Windows Server 2025 / How to Install IIS and Serve a Static Website

On Windows Server 2025, IIS can serve an HTML file after you install the web server role and static content features. Configure the physical path, application pool, binding, and read permissions, then test locally and from a separate client.

Prepare a separate web server

Internet Information Services (IIS) is the Windows web server. This exercise serves one static HTML page without a database or application framework. PHP and ASP.NET applications need their own runtime and deployment configuration.

Use a separate domain member WEB1 on the isolated lab network, rather than adding another role to DC1 or FS1. Its example address is 172.24.50.30/24, with DC1 at 172.24.50.10 as DNS and membership in ad.example.test. Check address conflicts and the host resource budget first.

Use elevated Windows PowerShell and IIS Manager on WEB1. The new site is LabSite, its pool LabSitePool, its folder C:\Sites\LabSite, and its HTTP port 8080. Keep the default site’s port 80 binding separate. This exercise does not expose the server to the public internet.

Install IIS and the required features

1. In Server Manager, select Manage → Add Roles and Features and target WEB1.
2. Select Web Server (IIS) and the required management tools.
3. Check Static Content and Default Document under Common HTTP Features, and HTTP Logging under Health and Diagnostics.
4. Install without adding unrelated application runtimes.
5. Review the result and restart requirement, then open IIS Manager with inetmgr.

The PowerShell alternative is below. If IIS already exists, inspect its feature state first; installation success alone does not configure site permissions or network access.

Install-WindowsFeature Web-Server -IncludeManagementTools
Get-WindowsFeature Web-Static-Content,Web-Default-Doc,Web-Http-Logging,Web-Mgmt-Console

Create the page and a dedicated pool

If C:\Sites\LabSite already exists, stop and identify its purpose. Otherwise create the folder and save this complete example as UTF-8 index.html. Confirm that the actual extension is not index.html.txt.

<!doctype html>
<html lang="en">
<head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>LabSite</title></head>
<body><h1>Windows Server 2025 web server lab</h1><p>This page is served by LabSite on WEB1.</p></body>
</html>

1. In IIS Manager → Application Pools, create LabSitePool.
2. Choose No Managed Code for this static-only site.
3. In Advanced Settings, confirm Identity is ApplicationPoolIdentity.
4. In the folder’s Properties → Security, select WEB1 as the location and add IIS AppPool\LabSitePool.
5. Grant Read & execute, List folder contents, and Read, retaining SYSTEM and administrator permissions.

An application pool identity is a virtual account specific to the pool. Keep the publishing administrator’s write access separate from the web process’s read access. Serving content does not require giving that process administrator rights or Full control.

Configure the site and anonymous identity

1. Choose Sites → Add Website and set LabSite, LabSitePool, and C:\Sites\LabSite.
2. Use http, IP 172.24.50.30, port 8080, and an empty host name.
3. Open LabSite → Authentication → Anonymous Authentication → Edit and select Application pool identity.
4. Check that Default Document includes index.html.
5. Review binding, path, and pool state, then start the site.

The default anonymous user IUSR differs from the pool identity. Explicitly selecting the pool identity in anonymous authentication settings aligns requests with the folder permission granted above. Do not solve an authentication error with broad Everyone write access.

On WEB1, open http://172.24.50.30:8080/index.html and then the root URL. Both should show the sample sentence. The New-Website reference also identifies the site path, port, and pool parameters.

Verify client access and diagnose the response

After confirming WEB1 uses the Domain firewall profile, create inbound rule Lab-IIS-HTTP-8080 for TCP 8080, restricted to remote subnet 172.24.50.0/24. Investigate an unexpected profile instead of expanding the rule to every profile and address.

On CLIENT1, test the port and browse to the same URL:

Test-NetConnection -ComputerName 172.24.50.30 -Port 8080

Correlate requests with the correct site ID and time in C:\inetpub\logs\LogFiles\W3SVC folders. If local access works but CLIENT1 fails, separate network checks from IIS response checks. For cleanup, remove only the new site, pool, 8080 rule, and test folder after confirming they are no longer needed.