Windows – How to block IP addresses on Web Server 2008 R2

From a (now broken) IIS FAQ at TechNet:

Q. Does Web server performance degrade when Web sites use host headers instead of IP addresses?

A. The overhead for IIS to check a host header is negligible compared to the total cost of satisfying an HTTP request, even for a static file. Also, host headers scale better than IP addresses when you host thousands of Web sites on a server.

It doesn't sound like there's a real upper limit to the number of host header sites you can have, but I've yet to find any hard evidence.

Problem solved. I finally decided to compare the module list side-by-side and there actually was one missing. It turns out that there are two Windows Authentication modules:

On the server, the managed WindowsAuthentication module was there, but not the native WindowsAuthenticationModule highlighted above. Why it was configured that way is anyone's guess, but apparently if the native module is not loaded, the managed module will cheerfully load and silently fail.

So for any future readers who encounter this problem, make sure you have both modules loaded, because IIS will not warn you if one of them is missing.