Ionic’s Isapi Rewrite Filter, aka IIRF, is a small, FREE, easy to use, URL rewriting ISAPI filter. It combines a good price (free!) with good features. It is fast and powerful. It works on IIS 6.0, and later. If you use IIS, you can download IIRF and get started right now.

http://iirf.codeplex.com/

When you use the fully qualified domain name (FQDN) or a custom host header to browse a local Web site that is hosted on a computer that is running Microsoft Internet Information Services (IIS) 5.1 or IIS 6, you may receive an error message that resembles the following:

HTTP 401.1 – Unauthorized: Logon Failed

This issue occurs when the Web site uses Integrated Authentication and has a name that is mapped to the local loopback address.

To work around this issue, use one of the following methods.

Method 1: Specify host names

Note We recommend that you use this method.
To specify the host names that are mapped to the loopback address and can connect to Web sites on your computer, follow these steps:

1. Click Start, click Run, type regedit, and then click OK.
2. In Registry Editor, locate and then click the following registry key:

   HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0

3. Right-click MSV1_0, point to New, and then click Multi-String Value.
4. Type BackConnectionHostNames, and then press ENTER.
5. Right-click BackConnectionHostNames, and then click Modify.
6. In the Value data box, type the host name or the host names for the sites that are on the local computer, and then click OK.
7. Quit Registry Editor, and then restart the IISAdmin service.

Method 2: Disable the loopback check

Follow these steps:

1. Click Start, click Run, type regedit, and then click OK.
2. In Registry Editor, locate and then click the following registry key:

   HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa

3. Right-click Lsa, point to New, and then click DWORD Value.
4. Type DisableLoopbackCheck, and then press ENTER.
5. Right-click DisableLoopbackCheck, and then click Modify.
6. In the Value data box, type 1, and then click OK.
7. Quit Registry Editor, and then restart your computer

You receive error 401.1 when you browse a Web site that uses Integrated Authentication and is hosted on IIS 5.1 or IIS 6

Upgrade Plugin
Downloading update from http://downloads.wordpress.org/plugin/download-monitor.2.2.3.zip
Unpacking the update
Removing the old version of the plugin
Could not remove the old plugin
Plugin upgrade Failed

With some help from Patrick Burch, I found out this can be fixed by providing Physical Path Credentials in IIS. In previous versions of IIS, you could only use this feature when using UNC paths. It mainly existed as a way to connect to a virtual directory on a remote machine using a fixed set of credentials. In IIS 7, this feature was expanded so that it could also be used with local directories. I have searched for a good security guide on IIS 7 with WordPress, but most of what I have seen is geared towards WordPress on Apache. So, I have played around with a couple of settings to try to enable one click plugin upgrades while at the same time keeping a secure configuration. 

DISCLAIMER: I have to admit that I have not read the security guide for WordPress, and I am only mildly familiar with the new security settings in IIS 7. So there is a possibility that what I have done to fix this problem may open some kind of security hole. You must make your own determination when changing security settings on your servers. I am only reporting what worked for me to fix a specific issue. I will not be held responsible for security changes you make to your own systems.

1. Make sure your Application Pool identity is a user account (not Network Service)
2. In IIS Manager, right-click on your website –> Manage Web –> Advanced Settings
3. Click the … button in the Physical Path Credentials box.
4. Specify the account you are using for the Application Pool Identity
5. Find the wp-content folder under your web site, right click and choose Edit Permissions…
6. Go to the Security Tab, then click Add and enter the Application Pool Identity account. Give the account modify rights
7. Click OK until you have closed out of the security dialog
8. Reset IIS
9. Test plugin update

We could have given rights to just the plugins directory, but you will still need the ability to do uploads as well, so I just went with wp-content

Please feel free to comment if you are an expert on this subject and see problems with this post.

The IIS 7.0 PowerShell Provider is a PowerShell Snap-In that allows you to manage IIS7 configuration and run-time data. It gives easy access to Web-Sites, Application Pools, Web Applications, Virtual Directories, request in flight, Worker Processes and .NET Application Domains within Worker Processes.

Follow the subsequent walkthroughs. They cover the comprehensive functionality of the IIS 7 PowerShell Provider using common scenarios. It is recommended that you start with the basic walkthroughs first to understand how IIS 7.0 PowerShell Provider works.

http://learn.iis.net/page.aspx/428/getting-started-with-the-iis-70-powershell-snap-in/

This walkthrough will guide you through how to enable “Pretty Permalinks” for blog posts in the WordPress blog engine installed on IIS 7.0. Typically, without URL rewriting functionality on a Web server, WordPress users have to use “Almost Pretty” URLs (for example, http://contoso.com/index.php/yyyy/mm/dd/post-name/). This was the primary option for users who chose to host WordPress on IIS. Now, with the URL rewrite module available, you can have “Pretty Permalinks” (for example, http://example.com/year/month/day/post-name/) for WordPress blogs hosted on IIS 7.0.

Enabling Pretty Permalinks in WordPress : Using URL Rewrite Module : Installing and Configuring IIS 7.0 : The Official Microsoft IIS Site