diff --git a/scripts/deploy-iis-remote-apply.ps1 b/scripts/deploy-iis-remote-apply.ps1
index a93bd3d..3a512dc 100644
--- a/scripts/deploy-iis-remote-apply.ps1
+++ b/scripts/deploy-iis-remote-apply.ps1
@@ -36,6 +36,17 @@ Write-Host "Stopping IIS site $SiteName and app pool $AppPool"
 try { Stop-Website -Name $SiteName } catch { }
 try { Stop-WebAppPool -Name $AppPool } catch { }
 
+# The admin site's physical path may already point inside RemoteDir (e.g. RemoteDir\public-admin)
+# from a previous deploy - if it's left running, IIS holds those files open and the wipe below
+# fails with "Access is denied". Stop it up front, alongside the public site, not after.
+if(![string]::IsNullOrWhiteSpace($AdminSiteName) -and (Get-Website -Name $AdminSiteName -ErrorAction SilentlyContinue)){
+  Write-Host "Stopping IIS admin site $AdminSiteName"
+  try { Stop-Website -Name $AdminSiteName } catch { }
+  if(![string]::IsNullOrWhiteSpace($AdminAppPool)){
+    try { Stop-WebAppPool -Name $AdminAppPool } catch { }
+  }
+}
+
 if(Test-Path $RemoteDir){
   Write-Host "Wiping $RemoteDir"
   Remove-Item -Recurse -Force (Join-Path $RemoteDir '*') -ErrorAction SilentlyContinue
@@ -78,9 +89,7 @@ if(![string]::IsNullOrWhiteSpace($AdminSiteName) -and (Test-Path $adminPublicDir
     throw "IIS admin site '$AdminSiteName' does not exist yet. Create the site and app pool once manually before running this deploy."
   }
   Write-Host "Configuring admin site $AdminSiteName"
-  Stop-Website -Name $AdminSiteName -ErrorAction SilentlyContinue
   if(![string]::IsNullOrWhiteSpace($AdminAppPool)){
-    Stop-WebAppPool -Name $AdminAppPool -ErrorAction SilentlyContinue
     Set-ItemProperty ('IIS:\Sites\' + $AdminSiteName) -Name applicationPool -Value $AdminAppPool
     Set-ItemProperty ('IIS:\AppPools\' + $AdminAppPool) -Name enable32BitAppOnWin64 -Value $false
     icacls $dataDir /grant ("IIS AppPool\" + $AdminAppPool + ":(OI)(CI)(M)") /T | Out-Null