Best configuration for IIS and SQL2005

It depends how many users you expect your websites to be receiving, and how powerful the server in question is. If it's only an internal site and the server is reasonably high spec, then I wouldn't see a problem leaving SQL Server on the IIS server. The only time I would actually split the SQL server role off the IIS server is when you've got a public site receiving thousands of hits a day - in that case, you would see a performance gain by running it on two servers.

-tigermatt

Is it exposed to the outside would ? If so, would be inclined to seperate and hide the sql server allowing only secured connections to it... If internal, then not quite as important, and likely OK to be on same machine. Memory management will be the key - they are both reasonably memory intensive with IIS wanting to cache, but more likely to swap memory if dealing with differing requests, where as sql likes to use as much as it can get and sit on it... So, could also depend on how big the database, the nature and type of queries. Ideal would be to split the servers...

That's a good idea actually Mark, which must be taken into consideration when you spread the roles out between servers. We are assuming that by placing both on the same machine, Microsoft have patched up any potential security holes in the software - and that's a BIG assumption!

@tigermatt : Thanks, been caught out with that assumption before, and the the increase of SQL injections, kind of becomes a self-fulfilling prophecy...

Thanks for these comments.  Obviously you prefer to seperate the SQL and IIS machines.  

It would be good to find something a bit more quantitative.  The web service in question has about 40 public websites divide between 2 servers, one with 1GB RAM and other 2GB.  Hits are in the 100s per day.  Each website has its own database running on SQL Express.   Tne database sizes are typically 50 - 100MB.    Typical queries are select statements return < 20 rows from 2 - 4 tables.   It seems fine at the moment.

Putting securitty on one side for the moment, at what size of database, type of query or number of hits would there be a performance benefit from running all the databases on one server with all the websites on the other?

My quandary is if I split the functions each website needs 2 machines to be operational whereas if I don't they only need one.   Theoretically improving the reliability.  (Not that either machine has ever failed.)

Thanks experts,  
That has told me what I needed to know and given me a way to assess my future needs.