PowerShell cmdlets replace ad-hoc IIS Manager changes with version-controlled scripts. This approach eliminates configuration drift across multiple servers and makes rollbacks deterministic.

Recent Windows Server releases continue to expose the full IIS feature set through the WebAdministration and IISAdministration modules. Scripts written against these modules remain stable across patch cycles.

#Core Cmdlets for Daily Operations

Start every script by importing the required modules and confirming the WebAdministration provider is available. The following pattern appears in most production runbooks.

powershell 
Import-Module WebAdministration, IISAdministration
Get-IISAppPool | Select-Object Name, State, ManagedRuntimeVersion

#Enforcing Security Baselines

  • Disable anonymous authentication on administrative virtual directories.
  • Require TLS 1.3 and disable legacy protocols via Set-WebConfiguration.
  • Lock application pool identities to domain service accounts managed in Active Directory.

These controls are applied in a single idempotent script that can be scheduled or executed via Desired State Configuration.

#Auditing and Reporting

Regular audits compare live settings against a stored baseline. Export the current configuration to JSON, then diff it against the approved version stored in source control.

powershell 
$baseline = Get-Content .\iis-baseline.json | ConvertFrom-Json
$current = Get-IISSite | ConvertTo-Json -Depth 5
Compare-Object $baseline $current

#Integration with Active Directory

Application pool identities should be domain accounts with minimal rights. Grant the accounts only the NTFS permissions required by the application content and log directories.

Use the same PowerShell session to validate group membership and SPN registration before the site is placed into production.

Maintain a short runbook that combines these steps into a single invocation. Run the script after every patch cycle and after any change to domain policies.