IIS web server: sites, app pools, HTTPS and Kerberos

Start DC01, SRV01 and CL01. Work on SRV01 as SAATLAB\Administrator in PowerShell as administrator.

1Install IIS

On SRV01, run this:

Install-WindowsFeature Web-Server, Web-Windows-Auth -IncludeManagementTools
Import-Module WebAdministration
Get-Website | Select-Object Name, State, PhysicalPath

You should see something like this:

Success Restart Needed Exit Code Feature Result
------- -------------- --------- --------------
True    No             Success   {Common HTTP Features, Default Document, Directory Browsing, ...}

Name             State   PhysicalPath
----             -----   ------------
Default Web Site Started %SystemDrive%\inetpub\wwwroot

✅ Checkpoint: IIS is installed and the Default Web Site is Started.

2Create the content, app pool and site

On SRV01, run this:

New-Item -ItemType Directory D:\Sites\Intranet -Force | Out-Null
'<html><body><h1>SaatLab Intranet</h1><p>Welcome to the lab intranet.</p></body></html>' | Set-Content D:\Sites\Intranet\index.html
icacls D:\Sites\Intranet /grant "SAATLAB\gmsa_intranet$:(OI)(CI)RX" "SAATLAB\Domain Users:(OI)(CI)RX" | Out-Null

New-WebAppPool -Name IntranetPool | Out-Null
Set-ItemProperty IIS:\AppPools\IntranetPool -Name processModel -Value @{userName='SAATLAB\gmsa_intranet$'; password=''; identityType=3}
New-Website -Name Intranet -PhysicalPath D:\Sites\Intranet -ApplicationPool IntranetPool -HostHeader intranet.saatlab.internal -Port 80 | Out-Null
Get-Website -Name Intranet | Select-Object Name, State, Bindings
(Get-ItemProperty IIS:\AppPools\IntranetPool -Name processModel).userName

You should see something like this:

Name     State   Bindings
----     -----   --------
Intranet Started Microsoft.IIs.PowerShell.Framework.ConfigurationElement

SAATLAB\gmsa_intranet$

identityType 3 means “specific user”, and the empty password is how you tell IIS it’s a gMSA: Windows fetches the password from AD. The gMSA must be installed on SRV01 (you did that in Lesson 22), or the pool fails to start and the site returns 503.

✅ Checkpoint: The Intranet site is Started, and IntranetPool runs as SAATLAB\gmsa_intranet$.

3Add HTTPS with a certificate

On SRV01, create a certificate and bind it:

$cert = New-SelfSignedCertificate -DnsName intranet.saatlab.internal -CertStoreLocation Cert:\LocalMachine\My -NotAfter (Get-Date).AddYears(1)
New-WebBinding -Name Intranet -Protocol https -Port 443 -HostHeader intranet.saatlab.internal -SslFlags 1
(Get-WebBinding -Name Intranet -Protocol https).AddSslCertificate($cert.Thumbprint, 'My')
Export-Certificate -Cert $cert -FilePath D:\Sites\intranet.cer | Out-Null
Get-WebBinding -Name Intranet | Select-Object protocol, bindingInformation, sslFlags

You should see something like this:

protocol bindingInformation              sslFlags
-------- ------------------              --------
http     *:80:intranet.saatlab.internal         0
https    *:443:intranet.saatlab.internal        1

SslFlags 1 turns on SNI, so other sites can share port 443 with their own certificates. A self-signed certificate isn’t trusted by other computers, so for the lab you’ll trust it on CL01 by hand. In Lesson 34 you’ll replace it with one issued by your own CA, trusted everywhere automatically.

✅ Checkpoint: The site has an http and an https binding for intranet.saatlab.internal.

4Turn on Windows authentication with Kerberos

On SRV01, change the authentication settings for the Intranet site:

$auth = 'system.webServer/security/authentication'
Set-WebConfigurationProperty -PSPath 'MACHINE/WEBROOT/APPHOST' -Location 'Intranet' -Filter "$auth/anonymousAuthentication" -Name enabled -Value $false
Set-WebConfigurationProperty -PSPath 'MACHINE/WEBROOT/APPHOST' -Location 'Intranet' -Filter "$auth/windowsAuthentication" -Name enabled -Value $true
Set-WebConfigurationProperty -PSPath 'MACHINE/WEBROOT/APPHOST' -Location 'Intranet' -Filter "$auth/windowsAuthentication" -Name useAppPoolCredentials -Value $true
Get-WebConfigurationProperty -PSPath 'MACHINE/WEBROOT/APPHOST' -Location 'Intranet' -Filter "$auth/windowsAuthentication" -Name useAppPoolCredentials | Select-Object Value

You should see this:

Value
-----
 True

Anonymous access is off, so every visitor must prove who they are. useAppPoolCredentials makes IIS decrypt Kerberos tickets with gmsa_intranet’s key, which matches the HTTP SPN you moved to that account in Lesson 22.

✅ Checkpoint: Anonymous is disabled, Windows authentication is enabled, and useAppPoolCredentials is True.

5Test from CL01 and confirm Kerberos

On CL01, as an administrator, trust the lab certificate:

Import-Certificate -FilePath \\SRV01\D$\Sites\intranet.cer -CertStoreLocation Cert:\LocalMachine\Root | Out-Null

Then sign in as Priya and, in a normal PowerShell window:

klist purge | Out-Null
$r = Invoke-WebRequest -Uri https://intranet.saatlab.internal -UseDefaultCredentials -UseBasicParsing
$r.StatusCode
klist | Select-String 'Server:'

You should see something like this:

200
        Server: krbtgt/SAATLAB.INTERNAL @ SAATLAB.INTERNAL
        Server: HTTP/intranet.saatlab.internal @ SAATLAB.INTERNAL

StatusCode 200 means the page loaded, and the HTTP/intranet.saatlab.internal ticket proves Kerberos did the authentication. Open the site in Edge on CL01 too: it loads without a password prompt and with a padlock.

On SRV01, look at the log entry for that request:

Get-ChildItem C:\inetpub\logs\LogFiles\W3SVC2 | Sort-Object LastWriteTime | Select-Object -Last 1 | Get-Content -Tail 2

You should see something like this:

2026-10-19 15:12:40 10.0.0.20 GET / - 443 - 10.0.0.150 Mozilla/5.0+(Windows+NT;...) - 401 2 5 3
2026-10-19 15:12:40 10.0.0.20 GET / - 443 SAATLAB\priya.sharma 10.0.0.150 Mozilla/5.0+(Windows+NT;...) - 200 0 0 15

The first request gets 401.2 (no credentials yet), the browser answers with a Kerberos ticket, and the second gets 200 with Priya’s name. Seeing a 401 followed by a 200 is normal; seeing only 401s is a problem.

✅ Checkpoint: CL01 gets 200, holds an HTTP/intranet ticket, and the IIS log shows priya.sharma with status 200.