mode
Read IIS/provider and network evidence where modules exist. Without IIS lab,
return a diagnostic/change plan and NOT_ASSESSED execution.
Outputs
IIS topology, layered diagnosis, certificate expiry/reference, configuration
diff, deployment/rollback plan, probe results, and residual risk.
Decision rules
| Evidence | Owner |
|---|
| No listener/binding | IIS/HTTP.sys |
| TLS name/chain/expiry failure | certificate owner |
| 503 with stopped/rapid-fail pool | pool/application branch |
| HTTP healthy but business action fails | application/database owner |
Quality standards
Configuration validity and external outcome are separate gates. Never store
private keys, connection strings, or authentication tokens in evidence.
Anti-patterns
- Recycling pool first. Fix: capture failure evidence.
- Replacing cert by friendly name. Fix: use validated thumbprint/chain/name.
- Testing localhost only. Fix: use client path.
- Editing applicationHost.config live without backup. Fix: staged owner-aware change.
- Blaming IIS for app errors. Fix: separate layers.
References
