Windows Server / Services, IIS & Secure Operations
Investigate an IIS 503 through HTTP.sys and worker evidence
A 503 can originate before the application handles a request, including queue or worker availability problems. Capture the response and kernel HTTP state.
Environment and inputs: Windows Server 2022 / 2025 baseline · Windows PowerShell with the specified role or RSAT modules; native utilities are identified in the text. Use delegated administration and elevation only where required.
Start with this check
Confirm the host, shell and access role. Replace sample names, paths, domains and interfaces with approved targets. These are diagnostic commands; assess policy and workload impact before making changes.
netsh http show servicestateRead the result
In an authorized Windows terminal, the command reports HTTP service state. Use it with IIS, WAS and HTTP error logs rather than treating every 503 as the same failure.
Resolve and verify
Match the request queue, pool state and first relevant error at the incident time. Fix the demonstrated worker or queue dependency and validate a representative request.
Before changing production
Do not raise every queue limit or restart HTTP.sys indiscriminately; other services may depend on it.