How to Configure WebDAV Settings Using AppCmd
Introduction
Microsoft released a new WebDAV extension module that was completely rewritten for Internet Information Services 7.0 (IIS 7.0) on Windows Server® 2008. This new WebDAV extension module incorporated many new features that enable web authors to publish content better than before, and offers web administrators more security and configuration options. Microsoft has released an update to the WebDAV extension module for Windows Server® 2008 that provides shared and exclusive locks support to prevent lost updates due to overwrites.
This document will walk you through using the new AppCmd.exe utility in IIS 7.0 to configure WebDAV settings from a command-line or batch script.
Prerequisites
The following items are required to complete the procedures in this article:
IIS 7.0 must be installed on your server, and the following must be configured:
- The Default Web Site that is created by the IIS 7.0 installation must still exist.
The new WebDAV extension module must be installed. For information regarding the installation of the new WebDAV module, please see the following document:
Note
You need to make sure that you follow the steps in this document using full administrative permissions. This is best accomplished using one of two methods:
- Log in to your computer using the local "administrator" account.
- If you are logged in using an account with administrative permissions that is not the local "administrator" account, open IIS Manager and all command prompt sessions using the "Run as Administrator" option.
The above condition is required because the User Account Control (UAC) security component in Windows Server 2008 will prevent administrative access to IIS 7.0's configuration settings. For more information about UAC, please see the following documentation:
Note
Request Filtering settings may block several file types from WebDAV authoring by default. When you configure WebDAV using the IIS Manager UI, the request filtering settings are automatically updated in order to unblock WebDAV authoring. However, if you choose to configure WebDAV in any manner other than using the IIS Manager UI see the How to Configure WebDAV with Request Filtering walkthrough.
Basic AppCmd Concepts
AppCmd.exe is a new command-line tool for administering IIS 7.0. In many ways, think of it as a replacement for the adsutil.vbs script from previous IIS versions. AppCmd.exe supports a wide range of command switches for various objects, making it easily scriptable in batch files to configure a myriad of IIS settings. (Note: The AppCmd.exe utility is located in the %WinDir%\System32\InetSrv folder.)
The general syntax for AppCmd.exe is:
AppCmd (command) (object-type) <identifier> </parameter1:value1 ...>
AppCmd.exe also provides extensive command-line help support, which can be accessed using one of the following methods:
AppCmd /?
AppCmd (object) /?
AppCmd (command) (object) /?
The list of commands depends on the object, and the following objects are supported:
| Object | Description |
|---|---|
| SITE | Administration of virtual sites |
| APP | Administration of applications |
| VDIR | Administration of virtual directories |
| APPPOOL | Administration of application pools |
| CONFIG | Administration of general configuration sections |
| WP | Administration of worker processes |
| REQUEST | Administration of HTTP requests |
| MODULE | Administration of server modules |
| BACKUP | Administration of server configuration backups |
| TRACE | Working with failed request trace logs |
For example, you can list which web sites are configured on your server using the SITE object with the following syntax:
AppCmd list site
Likewise, you can list which application pools are configured on your server using the APPPOOL object with following syntax:
AppCmd list apppool
AppCmd can also be used to set the values for various configuration settings using the SITE object, and you can use the following command to list the available settings for your Default Web Site using the following syntax:
AppCmd set site "Default Web Site" /?
To list the configuration settings for a specific path, you use the CONFIG object like the following example:
AppCmd list config "Default Web Site/" /section:system.webServer/security/authentication/windowsAuthentication
The CONFIG object can also be used to set configuration settings, as shown in the following example:
AppCmd set config "Default Web Site/" /section:system.webServer/security/authentication/windowsAuthentication /enabled:true
You can also control where AppCmd will write the settings that you specify by using the "/commit:" command-line parameter. For example, later in this document we will take a look at the following command that enables WebDAV on your Default Web Site:
AppCmd set config "Default Web Site/" /section:system.webServer/webdav/authoring /enabled:true /commit:apphost
Note
This command enables WebDAV for the Default Web Site and writes that setting to the ApplicationHost.config file.
AppCmd is an extremely powerful utility, and realistically speaking there's too much to cover in such a short space, so for more information about becoming familiar with AppCmd.exe, please see the following article on the IIS.NET web site:
Thatsaid, we move on to configuring WebDAV on your server.
Getting Started with WebDAV
WebDAV installs an extension to the default schema for IIS settings, which is what makes AppCmd work with WebDAV without any special modifications. The new WebDAV module stores all of its configurable settings in ApplicationHost.config file, and uses the following sections:
- system.webServer/webdav/authoring
- system.webServer/webdav/authoringRules
The "authoring" settings are only configurable at the root of a web site, whereas the "authoringRules" settings can be configured per-URL. To see which settings have been configured for each of these sections for a given path, you can use AppCmd as seen in the following examples:
AppCmd list config "Default Web Site/" /section:system.webServer/webdav/authoring
AppCmd list config "Default Web Site/" /section:system.webServer/webdav/authoringRules
Enabling or Disabling WebDAV for a Web Site
Understandably enough, the most basic and useful command for WebDAV is enabling or disabling WebDAV for a site. The syntax for enabling WebDAV a web site follows the following example:
AppCmd set config "Default Web Site/" /section:system.webServer/webdav/authoring /enabled:true /commit:apphost
In this example, we set the "enabled" attribute to "true" for the WebDAV "authoring" section on the Default Web Site and force that change to be written to the ApplicationHost.config file. Conversely, you can disable WebDAV by setting that same value to "false" as shown in the following example:
AppCmd set config "Default Web Site/" /section:system.webServer/webdav/authoring /enabled:false /commit:apphost
Requiring SSL for WebDAV Authoring for a Web Site
In order to protect the information that you may be transferring, WebDAV can be configured to require SSL for all operations. This is accomplished by setting the "requireSsl " attribute to "true" for the WebDAV "authoring" section using syntax like the following:
AppCmd set config "Default Web Site/" /section:system.webServer/webdav/authoring /requireSsl:true /commit:apphost
This functionality can be disabled by setting the "requireSsl" attribute to "false" using syntax like the following:
AppCmd set config "Default Web Site/" /section:system.webServer/webdav/authoring /requireSsl:false /commit:apphost
Allowing Access to Hidden Files for a Web Site
For security reasons, you can suppress whether files that are marked as hidden on the server will be returned in file listings. To do so, set the "allowHiddenFiles" attribute to "true" on the "fileSystem" element in the "authoring" section using syntax like the following:
AppCmd set config "Default Web Site/" /section:system.webServer/webdav/authoring /fileSystem.allowHiddenFiles:true /commit:apphost
To disable listing hidden files, set the "allowHiddenFiles" attribute to "false" using syntax like the following:
AppCmd set config "Default Web Site/" /section:system.webServer/webdav/authoring /fileSystem.allowHiddenFiles:false /commit:apphost
Configuring WebDAV Compatibility Settings for a Web Site
In order to be compatible with previous versions of WebDAV for IIS, some optional features are exposed through compatibility settings. Currently the list of options is as follows:
| Compatibility Setting | Description |
|---|---|
| None | Specifies that no compatibility features should be supported. |
| MsAuthorVia | Specifies that the "MS-Author-Via" header should be returned. (Note: Several of Microsoft's web authoring tools use this header.) |
| MultiProp | Specifies that multiple <prop> statements should be allowed in client requests. |
| CompactXml | Defines whether the XML returned by the WebDAV module will terminate each line with a CRLF sequence. |
| IsHidden | Specifies that the IsHidden pseudo-live property should be supported. |
| IsCollection | Specifies that the IsCollection pseudo-live property should be supported. |
To set any of these features, you will need to set the value of "compatFlags" attribute on the "authoring" section using syntax like the following:
AppCmd set config "Default Web Site/" /section:system.webServer/webdav/authoring /compatFlags:"MsAuthorVia,CompactXml" /commit:apphost
Notice that the compatibility settings are specified as a set of comma-separated flags.
Working with WebDAV Authoring Rules
The new WebDAV module makes use of authoring rules, which allow you to configure the way that WebDAV responds to authoring request from clients. For example, your web site may have anonymous access enabled for Internet users, but your web authoring access should be restricted to a certain set of users. Using authoring rules, you can configure which users have access to the various parts of your web site's content.
Configuring Authoring Rule Defaults
Specifying whether non-MIME-mapped files are allowed
For security reasons, IIS does not allow access to files that are not listed in the MIME map by default. With that in mind, web authors may need to work with certain file types on a server that are not listed in the MIME map. (For example: include files, data files, etc.) To enable access to non-MIME-mapped files, you need to set the "allowNonMimeMapFiles" attribute to "true" on the "authoringRules" section. The following syntax example illustrates how this is accomplished:
AppCmd set config "Default Web Site/" /section:system.webServer/webdav/authoringRules /allowNonMimeMapFiles:true /commit:apphost
This functionality can be disabled by setting the "allowNonMimeMapFiles" attribute to "false" using syntax like the following:
AppCmd set config "Default Web Site/" /section:system.webServer/webdav/authoringRules /allowNonMimeMapFiles:false /commit:apphost
Specifying the default MIME type
When working with file types that are not in the MIME list, IIS still needs to return a MIME type to clients. By default this is set to "application/octet-stream", which means that the file should be treated as a raw binary file regardless of the content type. To set the default MIME type for non-MIME-mapped files to a text file type you could use the following syntax:
AppCmd set config "Default Web Site/" /section:system.webServer/webdav/authoringRules /defaultMimeType:"text/plain" /commit:apphost
To reset the default MIME type, use the following syntax:
AppCmd set config "Default Web Site/" /section:system.webServer/webdav/authoringRules /defaultMimeType:"application/octet-stream" /commit:apphost
Managing Authoring Rules
Authoring rules are kept in a collection, and each rule can contain the following attributes:
| Attribute | Description |
|---|---|
| path | Specifies the content type for the rule. (See below) |
| users | Specifies the user name for the rule. (See below) |
| roles | Specifies a group/role for the rule. |
| access | Specifies the access type for the rule. (See below) |
Notes:
The "path" attribute is used to specify the content type for the authoring rule. This can be for specific content types like "*.aspx", "*.htm", etc., or you can use "*" to indicate that the authoring rule is for all content.
The "roles" and "users" attributes should be declared exclusive to each other. That is to say, an authoring rule should be for either "users" or "roles", but not both.
The following special values for the "users" attribute are defined:
Value Description * All users ? Anonymous users Note
Anonymous users cannot read/write content; this setting is used to restrict the file types for anonymous property queries.
The following values are defined for the access types:
Value Description None Specifies that access is not allowed for the content type Read Specifies read access for the content type Write Specifies write access for the content type Source Specifies access to the source code for the content type
Adding an authoring rule
To add an authoring rule for a path, you can use syntax like the following examples:
AppCmd set config "Default Web Site/" /section:system.webServer/webdav/authoringRules /+[users='administrator',path='*',access='Read,Write,Source'] /commit:apphost
AppCmd set config "Default Web Site/mypath" /section:system.webServer/webdav/authoringRules /+[roles='Authors',path='*.aspx',access='Read,Write,Source'] /commit:apphost
Editing an authoring rule
Once an authoring rule has been added, you can edit that rule using syntax like the following:
AppCmd set config "Default Web Site/" /section:system.webServer/webdav/authoringRules /[users='administrator',path='*'].access:"None" /commit:apphost
Removing an authoring rule
You can remove an authoring rule by simply specifying the user or role name using syntax like the following:
AppCmd set config "Default Web Site/" /section:system.webServer/webdav/authoringRules /-[users='administrator'] /commit:apphost
Note
If more than one authoring rule exists for that user, the above command will only remove the first authoring rule in the list and you would need to repeat the command to remove subsequent rules for that user.
Or you can specify both the user or role name and the content type like the following example:
AppCmd set config "Default Web Site/" /section:system.webServer/webdav/authoringRules /-[users='administrator',path='*'] /commit:apphost
Summary
This document has shown you how to do the following:
More Information
For additional information about using WebDAV, please see the following articles:
Note
As mentioned earlier, your default request filtering settings may block several file types from WebDAV authoring. If you do not modify your request filtering settings, you may see various errors when you try to publish files that are blocked. For example, if you attempt to upload or download a web.config file you will see errors in your WebDAV client. For more information about configuring your request filtering settings, see the How to Configure WebDAV with Request Filtering walkthrough.