IIS Architecture
Understanding the parts of IIS explains behaviour like app pool recycling, 503 errors and why one site can crash without affecting another.
On this page · 5 min · Beginner
On this page
- In simple words
- Learning objectives
- Explanation
- Code example
- Step by step
- Real-world use
- Common mistakes
- Best practices
- Remember this
- Practice exercise
- Mini quiz
- Related topics
- My notes
- Reading time
- 5 min
- Difficulty
- Beginner
- Updated
- Oct 30, 2026
Related tutorials
Interview questions
In simple words#
HTTP.sys is the security gate, WAS is the HR department that hires and replaces workers, application pools are separate teams, and w3wp.exe workers are the employees who actually serve customers.
- HTTP.sys
- Kernel driver that receives requests and queues them.
- WAS
- Windows Process Activation Service — starts and recycles worker processes.
- Modules
- Plug-ins in the pipeline: authentication, compression, logging…
Learning objectives#
- Describe HTTP.sys, WAS and W3SVC
- Explain application pools and worker processes
- Understand the integrated pipeline and modules
- Relate architecture to common errors
Explanation#
HTTP.sys is a kernel-mode driver that listens on ports, matches bindings and queues requests per application pool. It can return errors (like 503) even when no worker is running.
W3SVC (World Wide Web Publishing Service) configures HTTP.sys; WAS starts, monitors and recycles worker processes (w3wp.exe).
Each application pool has its own worker process(es), so a crash in one pool does not affect others.
Requests flow through modules in the integrated pipeline (authentication, authorization, static file, compression, logging). The ASP.NET Core Module is one such module.
Code example: See worker processes and their pools#
# Which worker processes are running, for which app pool?
& "$env:windir\System32\inetsrv\appcmd.exe" list wp
# Same with PowerShell
Get-CimInstance Win32_Process -Filter "Name='w3wp.exe'" |
Select-Object ProcessId, @{n='AppPool';e={ ($_.CommandLine -split '-ap "')[1].Split('"')[0] }}
# HTTP.sys URL reservations and request queues
netsh http show servicestate view=requestq | Select-String "Request queue name|URL"
WP "6148" (applicationPool:ShopPool)
WP "7312" (applicationPool:ApiPool)
ProcessId AppPool
--------- -------
6148 ShopPool
7312 ApiPoolThis example is illustrative. Copy or download it and run it in your own environment; the expected output is shown above.
Step-by-step explanation#
- appcmd list wp shows each running worker process and its pool.
- The PowerShell query reads the pool name from w3wp’s command line.
- netsh shows the request queues HTTP.sys keeps per pool.
- Two pools → two independent processes.
Real-world use case#
When the API pool crashes repeatedly, the shop site in its own pool keeps working — and the team uses these commands to find the failing process.
Common mistakes#
One bad app can take down all of them. Isolate apps in separate pools.
It stops all sites. Recycle only the affected app pool.
Best practices#
- One pool per app
- Recycle a pool instead of iisreset
- Understand that HTTP.sys answers 503 when a pool is stopped
- Monitor w3wp memory and CPU per pool
Remember this#
HTTP.sys receives, WAS manages workers, w3wp.exe runs the app.
App pool = isolation boundary.
Recycle the pool, avoid iisreset.
Practice exercise#
Your task: Recycle only the app pool named ApiPool.
Show solution
Restart-WebAppPool -Name ApiPool
# or
& "$env:windir\System32\inetsrv\appcmd.exe" recycle apppool /apppool.name:ApiPool
Mini quiz#
Which component starts and recycles w3wp.exe processes?
Want more? Practise all IIS MCQs · IIS interview questions
My notes#
Saved in this browser.