Some workflows still need FTP: legacy applications, scanners and devices, partners’ upload scripts, or web designers used to FTP clients. Windows Server’s IIS FTP Server can provide it, and with FTPS (FTP over TLS) the credentials and files are encrypted. Plain FTP sends passwords in clear text, and shouldn’t be used over the internet.

If you have a choice, SFTP (over SSH) is simpler to secure and firewall. See OpenSSH on Windows Server.

Install the FTP role

Install-WindowsFeature Web-Ftp-Server -IncludeManagementTools

This adds the FTP Service and the FTP management tools to IIS Manager. See install IIS.

Create the FTP site

IIS Manager → Sites → Add FTP Site:

  1. Name and path: for example FTP → D:\FTP.
  2. Binding: your server IP, port 21. Choose SSL: Require, and select a certificate (see below).
  3. Authentication: Basic. Authorization: specific users or groups, with Read and/or Write.

User isolation

So each user only sees their own folder: FTP site → FTP User Isolation → “User name directory (disable global virtual directories)”. Then create folders:

D:\FTP\LocalUser\alice
D:\FTP\LocalUser\bob

(LocalUser for local Windows accounts. For domain users, use the domain name as the folder.)

Create dedicated local accounts for FTP users (not administrators), and grant NTFS rights only on their folders. See Windows Server users and groups.

Certificate for FTPS

FTPS needs a certificate in the machine store:

  • reuse your website’s Let’s Encrypt certificate (win-acme can also install certificates for FTP; see IIS SSL certificates), or
  • a self-signed certificate for internal use (clients will warn).

Set FTP site → FTP SSL Settings → “Require SSL connections” and choose the certificate.

Passive mode and the firewall

FTP uses a control connection (21) plus separate data connections. With passive mode, clients connect to a port range on the server, which you must define and open:

  1. IIS Manager → server node → FTP Firewall Support:
    • Data Channel Port Range: for example 50000-50100;
    • External IP Address of Firewall: your VPS public IP.
  2. Restart the FTP service: Restart-Service ftpsvc.
  3. Open the ports:
New-NetFirewallRule -DisplayName "FTP control" -Direction Inbound -Protocol TCP -LocalPort 21 -Action Allow
New-NetFirewallRule -DisplayName "FTP passive" -Direction Inbound -Protocol TCP -LocalPort 50000-50100 -Action Allow

Restrict both rules to known client IPs where possible (-RemoteAddress). See Windows Server firewall with PowerShell.

Connect

In FileZilla or WinSCP, choose FTP with explicit TLS (“FTPES”), the server IP, port 21, and the user’s credentials. Accept the certificate if self-signed.

Hardening

  • Require SSL for control and data channels (no plain FTP).
  • Enable FTP Logon Attempt Restrictions (IIS 10) to block IPs after repeated failures.
  • Use FTP IP Address and Domain Restrictions to allow only known IPs.
  • Disable anonymous authentication.
  • Review logs: C:\inetpub\logs\LogFiles\FTPSVC<ID>. See IIS logs.

Troubleshooting

Problem Fix
Connects, but directory listing times out Passive port range not open, or external IP not set
“530 User cannot log in, home directory inaccessible” Missing user folder under LocalUser, or NTFS permissions
TLS errors Certificate not selected, or the client requires implicit FTPS (port 990)
Works locally, not remotely Windows Firewall rules, or the provider network blocking FTP ports

Quick reference

Item Value
Install Install-WindowsFeature Web-Ftp-Server
Control port 21 (explicit FTPS)
Passive ports e.g. 50000–50100 (set in FTP Firewall Support)
Isolation D:\FTP\LocalUser\<username>
Prefer SFTP via OpenSSH when possible

Related: SMB file sharing and Windows VPS.

  • IIS
  • FTP
  • Windows Server