Groups | Blog | Home
all groups > iis security > january 2005 >

iis security : IIS 6, Application Pools, Thread Count, and Kerberos


matt wilson
1/13/2005 6:40:31 PM
I have seen the articles (e.g.
http://www.microsoft.com/resources/documentation/WindowsServ/2003/standard/proddocs/en-us/Default.asp?url=/resources/documentation/WindowsServ/2003/standard/proddocs/en-us/ca_cfgwrkridentity.asp?frame=true)
that mentions odd behavior when using Windows Integrated Authentication. I
have an ASP.NET program running in a dedicated Application Pool that only
supports Windows Integrated Security. This component (and friends) will be
propagated to numerous environments for the next few years. I have observed
a strange phenomenon when monitoring the w3wp.exe process that gets
instantiated on my IIS Server. This new process spawns off to process the
requested that are inside my new application pool (it appears) but the
thread count is THROUGH THE ROOF. This has happen in more than on
environment. We authenticate ok, but this is a serious concern for me. As
the articles recommend, we added a Service Principal Name (SPN) to the
domain controller for this service & user account combination. After
iisreset, the same w3wp.exe only creates 4 threads. This is more inline as
to what I believe IIS is using underneath to support the large number of
simultaneous client requests (Asynchronous I/O Pattern aka IO Completion
Port).



Can anybody shed some light on why there is an apparent correlation between
Kerberos & Thread Count in IIS 6 Application Pools? Please also bear in
mind that I am NOT an IIS expert or administrator - just someone that seeks
to under the guts.


matt wilson
1/16/2005 11:26:51 AM
This is with just one user making a request & it creates roughly 46 threads.
Any ideas why?
[quoted text, click to view]

Ken Schaefer
1/16/2005 8:50:33 PM
Hi,

Can you elaborate on what you are seeing when the thread count is "through
the roof" (i.e. how many threads in the w3wp.exe process). And how many
simultaneous requests (pending and processing) are you seeing at the same
point (you can get this info from perfmon).

Thanks

Cheers
Ken

[quoted text, click to view]

Ken Schaefer
1/17/2005 9:42:10 PM
I'm not sure 46 threads would be that much in a single w3wp.exe process - if
you use IISState you can see what thread types you have:
http://www.iisfaq.com/Default.aspx?tabid=2513

Cheers
Ken


[quoted text, click to view]

AddThis Social Bookmark Button