Ssl – What are some easy tips for accelerating SSL when using IIS

PerfMon is a good basic tool for monitoring.

There are a number of key performance monitor counters that can be used for keeping an eye a server.

A useful article by Microsoft's Thomas Marquardt suggests the following as the minimum counters that should be used for monitoring an ASP.NET application

• Processor(_Total)\% Processor Time
• Process(aspnet_wp)\% Processor Time
• Process(aspnet_wp)\Private Bytes
• Process(aspnet_wp)\Virtual Bytes
• Process(aspnet_wp)\Handle Count
• Microsoft® .NET CLR Exceptions# Exceps thrown / sec
• ASP.NET\Application Restarts
• ASP.NET\Requests Rejected
• ASP.NET\Worker Process Restarts (not applicable to IIS 6.0)
• Memory\Available Mbytes
• Web Service\Current Connections
• Web Service\ISAPI Extension Requests/sec

One counter that I have found useful that isn't mentioned in that article but is discussed in a Thomas Marquardt blog post on ASP.NET Thread Usage is this one:

• ASP.NET Applications\Requests in Application Queue

I had a similar situation with a client. The domain controllers were misconfigured (in NT4 mode), and IE had the "Enable Windows Integrated Security" option checked.

What IE does when in Windows Integrated Security mode is it tries the request with a Windows 2000+ mode AD/Kerberos ticket. When the web server fails to authenticate the ticket, it fails back to NTLM.

You have 3 options.

1. Figure out what's boned about your AD setup. It could be your domain controllers are all good and your web server is out-of-sorts. This KB article is old, but it may help http://support.microsoft.com/kb/326985 .
2. Switch IIS into NTLM-only mode. You're going to be hacking the metabase to do this. This is pretty easy to do, actually, but you don't want to use NTLM if you don't have to, since its slower and less secure than Kerberos.
3. Clear the "Windows Integrated Security" checkbox in IE. You don't really want to do this either, because it can break other web apps on your network.

Unfortunately, in my situation, I had to go with option #2 because of the egos involved, but it worked exceptionally well.