Setting up an FTP server on Windows remains one of the easiest ways to quickly share files within a local network or over the internet , without relying on cloud services or size limits. Although more modern alternatives like SFTP or online storage solutions exist today, FTP continues to be widely used for hosting, testing environments, and large-scale data transfers.
However, if you really want to do it right, simply getting it to "work" isn't enough: it's crucial to correctly configure users, ports, permissions, firewalls, and security measures , especially when the server will be accessible from outside your network. This comprehensive guide will show you how to install and configure IIS-based FTP on different versions of Windows, how to adjust service security, and the available connection methods, as well as common errors and how to avoid them.
What is FTP and what role does it play in Windows and IIS?
FTP (File Transfer Protocol) is a long-established protocol used to send and receive files between a client and a server over a TCP/IP network . In practice, it allows you to connect to a remote machine, view folders and files, and upload or download content almost as if it were another drive on your computer.
In Windows Server (and also in Windows 7, 8, 8.1, 10, and later), the FTP server is typically set up on top of IIS, Microsoft's web server. Internally, IIS exposes an `<ftpServer>` element within the site configuration , and within this element is `<security>`, which is the block where authentication, authorization, command filtering, and data channel and SSL protection are controlled.
That <security> element includes several critical sections: <authentication> (anonymous, basic, certificates, custom) , <commandFiltering> to limit dangerous commands, <dataChannelSecurity> to harden security between the control and data channels, and the <ssl> and <sslClientCertificates> blocks to define the use of certificates and FTPS.
In modern versions of IIS (7.5, 8.0, 8.5, 10.0), the syntax for `<security>` remains stable, replacing the classic FTP configuration from IIS 6.0 that resided in the LM/MSFTPSVC metabase. Since Windows 7/Windows Server 2008 R2, the FTP 7.5 role is integrated as a feature of IIS, so it does not need to be downloaded separately.
Prerequisites: equipment, network, and planning
Before making any changes, it's essential to ensure your environment is ready to host an FTP server and that you clearly understand which users will be connecting, from where, and what type of information will be transferred . This will influence everything from the folder structure to the security policies you implement. These are the requirements:
- Has administrator privilegesTo install the FTP server role, modify the IIS configuration and adjust the firewall.
- Sufficient disk space for the FTP data folder And for the expected growth. If the server is going to handle many concurrent clients or very heavy transfers, it might be worth upgrading the RAM, CPU, or the network connection itself.
From a network perspective, it's crucial that your firewall and router allow the necessary traffic. By default, FTP uses ports 20 and 21 in insecure mode , but if you use secure variants (FTPS or FTP over SSH), other ports are involved, such as port 22 in the case of SSH. Your company may have FTP blocked due to security policy, so you'll need to coordinate with your network administrator or internet service provider. To better understand address assignment and NAT, see how devices obtain their IP addresses.
Finally, decide whether your server will be internal only or also accessible from the internet. This decision impacts port configuration, NAT, DNS, SSL certificates, and the type of authentication you will allow . For externally exposed environments, FTPS and strong passwords are practically mandatory.
Installing an IIS-based FTP service on Windows
In Windows, the FTP server is installed as a role service within Internet Information Services (IIS) . The exact procedure varies slightly depending on the operating system version, but the general idea is always the same: add the web server role and, within it, the FTP service.
Install FTP on Windows Server 2012 / 2012 R2
In Windows Server 2012 and 2012 R2, the process is performed from Server Manager. From the taskbar, go to "Server Manager > Manage > Add Roles and Features" and follow the wizard, selecting a role-based or feature-based installation and the appropriate target server.
On the Server Roles screen, expand “Web Server (IIS)” and select “FTP Server .” The wizard will prompt you to add the necessary features; it's generally best to accept them as is, including the administration tools. After clicking Next on the intermediate screens, confirm the installation and wait for it to finish.
Install FTP on Windows Server 2008 / 2008 R2
In Windows Server 2008 R2, from Start go to “Administrative Tools > Server Manager” . In the Roles pane, select “Web Server (IIS)” and click “Add Role Services”. In the wizard, locate “FTP Server”, expand it, and select “FTP Service”.
Once you've selected the role service, follow the wizard to the confirmation screen and click "Install" to add the component . When the wizard displays the results, you can close the window and continue with the configuration in IIS.
Install FTP on Windows 7, 8, 8.1 and 10
On desktop systems like Windows 7, 8, 8.1, and 10, the FTP server is also included as a Windows component. From the Control Panel, go to "Programs and Features > Turn Windows features on or off" and expand "Internet Information Services."
Within IIS, you'll find the "FTP Server" option; select the FTP service (and FTP extensibility if you want extra features) and confirm with OK. In Windows 10, the process is very similar: access the same settings panel and make sure to select both "FTP Server" and the web administration tools so you can easily use IIS Manager.
Installation on Windows Server 2019
In Windows Server 2019, the procedure is virtually identical to 2012/2016: In Server Manager, go to "Add Roles and Features," select "Web Server (IIS)," and under "Role Services," include "FTP Server" among the components to install . After installation, you can create your FTP sites in IIS Manager.
Creating users and groups for FTP
A good security practice is to avoid reusing user accounts with elevated privileges for FTP connections . Instead, create dedicated users (and, if necessary, groups) that only have access to the folders required for uploading and downloading content.
On a Windows server, you can use the Users and Groups Management Console. In the search bar, type something like "users" and access the "Add, edit, or delete other users" option . From there, or from the "Local Users and Groups" tool (or Active Directory Users and Computers in a domain), you can create new accounts.
When creating an FTP user, you define a username, full name, and description; the login identifier is essential. Then you choose a strong password and adjust options such as "user cannot change password" or "password never expires ," depending on how you intend to use the FTP account.
If you plan to manage multiple users with identical permissions, it's worthwhile to create a specific group, such as "FTP_Users". From the Groups tab, you can create a new group, assign it a name and description, and add the users who will share rights . This group can then be used later for both NTFS permissions and IIS authorization rules.
In environments with Active Directory (as in many Windows Server 2019 systems) it is common to create a dedicated organizational unit, for example "FTP Service", and within it define the accounts that will have access to the service , facilitating centralized administration and security policies.
FTP root (home) folder configuration
With the FTP service installed and users created, the next step is to prepare the folder that will act as the base directory for the FTP site . This location can be a simple “C:\FTP” in a test environment or a dedicated volume in production.
From File Explorer, create the folder in the chosen location and then go to its properties (right-click > “Properties”). In the “Security” tab, go to “Advanced” to manage permissions more precisely and, if necessary, break the disk permission inheritance.
Breaking inheritance is usually done by clicking on “Disable inheritance” and choosing “Make inherited permissions explicit on this object” , so that from then on you can edit who accesses the folder without dragging the entire ACL from the disk or parent folders.
Back in the security window, it's recommended to remove any entries you don't need (such as the generic "Users" group) and add only the FTP user or group you created. In the permissions editor, grant that user/group "Full Control" to ensure they can read, write, delete, and rename files without issue.
In multi-user scenarios you can go a step further and create subfolders per user , configuring separate permissions so that each one only sees their own content, or play with IIS authorization to isolate directories based on identity.
Create and configure the FTP site in IIS
Once you have the FTP role enabled and the base folder with its permissions, you need to create the FTP site in Internet Information Services (IIS) Manager . This is the piece that connects the IP address, port, physical path, and authentication/authorization policies. These are the steps to follow:
- Open IIS Manager from the administrative tools menu (or by searching for it directly).
- In the connections panel, right-click on “Sites.
- Choose “Add FTP site”A small guided assistant will open.
- On the first screen of the assistant, define the FTP site name and physical path to the base folderYou can type the path manually or click the browse button to locate the folder you created earlier (for example, "C:\FTP"). Once you've set the home directory, click "Next".
- The second screen configures the "Link and SSL" section. Choose the IP address the site will listen on (or leave "All unassigned" if you only have one) and specify the TCP port you want to use (default is 21 for standard FTP, or 990 if you want implicit FTPS).
- Regarding SSL, you have three basic options:
- Disable it (“No SSL”).
- Allow it optionally (“Allow SSL”).
- Force it (“Require SSL”).
- The third screen of the wizard defines authentication and authorization. You can enable anonymous authentication, basic authentication, or both. In the authorization section, you choose who can connect and what permissions they will have. IIS allows you to specify "All users," "Anonymous users," "Specified users," or built-in groups. For example, you can select "Specified users," specify an account or group, and check the box. Read and write permissions to enable file uploading and downloading.
- Click “Finish” and the FTP site will be created.
FTP Authentication: Anonymous, Basic, and Advanced
The <authentication> section of the IIS FTP settings determines how clients attempting to connect are identified . From the FTP site features view, double-clicking "FTP Authentication" will display several options.
- Anonymous authentication. Allows anyone to enter without credentials, useful only for completely public sites where you only want to share downloads And nothing is restricted. From the authentication tab, by selecting "Anonymous Authentication" and using the "Enable" or "Disable" actions, you can activate or block it as needed.
- Basic authenticationIt requires the customer to send a valid username and password on the domain or machineThis is the usual method for internal or small hosting environments, but keep in mind that the username and password travel in plain text if you don't use SSL, so on the Internet it is highly recommended to combine it with FTPS.
- Authentication using Active Directory client certificates (clientCertAuthentication). The client identifies themselves with a digital certificate instead of username/password.
- Personalized authentication (customAuthentication). Allows you to plug in your own or third-party modules to validate credentials in more advanced ways.
If you want to change the default authentication method, simply select "Basic Authentication" on the "FTP Authentication" screen and click "Enable," disabling anonymous authentication. This simple change significantly reduces server exposure , especially when combined with restrictive authorization rules.
Security, SSL/FTPS, and command filtering
These days, leaving an unencrypted FTP server listening on the internet is not a good idea, so it's worth taking a closer look at the advanced security options offered by the FTP <security> section in IIS . This includes using SSL, protecting the data channel, and filtering commands.
To protect your traffic, you can use SSL certificates. IIS allows you to create a self-signed certificate directly from "Server Certificates" in IIS Manager, or import one issued by a trusted authority. Once you have it, in the site's FTP settings (under "FTP SSL Settings"), select that certificate and check "Require SSL connection" if you want all connections to be encrypted (explicit or implicit FTPS, depending on the port).
The block within It allows you to adjust policies such as controlChannelPolicy and dataChannelPolicy, which indicate whether or not SSL is required on the control and data channels.
On the other hand, FTP command filtering via `<commandFiltering>` allows you to deny specific commands that you consider dangerous or unnecessary.
For data channel security, <dataChannelSecurity> adds extra layers, such as requiring the client's address on the data channel to match the address on the control channel. This makes it more difficult for certain attacks that attempt to hijack or redirect the FTP session by exploiting dynamic port forwarding.
Finally, `<sslClientCertificates>` controls the policy regarding client certificates in SSL, allowing you to ignore (`CertIgnore`), accept, or require them. If you work in a very closed corporate environment, requiring client certificates adds a very strong security barrier against unauthorized access.
Windows Firewall and port opening
Having the perfect FTP server is useless if the firewall blocks all traffic. On Windows, Windows Firewall with Advanced Security blocks many incoming connections by default , so you'll need to create specific rules or use the predefined ones.
From "Control Panel > System and Security > Windows Defender Firewall", you can access "Allow an app or feature through Windows Firewall" . There, make sure that "FTP Server" is enabled for both private and public networks, depending on your intended use.
For more granular control, open "Windows Firewall with Advanced Security" and, under "Inbound Rules," create a new predefined rule for "FTP Server," selecting all relevant components . This will automatically generate the necessary entries for port 21 and other associated services.
In some cases, you'll also need to authorize processes like svchost.exe, which is the service host where many Windows functions run. If you detect conflicts, you can use the "Allow another application" option and add svchost to the allowed list , always proceeding with caution and understanding the implications.
If you also want your FTP server to be accessible from the internet, you'll need to open port 21 (or whichever port you use for FTP) on your router by creating a port forwarding rule to your server's internal IP address . This is done through the router's WAN or NAT settings, specifying the service, external port, internal IP address, and internal port—usually all 21/TCP if you're using classic FTP.
Ways to connect to an FTP server in Windows
Once the server is up and running, you have several ways to connect from a Windows client and move files . Some are more user-friendly and graphical, others are more technical but very useful for diagnostics.
The most common way nowadays is to use a dedicated FTP client such as FileZilla, WinSCP, or others . These programs offer a two-pane interface (local/remote), drag-and-drop functionality, and queue management; you only need to specify the host (IP or domain), protocol type, username, password, and port (see the three best FTP clients ).
Another option is to use your web browser by typing a URL like ftp://server-IP or ftp://ftp.yourdomain.com into the address bar . If your browser still supports FTP, a username and password prompt will appear, and you'll see the contents listed. However, modern browsers have been removing FTP support due to security concerns and low usage, so this method is now almost obsolete.
You can also use the command prompt. Open "cmd", run the command ftp to access the basic client built into Windows , and then type "open IP-or-host port" to connect. If the server uses port 21, simply type "open 192.168.xx"; if it's on a different port, you must specify it, for example, "open 192.168.0.26 214".
Finally, Windows File Explorer allows you to treat an FTP server as a network location. From "This PC," you can choose "Add a network location," and in the wizard, select "Choose a custom network location" and enter the server address in the format ftp://server-or-IP . After entering your credentials and giving it a descriptive name, that FTP location will appear as an icon under "This PC."
Managing multiple accounts and permissions in FTP
In scenarios where several people will be using the server, it is normal to want to create several FTP accounts with different permissions , so that some can only read, others can also write, and some may be limited to a specific subdirectory.
In Windows 10 and later versions, you can create new user accounts from Settings > Accounts > Family & other users, using the "Add someone else to this PC" option and selecting "Add a user without a Microsoft account" for simple local accounts. Enter a username and password, and you'll have an additional profile.
Next, on the server, navigate to the FTP folder, go to Properties > Security, and add the new account to the security list, granting the desired permissions (for example, only "Modify" and "Read and Execute"). This controls what the user can do at the file system level , and you can automate file-related tasks with tools like FreeCommander XE.
Finally, in IIS Manager, within the FTP site, open the "Authorization Rules" feature and create a new permission rule specifying "Specified Users" with the name of the account or group you want to allow access. Assign read and/or write permissions according to the user's role , so that the same FTP site can host accounts with very different privileges.
If you repeat this process with different users, you will build a much more organized multi-user FTP environment , in which each person only sees what they should and the server is not a hodgepodge accessible with a single shared account.
With all these pieces properly fitted together—installing the FTP role in IIS, creating specific users and groups, carefully configuring the root folder, adjusting authentication, using SSL, opening ports, and understanding the different connection methods—it is possible to set up a robust, relatively secure FTP server on Windows, tailored to your needs , whether for simple file sharing on your LAN or for exposing a repository accessible from anywhere in the world.
