# Install IIS on Windows Server 2025 without installing everything

> Add the IIS role with the minimum role services, verify W3SVC, open the right firewall port and avoid the default-site habits that cause later trouble.

**Tested on**

- Build: 26100.33650
- Edition: Standard / Datacenter
- Architecture: x64
- Evidence: E1
- Verified: 2026-10-29
- Test machine: IIS Manager UI reference: VM 361 Windows 11 26H2 (IIS 10); Server 2025 role selection is E1

IIS Manager UI reference from VM 361 (Windows 11 26H2). Server 2025 role selection is documented as E1, not claimed as reproduced. Click to open full size.

## The short answer

On Windows Server 2025:

1. **Server Manager → Add Roles and Features → Web Server (IIS)**.
2. Install only the role services you need today.
3. Verify `W3SVC`, the default binding and `http://localhost`.
4. Remove or replace the default page before exposing the site.
5. Open the firewall port only for the network that needs it.

The mistake is installing “everything” because the wizard offers it. Every extra module is more patch surface and more configuration you did not review.

## Desktop Experience or Core?

| Choice | IIS Manager (GUI) | Management |
|---|---|---|
| Desktop Experience | Yes | Local IIS Manager or remote |
| Server Core | No local console | Remote IIS Manager, `appcmd`, PowerShell, WAC |

On Core, the role still serves sites; you manage it remotely. Do not install the GUI shell just to click “Sites”.

## Minimum role services

For a static site with logging and request filtering:

- Web Server
- Common HTTP Features → Static Content, Default Document, HTTP Errors
- Health and Diagnostics → HTTP Logging
- Security → Request Filtering
- Management Tools → IIS Management Console (Desktop only)

Add **FastCGI** for PHP, **ASP.NET Core Hosting Bundle/ANCM** for .NET, **URL Rewrite/ARR** only when the app needs them. Do not add FTP, WebDAV or IIS 6 compatibility by default.

## Install with PowerShell

On Server 2025 (elevated):

```powershell
Install-WindowsFeature Web-Server -IncludeManagementTools
Get-WindowsFeature Web-Server,Web-Mgmt-Console,Web-Filtering,Web-Http-Logging
Get-Service W3SVC
```

For a smaller Core install, list role services explicitly:

```powershell
Install-WindowsFeature Web-Server,Web-Static-Content,Web-Default-Doc,Web-Http-Errors,Web-Http-Logging,Web-Filtering
```

On a Windows client the cmdlet is `Enable-WindowsOptionalFeature`; do not copy that command to Server 2025. The lab UI was captured on Windows 11, but the Server cmdlet is the one above.

## Verify before adding an app

```powershell
Get-Service W3SVC
Invoke-WebRequest http://localhost/ -UseBasicParsing | Select-Object StatusCode
netsh http show servicestate | Select-String ":80"
```

If `localhost` fails:

- Is `W3SVC` running?
- Is the Default Web Site started?
- Is another process on port 80?
- Is the firewall blocking only the remote client (not localhost)?

## First hardening

- Remove `iisstart.htm` or replace it with an intentional page.
- Create a dedicated app pool for the site; do not leave it on `DefaultAppPool`.
- Disable directory browsing unless you need it.
- Remove unused modules and handlers.
- Set a logging directory with retention.
- Bind only the hostnames/IPs you need.

> **Caution: Do not expose the default site**
>
> The IIS welcome page tells the world the server is freshly installed. Replace it before DNS points at the server, and do not enable directory browsing “to test”.

## Lab note

The screenshots come from VM 361, Windows 11 26H2, IIS 10. The role-service names and `Install-WindowsFeature` path are Server 2025 documentation (E1). A Server 2025 VM will be added for E2; until then the UI is a reference, not a Server 2025 reproduction claim.

## Sources

- [Microsoft Learn — Install roles, role services or features](https://learn.microsoft.com/en-us/windows-server/administration/server-manager/install-or-uninstall-roles-role-services-or-features)
- [Microsoft Learn — IIS web server overview](https://learn.microsoft.com/en-us/iis/get-started/introduction-to-iis/iis-web-server-overview)
- [Microsoft Learn — IIS application pool identities](https://learn.microsoft.com/en-us/iis/manage/configuring-security/application-pool-identities)

---

Source: https://winbook.fyi/en/server/web/iis-install/