Timeless Question about Installing IIS on a Non-System partition

A question was asked — Why does Microsoft still force customers to install as the webroot to the system partition (i.e. C:\inetpub) when all security-related documentation advises to not do this?

I casually grinned, then openly smiled and said…”just because.  Kidding!”  It is a very legitimate question and my response was fairly lengthy but went something like this…

Starting with Windows 2000, IIS was installed using Windows installation technology (SysOcMgr).  The technical reason we don’t allow this is based on the fact that there is no means of doing a “custom action” in SysOcMgr.  If you ever think back to anything you do in Add\Remove programs, Windows never “prompts” you to enter any information.  The only actions you take is to click a check mark and then all the magic occurs — except if you don’t have the source files from Windows still available which that is considered an error (not a custom action.)

There is actually a simple solution around this but often many think the tax is to large to do it.  The Microsoft answer to this non-system partition webroot is to automate IIS’s installation.  This often scares many of our customers as they don’t want to go down that path.  However, it should be noted though that you don’t have to do a full OS install through automation but instead just automate the install of IIS.  This is easy.

1).  Create a file called Unattend.txt and open it with Notepad

2).  Paste the following into that file:

[SetupMgr]
    DistFolder=d:\i386

[Components]
    aspnet=off
    complusnetwork=on
    dtcnetwork=on
    bitsserverextensionisapi=off
    iis_common=on
    iis_ftp=on
    fp_extensions=on
    iis_inetmgr=on
    iis_nntp=off
    iis_smtp=off
    iis_asp=on
    iis_internetdataconnector=off
    sakit_web=off
    tswebclient=off
    iis_serversideincludes=off
    iis_webdav=off
    iis_www=on
    appsrv_console=off
    inetprint=off

[InternetServer]
    PathFTPRoot={YourDesiredFTPRootPath}
    PathWWWRoot={YourDesiredWebRootPath}

3).  The next step is to open a command-prompt (Start – Run – CMD) and type the following:

 SysOcMgr.exe /i:sysoc.inf /u:$PathToUnattendFileCreatedInStep2$

This will magically install IIS based on your parameters.  The above file, unattend.txt, installs and enables the following:

• WWW Server
• FTP Server
• Enables ASP & FPSE

The key is to understand that you don’t have to automate the entire OS installation in order to do this.  It can be done afterwards.  You can also cover all your bases and build a full automated installation of the OS and IIS.  This is completely an option.  The major thing that changes is that you have a couple of options -

   1).  Install from a CD

   2).  Install from a Shared UNC Location

In my case, I chose to install from a CD.  This was done by creating a winnt.sif file and placing it on a floppy drive.  The Winnt.sif had the following information:

[Data]
    AutoPartition=1
    MsDosInitiated="0"
    UnattendedInstall="Yes"

[Unattended]
    UnattendMode=FullUnattended
    OemSkipEula=Yes
    OemPreinstall=No
    TargetPath=\WINDOWS
    Repartition = Yes

[GuiUnattended]
    AdminPassword=ca8d43d0eae56d10197a3608820ae698fa3254ef3d8ce553674c94fb185
    EncryptedAdminPassword=Yes
    OEMSkipRegional=1
    TimeZone=4
    OemSkipWelcome=1

[UserData]
    ProductKey=**InsertValidKey**
    FullName="MyName"
    OrgName="MyCompany"
    ComputerName=MyComputer

[Display]
    BitsPerPel=24
    Xresolution=800
    YResolution=600
    Vrefresh=70

[LicenseFilePrintData]
    AutoMode=PerServer
    AutoUsers=5

[TapiLocation]
    CountryCode=1
    Dialing=Tone
    AreaCode=425
    LongDistanceAccess="9"

[Networking]
    InstallDefaultComponents=Yes

[Components]
    aspnet=off
    complusnetwork=on
    dtcnetwork=on
    bitsserverextensionisapi=off
    iis_common=on
    iis_ftp=on
    fp_extensions=on
    iis_inetmer=on
    iis_nntp=off
    iis_smtp=off
    iis_asp=on
    iis_internetdataconnector=off
    sakit_web=off
    tswebclient=off
    iis_serversideincludes=off
    iis_webdav=off
    iis_www=on
    appsrv_console=off
    inetprint=off

[InternetServer]
    PathFTPRoot=c:\FTPSites
    PathWWWRoot=c:\WebSites

[GUIRunOnce]
"a:\SetupIIS.Bat"

The only execution I have to do now is the following:

 Winnt32.exe /unattend:AnswerFile /s:InstallSource