IIS (Internet Information Services) · Getting Started

IIS Architecture

Understanding the parts of IIS explains behaviour like app pool recycling, 503 errors and why one site can crash without affecting another.

Beginner 5 min Lesson 4 of 33Covers IIS 10 on Windows Server 2019/2022/2025 and Windows 10/11.
Before you start:IIS Manager
0/33 in IIS
On this page · 5 min · Beginner

In simple words#

HTTP.sys is the security gate, WAS is the HR department that hires and replaces workers, application pools are separate teams, and w3wp.exe workers are the employees who actually serve customers.

HTTP.sys
Kernel driver that receives requests and queues them.
WAS
Windows Process Activation Service — starts and recycles worker processes.
Modules
Plug-ins in the pipeline: authentication, compression, logging…

Learning objectives#

  • Describe HTTP.sys, WAS and W3SVC
  • Explain application pools and worker processes
  • Understand the integrated pipeline and modules
  • Relate architecture to common errors

Explanation#

HTTP.sys is a kernel-mode driver that listens on ports, matches bindings and queues requests per application pool. It can return errors (like 503) even when no worker is running.

W3SVC (World Wide Web Publishing Service) configures HTTP.sys; WAS starts, monitors and recycles worker processes (w3wp.exe).

Each application pool has its own worker process(es), so a crash in one pool does not affect others.

Requests flow through modules in the integrated pipeline (authentication, authorization, static file, compression, logging). The ASP.NET Core Module is one such module.

Code example: See worker processes and their pools#

PowerShellSee worker processes and their pools Illustrative
# Which worker processes are running, for which app pool?
& "$env:windir\System32\inetsrv\appcmd.exe" list wp


# Same with PowerShell
Get-CimInstance Win32_Process -Filter "Name='w3wp.exe'" |
  Select-Object ProcessId, @{n='AppPool';e={ ($_.CommandLine -split '-ap "')[1].Split('"')[0] }}


# HTTP.sys URL reservations and request queues
netsh http show servicestate view=requestq | Select-String "Request queue name|URL"
Expected output
WP "6148" (applicationPool:ShopPool)
WP "7312" (applicationPool:ApiPool)

ProcessId AppPool
--------- -------
     6148 ShopPool
     7312 ApiPool

This example is illustrative. Copy or download it and run it in your own environment; the expected output is shown above.

Step-by-step explanation#

  1. appcmd list wp shows each running worker process and its pool.
  2. The PowerShell query reads the pool name from w3wp’s command line.
  3. netsh shows the request queues HTTP.sys keeps per pool.
  4. Two pools → two independent processes.

Real-world use case#

When the API pool crashes repeatedly, the shop site in its own pool keeps working — and the team uses these commands to find the failing process.

Common mistakes#

Putting every site in DefaultAppPool

One bad app can take down all of them. Isolate apps in separate pools.

Restarting IIS (iisreset) for every problem

It stops all sites. Recycle only the affected app pool.

Best practices#

  • One pool per app
  • Recycle a pool instead of iisreset
  • Understand that HTTP.sys answers 503 when a pool is stopped
  • Monitor w3wp memory and CPU per pool

Remember this#

HTTP.sys receives, WAS manages workers, w3wp.exe runs the app.

App pool = isolation boundary.

Recycle the pool, avoid iisreset.

Practice exercise#

Your task: Recycle only the app pool named ApiPool.

Show solution
PowerShell Illustrative
Restart-WebAppPool -Name ApiPool
# or
& "$env:windir\System32\inetsrv\appcmd.exe" recycle apppool /apppool.name:ApiPool

Mini quiz#

IIS Architecture quizMultiple choice Question 1 of 1

Which component starts and recycles w3wp.exe processes?

Score so far: 0/0

Want more? Practise all IIS MCQs · IIS interview questions

My notes#

Saved in this browser.

Progress is saved in this browser. Sign in to sync.