IIS setting for SharePoint 2013

Some checks and reminders for IIS - This is a work in progress!

1.> Change the IIS log location for existing websites, this needs to be done on each WFE in your farm, providing you want to change them. 
PS Script to Change the IIS log directory for existing web sites.
2.> Disable IIS recycling
3.> Ensure app pool accounts have low levels of network permissions.
4.> Certificates used by IIS, when do they expire.
5.> Application Initialisation for IIS8 or warm-up scripts to stop the long delays after and IISREST/app pool recycle.

   **************
CPU over utilisation

   ********************

Verify when certificates are going to expire:

import-module webadministration

$DaysToExpiration = 365
#change this once it's working
$expirationDate = (Get-Date).AddDays($DaysToExpiration)
$expirationDate5yrs = (Get-Date).AddDays(1020)

$certs = Get-ChildItem IIS:SSLBindings

foreach($cert in $certs)
{
 $store = $cert.Store.ToString()
 Write-Host " Cert Store:" $cert.Store.ToString()
 Write-Host " Cert Port:" $cert.Port.ToString()
 Write-Host " Cert Thumbprint:" $cert.Thumbprint
  $body = Get-ChildItem CERT:LocalMachine/$store
  foreach ($me in $body) {

   if ($expirationDate -gt $me.NotAfter) {
    Write-Host " Expiring soon" -BackgroundColor red
   }
   elseif ($expirationDate5yrs -gt $me.NotAfter) {
    Write-Host " Expiring in 5 years" -BackgroundColor Yellow
   }
   elseif ($expirationDate -le $me.NotAfter) {
    Write-Host " Expiring more than a year away" -BackgroundColor green
   }
   Write-Host " - Body subject: " $me.Subject
   Write-Host " - Body thumbprint: " $me.Thumbprint
   Write-Host " - Body fiendly name: "$me.FriendlyName
   Write-Host " - Body Expiry: "$me.NotAfter
  }
     Write-Host ""
}

 *********************

 Check the service account do not have too many permissions:

Script below retrieves pswd to show client potential issue



Import-Module WebAdministration

$webapps = Get-WebApplication

foreach ($webapp in get-childitem IIS:\AppPools\)

{

$iispath = "IIS:\AppPools\" + $webapp.name

$pswd = $webapp.processModel.password

$state = (Get-WebAppPoolState -Name $webapp.name).Value

$color = "White"

$forecolor = "Black"

if ($pswd.Length -gt 0)  {$color = "red"} # verify the domain accounts don't have excessive priviges

if ($state -eq "Stopped")  {$forecolor = "blue"} #Why are there stopped IIS websites

Write-Host "Name:" $webapp.name " | Version:" (Get-ItemProperty $iispath managedRuntimeVersion).Value `

" | Username:" $webapp.processModel.userName " | Pswd:" $pswd `

" | State:" $state -BackgroundColor $color -ForegroundColor $forecolor

}

 Tip: Advise client to change Windows service account used to run the SP timer job.  Check ramifications.


**********************************

Changing service account passwords - The Service is unavailable

Problem: Browsers return the following error "Service Unavailable  Http Error 503.  The Service is unavailable." on all SharePoint websites including central admin.

Initial Hypothesis: I changed my password yesterday causing the app polls to fail when logging in.  The domain account used on my development machine required a password change.  Starting the machine causes all the IIS web sites to display the error message "Service Unavailable".  I run various services and application polls using my domain account.  The services can no longer log on.  Application pool cannot be started after the reboot/iisreset.

Resolution:  Change the log on details for the application pools used by IIS that run using the domain account that's password was reset.  Also start the Windows services that run using the windows domain account.

Ensure the SharePoint services running