How do you change the allowDefinition section attribute using appcmd in IIS 7?

Question

Is it possible to use appcmd to change the value of allowDefinition? Specifically I'm try to enable changes to the httpCompression module at the application level.

Modifying the applicationHost.config by manually changing the following line:

<section name="httpCompression" allowDefinition="AppHostOnly" overrideModeDefault="Deny" />

To

<section name="httpCompression" allowDefinition="MachineToApplication" overrideModeDefault="Allow" />

allows me to then execute the following appcmd commands:

appcmd set config "website name" /section:httpCompression /noCompressionForProxies:false
appcmd set config "website name" /section:httpCompression /noCompressionForHttp10:false

However I need a solution that does not rely on manually editing the applicationHost.config

Bowse

Do you have a way to set overrideModeDefault to Allow using appcmd.exe? – Ming

Answer 1

My problem was, I had to change anonymousAuthentication from False to True. When I did: appcmd set config websitename /section:anonymousAuthentication /enabled:True

Error I got: Config Error This configuration cannot be used at this path. This happens when the section is locked at the parent level. Locking is either by default(overrideModeDefault="Deny")...

To unlock, do the following: appcmd unlock config /section:? This will list the section you want. Then type:

appcmd unlock config /section:system.webserver/security/authentication/anonymousauthentication

Thats it... :)

Verla

this didn't work for me with IIS7.5 or IIS8. I can unlock the config section fine (it doesn't give me an error message), but applying any changes at site level then fail with the same error mentioned above. – Bret

adding -commit:apphost helps if nothing else works – Diagram

Answer 2

Try using %windir%\system32\inetsrv\appcmd unlock config -section:*sectionName*. See http://blog.donnfelker.com/2007/03/26/iis-7-this-configuration-section-cannot-be-used-at-this-path/

I actually came across a need to do just that after posting this answer.

%systemroot%\System32\inetsrv\appcmd.exe unlock config /section:system.WebServer/[rest of the path to config section you need to edit]

Fatal

Answer 3

One big warning, you should NEVER change the allowDefinition, that is an important setting that is usually there for a reason, for example it might be that even if you set it in a specific directory or app it will not work, so the developers have specified that.

So please, never modify the allowDefinition attribute in the section definitions. On the other hand you can modify the overrideModeDefault which will allow users to define it in a different place if allowed by definition.

Elevator

I don't have a reference, but trust me you do not want to do that :). As an example we added the modules section with allowDefinition to MachineToApp, if you change that to be say Everywhere, that still will not work since the modules NEED to be per App and not say folder (so although config is valid, runtime behavior will not work). Same goes for almost all settings. That is why we invented the overrideModeDefault value so that could be changed, but more importantly the recommended way is to use location paths and overrideMode instead. – Elevator