Iis – Support 250+ concurrent users for an intranet web site

There are several considerations in this, some which are handled on IIS (HTTP compression, caching headers fx), and some which are handled during the build process / before deployment (such as Javascript and CSS file concatenation & whitespace minification).

As such, it's a bit hard to give you a complete rundown in one answer, as some of it will depend on your build & release methods. In high level steps:

• The site is "cookieless" by virtue of you using a new domain, one that is not tied to your webapplication. Since you're not setting any cookies for the domain (using f.x. .NET application code), it's then "cookieless".

• You should absolutely enable HTTP compression for static text content such as Javascript and CSS.

• I'm not the greatest IIS administrator, but as far as I can tell, you only need the default IIS components associated with the basic "Web Server (IIS)" server role.

• You should absolutely enable long caching headers for the static content. The general recommendation is 31 days, but you can set it higher or lower. Remember, if you serve static content with long cache headers, then you must change the URL if you change the file, to avoid old cached content being re-used by the clients.

• You should enable HTTP keep-alive (same docs as caching headers).

In addition to this, there are pre-deployement tasks, such as whitespace compressing the Javascript and CSS, and ideally compress PNG's better, etc. This is were your development tools and build cycle helps decide how to proceed.

When you're done, try downloading a few files from your static servers with YSlow enabled. I find that the "Classic V2" ruleset gives the biggest impact for the effort, so I would suggest check your score against this YSlow ruleset.

Of the "Classic V2" ruleset, these rules apply cleanly to your static server IIS instances & content:

3. Add an Expires or a Cache-Control Header
4. Gzip Components
10. Minify JavaScript and CSS
11. Avoid Redirects
13. Configure ETags
19. Use Cookie-Free Domains for Components
22. Make favicon.ico Small and Cacheable

ASP.NET does not support having multiple built-in authentication modules at once. This is prominent in the documentation, <authentication mode="[Windows|Forms|Passport|None]" ...>

Solutions:

• Build a custom IHttpModule which handles authentication.
• Separate your application into two web applications in your IIS, which point towards two different directories with different configuration files. This is the easiest solution.
• Separate your application into two web applications in your IIS, but point both of them to the same directory. You will need to remove the authentication- and impersonation settings from the web.config residing in the directory, and move these into the system-wide web.config (%SystemRoot%\Microsoft.NET\Framework64\v4.0.30319\Config\web.config or similar). These settings must be wrapped by location-tags using the name of the IIS-site.

Example:

<location path="My Awesome Site - Forms">
    <system.web>
        <authentication mode="Forms" />
    </system.web>
</location>

<location path="My Awesome Site - Windows">
    <system.web>
        <authentication mode="Windows" />
        <identity impersonate="true"/>
    </system.web>
</location>