Determine what sites are running under IIS on Web Servers

(imported topic written by ErnieF91)

I can successfully determine what servers are running IIS and WWW, but is there a way to report on what actual WWW sites are running under them?

Thanks,

Ernie

(imported comment written by JasonO91)

Hey Ernie,

How’s that car of yours? =)

Here’s a vbscript to get the information you want into a csv file. You could pull all of the same information from wmi, and save it to each of your IIS servers via custom property.

This will attempt to create a file for each of your servers with the IIS information.

Be sure to change the 204.204.204.204 to where you want the files to be created.

on error resume next

Dim objnet

set objnet = wscript.createobject(“wscript.network”)

dim strinfo

strinfo = objnet.computername

Dim filesys, testfile

Set filesys = CreateObject(“Scripting.FileSystemObject”)

MachineName = strinfo

IIsObjectPath = “IIS://” & MachineName & “/w3svc”

Set IIsObject = GetObject(IIsObjectPath)

if err.number 0 then

wscript.quit

end if

Set testfile = filesys.CreateTextFile("\204.204.204.204\iis" & strinfo & “.csv”, True)

testfile.write strinfo & “,”

testfile.writeline

testfile.write “Description” & “,” & “IP” & “,” & “Port” & “,” & “HostHeader” & “,”

testfile.writeline

Set IIsObject = GetObject(IIsObjectPath)

for each obj in IISObject

if (Obj.Class = “IIsWebServer”) then

BindingPath = IIsObjectPath & “/” & Obj.Name

Set IIsObjectIP = GetObject(BindingPath)

ValueList = IISObjectIP.Get(“ServerBindings”)

ValueString = “”

For ValueIndex = 0 To UBound(ValueList)

value = ValueList(ValueIndex)

Values = split(value, “:”)

IP = values(0)

if (IP = “”) then

IP = “(All Unassigned)”

end if

TCP = values(1)

if (TCP = “”) then

TCP = “80”

end if

HostHeader = values(2)

If (HostHeader = “”) then

HostHeader = “None”

end if

testfile.Write IISObjectIP.ServerComment & “,”

testfile.write IP & “,”

testfile.write TCP & “,”

testfile.write HostHeader & “,”

testfile.writeline

Next

set IISObjectIP = Nothing

end if

next

set IISObject = Nothing

set objnet = nothing

If you want, I can take a look at getting the wmi into a custom property.

Jason

(imported comment written by JasonO91)

Ernie,

Download and install the IIS Resource kit on a web server from:

http://support.microsoft.com/kb/840671

Then you can use the IIS Metabase Explorer to see the values of the metabase.

For example, to pull the Server Comment from the default web server:

values whose (identifier of it as integer = 1015) of key “/LM/W3svc/1” of metabase

We could still use some help iterating through the LM/W3svc to get all of the Web Servers and then information about each :wink:

Jason

(imported comment written by BenKus)

Hey JasonO,

Did you guys see this post?

http://forum.bigfix.com/viewtopic.php?id=101

Ben

(imported comment written by JasonO91)

Ben,

That’s where I started looking for the metabase explorer. Those queries point to the correct location of the data. I think what Ernie and I are looking for, would be something like this:

Server Comment | Host Header | Port

So that he can see all of the URLs that the machine will respond to.

This is close to what I want, but it returns information seperately. What I’d like to perform is retrieve both properties at the same time.

values whose (identifier of it as integer = 1015 or identifier of it as integer = 1023) of keys of key “LM\w3svc” of metabase as string

I’ve looked at the WinInspectors, and any other documentation I can get my hands on. There just aren’t very many examples to look at when it comes to using the metabase.

Jason

(imported comment written by BenKus)

Try this… It will iterate over each key and concatenate the results together for keys that have the two values…

q:(value whose (identifier of it as integer = 1015) of it as string & “-” & value whose (identifier of it as integer = 1023) of it as string) of keys whose (exists value whose (identifier of it as integer = 1015) of it AND exists value whose (identifier of it as integer = 1023) of it )of key “LM\w3svc” of metabase as string

A: Default Web Site-:80:

Ben

(imported comment written by JesseR91)

Ben Kus

Try this… It will iterate over each key and concatenate the results together for keys that have the two values…

q:(value whose (identifier of it as integer = 1015) of it as string & “-” & value whose (identifier of it as integer = 1023) of it as string) of keys whose (exists value whose (identifier of it as integer = 1015) of it AND exists value whose (identifier of it as integer = 1023) of it )of key “LM\w3svc” of metabase as string
A: Default Web Site-:80:

Ben

Ben,

Jason is here working with me and we created a task with the above revelance and it does work. However, this is the ouput when viewed in Web Reports.

Default Web Site-:81:%00;

SharePoint Central Administration-:5000:%00;

STS-:82:%00;

As you can see its returning a %00 at the end of each one. Do you have any idea what the cause of that is?

(imported comment written by jessewk)

%00 is a null termination character. You’ll sometimes see registry keys or other strings include these characters. You can strip it out in the property:

q: (if (it contains “%00”) then (preceding text of last “%00” of it) else (it)) of (it as string) of (value whose (identifier of it as integer = 1015) of it as string & “-” & value whose (identifier of it as integer = 1023) of it as string) of keys whose (exists value whose (identifier of it as integer = 1015) of it AND exists value whose (identifier of it as integer = 1023) of it )of key “LM\w3svc” of metabase as string

A: Default Web Site-:80:

(imported comment written by ErnieF91)

Thanks a bunch, it works great. I knew if I posted, the answers would be waiting for me when I returned from vacation.

After 38 years the car is still plugging along.

Ernie